[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 8 Dec 2009 12:43:45 -0500 (EST)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security <oss-security@...ts.openwall.com>,
oss-security <oss-security@...ts.openwall.com>
cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE Request -- xfig
On Thu, 3 Dec 2009, Jan Lieskovsky wrote:
> PEDAMACHEPHEPTOLIONES reported [1] a stack-based buffer overflow present
> in Xfig by loading malformed .FIG files.
Use CVE-2009-4227 for the read_1_3_textobject
I also assigned CVE-2009-4228 for a stack-consumption issue (NOT an
overflow) in u_bound.c, associated with the readfp_fig function in
f_read.c.
- Steve
======================================================
Name: CVE-2009-4227
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4227
Reference: MLIST:[oss-security] 20091203 CVE Request -- xfig
Reference: URL:http://www.openwall.com/lists/oss-security/2009/12/03/2
Reference: CONFIRM:http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=559274
Reference: CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=543905
Reference: BID:37193
Reference: URL:http://www.securityfocus.com/bid/37193
Reference: SECUNIA:37571
Reference: URL:http://secunia.com/advisories/37571
Reference: SECUNIA:37577
Reference: URL:http://secunia.com/advisories/37577
Reference: XF:xfig-read13textobject-bo(54525)
Reference: URL:http://xforce.iss.net/xforce/xfdb/54525
Stack-based buffer overflow in the read_1_3_textobject function in
f_readold.c in Xfig 3.2.5b and earlier, and in the read_textobject
function in read1_3.c in fig2dev in Transfig 3.2.5a and earlier,
allows remote attackers to execute arbitrary code via a long string in
a malformed .fig file that uses the 1.3 file format. NOTE: some of
these details are obtained from third party information.
======================================================
Name: CVE-2009-4228
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4228
Reference: CONFIRM:http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=559274
Reference: CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=543905
Stack consumption vulnerability in u_bound.c in Xfig 3.2.5b and
earlier allows remote attackers to cause a denial of service
(application crash) via a long string in a malformed .fig file that
uses the 1.3 file format, possibly related to the readfp_fig function
in f_read.c.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
