Segmentation fault in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via put_patternarc function.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7587-1 advisory.

    Suhwan Song discovered that Fig2dev did not correctly handle certain memory operations. If a user or     automated system were tricked into opening a specially crafted file, an attacker could possibly use this     issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
    (CVE-2020-21680, CVE-2020-21682, CVE-2020-21683)

    It was discovered that Fig2dev did not limit the size of certain inputs. If a user or automated system     were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a     denial of service. (CVE-2025-31162, CVE-2025-31163)

    It was discovered that Fig2dev did not correctly handle certain inputs. If a user or automated system were     tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial     of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2025-31164)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01835-1 advisory.

    Update to fig2dev version 3.2.9a

    - CVE-2025-31162: Fixed a floating point exception in fig2dev in get_slope function (bsc#1240380).
    - CVE-2025-31163: Fixed a segmentation fault in fig2dev in put_patternarc function (bsc#1240381).
    - CVE-2025-31164: Fixed a heap buffer overflow in fig2dev in create_line_with_spline function     (bsc#1240379).
    - CVE-2025-46397: Fixed a stack buffer overflow in fig2dev in bezier_spline function (bsc#1243260).
    - CVE-2025-46398: Fixed a stack buffer overflow in fig2dev in read_objects function (bsc#1243262).
    - CVE-2025-46399: Fixed a segmentation fault in fig2dev in genge_itp_spline function (bsc#1243263).
    - CVE-2025-46400: Fixed a segmentation fault in fig2dev in read_arcobject function (bsc#1243261).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1540-1 advisory.

    - CVE-2025-31164: Fixed heap-buffer overflow in fig2dev create_line_with_spline() function (bsc#1240379)
    - CVE-2025-31162: Fixed floating point exception in fig2dev get_slope() function (bsc#1240380)
    - CVE-2025-31163: Fixed segmentation fault in fig2dev put_patternarc() function (bsc#1240381)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4134 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4134-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Adrian Bunk     April 21, 2025                                https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : fig2dev     Version        : 1:3.2.8-3+deb11u2     CVE ID         : CVE-2025-31162 CVE-2025-31163 CVE-2025-31164

    Multiple vulnerabilities have been fixed in the fig2dev utilities for     converting XFig figure files.

    CVE-2025-31162

        floating point exception with huge pattern lengths

    CVE-2025-31163

        non-rejection of arcs with co-incident points

    CVE-2025-31164

        heap buffer overflow on arc-box with zero radius

    For Debian 11 bullseye, these problems have been fixed in version     1:3.2.8-3+deb11u2.

    We recommend that you upgrade your fig2dev packages.

    For the detailed security status of fig2dev please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/fig2dev

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
240492	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : Fig2dev vulnerabilities (USN-7587-1)	Nessus	Ubuntu Local Security Checks	medium
238044	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : transfig (SUSE-SU-2025:01835-1)	Nessus	SuSE Local Security Checks	medium
235927	SUSE SLES12 Security Update : transfig (SUSE-SU-2025:1540-1)	Nessus	SuSE Local Security Checks	medium
234687	Debian dla-4134 : fig2dev - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2025-31163

medium

Tenable Plugins

medium

medium

medium

medium