Bug 1159293 – VUL-1: CVE-2019-19797: transfig,xfig: out-of-bounds write in read_colordef in read.c

Bug 1159293 - (CVE-2019-19797) VUL-1: CVE-2019-19797: transfig,xfig: out-of-bounds write in read_colordef in read.c

(CVE-2019-19797)
Summary:	VUL-1: CVE-2019-19797: transfig,xfig: out-of-bounds write in read_colordef in...

Status:	RESOLVED FIXED

Classification:	openSUSE
Product:	openSUSE Tumbleweed
Classification:	openSUSE
Component:	Security
Version:	Current
Hardware:	Other Other

Priority:	P4 - Low Severity: Normal (vote)
Target Milestone:	Current
Assigned To:	Dr. Werner Fink
QA Contact:	E-mail List

URL:	https://smash.suse.de/issue/249076/
Whiteboard:	CVSSv3.1:NVD:CVE-2019-19797:9.8:(AV...
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2019-12-16 15:25 UTC by Alexandros Toptsoglou
Modified:	2021-10-06 19:54 UTC (History)
CC List:	1 user (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
POC (3.61 KB, image/x-xfig) 2020-01-21 18:11 UTC, Alexandros Toptsoglou	Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Alexandros Toptsoglou 2019-12-16 15:25:45 UTC

CVE-2019-19797

read_colordef in read.c in Xfig fig2dev 3.2.7b has an out-of-bounds write.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-19797
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19797
https://sourceforge.net/p/mcj/tickets/67/

Comment 1 Alexandros Toptsoglou 2020-01-21 18:10:37 UTC

I could not reproduce the issue. Running in TW resulted in an invalid color definition and a normal exit. No write out of bounds was spotted. Will track only TW as affected so that it receives the updates. 
The POC is attached. There is a commit that fixes multiple issues at [1]. To reproduce just run : fig2dev -L box $POC

[1] https://sourceforge.net/p/mcj/fig2dev/ci/41b9bb838a3d544539f6e68aa4f87d70ef7d45ce

Comment 2 Alexandros Toptsoglou 2020-01-21 18:11:04 UTC

Created attachment 827951 [details]
POC

Comment 5 Swamp Workflow Management 2021-07-22 16:17:28 UTC

SUSE-SU-2021:2454-1: An update that fixes 5 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1143650,1159130,1159293,1161698,1186329
CVE References: CVE-2019-14275,CVE-2019-19555,CVE-2019-19746,CVE-2019-19797,CVE-2021-3561
JIRA References: 
Sources used:
SUSE Linux Enterprise Workstation Extension 15-SP3 (src):    transfig-3.2.8a-4.12.2
SUSE Linux Enterprise Workstation Extension 15-SP2 (src):    transfig-3.2.8a-4.12.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 6 Swamp Workflow Management 2021-07-22 16:24:50 UTC

openSUSE-SU-2021:2454-1: An update that fixes 5 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1143650,1159130,1159293,1161698,1186329
CVE References: CVE-2019-14275,CVE-2019-19555,CVE-2019-19746,CVE-2019-19797,CVE-2021-3561
JIRA References: 
Sources used:
openSUSE Leap 15.3 (src):    transfig-3.2.8a-4.12.2

Comment 7 Dr. Werner Fink 2021-07-23 06:09:06 UTC

fixed

Comment 8 Swamp Workflow Management 2021-08-10 22:27:01 UTC

openSUSE-SU-2021:1143-1: An update that fixes 5 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1143650,1159130,1159293,1161698,1186329
CVE References: CVE-2019-14275,CVE-2019-19555,CVE-2019-19746,CVE-2019-19797,CVE-2021-3561
JIRA References: 
Sources used:
openSUSE Leap 15.2 (src):    transfig-3.2.8a-lp152.6.6.2

Comment 13 Swamp Workflow Management 2021-09-16 22:27:08 UTC

# maintenance_jira_update_notice
SUSE-SU-2021:3124-1: An update that solves 8 vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1136882,1159130,1159293,1161698,1186329,1189325,1189343,1189345,1189346
CVE References: CVE-2019-19555,CVE-2019-19746,CVE-2019-19797,CVE-2020-21680,CVE-2020-21681,CVE-2020-21682,CVE-2020-21683,CVE-2021-3561
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    transfig-3.2.8a-2.17.1
SUSE OpenStack Cloud Crowbar 8 (src):    transfig-3.2.8a-2.17.1
SUSE OpenStack Cloud 9 (src):    transfig-3.2.8a-2.17.1
SUSE OpenStack Cloud 8 (src):    transfig-3.2.8a-2.17.1
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    transfig-3.2.8a-2.17.1
SUSE Linux Enterprise Server for SAP 12-SP3 (src):    transfig-3.2.8a-2.17.1
SUSE Linux Enterprise Server 12-SP5 (src):    transfig-3.2.8a-2.17.1
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    transfig-3.2.8a-2.17.1
SUSE Linux Enterprise Server 12-SP3-LTSS (src):    transfig-3.2.8a-2.17.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    transfig-3.2.8a-2.17.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    transfig-3.2.8a-2.17.1
HPE Helion Openstack 8 (src):    transfig-3.2.8a-2.17.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 14 OBSbugzilla Bot 2021-09-20 14:40:21 UTC

This is an autogenerated message for OBS integration:
This bug (1159293) was mentioned in
https://build.opensuse.org/request/show/920329 Backports:SLE-15-SP2 / transfig
https://build.opensuse.org/request/show/920330 Backports:SLE-15-SP3 / transfig

Comment 16 Swamp Workflow Management 2021-09-27 19:16:58 UTC

openSUSE-SU-2021:1311-1: An update that fixes 5 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1143650,1159130,1159293,1161698,1186329
CVE References: CVE-2019-14275,CVE-2019-19555,CVE-2019-19746,CVE-2019-19797,CVE-2021-3561
JIRA References: 
Sources used:
openSUSE Backports SLE-15-SP2 (src):    transfig-3.2.8a-bp152.3.3.2

Comment 17 Swamp Workflow Management 2021-09-28 16:21:51 UTC

openSUSE-SU-2021:1318-1: An update that fixes 5 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1143650,1159130,1159293,1161698,1186329
CVE References: CVE-2019-14275,CVE-2019-19555,CVE-2019-19746,CVE-2019-19797,CVE-2021-3561
JIRA References: 
Sources used:
openSUSE Backports SLE-15-SP3 (src):    transfig-3.2.8a-bp153.3.3.2

Comment 18 Swamp Workflow Management 2021-10-06 19:54:37 UTC

SUSE-SU-2021:14823-1: An update that solves 9 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1136882,1143650,1159130,1159293,1161698,1186329,1189325,1189343,1189345,1189346
CVE References: CVE-2019-14275,CVE-2019-19555,CVE-2019-19746,CVE-2019-19797,CVE-2020-21680,CVE-2020-21681,CVE-2020-21682,CVE-2020-21683,CVE-2021-3561
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 11-SP4-LTSS (src):    transfig-3.2.8a-1.160.13.1
SUSE Linux Enterprise Point of Sale 11-SP3 (src):    transfig-3.2.8a-1.160.13.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    transfig-3.2.8a-1.160.13.1
SUSE Linux Enterprise Debuginfo 11-SP3 (src):    transfig-3.2.8a-1.160.13.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.