CVE-2009-4227
NoneCVSS
—
EPSS
11.5%
Published
Dec 8, 2009
CISA due date
—
The record
Stack-based buffer overflow in the read_1_3_textobject function in f_readold.c in Xfig 3.2.5b and earlier, and in the read_textobject function in read1_3.c in fig2dev in Transfig 3.2.5a and earlier, allows remote attackers to execute arbitrary code via a long string in a malformed .fig file that uses the 1.3 file format. NOTE: some of these details are obtained from third party information.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:10 | xfig | 0 | 1:3.2.5.b-1 |
| Debian:11 | xfig | 0 | 1:3.2.5.b-1 |
| Debian:12 | xfig | 0 | 1:3.2.5.b-1 |
| Debian:13 | xfig | 0 | 1:3.2.5.b-1 |
| Ubuntu:16.04:LTS | xfig | 0 | 1:3.2.5.c-7 |
| openSUSE:Tumbleweed | xfig | 0 | 3.2.6-1.1 |
Related vulnerabilities
- CVE-2026-112108 A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. CWE-119
- CVE-2026-112073 A vulnerability was identified in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dc… CWE-119
- CVE-2026-90831 A vulnerability was detected in GNU Binutils 2.47. CWE-119
- CVE-2026-90804 A vulnerability was detected in GNU Binutils 2.47. CWE-119
- CVE-2026-90803 A security vulnerability has been detected in GNU Binutils 2.47. CWE-119
- CVE-2026-90801 A security flaw has been discovered in GNU Binutils 2.47. CWE-119
- CVE-2026-87933 A vulnerability was found in DaveGamble cJSON up to 1.7.19. CWE-119
- CVE-2026-87931 A vulnerability has been found in Behavioral Technology Group Pavlok Behavioral… CWE-119