AOH :: HP Unsorted D :: B06-1307.HTM

Dia xfig import buffer overflow
Buffer overflows in Dia XFig import
Buffer overflows in Dia XFig import

A security review kindly performed by infamous41md has turned up three buffer overflow vulnerabilities in the XFig import plug-in in Dia, a diagramming tool for Gtk that runs on both Winddows and Unix.  While the XFig format is not the native format of Dia, a specially crafted XFig file could cause arbitrary code execution *if* loaded into Dia.

The vulnerabilities affect versions 0.87 through 0.94 as well as prereleases 1-5 of 0.95, after which it is fixed in the source and later prereleases. A patch against the 0.94 release has been attached to the announcement on the dia-list at 

-Lars Clausen
Head Dia maintainer

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH
We do not send spam. If you have received spam bearing an email address, please forward it with full headers to