{"id":"CVE-2025-46397","aliases":["ALPINE-CVE-2025-46397","ALSA-2026:0700","ALSA-2026:0756","DEBIAN-CVE-2025-46397","DLA-4147-1","EUVD-2025-12159","GHSA-fqm9-qqwf-gq9r","MGASA-2025-0253","OESA-2025-1509","OESA-2025-1510","OESA-2025-1947","OESA-2025-1948","OESA-2025-1949","RHSA-2026:0700","RHSA-2026:0704","RHSA-2026:0705","RHSA-2026:0756","RLSA-2026:0700","RLSA-2026:0756","SUSE-SU-2025:01835-1","SUSE-SU-2025:01835-2","SUSE-SU-2025:01890-1","openSUSE-SU-2025:15155-1"],"status":"published","title":"Xfig: xfig: stack-overflow allows possible code execution via local input manipulation","description":"A flaw was found in xfig. This vulnerability allows possible code execution via local input manipulation via bezier_spline function.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00305,"percentile":0.23489,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120","CWE-121"],"published":"2025-04-23T20:55:09Z","modified":"2026-11-05T16:17:15Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"fig2dev","fixed_in":["3.2.9a-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"fig2dev","fixed_in":["3.2.9a-r3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"transfig","fixed_in":["1:3.2.7b-11.el9_7"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"transfig","fixed_in":["1:3.2.6a-5.el8_10"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"fig2dev","fixed_in":["1:3.2.8b-3+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"fig2dev","fixed_in":["1:3.2.9a-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"fig2dev","fixed_in":["1:3.2.9a-4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"transfig","fixed_in":["1:3.2.7b-11.el9_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"transfig-debuginfo","fixed_in":["1:3.2.7b-11.el9_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"transfig-debugsource","fixed_in":["1:3.2.7b-11.el9_7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"transfig","fixed_in":["1:3.2.7b-10.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"transfig-debuginfo","fixed_in":["1:3.2.7b-10.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"transfig-debugsource","fixed_in":["1:3.2.7b-10.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"transfig","fixed_in":["1:3.2.7b-10.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"transfig-debuginfo","fixed_in":["1:3.2.7b-10.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"transfig-debugsource","fixed_in":["1:3.2.7b-10.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"transfig","fixed_in":["1:3.2.6a-5.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"transfig-debuginfo","fixed_in":["1:3.2.6a-5.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"transfig-debugsource","fixed_in":["1:3.2.6a-5.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"transfig","fixed_in":["1:3.2.7b-11.el9_7"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"transfig","fixed_in":["1:3.2.6a-5.el8_10"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"fig2dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.9a-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"fig2dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.9a-r3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"transfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.7b-11.el9_7"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"transfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.6a-5.el8_10"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"fig2dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.8b-3+deb12u2"}]}],"versions":["1:3.2.8b-3","1:3.2.8b-3+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"fig2dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.9a-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"fig2dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.9a-4"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"fig2dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.8-3+deb11u3"}]}],"versions":["1:3.2.8-3","1:3.2.8-3+deb11u1","1:3.2.8-3+deb11u2"],"bundled":4},{"source":"osv","ecosystem":"Mageia:9","package":"transfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.9a-1.1.mga9"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"transfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.9-3.oe2403"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"transfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.9-3.oe2403sp1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"transfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.8b-4.oe2203sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"transfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.8b-4.oe2003sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"transfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.8b-4.oe2203sp3"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"transfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.7b-11.el9_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"transfig-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.7b-11.el9_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"transfig-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.7b-11.el9_7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"transfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.7b-10.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"transfig-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.7b-10.