Skip to content
OpenAdvisories
Medium ALAS2-2020-1398 2 CVEs

Moderate: transfig security update (Amazon Linux 2)

Published Feb 24, 2020 · Updated Feb 27, 2020

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-19797: read_colordef in read.c in Xfig fig2dev 3.2.7b has an out-of-bounds write. 1786726: CVE-2019-19797 transfig: out-of-bounds write in read_colordef in read.c CVE-2019-19746: make_arrow in arrow.c in Xfig fig2dev 3.2.7b allows a segmentation fault and out-of-bounds write because of an integer overflow via a large arrow type. 1787040: CVE-2019-19746 transfig: integer overflow leads to out-of-bounds write in make_arrow in arrow.c

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2 transfig 1:3.2.7b-2.amzn2
Amazon Linux · 2 transfig-debuginfo 1:3.2.7b-2.amzn2

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-19746.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-19797.html