CVE-2021-3561

moderate-risk

Published 2021-05-26

An Out of Bounds flaw was found fig2dev version 3.2.8a. A flawed bounds check in read_objects() could allow an attacker to provide a crafted malicious input causing the application to either crash or in some cases cause memory corruption. The highest threat from this vulnerability is to integrity as well as system availability.

Do I need to act?

0.44% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.1/10 High

LOCAL / LOW complexity

Affected Products (4)

Fig2Dev

Fedora

Debian Linux

Affected Vendors

Debian Fedoraproject Fig2Dev Project

References (12)

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1955675

Mailing List https://lists.debian.org/debian-lts-announce/2021/10/msg00002.html

Mailing List https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Patch https://sourceforge.net/p/mcj/fig2dev/ci/6827c09d2d6491cb2ae3ac7196439ff3aa791fd...

Exploit https://sourceforge.net/p/mcj/tickets/116/

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1955675

Mailing List https://lists.debian.org/debian-lts-announce/2021/10/msg00002.html

Mailing List https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Patch https://sourceforge.net/p/mcj/fig2dev/ci/6827c09d2d6491cb2ae3ac7196439ff3aa791fd...

Exploit https://sourceforge.net/p/mcj/tickets/116/

/ 100

moderate-risk

Severity 22/34 · High

Exploitability 2/34 · Minimal

Exposure 10/34 · Low