{"id":"CVE-2023-45920","aliases":["DEBIAN-CVE-2023-45920","EUVD-2023-50183","GHSA-57m4-vwwv-mmqr","MGASA-2024-0125","SUSE-SU-2024:1196-1"],"status":"disputed","title":"Xfig v3.2.8 was discovered to contain a NULL pointer dereference when calling XGetWMHints(). NOTE...","description":"Xfig v3.2.8 was discovered to contain a NULL pointer dereference when calling XGetWMHints(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server or window manager.","severity":{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00228,"percentile":0.13654,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2024-03-27T00:00:00Z","modified":"2026-10-26T18:02:49Z","fixes":[{"ecosystem":"Debian:13","package":"xfig","fixed_in":["1:3.2.9-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xfig","fixed_in":["1:3.2.9-1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"xfig","fixed_in":["3.2.8b-3.1.mga9"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"xfig","fixed_in":["3.2.8a-4.6.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"xfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.2.8b-2","1:3.2.9-1","1:3.2.9-2","1:3.2.9-3","1:3.2.9-4","1:3.2.9a-1","1:3.2.9a-2","1:3.2.9a-3","1:3.2.9a-4","1:3.2.9a-5"]},{"source":"osv","ecosystem":"Debian:13","package":"xfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.9-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.9-1"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"xfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.8b-3.1.mga9"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"xfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.8a-4.6.1"}]}]}],"products":[{"vendor":"xfig_project","product":"xfig"}],"references":[{"url":"https://sourceforge.net/p/mcj/tickets/155/","tags":["x_transferred","Issue Tracking","report"]},{"url":"http://seclists.org/fulldisclosure/2024/Jan/48","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://packetstormsecurity.com/files/176803/Xfig-3.2.8-Null-Pointer.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45920"},{"url":"https://sourceforge.net/p/mcj/tickets/155"},{"url":"https://github.com/advisories/GHSA-57m4-vwwv-mmqr"},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-45920","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0125.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33088","tags":["report"]},{"url":"https://lwn.net/Articles/969307/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241196-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1222057","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45920","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-45920","description":"Xfig v3.2.8 was discovered to contain a NULL pointer dereference when calling XGetWMHints(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server or window manager.","status":"disputed","published":"2024-03-27T00:00:00Z","modified":"2025-11-04T18:17:59.554Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:35:22.640346Z"}],"euvd":[{"id":"EUVD-2023-50183","description":"Xfig v3.2.8 was discovered to contain a NULL pointer dereference when calling XGetWMHints(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server or window manager.","status":"published","published":"2024-03-27T00:00:00Z","modified":"2025-11-04T18:17:59Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T19:49:24.543935Z"}],"ghsa":[{"id":"GHSA-57m4-vwwv-mmqr","title":"Xfig v3.2.8 was discovered to contain a NULL pointer dereference when calling XGetWMHints(). NOTE...","description":"Xfig v3.2.8 was discovered to contain a NULL pointer dereference when calling XGetWMHints(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server or window manager.","status":"published","published":"2024-03-27T06:30:31Z","modified":"2025-11-04T21:31:23Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:04:36.536202Z"}],"nvd":[{"id":"CVE-2023-45920","description":"Xfig v3.2.8 was discovered to contain a NULL pointer dereference when calling XGetWMHints(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server or window manager.","status":"disputed","published":"2024-03-27T05:15:47.14Z","modified":"2026-06-17T06:29:47.523Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:09:10.192572Z"}],"osv":[{"id":"CVE-2023-45920","description":"Xfig v3.2.8 was discovered to contain a NULL pointer dereference when calling XGetWMHints(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server or window manager.","status":"published","published":"2024-03-27T05:15:47.14Z","modified":"2026-04-16T04:35:28.25046001Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:34.287121Z"},{"id":"DEBIAN-CVE-2023-45920","description":"Xfig v3.2.8 was discovered to contain a NULL pointer dereference when calling XGetWMHints(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server or window manager.","status":"published","published":"2024-03-27T05:15:47.14Z","modified":"2026-10-26T18:02:49.601763214Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"MGASA-2024-0125","title":"Updated xfig packages fix security vulnerability","description":"Xfig v3.2.8 was discovered to contain a NULL pointer dereference when\ncalling XGetWMHints(). (CVE-2023-45920)\n","status":"published","published":"2024-04-12T20:45:19Z","modified":"2026-04-16T04:41:57.0194728Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"SUSE-SU-2024:1196-1","title":"Security update for xfig","description":"This update for xfig fixes the following issues:\n\n- CVE-2023-45920: Fixed NULL pointer dereference when calling XGetWMHints() (bsc#1222057).\n","status":"published","published":"2024-04-10T07:48:28Z","modified":"2025-05-02T04:35:35.902567Z","updated_at":"2026-11-02T15:53:54.652421Z"}]}}