CVE-2017-16899
An array index error in the fig2dev program in Xfig 3.2.6a allows remote attackers to cause a...
CVE-2017-16899 is a high vulnerability (CVSS 7.1) in Xfig Project Xfig, published November 20, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.35%, the 71st percentile. Fixed in fig2dev 1:3.2.6a-5.
An array index error in the fig2dev program in Xfig 3.2.6a allows remote attackers to cause a denial-of-service attack or information disclosure with a maliciously crafted Fig format file, related to a negative font value in dev/gentikz.c, and the read_textobject functions in read.c and read1_3.c.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An array index error in the fig2dev program in Xfig 3.2.6a allows remote attackers to cause a denial-of-service attack or information disclosure with a maliciously crafted Fig format file, related to a negative font value in dev/gentikz.c, and the read_textobject functions in read.c and read1_3.c.
- Record
CVE-2017-16899- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:P - Weakness
- CWE-129
- Updated
- 2026-11-02
CVE List No score
An array index error in the fig2dev program in Xfig 3.2.6a allows remote attackers to cause a denial-of-service attack or information disclosure with a maliciously crafted Fig format file, related to a negative font value in dev/gentikz.c, and the read_textobject functions in read.c and read1_3.c.
- Record
CVE-2017-16899- Updated
- 2026-11-02
EUVDEUVD-2017-8069 No score
An array index error in the fig2dev program in Xfig 3.2.6a allows remote attackers to cause a denial-of-service attack or information disclosure with a maliciously crafted Fig format file, related to a negative font value in dev/gentikz.c, and the read_textobject functions in read.c and read1_3.c.
- Record
EUVD-2017-8069- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6jhq-gx6q-28qv
An array index error in the fig2dev program in Xfig 3.2.6a allows remote attackers to cause a...
An array index error in the fig2dev program in Xfig 3.2.6a allows remote attackers to cause a denial-of-service attack or information disclosure with a maliciously crafted Fig format file, related to a negative font value in dev/gentikz.c, and the read_textobject functions in read.c and read1_3.c.
- Record
GHSA-6jhq-gx6q-28qv- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Weakness
- CWE-129
- Updated
- 2026-11-02
OSV
An array index error in the fig2dev program in Xfig 3.2.6a allows remote attackers to cause a denial-of-service attack or information disclosure with a maliciously crafted Fig format file, related to a negative font value in dev/gentikz.c, and the read_textobject functions in read.c and read1_3.c.
- Record
CVE-2017-16899- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-16899
An array index error in the fig2dev program in Xfig 3.2.6a allows remote attackers to cause a denial-of-service attack or information disclosure with a maliciously crafted Fig format file, related to a negative font value in dev/gentikz.c, and the read_textobject functions in read.c and read1_3.c.
- Record
DEBIAN-CVE-2017-16899- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVMGASA-2017-0469 No score
Updated transfig package fix security vulnerability
An out-of-bounds read flaw was found in the way fig2dev program in Xfig handled the processing of Fig format files. This flaw could potentially be used to crash the fig2dev program by tricking it into processing specially crafted Fig format files (CVE-2017-16899).
- Record
MGASA-2017-0469- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11472-1 No score
transfig-3.2.8a-5.1 on GA media
These are all security issues fixed in the transfig-3.2.8a-5.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11472-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:0231-1 No score
Security update for transfig
This update for transfig fixes the following issues:
Security issue fixed:
- CVE-2017-16899: Fix array index error in the fig2dev program (bsc#1069257).
- Record
SUSE-SU-2018:0231-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:0232-1 No score
Security update for transfig
This update for transfig fixes the following issues:
Security issue fixed:
- CVE-2017-16899: Fix array index error in the fig2dev program (bsc#1069257).
- Record
SUSE-SU-2018:0232-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
fig2devDebian:12 |
before 1:3.2.6a-5 | 1:3.2.6a-5 |
fig2devDebian:13 |
before 1:3.2.6a-5 | 1:3.2.6a-5 |
fig2devDebian:14 |
before 1:3.2.6a-5 | 1:3.2.6a-5 |
transfigMageia:5 |
before 3.2.5d-8.1.mga5 | 3.2.5d-8.1.mga5 |
transfigMageia:6 |
before 3.2.5d-9.1.mga6 | 3.2.5d-9.1.mga6 |
transfigSUSE:Linux Enterprise Desktop 12 SP2 |
before 3.2.5e-2.3.2 | 3.2.5e-2.3.2 |
transfigSUSE:Linux Enterprise Desktop 12 SP3 |
before 3.2.5e-2.3.2 | 3.2.5e-2.3.2 |
transfigSUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 |
before 3.2.5e-2.3.2 | 3.2.5e-2.3.2 |
transfigSUSE:Linux Enterprise Server 12 SP2 |
before 3.2.5e-2.3.2 | 3.2.5e-2.3.2 |
transfigSUSE:Linux Enterprise Server for SAP Applications 12 SP2 |
before 3.2.5e-2.3.2 | 3.2.5e-2.3.2 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
transfigSUSE:Linux Enterprise Server 12 SP3 |
before 3.2.5e-2.3.2 | 3.2.5e-2.3.2 |
transfigSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 3.2.5e-2.3.2 | 3.2.5e-2.3.2 |
transfigSUSE:Linux Enterprise Server 11 SP4 |
before 3.2.5-160.3.2 | 3.2.5-160.3.2 |
transfigSUSE:Linux Enterprise Server for SAP Applications 11 SP4 |
before 3.2.5-160.3.2 | 3.2.5-160.3.2 |
transfigopenSUSE:Tumbleweed |
before 3.2.8a-5.1 | 3.2.8a-5.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
bugs.debian.org/cgi-bin/bugreport.cgi?bug=881143
nvd.nist.gov/vuln/detail/CVE-2017-16899
github.com/advisories/GHSA-6jhq-gx6q-28qv
security-tracker.debian.org/tracker/CVE-2017-16899
advisories.mageia.org/MGASA-2017-0469.html
bugs.mageia.org/show_bug.cgi?id=22199
Show 15 moreShow less
lists.fedoraproject.org/archives/list/[email protected]/thread/MCUENJQNHVYLROFSXJPDPPHHAYFYM3Z2
suse.com/support/update/announcement/2018/suse-su-20180231-1
bugzilla.suse.com/1069257