CVE-2019-19797

Vulnerability

The read_colordef function in read.c of fig2dev version 3.2.7b contains an out-of-bounds write vulnerability. The issue occurs when processing a malformed color definition line in a .fig file. The parser fails to properly validate the length or format of the color string, leading to an invalid memory write. The bug was discovered through fuzzing and is triggered when the file contains a specially crafted color definition line [1].

Exploitation

An attacker can exploit this vulnerability by supplying a crafted .fig file to the fig2dev utility, for instance with the command ./fig2dev -Lbox <malicious_file>. The attacker does not require authentication or special privileges; the attack vector is local file parsing. The vulnerable code path is reached during the read_colordef call at read.c:488 when the program attempts to parse an invalid color definition [1].

Impact

Successful exploitation results in an out-of-bounds write of 4 bytes (a single integer value) beyond the intended buffer boundary, as observed in the Valgrind output [1]. This memory corruption could lead to a denial of service (crash) or potentially be leveraged for arbitrary code execution if the memory layout allows controlled corruption. The impact is limited to the privileges of the user running fig2dev.

Mitigation

As of the available references, no official patch or fixed version has been released. The advisory suggests the issue remained open until at least April 2021 [1]. Users should avoid processing untrusted .fig files with fig2dev 3.2.7b until a fix is provided. No workaround is documented.