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"transfig-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.7b-10.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"transfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.7b-10.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"transfig-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.7b-10.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"transfig-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.7b-10.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"transfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.6a-5.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"transfig-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.6a-5.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"transfig-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.6a-5.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"transfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.7b-11.el9_7"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"transfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.6a-5.el8_10"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"transfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.9a-150600.3.5.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP6","package":"transfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.9a-150600.3.5.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"transfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.9a-150600.3.5.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"transfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.9a-150600.3.5.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"transfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.9a-150600.3.5.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"transfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.8b-2.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"transfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.9a-3.1"}]}],"bundled":4}],"products":[{"vendor":"fig2dev_project","product":"fig2dev"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.4 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 9.6 extended update support"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:0700","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:0704","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:0705","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:0756","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-46397","tags":["vdb-entry","x_refsource_REDHAT","Vendor Advisory","report","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2362058","tags":["issue-tracking","x_refsource_REDHAT","Vendor Advisory","advisory","report"]},{"url":"https://sourceforge.net/p/mcj/tickets/192/","tags":["Exploit","Issue Tracking","report","article"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00043.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46397","tags":["advisory"]},{"url":"https://sourceforge.net/p/mcj/tickets/192"},{"url":"https://github.com/advisories/GHSA-fqm9-qqwf-gq9r"},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-46397","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/2362058","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-0700.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-0756.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-46397","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0253.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34309","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/ZDNSWLCQENGSN2O2GVDL64VL52AR7HAU/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1509","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46398","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46399","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46400","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1510","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1947","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1948","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1949","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0700.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-46397","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0704.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0705.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0756.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:0700","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:0756","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501835-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1225947","tags":["report"]},{"url":"https://bugzilla.suse.com/1230427","tags":["report"]},{"url":"https://bugzilla.suse.com/1240379","tags":["report"]},{"url":"https://bugzilla.suse.com/1240380","tags":["report"]},{"url":"https://bugzilla.suse.com/1240381","tags":["report"]},{"url":"https://bugzilla.suse.com/1243260","tags":["report"]},{"url":"https://bugzilla.suse.com/1243261","tags":["report"]},{"url":"https://bugzilla.suse.com/1243262","tags":["report"]},{"url":"https://bugzilla.suse.com/1243263","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-31162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-31163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-31164","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46397","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46400","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501835-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501890-1/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZDNSWLCQENGSN2O2GVDL64VL52AR7HAU/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-46397","title":"Xfig: