2 results · Clear filters · Feed
-
High 7.8
Dia: dia: heap buffer overflow in wpg colormap parser via out-of-bounds palette index
A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer. In plug-ins/wpg/wpg-import.c, the WPG import renderer allocates a fixed palette with: ren->pPal = g_new0(WPGColorRGB, 256); When handling a WPG_COLORMAP reco…
-
High 7.8
Dia: dia: stack buffer overflow in bus object via unvalidated handle count in project files
A stack-based buffer overflow vulnerability exists in the Dia diagram editor when processing Network Bus objects from Dia XML project files. In objects/network/bus.c, bus_load() reads the number of bus handles from the file attribute "bus_handles" using attri…