CVE-2017-16899 — Improper Validation of Array Index in Project Xfig

CWE-129 — Improper Validation of Array IndexCWE-125 — Out-of-bounds Read9 documents7 sources
Severity
7.1HIGHNVD
EPSS
0.4%
top 37.70%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Fig2dev Project Fig2devDebian LinuxXfig Project Xfig
Timeline
PublishedNov 20
Latest updateMay 17

Description

An array index error in the fig2dev program in Xfig 3.2.6a allows remote attackers to cause a denial-of-service attack or information disclosure with a maliciously crafted Fig format file, related to a negative font value in dev/gentikz.c, and the read_textobject functions in read.c and read1_3.c.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:HExploitability: 1.8 | Impact: 5.2

Affected Packages2 packages

▶Debianfig2dev_project/fig2dev< 1:3.2.6a-5+3
▶NVDxfig_project/xfig3.2.6a

Also affects: Debian Linux 8.0, 9.0

🔴Vulnerability Details

3
GHSA
GHSA-6jhq-gx6q-28qv: An array index error in the fig2dev program in Xfig 3↗2022-05-17
▶
OSV
CVE-2017-16899: An array index error in the fig2dev program in Xfig 3↗2017-11-20
▶
CVEList
CVE-2017-16899: An array index error in the fig2dev program in Xfig 3↗2017-11-20
▶

📋Vendor Advisories

2
Red Hat
transfig: Array index error in the fig2dev program↗2017-11-20
▶
Debian
CVE-2017-16899: fig2dev - An array index error in the fig2dev program in Xfig 3.2.6a allows remote attacke...↗2017
▶

💬Community

3
Bugzilla
CVE-2017-16899 transfig: Array index error in the fig2dev program [fedora-all]↗2017-11-21
▶
Bugzilla
CVE-2017-16899 transfig: Array index error in the fig2dev program↗2017-11-21
▶
Bugzilla
CVE-2017-16899 xfig: Array index error in the fig2dev program [epel-7]↗2017-11-21
▶
CVE-2017-16899 — Improper Validation of Array Index | cvebase