xfig: stack-overflow allows possible code execution via local input manipulation","description":"A flaw was found in xfig. This vulnerability allows possible code execution via local input manipulation via bezier_spline function.","status":"published","published":"2025-04-23T20:55:09.795Z","modified":"2026-11-05T15:49:05.496Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-120"],"updated_at":"2026-11-05T16:36:33.176634Z"}],"euvd":[{"id":"EUVD-2025-12159","description":"A flaw was found in xfig. This vulnerability allows possible code execution via local input manipulation via bezier_spline function.","status":"published","published":"2025-04-23T20:55:09Z","modified":"2026-11-05T15:49:05Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T18:00:59.460287Z"}],"ghsa":[{"id":"GHSA-fqm9-qqwf-gq9r","title":"Stack-overflow in fig2dev in version 3.2.9a allows an attacker possible code execution via local...","description":"Stack-overflow in fig2dev in version 3.2.9a allows an attacker possible code execution via local input manipulation via bezier_spline function.","status":"published","published":"2025-04-23T21:30:36Z","modified":"2026-01-19T06:30:28Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-120","CWE-121"],"updated_at":"2026-11-02T15:05:39.898984Z"}],"nvd":[{"id":"CVE-2025-46397","description":"A flaw was found in xfig. This vulnerability allows possible code execution via local input manipulation via bezier_spline function.","status":"published","published":"2025-04-23T21:15:16.807Z","modified":"2026-11-05T16:17:15.6Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-120"],"updated_at":"2026-11-05T19:55:50.758755Z"}],"osv":[{"id":"ALPINE-CVE-2025-46397","description":"A flaw was found in xfig. This vulnerability allows possible code execution via local input manipulation via bezier_spline function.","status":"published","published":"2025-04-23T21:15:16.807Z","modified":"2026-11-03T06:33:00.597900478Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:15:53.944853Z"},{"id":"CVE-2025-46397","description":"A flaw was found in xfig. This vulnerability allows possible code execution via local input manipulation via bezier_spline function.","status":"published","published":"2025-04-23T21:15:16.807Z","modified":"2026-04-16T04:33:45.909900637Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:49.707645Z"},{"id":"DEBIAN-CVE-2025-46397","description":"A flaw was found in xfig. This vulnerability allows possible code execution via local input manipulation via bezier_spline function.","status":"published","published":"2025-04-23T21:15:16.807Z","modified":"2026-09-01T20:05:52.756704877Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"OESA-2025-1509","title":"transfig security update","description":"The transfig utility creates a makefile which translates FIG (created by xfig) or PIC figures into a specified LaTeX graphics language (for example, PostScript(TM)).  Transfig is used to create TeX documents which are portable (i.e., they can be printed in a wide variety of environments).\r\n\r\nSecurity Fix(es):\n\nIn xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation at the bezier_spline function.(CVE-2025-46397)\n\nIn xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation via read_objects function.(CVE-2025-46398)\n\nIn xfig diagramming tool, a segmentation fault in fig2dev allows memory corruption via local input manipulation at genge_itp_spline function.(CVE-2025-46399)\n\nIn xfig diagramming tool, a segmentation fault while running fig2dev allows an attacker to availability via local input manipulation via read_arcobject function.(CVE-2025-46400)","status":"published","published":"2025-05-16T11:08:36Z","modified":"2026-08-18T01:17:57.603618818Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1510","title":"transfig security update","description":"The transfig utility creates a makefile which translates FIG (created by xfig) or PIC figures into a specified LaTeX graphics language (for example, PostScript(TM)).  Transfig is used to create TeX documents which are portable (i.e., they can be printed in a wide variety of environments).\r\n\r\nSecurity Fix(es):\n\nIn xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation at the bezier_spline function.(CVE-2025-46397)\n\nIn xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation via read_objects function.(CVE-2025-46398)\n\nIn xfig diagramming tool, a segmentation fault in fig2dev allows memory corruption via local input manipulation at genge_itp_spline function.(CVE-2025-46399)\n\nIn xfig diagramming tool, a segmentation fault while running fig2dev allows an attacker to availability via local input manipulation via read_arcobject function.(CVE-2025-46400)","status":"published","published":"2025-05-16T11:08:36Z","modified":"2026-08-18T01:17:57.704819962Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1947","title":"transfig security update","description":"The transfig utility creates a makefile which translates FIG (created by xfig) or PIC figures into a specified LaTeX graphics language (for example, PostScript(TM)).  