Advisories ยป MGASA-2020-0116

Updated transfig packages fix security vulnerability

Publication date: 06 Mar 2020
Modification date: 06 Mar 2020
Type: security
Affected Mageia releases : 7
CVE: CVE-2019-14275 , CVE-2019-19555 , CVE-2019-19746 , CVE-2019-19797

Description

The updated package fixes security vulnerabilities:

Xfig fig2dev 3.2.7a has a stack-based buffer overflow in the calc_arrow
function in bound.c. (CVE-2019-14275)

read_textobject in read.c in Xfig fig2dev 3.2.7b has a stack-based buffer
overflow because of an incorrect sscanf. (CVE-2019-19555)

make_arrow in arrow.c in Xfig fig2dev 3.2.7b allows a segmentation fault
and out-of-bounds write because of an integer overflow via a large arrow
type. (CVE-2019-19746)

read_colordef in read.c in Xfig fig2dev 3.2.7b has an out-of-bounds write.
(CVE-2019-19797)
                

References

SRPMS

7/core