Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 297379 (CVE-2009-4227) - <media-gfx/xfig-3.2.5c: multiple vulnerabilites (CVE-2009-{4227,4228})
Summary: <media-gfx/xfig-3.2.5c: multiple vulnerabilites (CVE-2009-{4227,4228})
Status: RESOLVED FIXED
Alias: CVE-2009-4227
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard: B2 [glsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2009-12-18 01:24 UTC by Stefan Behte (RETIRED)
Modified: 2017-10-15 12:13 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Stefan Behte (RETIRED) gentoo-dev Security 2009-12-18 01:24:33 UTC
CVE-2009-4227 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-4227):
  Stack-based buffer overflow in the read_1_3_textobject function in
  f_readold.c in Xfig 3.2.5b and earlier, and in the read_textobject
  function in read1_3.c in fig2dev in Transfig 3.2.5a and earlier,
  allows remote attackers to execute arbitrary code via a long string
  in a malformed .fig file that uses the 1.3 file format.  NOTE: some
  of these details are obtained from third party information.
Comment 1 Stefan Behte (RETIRED) gentoo-dev Security 2009-12-18 01:29:42 UTC
CVE-2009-4228 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-4228):
  Stack consumption vulnerability in u_bound.c in Xfig 3.2.5b and
  earlier allows remote attackers to cause a denial of service
  (application crash) via a long string in a malformed .fig file that
  uses the 1.3 file format, possibly related to the readfp_fig function
  in f_read.c.

Comment 2 Peter Volkov (RETIRED) gentoo-dev 2010-01-14 20:50:03 UTC
CVE-2009-4227 is fixed in 3.2.5b and stabilization I guess will happen in bug 264575.
CVE-2009-4228 - iiuc redhat states fortify features should help us to avoid that problem, but still there is not patch for that issue.
Comment 3 Samuli Suominen (RETIRED) gentoo-dev 2010-03-09 04:53:52 UTC
treecleaners: 

- This package is using imake (bug 289296)
- Doesn't compile against vanilla libpng 1.4 (bug 308437)
- Is vulnerable (this bug)
Comment 4 Peter Volkov (RETIRED) gentoo-dev 2010-03-09 07:27:07 UTC
No way, I'm maintaining that package. imake is not a bug. If you have bugs, fill them and assign on me.
Comment 5 Christoph Junghans (RETIRED) gentoo-dev 2013-03-04 01:48:25 UTC
Is this bug still valid?
Comment 6 Sergey Popov gentoo-dev 2013-11-28 10:04:39 UTC
CVE-2009-4228 is fixed in Xfig 3.2.5c [1]

[1] - http://xfig.org/art17.html
Comment 7 Sean Amoss (RETIRED) gentoo-dev Security 2014-08-10 19:12:19 UTC
Maintainers, can we proceed to stabilize =media-gfx/xfig-3.2.5c ? Thanks
Comment 8 Peter Volkov (RETIRED) gentoo-dev 2014-11-04 20:49:35 UTC
Yes, go ahead with stabilization:
=media-gfx/transfig-3.2.5e
=media-gfx/xfig-3.2.5c
Comment 9 Jeroen Roovers (RETIRED) gentoo-dev 2014-11-05 12:31:05 UTC
Stable for HPPA.
Comment 10 Myckel Habets 2014-11-06 10:58:36 UTC
Builds and runs fine on x86. Rdeps build fine as well. Please mark stable for x86
Comment 11 Agostino Sarubbo gentoo-dev 2014-11-08 18:21:29 UTC
amd64 stable
Comment 12 Agostino Sarubbo gentoo-dev 2014-11-08 18:21:48 UTC
x86 stable
Comment 13 Agostino Sarubbo gentoo-dev 2014-11-10 13:44:57 UTC
ppc stable
Comment 14 Agostino Sarubbo gentoo-dev 2014-11-10 13:52:02 UTC
ppc64 stable
Comment 15 Tobias Klausmann (RETIRED) gentoo-dev 2014-11-13 17:47:01 UTC
Stable on alpha.
Comment 16 Agostino Sarubbo gentoo-dev 2014-12-01 09:17:14 UTC
sparc stable.

Maintainer(s), please cleanup.
Security, please add it to the existing request, or file a new one.
Comment 17 Sean Amoss (RETIRED) gentoo-dev Security 2014-12-02 23:28:34 UTC
GLSA has been drafted and is ready for peer-review.
Comment 18 Mikle Kolyada (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2014-12-13 15:10:09 UTC
Cleanup done.
Comment 19 GLSAMaker/CVETool Bot gentoo-dev 2014-12-13 17:49:21 UTC
This issue was resolved and addressed in
 GLSA 201412-14 at http://security.gentoo.org/glsa/glsa-201412-14.xml
by GLSA coordinator Sean Amoss (ackle).