CVE-2021-3561

Vulnerability

A global buffer overflow vulnerability exists in fig2dev version 3.2.8a within the read_objects() function in fig2dev/read.c [1][2]. The flaw occurs due to an insufficient bounds check when processing color definitions from a FIG file, specifically when copying a color name string via sprintf() without adequate length validation [1][2][3]. An attacker can craft a malicious FIG file with overly long color definitions to trigger a write beyond the bounds of a global buffer (gif_transparent) [2].

Exploitation

Exploitation requires the attacker to supply a specially crafted FIG file to fig2dev (e.g., via the command-line invocation ./fig2dev -L box <crafted_file>) [2]. No special privileges are needed; the victim merely opens the file. The overflow is triggered in the read_objects() function at line 505, which parses the file and writes to a fixed-size buffer [2]. A proof-of-concept file demonstrates the crash with AddressSanitizer reporting a write of size 14 into a global buffer [2].

Impact

Successful exploitation results in a denial of service (application crash) and potentially memory corruption that could be leveraged for further code execution [1]. The highest threat is to system integrity and availability, as per the CVE description [1]. The attacker gains no persistent access but can affect the operation of the fig2dev tool.

Mitigation

The fix was committed to the fig2dev repository on April 24, 2021, in commit 6827c0 with the message "Sanitize color definitions, ticket #116" [3]. Users should update to a version containing this patch (e.g., fig2dev 3.2.8b or later). No workaround is documented; avoiding processing untrusted FIG files is a general precaution. Red Hat classified this as a medium-severity issue and do not consider it a security bug in actively supported products [1].