CVE-2017-16899
HighSummary
An array index error in the fig2dev program in Xfig 3.2.6a allows remote attackers to cause a denial-of-service attack or information disclosure with a maliciously crafted Fig format file.
Risk Assessment
The organization may be exposed to attacks that lead to service unavailability or leakage of confidential information.
Recommendation
It is recommended to update to the latest version of Xfig and monitor systems for potential attack attempts.
Other vulnerabilities in Xfig 3.2.6a
See all- CVE-2025-46400Medium
In the xfig diagramming tool, a segmentation fault occurs in fig2dev within the read_arcobject function, allowing an attacker to cause a denial of service via local input manipulation.
- CVE-2025-46398Medium
In the xfig diagramming tool, a stack overflow while running fig2dev allows memory corruption via local input manipulation in the read_objects function.
- CVE-2025-46397High
A flaw was found in xfig that allows potential code execution via local input manipulation in the bezier_spline function.
Original NVD description (English source)
An array index error in the fig2dev program in Xfig 3.2.6a allows remote attackers to cause a denial-of-service attack or information disclosure with a maliciously crafted Fig format file, related to a negative font value in dev/gentikz.c, and the read_textobject functions in read.c and read1_3.c.