{"id":"CVE-2017-16899","aliases":["DEBIAN-CVE-2017-16899","EUVD-2017-8069","GHSA-6jhq-gx6q-28qv","MGASA-2017-0469","SUSE-SU-2018:0231-1","SUSE-SU-2018:0232-1","openSUSE-SU-2024:11472-1"],"status":"published","title":"An array index error in the fig2dev program in Xfig 3.2.6a allows remote attackers to cause a...","description":"An array index error in the fig2dev program in Xfig 3.2.6a allows remote attackers to cause a denial-of-service attack or information disclosure with a maliciously crafted Fig format file, related to a negative font value in dev/gentikz.c, and the read_textobject functions in read.c and read1_3.c.","severity":{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0135,"percentile":0.71706,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-129"],"published":"2017-11-20T18:00:00Z","modified":"2026-09-01T20:03:45Z","fixes":[{"ecosystem":"Debian:12","package":"fig2dev","fixed_in":["1:3.2.6a-5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"fig2dev","fixed_in":["1:3.2.6a-5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"fig2dev","fixed_in":["1:3.2.6a-5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"transfig","fixed_in":["3.2.5d-8.1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"transfig","fixed_in":["3.2.5d-9.1.mga6"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"transfig","fixed_in":["3.2.5e-2.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"transfig","fixed_in":["3.2.5e-2.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"transfig","fixed_in":["3.2.5e-2.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"transfig","fixed_in":["3.2.5e-2.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"transfig","fixed_in":["3.2.5e-2.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"transfig","fixed_in":["3.2.5e-2.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"transfig","fixed_in":["3.2.5e-2.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"transfig","fixed_in":["3.2.5-160.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"transfig","fixed_in":["3.2.5-160.3.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"fig2dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.6a-5"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"fig2dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.6a-5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"fig2dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.6a-5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"transfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5d-8.1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"transfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5d-9.1.mga6"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"transfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5e-2.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"transfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5e-2.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"transfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5e-2.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"transfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5e-2.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"transfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5e-2.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"transfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5e-2.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"transfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5e-2.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"transfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-160.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"transfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-160.3.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"transfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.8a-5.1"}]}],"bundled":11}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"xfig_project","product":"xfig"}],"references":[{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=881143","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-16899"},{"url":"https://github.com/advisories/GHSA-6jhq-gx6q-28qv"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-16899","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0469.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22199","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/MCUENJQNHVYLROFSXJPDPPHHAYFYM3Z2/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180231-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1069257","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16899","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180232-1/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-21680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-21681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-21682","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-21683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3561","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-16899","description":"An array index error in the fig2dev program in Xfig 3.2.6a allows remote attackers to cause a denial-of-service attack or information disclosure with a maliciously crafted Fig format file, related to a negative font value in dev/gentikz.c, and the read_textobject functions in read.c and read1_3.c.","status":"published","published":"2017-11-20T18:00:00Z","modified":"2024-09-16T22:50:59.682Z","updated_at":"2026-11-02T14:33:21.142987Z"}],"euvd":[{"id":"EUVD-2017-8069","description":"An array index error in the fig2dev program in Xfig 3.2.6a allows remote attackers to cause a denial-of-service attack or information disclosure with a maliciously crafted Fig format file, related to a negative font value in dev/gentikz.c, and the read_textobject functions in read.c and read1_3.c.","status":"published","published":"2017-11-20T18:00:00Z","modified":"2024-09-16T22:50:59Z","updated_at":"2026-11-03T00:54:59.221564Z"}],"ghsa":[{"id":"GHSA-6jhq-gx6q-28qv","title":"An array index error in the fig2dev program in Xfig 3.2.6a allows remote attackers to cause a...","description":"An array index error in the fig2dev program in Xfig 3.2.6a allows remote attackers to cause a denial-of-service attack or information disclosure with a maliciously crafted Fig format file, related to a negative font value in dev/gentikz.c, and the read_textobject functions in read.c and read1_3.c.","status":"published","published":"2022-05-17T00:16:45Z","modified":"2023-02-03T05:01:20Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"cwes":["CWE-129"],"updated_at":"2026-11-02T14:52:57.625741Z"}],"nvd":[{"id":"CVE-2017-16899","description":"An array index error in the fig2dev program in Xfig 3.2.6a allows remote attackers to cause a denial-of-service attack or information disclosure with a maliciously crafted Fig format file, related to a negative font value in dev/gentikz.c, and the read_textobject functions in read.c and read1_3.c.","status":"published","published":"2017-11-20T18:29:00.237Z","modified":"2026-06-17T01:10:07.013Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-129"],"updated_at":"2026-11-02T14:04:09.7374Z"}],"osv":[{"id":"CVE-2017-16899","description":"An array index error in the fig2dev program in Xfig 3.2.6a allows remote attackers to cause a denial-of-service attack or information disclosure with a maliciously crafted Fig format file, related to a negative font value in dev/gentikz.c, and the read_textobject functions in read.c and read1_3.c.","status":"published","published":"2017-11-20T18:29:00.237Z","modified":"2026-04-16T06:20:27.020741836Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:04.853379Z"},{"id":"DEBIAN-CVE-2017-16899","description":"An array index error in the fig2dev program in Xfig 3.2.6a allows remote attackers to cause a denial-of-service attack or information disclosure with a maliciously crafted Fig format file, related to a negative font value in dev/gentikz.c, and the read_textobject functions in read.c and read1_3.c.","status":"published","published":"2017-11-20T18:29:00.237Z","modified":"2026-09-01T20:03:45.225223634Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.100767Z"},{"id":"MGASA-2017-0469","title":"Updated transfig package fix security vulnerability","description":"An out-of-bounds read flaw was found in the way fig2dev program in Xfig\nhandled the processing of Fig format files. This flaw could potentially\nbe used to crash the fig2dev program by tricking it into processing\nspecially crafted Fig format files (CVE-2017-16899).\n","status":"published","published":"2017-12-25T11:16:09Z","modified":"2026-04-16T06:23:01.843359171Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2024:11472-1","title":"transfig-3.2.8a-5.1 on GA media","description":"These are all security issues fixed in the transfig-3.2.8a-5.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:00:53.12154Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2018:0231-1","title":"Security update for transfig","description":"This update for transfig fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2017-16899: Fix array index error in the fig2dev program (bsc#1069257).\n","status":"published","published":"2018-01-26T07:44:41Z","modified":"2026-02-04T02:54:20.089481Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2018:0232-1","title":"Security update for transfig","description":"This update for transfig fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2017-16899: Fix array index error in the fig2dev program (bsc#1069257).\n","status":"published","published":"2018-01-26T07:45:55Z","modified":"2025-05-02T04:06:34.671852Z","updated_at":"2026-11-02T15:53:44.594517Z"}]}}