CVE-2021-3561

Name	CVE-2021-3561
Description	An Out of Bounds flaw was found fig2dev version 3.2.8a. A flawed bounds check in read_objects() could allow an attacker to provide a crafted malicious input causing the application to either crash or in some cases cause memory corruption. The highest threat from this vulnerability is to integrity as well as system availability.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2778-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
fig2dev (PTS)	bullseye	1:3.2.8-3+deb11u1	fixed
	bullseye (security)	1:3.2.8-3+deb11u3	fixed
	bookworm	1:3.2.8b-3+deb12u2	fixed
	forky, sid, trixie	1:3.2.9a-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
fig2dev	source	stretch	1:3.2.6a-2+deb9u4	DLA-2778-1
fig2dev	source	buster	1:3.2.7a-5+deb10u4
fig2dev	source	(unstable)	1:3.2.8-3
transfig	source	(unstable)	(unfixed)

Notes

https://sourceforge.net/p/mcj/tickets/116/
https://sourceforge.net/p/mcj/fig2dev/ci/6827c09d2d6491cb2ae3ac7196439ff3aa791fd9/
Depends on CVE-2019-19797 fix