Incorrect calculation in fig2dev - CVE-2025-31162

Vulnerability identifier: #VU106983

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-31162

CWE-ID: CWE-682

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a floating point exception within the get_slope() function. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

fig2dev
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
Ubuntu
openEuler
fig2dev (Ubuntu package)
transfig-debugsource
transfig
transfig-debuginfo
transfig-help

Install updates from vendor's website.

fig2dev (Ubuntu package) - addressed in versions 1:3.2.6a-6ubuntu1.1+esm1, 1:3.2.7a-7ubuntu0.1+esm1, 1:3.2.8b-1ubuntu0.1~esm1, 1:3.2.9-3ubuntu0.1~esm1, 1:3.2.9-4ubuntu0.1
transfig-debugsource - update to 3.2.8b-2.23.1
transfig - update to 3.2.8b-2.23.1
transfig-debuginfo - update to 3.2.8b-2.23.1
transfig-debugsource - addressed in versions 3.2.8b-3, 3.2.9-2
transfig-help - addressed in versions 3.2.8b-3, 3.2.9-2
transfig-debuginfo - addressed in versions 3.2.8b-3, 3.2.9-2
transfig - addressed in versions 3.2.8b-3, 3.2.9-2

• https://sourceforge.net/p/mcj/tickets/185/
• https://sourceforge.net/p/mcj/fig2dev/ci/da8992f44b84a337b4edaa67fc8b36b55eaef696/

• Multiple vulnerabilities in fig2dev
• openEuler 24.03 LTS SP1 update for transfig
• openEuler 24.03 LTS update for transfig
• openEuler 22.03 LTS SP3 update for transfig
• openEuler 20.03 LTS SP4 update for transfig
• openEuler 22.03 LTS SP4 update for transfig
• SUSE update for transfig
• Ubuntu update for fig2dev