Xfig: transfig: fig2dev segmentation fault vulnerability

Vulnerability

The vulnerability is a segmentation fault in fig2dev, part of the transfig package, in the genge_itp_spline function in dev/genge.c (line 249). This occurs when processing a specially crafted FIG file with the -L ge output option. Affected version: fig2dev 3.2.9a (as reported in references [2], [3]). The issue likely stems from improper handling of spline data, leading to a read access violation on a null pointer.

Exploitation

An attacker with local access can craft a malicious FIG file and invoke fig2dev -L ge ./poc to trigger the segmentation fault. No special privileges or authentication beyond local file manipulation are required. The crash is reproducible as shown by AddressSanitizer (ASAN) output in reference [2].

Impact

Successful exploitation results in a denial of service by crashing the fig2dev process. The vulnerability affects availability only; confidentiality and integrity are not compromised according to the CVE description.

Mitigation

As of the latest available information, no patched version has been released for fig2dev. Users are advised to avoid processing untrusted FIG files with the -L ge option until a fix is applied. The issue is tracked in Red Hat Bugzilla [3] and Sourceforge ticket [2].