CVE-2020-21675

Name	CVE-2020-21675
Description	A stack-based buffer overflow in the genptk_text component in genptk.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting a xfig file into ptk format.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2778-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
fig2dev (PTS)	bookworm	1:3.2.8b-3+deb12u2	fixed
	trixie	1:3.2.9a-4	fixed
	forky, sid	1:3.2.9a-5	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
fig2dev	source	stretch	1:3.2.6a-2+deb9u4	DLA-2778-1
fig2dev	source	buster	1:3.2.7a-5+deb10u3
fig2dev	source	(unstable)	1:3.2.7b-3
transfig	source	(unstable)	(unfixed)

https://sourceforge.net/p/mcj/tickets/78/
https://sourceforge.net/p/mcj/fig2dev/ci/41b9bb838a3d544539f6e68aa4f87d70ef7d45ce/ (3.2.8)