Skip to content
OpenAdvisories
Medium ALAS2-2023-2173 2 CVEs

Moderate: transfig security update (Amazon Linux 2)

Published Jul 20, 2023 · Updated Aug 3, 2023

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-32280: An issue was discovered in fig2dev before 3.2.8.. A NULL pointer dereference exists in the function compute_closed_spline() located in trans_spline.c. It allows an attacker to cause Denial of Service. The fixed version of fig2dev is 3.2.8. CVE-2020-21682: A global buffer overflow in the set_fill component in genge.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting a xfig file into ge format.

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2 transfig 1:3.2.8b-7.amzn2
Amazon Linux · 2 transfig-debuginfo 1:3.2.8b-7.amzn2

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-21682.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-32280.html