MGASA-2023-0101 - Updated xfig packages fix security vulnerability

Publication date: 18 Mar 2023
URL: https://advisories.mageia.org/MGASA-2023-0101.html
Type: security
Affected Mageia releases: 8
CVE: CVE-2021-40241

A potential buffer overflow exists in the file src/w_help.c at line 55.
Specifically, the length of the string returned by getenv("LANG") may
become very long and cause a buffer overflow while executing the sprintf()
function. This vulnerability could potentially allow an attacker to
execute arbitrary code or cause a denial-of-service condition.
(CVE-2021-40241)

References:
- https://bugs.mageia.org/show_bug.cgi?id=31650
- https://www.debian.org/lts/security/2023/dla-3353
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40241

SRPMS:
- 8/core/xfig-3.2.7b-1.1.mga8

Mageia 2023-0101: xfig security update

A potential buffer overflow exists in the file src/w_help.c at line 55

Summary

A potential buffer overflow exists in the file src/w_help.c at line 55. Specifically, the length of the string returned by getenv("LANG") may become very long and cause a buffer overflow while executing the sprintf() function. This vulnerability could potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition. (CVE-2021-40241)