CVE-2018-16140
A buffer underwrite vulnerability in get_line() (read.c) in fig2dev 3.2.7a allows an attacker to...
A buffer underwrite vulnerability in get_line() (read.c) in fig2dev 3.2.7a allows an attacker to write prior to the beginning of the buffer via a crafted .fig file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A buffer underwrite vulnerability in get_line() (read.c) in fig2dev 3.2.7a allows an attacker to write prior to the beginning of the buffer via a crafted .fig file.
- Record
CVE-2018-16140- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
A buffer underwrite vulnerability in get_line() (read.c) in fig2dev 3.2.7a allows an attacker to write prior to the beginning of the buffer via a crafted .fig file.
- Record
CVE-2018-16140- Updated
- 2026-11-02
EUVDEUVD-2018-7995 No score
A buffer underwrite vulnerability in get_line() (read.c) in fig2dev 3.2.7a allows an attacker to write prior to the beginning of the buffer via a crafted .fig file.
- Record
EUVD-2018-7995- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8j2g-wgpq-4f6c
A buffer underwrite vulnerability in get_line() (read.c) in fig2dev 3.2.7a allows an attacker to...
A buffer underwrite vulnerability in get_line() (read.c) in fig2dev 3.2.7a allows an attacker to write prior to the beginning of the buffer via a crafted .fig file.
- Record
GHSA-8j2g-wgpq-4f6c- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
A buffer underwrite vulnerability in get_line() (read.c) in fig2dev 3.2.7a allows an attacker to write prior to the beginning of the buffer via a crafted .fig file.
- Record
CVE-2018-16140- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-16140
A buffer underwrite vulnerability in get_line() (read.c) in fig2dev 3.2.7a allows an attacker to write prior to the beginning of the buffer via a crafted .fig file.
- Record
DEBIAN-CVE-2018-16140- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVUBUNTU-CVE-2018-16140
A buffer underwrite vulnerability in get_line() (read.c) in fig2dev 3.2.7a allows an attacker to write prior to the beginning of the buffer via a crafted .fig file.
- Record
UBUNTU-CVE-2018-16140- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2019-0064 No score
Updated transfig packages fix security vulnerability
It was discovered that transfig incorrectly handled certain FIG files. An attacker could possibly use this to execute arbitrary code (CVE-2018-16140).
- Record
MGASA-2019-0064- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1455-1 No score
Security update for transfig
This update for transfig fixes the following issues:
Security issue fixed:
- CVE-2018-16140: Fixed a buffer underwrite vulnerability in get_line() in read.c, which allowed an attacker to write prior to the beginning of the buffer via specially crafted .fig file (bsc#1106531)
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:1455-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11472-1 No score
transfig-3.2.8a-5.1 on GA media
These are all security issues fixed in the transfig-3.2.8a-5.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11472-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:1291-1 No score
Security update for transfig
This update for transfig fixes the following issues:
Security issue fixed:
- CVE-2018-16140: Fixed a buffer underwrite vulnerability in get_line() in read.c, which allowed an attacker to write prior to the beginning of the buffer via specially crafted .fig file (bsc#1106531)
- Record
SUSE-SU-2019:1291-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:1806-1 No score
Security update for transfig
This update for transfig fixes the following issues:
Security issue fixed:
- CVE-2019-14275: Fixed stack-based buffer overflow in the calc_arrow function (bsc#1143650).
- CVE-2018-16140: Fixed a buffer underwrite vulnerability in get_line() in read.c, which allowed an attacker to write prior to the beginning of the buffer via specially crafted .fig file (bsc#1106531)
- Record
SUSE-SU-2020:1806-1- Updated
- 2026-11-02
OSVUSN-3760-1 No score
transfig vulnerability
It was discovered that transfig incorrectly handled certain FIG files. An attacker could possibly use this to execute arbitrary code.
- Record
USN-3760-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
fig2devDebian:12 |
before 1:3.2.7a-3 | 1:3.2.7a-3 |
fig2devDebian:13 |
before 1:3.2.7a-3 | 1:3.2.7a-3 |
fig2devDebian:14 |
before 1:3.2.7a-3 | 1:3.2.7a-3 |
transfigDebian:8 From an advisory covering 3 CVEs |
before 1:3.2.5.e-4+deb8u2, plus listed versions 1:3.2.5.e-41:3.2.5.e-4+deb8u1 |
1:3.2.5.e-4+deb8u2 |
transfigMageia:6 |
before 3.2.5d-9.2.mga6 | 3.2.5d-9.2.mga6 |
transfigSUSE:Linux Enterprise Workstation Extension 15 |
before 3.2.6a-4.3.51 | 3.2.6a-4.3.51 |
transfigSUSE:Linux Enterprise Server 12 SP4 From an advisory covering 2 CVEs |
before 3.2.5e-2.8.2 | 3.2.5e-2.8.2 |
transfigSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 2 CVEs |
before 3.2.5e-2.8.2 | 3.2.5e-2.8.2 |
transfigSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 2 CVEs |
before 3.2.5e-2.8.2 | 3.2.5e-2.8.2 |
transfigSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 2 CVEs |
before 3.2.5e-2.8.2 | 3.2.5e-2.8.2 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
transfigUbuntu:14.04:LTS |
before 1:3.2.5.e-1ubuntu1.1, plus listed versions 1:3.2.5.d-3ubuntu11:3.2.5.e-1ubuntu1 |
1:3.2.5.e-1ubuntu1.1 |
transfigUbuntu:16.04:LTS |
before 1:3.2.5.e-5ubuntu0.1, plus listed versions 1:3.2.5.e-41:3.2.5.e-5 |
1:3.2.5.e-5ubuntu0.1 |
fig2devUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1:3.2.6a-31:3.2.6a-41:3.2.6a-4ubuntu11:3.2.6a-6ubuntu11:3.2.6a-6ubuntu1.11:3.2.6a-6ubuntu1.1+esm1 |
None known |
transfigopenSUSE:Leap 15.0 |
before 3.2.6a-lp151.4.3.1 | 3.2.6a-lp151.4.3.1 |
transfigopenSUSE:Leap 15.1 |
before 3.2.6a-lp151.4.3.1 | 3.2.6a-lp151.4.3.1 |
transfigopenSUSE:Tumbleweed From an advisory covering 11 CVEs |
before 3.2.8a-5.1 | 3.2.8a-5.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-16140 is a high vulnerability (CVSS 7.8) in Fig2dev Project Fig2dev, published August 29, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.43%, the 73rd percentile. Fixed in fig2dev 1:3.2.7a-3.
References
sourceforge.net/p/mcj/tickets/28
usn.ubuntu.com/3760-1
lists.debian.org/debian-lts-announce/2020/01/msg00018.html
nvd.nist.gov/vuln/detail/CVE-2018-16140
github.com/advisories/GHSA-8j2g-wgpq-4f6c
security-tracker.debian.org/tracker/CVE-2018-16140
Show 21 moreShow less
advisories.mageia.org/MGASA-2019-0064.html
bugs.mageia.org/show_bug.cgi?id=23537
suse.com/support/update/announcement/2019/suse-su-20191291-1
bugzilla.suse.com/1106531
ubuntu.com/security/CVE-2018-16140
cve.org/CVERecord?id=CVE-2018-16140
lists.opensuse.org/archives/list/[email protected]/thread/KCF4K7GDJWORSQSIBKFFBWXZGUW6T5MN