CVE-2020-21681

Vulnerability

A global buffer overflow vulnerability exists in the set_color component in genge.c (line 437) of fig2dev version 3.2.7b. When converting a specially crafted XFig file into the GE format, the function attempts to read a color index beyond the bounds of the global color array, causing a read overflow. The issue is triggered during processing of arc objects in genge_arc [1].

Exploitation

An attacker needs only to provide a malicious .fig file (XFig format) to the victim who runs fig2dev for conversion to GE format. No special privileges or user interaction beyond opening the file is required; the overflow occurs during normal processing of input data. The proof-of-concept involves a file with a color identifier (e.g., color 41) that cannot be located, leading to the out-of-bounds read [1].

Impact

Successful exploitation causes a denial of service (DoS) due to the global buffer overflow, which typically results in a crash of the fig2dev process. The vulnerability is a read overflow, so it may also leak memory contents; however, the primary and confirmed impact is availability loss. No privilege escalation or remote code execution is reported in the source [1].

Mitigation

The issue was reported to the maintainers and appears to be closed as of December 2020 on the project's ticket tracker [1]. Users should update to a version containing the fix (likely after 3.2.7b). If a patched version is unavailable, avoid processing untrusted .fig files with fig2dev until an update is applied.