CVE-2019-14275

Vulnerability

The calc_arrow function in bound.c (line 956) of fig2dev version 3.2.7a, part of the Xfig package, contains a stack-based buffer overflow. The flaw occurs when processing a specially crafted FIG file, leading to a write of 4 bytes beyond the stack buffer boundary as reported by AddressSanitizer [1].

Exploitation

An attacker can trigger the vulnerability by providing a malicious FIG file to fig2dev. No authentication or special privileges are required; only the ability to supply the file. The overflow is triggered during the arrow bounding box calculation in calc_arrow.

Impact

Successful exploitation results in a stack-based buffer overflow, which can potentially lead to arbitrary code execution under the context of the user running fig2dev. The overflow allows overwriting adjacent stack data, potentially hijacking control flow.

Mitigation

The issue was reported and fixed in a later version of fig2dev. Users should update to a patched version. As of the publication date, no official patch version number has been disclosed, but the ticket [1] tracks the fix. Affected users should monitor the project for updates.