CVE-2021-37530
A denial of service vulnerabiity exists in fig2dev through 3.28a due to a segfault in the...
A denial of service vulnerabiity exists in fig2dev through 3.28a due to a segfault in the open_stream function in readpics.c.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A denial of service vulnerabiity exists in fig2dev through 3.28a due to a segfault in the open_stream function in readpics.c.
- Record
CVE-2021-37530- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
A denial of service vulnerabiity exists in fig2dev through 3.28a due to a segfault in the open_stream function in readpics.c.
- Record
CVE-2021-37530- Updated
- 2026-11-02
EUVDEUVD-2021-24092 No score
A denial of service vulnerabiity exists in fig2dev through 3.28a due to a segfault in the open_stream function in readpics.c.
- Record
EUVD-2021-24092- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5v6m-wc53-qffj No score
A denial of service vulnerabiity exists in fig2dev through 3.28a due to a segfault in the...
A denial of service vulnerabiity exists in fig2dev through 3.28a due to a segfault in the open_stream function in readpics.c.
- Record
GHSA-5v6m-wc53-qffj- Weakness
- CWE-787
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-37530
A denial of service vulnerabiity exists in fig2dev through 3.28a due to a segfault in the open_stream function in readpics.c.
- Record
ALPINE-CVE-2021-37530- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSV
A denial of service vulnerabiity exists in fig2dev through 3.28a due to a segfault in the open_stream function in readpics.c.
- Record
CVE-2021-37530- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-37530
A denial of service vulnerabiity exists in fig2dev through 3.28a due to a segfault in the open_stream function in readpics.c.
- Record
DEBIAN-CVE-2021-37530- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2022-1509
transfig security update
The transfig utility creates a makefile which translates FIG (created by xfig) or PIC figures into a specified LaTeX graphics language (for example, PostScript(TM)). Transfig is used to create TeX documents which are portable (i.e., they can be printed in a wide variety of environments).
Security Fix(es):
A double-free vulnerability exists in fig2dev through 3.28a is affected by: via the free_stream function in readpics.c, which could cause a denial of service (context-dependent).(CVE-2021-37529)
A denial of service vulnerabiity exists in fig2dev through 3.28a due to a segfault in the open_stream function in readpics.c.(CVE-2021-37530)
- Record
OESA-2022-1509- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-37530
A denial of service vulnerabiity exists in fig2dev through 3.28a due to a segfault in the open_stream function in readpics.c.
- Record
UBUNTU-CVE-2021-37530- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
fig2devAlpine:v3.21 |
before 3.2.8b-r0 | 3.2.8b-r0 |
fig2devAlpine:v3.22 |
before 3.2.8b-r0 | 3.2.8b-r0 |
fig2devAlpine:v3.23 |
before 3.2.8b-r0 | 3.2.8b-r0 |
fig2devAlpine:v3.24 |
before 3.2.8b-r0 | 3.2.8b-r0 |
fig2devDebian:12 |
before 1:3.2.8b-1 | 1:3.2.8b-1 |
fig2devDebian:13 |
before 1:3.2.8b-1 | 1:3.2.8b-1 |
fig2devDebian:14 |
before 1:3.2.8b-1 | 1:3.2.8b-1 |
transfigopenEuler:20.03-LTS-SP1 From an advisory covering 2 CVEs |
before 3.2.8b-1.oe1 | 3.2.8b-1.oe1 |
transfigopenEuler:20.03-LTS-SP2 From an advisory covering 2 CVEs |
before 3.2.8b-1.oe1 | 3.2.8b-1.oe1 |
transfigopenEuler:20.03-LTS-SP3 From an advisory covering 2 CVEs |
before 3.2.8b-1.oe1 | 3.2.8b-1.oe1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-37530 is a medium vulnerability (CVSS 5.5) in Fig2dev Project Fig2dev, published January 12, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.77%, the 55th percentile. Fixed in fig2dev 3.2.8b-r0.
References
sourceforge.net/p/mcj/tickets/126
nvd.nist.gov/vuln/detail/CVE-2021-37530
github.com/advisories/GHSA-5v6m-wc53-qffj
security.alpinelinux.org/vuln/CVE-2021-37530
security-tracker.debian.org/tracker/CVE-2021-37530
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1509
ubuntu.com/security/CVE-2021-37530
cve.org/CVERecord?id=CVE-2021-37530