Description
Multiple buffer overflows in the xfig import code (xfig-import.c) in Dia 0.87 and later before 0.95-pre6 allow user-assisted attackers to have an unknown impact via a crafted xfig file, possibly involving an invalid (1) color index, (2) number of points, or (3) depth.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dia | 0.94.0-18 | — |
| Debian 13 | dia | 0.94.0-18 | — |
| Debian 12 | dia | 0.94.0-18 | — |
| Debian 3.1 | dia | 0.94.0-7sarge3 | DSA-1025-1 |
| Debian 3.0 | dia | 0.88.1-3woody1 | DSA-1025-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | dia | 1:0.94-5.4 | RHSA-2006:0280 |
Advisories 2
- RHSA-2006:0280 Red Hat Security Advisory: dia security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1025-1 dia - programming error Debian Security (DSA / DLA) · Mar 9, 2026
References
- MDKSA-2006:062 vendor-advisory
- RHSA-2006:0280 vendor-advisory
- [dia-list] 20060329 Vulnerability in xfig import code mailing-list
- 17310 vdb-entry
- DSA-1025 vendor-advisory
- 19505 third-party-advisory
- 19765 third-party-advisory
- 19469 third-party-advisory
- 20060329 Buffer overflows in Dia XFig import mailing-list
- 19507 third-party-advisory
- 19959 third-party-advisory
- 1015853 vdb-entry
- GLSA-200604-14 vendor-advisory
- oval:org.mitre.oval:def:10361 vdb-entry signature
- 19546 third-party-advisory
- FEDORA-2006-261 vendor-advisory
- diaxfig-xfig-import-bo(25566) vdb-entry
- USN-266-1 vendor-advisory
- 19897 third-party-advisory
- SUSE-SR:2006:009 vendor-advisory
- 19543 third-party-advisory