SB2021102932 - SUSE update for transfig
Published: October 29, 2021 Updated: June 28, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 secuirty vulnerabilities.
1) Stack-based buffer overflow (CVE-ID: CVE-2020-21529)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the bezier_spline() function in genepic.c. A remote attacker can pass a specially crafted file to the application, trigger a stack-based buffer overflow and perform a denial of service (DoS) attack.
2) Buffer overflow (CVE-ID: CVE-2020-21530)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the read_objects() function in read.c. A remote attacker can pass a specially crafted file to the application and crash it.
3) Buffer overflow (CVE-ID: CVE-2020-21531)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the conv_pattern_index() function in gencgm.c. A remote attacker can pass a specially crafted file to the application and crash it.
4) Buffer overflow (CVE-ID: CVE-2020-21532)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the setfigfont() function in genepic.c. A remote attacker can pass a specially crafted file to the application and crash it.
5) Stack-based buffer overflow (CVE-ID: CVE-2020-21533)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the read_textobject() function in read.c. A remote attacker can pass a specially crafted file to the application, trigger a stack-based buffer overflow and perform a denial of service (DoS) attack.
6) Buffer overflow (CVE-ID: CVE-2020-21534)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the get_line() function in read.c. A remote attacker can pass a specially crafted file to the application and crash it.
7) Buffer overflow (CVE-ID: CVE-2020-21535)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the gencgm_start() function in gencgm.c. A remote attacker can pass a specially crafted file to the application and crash it.
8) NULL pointer dereference (CVE-ID: CVE-2021-32280)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to NULL pointer dereference within the compute_closed_spline() function in trans_spline.c. A remote attacker can pass a specially crafted file to the application and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.