Transfig is used to create TeX documents which are portable (i.e., they can be printed in a wide variety of environments).\r\n\r\nSecurity Fix(es):\n\nIn xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation at the bezier_spline function.(CVE-2025-46397)\n\nIn xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation via read_objects function.(CVE-2025-46398)\n\nIn xfig diagramming tool, a segmentation fault in fig2dev allows memory corruption via local input manipulation at genge_itp_spline function.(CVE-2025-46399)\n\nIn xfig diagramming tool, a segmentation fault while running fig2dev allows an attacker to availability via local input manipulation via read_arcobject function.(CVE-2025-46400)","status":"published","published":"2025-08-01T11:09:01Z","modified":"2026-08-18T01:18:56.34343804Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1948","title":"transfig security update","description":"The transfig utility creates a makefile which translates FIG (created by xfig) or PIC figures into a specified LaTeX graphics language (for example, PostScript(TM)).  Transfig is used to create TeX documents which are portable (i.e., they can be printed in a wide variety of environments).\r\n\r\nSecurity Fix(es):\n\nIn xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation at the bezier_spline function.(CVE-2025-46397)\n\nIn xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation via read_objects function.(CVE-2025-46398)\n\nIn xfig diagramming tool, a segmentation fault in fig2dev allows memory corruption via local input manipulation at genge_itp_spline function.(CVE-2025-46399)\n\nIn xfig diagramming tool, a segmentation fault while running fig2dev allows an attacker to availability via local input manipulation via read_arcobject function.(CVE-2025-46400)","status":"published","published":"2025-08-01T11:09:02Z","modified":"2026-08-18T01:18:56.402357939Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1949","title":"transfig security update","description":"The transfig utility creates a makefile which translates FIG (created by xfig) or PIC figures into a specified LaTeX graphics language (for example, PostScript(TM)).  Transfig is used to create TeX documents which are portable (i.e., they can be printed in a wide variety of environments).\r\n\r\nSecurity Fix(es):\n\nIn xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation at the bezier_spline function.(CVE-2025-46397)\n\nIn xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation via read_objects function.(CVE-2025-46398)\n\nIn xfig diagramming tool, a segmentation fault in fig2dev allows memory corruption via local input manipulation at genge_itp_spline function.(CVE-2025-46399)\n\nIn xfig diagramming tool, a segmentation fault while running fig2dev allows an attacker to availability via local input manipulation via read_arcobject function.(CVE-2025-46400)","status":"published","published":"2025-08-01T11:09:02Z","modified":"2026-08-18T01:18:55.948408114Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"RHSA-2026:0700","title":"Red Hat Security Advisory: transfig security update","status":"published","published":"2026-01-16T10:09:33Z","modified":"2026-06-30T10:33:18Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.066978Z"},{"id":"RHSA-2026:0704","title":"Red Hat Security Advisory: transfig security update","status":"published","published":"2026-01-16T10:09:34Z","modified":"2026-06-30T10:33:19Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.066978Z"},{"id":"RHSA-2026:0705","title":"Red Hat Security Advisory: transfig security update","status":"published","published":"2026-01-16T10:09:35Z","modified":"2026-06-30T10:33:19Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.066978Z"},{"id":"RHSA-2026:0756","title":"Red Hat Security Advisory: transfig security update","status":"published","published":"2026-01-19T10:05:56Z","modified":"2026-06-30T10:33:27Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.066978Z"},{"id":"RLSA-2026:0700","title":"Moderate: transfig security update","description":"The transfig utility creates a makefile which translates FIG (created by xfig) or PIC figures into a specified LaTeX graphics language (for example, PostScript(TM)).  Transfig is used to create TeX documents which are portable (i.e., they can be printed in a wide variety of environments).  Install transfig if you need a utility for translating FIG or PIC figures into certain graphics languages.\n\nSecurity Fix(es):\n\n* xfig: xfig: Stack-overflow allows possible code execution via local input manipulation (CVE-2025-46397)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-01-17T09:05:17.262764Z","modified":"2026-01-17T09:30:06.465228Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"RLSA-2026:0756","title":"Moderate: transfig security update","description":"The transfig utility creates a makefile which translates FIG (created by xfig) or PIC figures into a specified LaTeX graphics language (for example, PostScript(TM)).  Transfig is used to create TeX documents which are portable (i.e., they can be printed in a wide variety of environments).  Install transfig if you need a utility for translating FIG or PIC figures into certain graphics languages.