SB2021102931 - SUSE update for transfig
Published: October 29, 2021 Updated: June 28, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 12 secuirty vulnerabilities.
1) Stack-based buffer overflow (CVE-ID: CVE-2020-21529)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the bezier_spline() function in genepic.c. A remote attacker can pass a specially crafted file to the application, trigger a stack-based buffer overflow and perform a denial of service (DoS) attack.
2) Buffer overflow (CVE-ID: CVE-2020-21530)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the read_objects() function in read.c. A remote attacker can pass a specially crafted file to the application and crash it.
3) Buffer overflow (CVE-ID: CVE-2020-21531)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the conv_pattern_index() function in gencgm.c. A remote attacker can pass a specially crafted file to the application and crash it.
4) Buffer overflow (CVE-ID: CVE-2020-21532)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the setfigfont() function in genepic.c. A remote attacker can pass a specially crafted file to the application and crash it.
5) Stack-based buffer overflow (CVE-ID: CVE-2020-21533)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the read_textobject() function in read.c. A remote attacker can pass a specially crafted file to the application, trigger a stack-based buffer overflow and perform a denial of service (DoS) attack.
6) Buffer overflow (CVE-ID: CVE-2020-21534)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the get_line() function in read.c. A remote attacker can pass a specially crafted file to the application and crash it.
7) Buffer overflow (CVE-ID: CVE-2020-21535)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the gencgm_start() function in gencgm.c. A remote attacker can pass a specially crafted file to the application and crash it.
8) Stack-based buffer overflow (CVE-ID: CVE-2020-21680)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error when converting a xfig file into pict2e format. A remote attacker can trigger a stack-based buffer overflow and crash the application.
9) Buffer overflow (CVE-ID: CVE-2020-21681)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the set_color component in genge.c when converting a xfig file into ge format. A remote attacker can pass a specially crafted file to the application and crash it.
10) Buffer overflow (CVE-ID: CVE-2020-21682)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the set_fill component in genge.c when converting a xfig file into ge format. A remote attacker can pass a specially crafted file to the application and crash it.
11) Buffer overflow (CVE-ID: CVE-2020-21683)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the shade_or_tint_name_after_declare_color() function in fig2dev/dev/genpstricks.c when converting a xfig file into pstricks format. A remote attacker can pass a specially crafted file to the application and crash it.
12) NULL pointer dereference (CVE-ID: CVE-2021-32280)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to NULL pointer dereference within the compute_closed_spline() function in trans_spline.c. A remote attacker can pass a specially crafted file to the application and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.