CVE-2020-21675

low-risk

Published 2021-08-10

A stack-based buffer overflow in the genptk_text component in genptk.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting a xfig file into ptk format.

Do I need to act?

0.62% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.5/10 Medium

LOCAL / LOW complexity

Affected Products (2)

Fig2Dev

Debian Linux

Affected Vendors

Debian Fig2Dev Project

References (6)

Technical Description https://cwe.mitre.org/data/definitions/121.html

Mailing List https://lists.debian.org/debian-lts-announce/2021/10/msg00002.html

Exploit https://sourceforge.net/p/mcj/tickets/78/

Technical Description https://cwe.mitre.org/data/definitions/121.html

Mailing List https://lists.debian.org/debian-lts-announce/2021/10/msg00002.html

Exploit https://sourceforge.net/p/mcj/tickets/78/

/ 100

low-risk

Severity 18/34 · Moderate

Exploitability 2/34 · Minimal

Exposure 7/34 · Low