Most recent entries from all

ALSA-2026:0700 — Moderate: transfig security update

Affected: AlmaLinux:9: transfig

The transfig utility creates a makefile which translates FIG (created by xfig) or PIC figures into a specified LaTeX graphics language (for example, PostScript(TM)). Transfig is used to create TeX documents which are portable (i.e., they can be printed in a wide variety of environments). Install transfig if you need a utility for translating FIG or PIC figures into certain graphics languages.

Security Fix(es):

* xfig: xfig: Stack-overflow allows possible code execution via local input manipulation (CVE-2025-46397)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2025-11851

EUVD-2026-331264

fkie_cve-2025-46397

A flaw was found in xfig. This vulnerability allows possible code execution via local input manipulation via bezier_spline function.

GHSA-fqm9-qqwf-gq9r

Stack-overflow in fig2dev in version 3.2.9a allows an attacker possible code execution via local input manipulation via bezier_spline function.

OESA-2025-1509 — transfig security update

Affected: openEuler:24.03-LTS: transfig

In xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation at the bezier_spline function.(CVE-2025-46397)

In xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation via read_objects function.(CVE-2025-46398)

In xfig diagramming tool, a segmentation fault in fig2dev allows memory corruption via local input manipulation at genge_itp_spline function.(CVE-2025-46399)

In xfig diagramming tool, a segmentation fault while running fig2dev allows an attacker to availability via local input manipulation via read_arcobject function.(CVE-2025-46400)

openSUSE-SU-2025:15155-1 — transfig-3.2.9a-3.1 on GA media

transfig-3.2.9a-3.1 on GA media

RHSA-2026:0705 — Red Hat Security Advisory: transfig security update

xfig: xfig: Stack-overflow allows possible code execution via local input manipulation

SUSE-SU-2025:01835-1 — Security update for transfig

Security update for transfig

Withdrawn: UBUNTU-CVE-2025-46397

Withdrawn by the publisher.

Affected: Ubuntu:Pro:18.04:LTS: fig2dev, Ubuntu:20.04:LTS: fig2dev, Ubuntu:22.04:LTS: fig2dev, Ubuntu:24.10: fig2dev, Ubuntu:24.04:LTS: fig2dev, Ubuntu:25.04: fig2dev

Stack-overflow in fig2dev in version 3.2.9a allows an attacker possible code execution via local input manipulation via bezier_spline function.

WID-SEC-W-2026-0125 — Red Hat Enterprise Linux (transfig): Schwachstelle ermöglicht Codeausführung

Ein lokaler Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux im transfig Paket ausnutzen, um beliebigen Programmcode auszuführen.