Homepage

Out-of-Bounds The advisory has been revoked - it doesn't affect any version of package xfig  (opens in a new tab)

Threat Intelligence

EPSS
25.98% (97th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU1904-XFIG-530935
  • published8 Dec 2009
  • disclosed8 Dec 2009
Report a new vulnerability Found a mistake?

Introduced: 8 Dec 2009

CVE-2009-4227  (opens in a new tab)
CWE-119  (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:19.04.

NVD Description

Note: Versions mentioned in the description apply only to the upstream xfig package and not the xfig package as distributed by Ubuntu.

Stack-based buffer overflow in the read_1_3_textobject function in f_readold.c in Xfig 3.2.5b and earlier, and in the read_textobject function in read1_3.c in fig2dev in Transfig 3.2.5a and earlier, allows remote attackers to execute arbitrary code via a long string in a malformed .fig file that uses the 1.3 file format. NOTE: some of these details are obtained from third party information.