\n\nSecurity Fix(es):\n\n* xfig: xfig: Stack-overflow allows possible code execution via local input manipulation (CVE-2025-46397)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-01-20T09:03:02.276902Z","modified":"2026-01-20T09:30:49.461966Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"ALSA-2026:0700","title":"Moderate: transfig security update","description":"The transfig utility creates a makefile which translates FIG (created by xfig) or PIC figures into a specified LaTeX graphics language (for example, PostScript(TM)). Transfig is used to create TeX documents which are portable (i.e., they can be printed in a wide variety of environments). Install transfig if you need a utility for translating FIG or PIC figures into certain graphics languages.  \n\nSecurity Fix(es):  \n\n  * xfig: xfig: Stack-overflow allows possible code execution via local input manipulation (CVE-2025-46397)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-01-15T00:00:00Z","modified":"2026-10-29T11:32:20.159778008Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"ALSA-2026:0756","title":"Moderate: transfig security update","description":"The transfig utility creates a makefile which translates FIG (created by xfig) or PIC figures into a specified LaTeX graphics language (for example, PostScript(TM)). Transfig is used to create TeX documents which are portable (i.e., they can be printed in a wide variety of environments). Install transfig if you need a utility for translating FIG or PIC figures into certain graphics languages.  \n\nSecurity Fix(es):  \n\n  * xfig: xfig: Stack-overflow allows possible code execution via local input manipulation (CVE-2025-46397)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-01-19T00:00:00Z","modified":"2026-10-29T11:02:28.585651919Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"DLA-4147-1","title":"fig2dev - security update","status":"published","published":"2025-04-30T00:00:00Z","modified":"2026-03-09T01:21:35.494355Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2025-0253","title":"Updated transfig packages fix security vulnerabilities","description":"fig2dev stack-overflow. (CVE-2025-46397)\nfig2dev stack-overflow via read_objects. (CVE-2025-46398)\nfig2dev segmentation fault vulnerability. (CVE-2025-46399)\nfig2dev segmentation fault in read_arcobject. (CVE-2025-46400)\n","status":"published","published":"2025-10-31T23:36:04Z","modified":"2026-04-16T04:42:37.721511081Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15155-1","title":"transfig-3.2.9a-3.1 on GA media","description":"These are all security issues fixed in the transfig-3.2.9a-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-05-23T00:00:00Z","modified":"2026-03-23T04:53:24.866914Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"SUSE-SU-2025:01835-1","title":"Security update for transfig","description":"This update for transfig fixes the following issues:\n\nUpdate to fig2dev version 3.2.9a\n\n- CVE-2025-31162: Fixed a floating point exception in fig2dev in get_slope function (bsc#1240380).\n- CVE-2025-31163: Fixed a segmentation fault in fig2dev in put_patternarc function (bsc#1240381).\n- CVE-2025-31164: Fixed a heap buffer overflow in fig2dev in create_line_with_spline function (bsc#1240379).\n- CVE-2025-46397: Fixed a stack buffer overflow in fig2dev in bezier_spline function (bsc#1243260).\n- CVE-2025-46398: Fixed a stack buffer overflow in fig2dev in read_objects function (bsc#1243262).\n- CVE-2025-46399: Fixed a segmentation fault in fig2dev in genge_itp_spline function (bsc#1243263).\n- CVE-2025-46400: Fixed a segmentation fault in fig2dev in read_arcobject function (bsc#1243261).\n","status":"published","published":"2025-06-09T13:24:44Z","modified":"2026-02-04T02:16:32.714759Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:01835-2","title":"Security update for transfig","description":"This update for transfig fixes the following issues:\n\nUpdate to fig2dev version 3.2.9a\n\n- CVE-2025-31162: Fixed a floating point exception in fig2dev in get_slope function (bsc#1240380).\n- CVE-2025-31163: Fixed a segmentation fault in fig2dev in put_patternarc function (bsc#1240381).\n- CVE-2025-31164: Fixed a heap buffer overflow in fig2dev in create_line_with_spline function (bsc#1240379).\n- CVE-2025-46397: Fixed a stack buffer overflow in fig2dev in bezier_spline function (bsc#1243260).\n- CVE-2025-46398: Fixed a stack buffer overflow in fig2dev in read_objects function (bsc#1243262).\n- CVE-2025-46399: Fixed a segmentation fault in fig2dev in genge_itp_spline function (bsc#1243263).\n- CVE-2025-46400: Fixed a segmentation fault in fig2dev in read_arcobject function (bsc#1243261).\n","status":"published","published":"2025-07-16T14:52:18Z","modified":"2026-03-23T04:49:32.236056Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:01890-1","title":"Security update for transfig","description":"This update for transfig fixes the following issues:\n\nUpdate to fig2dev version 3.2.9a\n\n- CVE-2025-46397: Fixed a stack buffer overflow in fig2dev in bezier_spline function (bsc#1243260).\n- CVE-2025-46398: Fixed a stack buffer overflow in fig2dev in read_objects function (bsc#1243262).\n- CVE-2025-46399: Fixed a segmentation fault in fig2dev in genge_itp_spline function (bsc#1243263).\n- CVE-2025-46400: Fixed a segmentation fault in fig2dev in read_arcobject function (bsc#1243261).\n","status":"published","published":"2025-06-11T05:43:46Z","modified":"2026-02-04T03:11:41.571379Z","updated_at":"2026-11-02T15:53:56.647031Z"}]}}