CVE-2019-19746

Vulnerability

In Xfig fig2dev version 3.2.7b, the make_arrow function in arrow.c contains an integer overflow vulnerability. When processing a large arrow type value, the integer overflow leads to an out-of-bounds write, causing a segmentation fault. The issue is triggered during the parsing of a specially crafted FIG file, specifically when reading arc objects that call make_arrow [1].

Exploitation

An attacker can exploit this vulnerability by providing a malicious FIG file with an oversized arrow type. The file is processed by fig2dev (e.g., via fig2dev -L command). No authentication is required; the attacker only needs to convince a user or automated system to open the crafted file. The crash occurs in make_arrow at arrow.c:89 due to the integer overflow [1].

Impact

Successful exploitation results in a segmentation fault and out-of-bounds write, which can cause a denial of service (application crash). In some memory configurations, this could potentially be leveraged for arbitrary code execution, though the primary impact is a crash [1].

Mitigation

No official patch has been released for fig2dev 3.2.7b as of the publication date. Users should avoid processing untrusted FIG files with this version. Upgrading to a newer version of fig2dev or Xfig that includes a fix is recommended. No workaround is documented.