CVE-2020-21676

low-risk

Published 2021-08-10

A stack-based buffer overflow in the genpstrx_text() component in genpstricks.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting a xfig file into pstricks format.

Do I need to act?

0.68% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.5/10 Medium

LOCAL / LOW complexity

Affected Products (3)

Fig2Dev

Debian Linux

Affected Vendors

Debian Fig2Dev Project

References (8)

Technical Description https://cwe.mitre.org/data/definitions/121.html

Mailing List https://lists.debian.org/debian-lts-announce/2021/10/msg00002.html

Mailing List https://lists.debian.org/debian-lts-announce/2023/01/msg00044.html

Exploit https://sourceforge.net/p/mcj/tickets/76/

Technical Description https://cwe.mitre.org/data/definitions/121.html

Mailing List https://lists.debian.org/debian-lts-announce/2021/10/msg00002.html

Mailing List https://lists.debian.org/debian-lts-announce/2023/01/msg00044.html

Exploit https://sourceforge.net/p/mcj/tickets/76/

/ 100

low-risk

Severity 18/34 · Moderate

Exploitability 2/34 · Minimal

Exposure 9/34 · Low