Heap-based buffer overflow in fig2dev - CVE-2025-31164

Vulnerability identifier: #VU106981

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-31164

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the create_line_with_spline() function. A remote attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and perform a denial of service (DoS) attack.

fig2dev
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
Ubuntu
openEuler
fig2dev (Ubuntu package)
transfig-debugsource
transfig
transfig-debuginfo
transfig-help

Install updates from vendor's website.

fig2dev (Ubuntu package) - addressed in versions 1:3.2.6a-6ubuntu1.1+esm1, 1:3.2.7a-7ubuntu0.1+esm1, 1:3.2.8b-1ubuntu0.1~esm1, 1:3.2.9-3ubuntu0.1~esm1, 1:3.2.9-4ubuntu0.1
transfig-debugsource - update to 3.2.8b-2.23.1
transfig - update to 3.2.8b-2.23.1
transfig-debuginfo - update to 3.2.8b-2.23.1
transfig-debugsource - addressed in versions 3.2.8b-3, 3.2.9-2
transfig-help - addressed in versions 3.2.8b-3, 3.2.9-2
transfig-debuginfo - addressed in versions 3.2.8b-3, 3.2.9-2
transfig - addressed in versions 3.2.8b-3, 3.2.9-2

• https://sourceforge.net/p/mcj/tickets/184/
• https://sourceforge.net/u/hamarituc/fig2dev/ci/da8992f44b84a337b4edaa67fc8b36b55eaef696/

• Multiple vulnerabilities in fig2dev
• openEuler 24.03 LTS SP1 update for transfig
• openEuler 24.03 LTS update for transfig
• openEuler 22.03 LTS SP3 update for transfig
• openEuler 20.03 LTS SP4 update for transfig
• openEuler 22.03 LTS SP4 update for transfig
• SUSE update for transfig
• Ubuntu update for fig2dev