SB2017112148 - Fedora 26 update for transfig
Published: November 21, 2017 Updated: April 24, 2025
Security Bulletin ID
SB2017112148
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Improper validation of array index (CVE-ID: CVE-2017-16899)
The vulnerability allows a remote attacker to obtain potentially sensitive information or cause DoS condition on the target system.The weakness exists in the fig2dev program due to an array index error. A remote attacker can submit a specially crafted Fig format file, related to a negative font value in dev/gentikz.c, and the read_textobject functions in read.c and read1_3.c, trick the victim into opening it, gain access to potentially sensitive information or cause the service to crash.
Remediation
Install update from vendor's website.