Vulnerability Name:

CVE-2019-19555 (CCN-172562)

Assigned:2019-12-03
Published:2019-12-03
Updated:2020-01-22
Summary:read_textobject in read.c in Xfig fig2dev 3.2.7b has a stack-based buffer overflow because of an incorrect sscanf.
CVSS v3 Severity:5.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
4.9 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
7.8 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
6.9 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
6.8 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-787
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2019-19555

Source: XF
Type: UNKNOWN
xfig-cve201919555-bo(172562)

Source: MLIST
Type: UNKNOWN
[debian-lts-announce] 20200121 [SECURITY] [DLA 2073-1] transfig security update

Source: CCN
Type: SourceForge Xfig Project
#55 Stack-based buffer overflow in the read_textobject() function

Source: MISC
Type: Exploit, Third Party Advisory
https://sourceforge.net/p/mcj/tickets/55/

Vulnerable Configuration:Configuration 1:
  • cpe:/a:xfig_project:xfig:3.2.7:b:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:51959
    P
    		Security update for kubevirt stack (Important)
    2022-11-21
    oval:org.opensuse.security:def:3594
    P
    		libgc1-7.2d-5.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:95224
    P
    		transfig-3.2.8b-4.15.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:113542
    P
    		transfig-3.2.8a-5.1 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:46254
    P
    		Security update for transfig (Important)
    2021-10-06
    oval:org.opensuse.security:def:39538
    P
    		Security update for transfig (Important)
    2021-10-06
    oval:org.opensuse.security:def:40954
    P
    		Security update for transfig (Important)
    2021-10-06
    oval:org.opensuse.security:def:43968
    P
    		Security update for transfig (Important)
    2021-10-06
    oval:org.opensuse.security:def:41824
    P
    		Security update for transfig (Important)
    2021-10-06
    oval:org.opensuse.security:def:45384
    P
    		Security update for transfig (Important)
    2021-10-06
    oval:org.opensuse.security:def:38332
    P
    		Security update for transfig (Important)
    2021-10-06
    oval:org.opensuse.security:def:106936
    P
    		transfig-3.2.8a-5.1 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:11136
    P
    		Security update for transfig (Moderate)
    2021-09-28
    oval:org.opensuse.security:def:111507
    P
    		Security update for transfig (Moderate)
    2021-09-28
    oval:org.opensuse.security:def:96428
    P
    		Security update for transfig (Moderate)
    2021-09-27
    oval:org.opensuse.security:def:109775
    P
    		Security update for transfig (Moderate)
    2021-09-27
    oval:org.opensuse.security:def:103118
    P
    		Security update for transfig (Moderate)
    2021-09-27
    oval:org.opensuse.security:def:11135
    P
    		Security update for transfig (Moderate)
    2021-09-27
    oval:org.opensuse.security:def:32182
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:84666
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:23668
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:57503
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:127168
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:34540
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:87468
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:30245
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:83332
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:59798
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:55948
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:89453
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:33004
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:85730
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:23971
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:58005
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:51656
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:88191
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:31266
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:83452
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:60363
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:56068
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:125604
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:33717
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:86144
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:29421
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:58827
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:88507
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:31680
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:84208
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:57089
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:126771
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:33975
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:86646
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:30125
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:82628
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:59540
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:55244
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:89195
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:111008
    P
    		Security update for transfig (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:70827
    P
    		Security update for transfig (Moderate)
    2021-07-22
    oval:org.opensuse.security:def:102324
    P
    		Security update for transfig (Moderate)
    2021-07-22
    oval:org.opensuse.security:def:119790
    P
    		Security update for transfig (Moderate)
    2021-07-22
    oval:org.opensuse.security:def:96312
    P
    		Security update for transfig (Moderate)
    2021-07-22
    oval:org.opensuse.security:def:109650
    P
    		Security update for transfig (Moderate)
    2021-07-22
    oval:org.opensuse.security:def:1772
    P
    		Security update for transfig (Moderate)
    2021-07-22
    oval:org.opensuse.security:def:10650
    P
    		Security update for transfig (Moderate)
    2021-07-22
    oval:org.opensuse.security:def:102984
    P
    		Security update for transfig (Moderate)
    2021-07-22
    oval:org.opensuse.security:def:10687
    P
    		Security update for transfig (Moderate)
    2021-07-22
    oval:org.opensuse.security:def:70790
    P
    		Security update for transfig (Moderate)
    2021-07-22
    oval:org.opensuse.security:def:111638
    P
    		Security update for transfig (Moderate)
    2021-07-22
    oval:com.ubuntu.disco:def:2019195550000000
    V
    		CVE-2019-19555 on Ubuntu 19.04 (disco) - negligible.
    2019-12-04
    oval:com.ubuntu.bionic:def:2019195550000000
    V
    		CVE-2019-19555 on Ubuntu 18.04 LTS (bionic) - negligible.
    2019-12-04
    oval:com.ubuntu.xenial:def:2019195550000000
    V
    		CVE-2019-19555 on Ubuntu 16.04 LTS (xenial) - negligible.
    2019-12-04
    BACK
    xfig_project xfig 3.2.7 b