CVE-2021-3561 Memory corruption in fig2dev
A crafted input can trigger an out-of-bounds write in fig2dev, leading to application crashes or potential memory corruption.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-3561?
CVE-2021-3561 is a high-severity memory corruption vulnerability in Debian Debian Linux, published on 26 May 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
An Out of Bounds flaw was found fig2dev version 3.2.8a. A flawed bounds check in read_objects() could allow an attacker to provide a crafted malicious input causing the application to either crash or in some cases cause memory corruption. The highest threat from this vulnerability is to integrity as well as system availability.
Which versions are affected by CVE-2021-3561?
It affects 3 products.
Products include Debian Debian Linux, Fedoraproject Fedora, Fig2dev Project Fig2dev.
How do I fix CVE-2021-3561?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2021-3561 being exploited?
There is no known exploitation of CVE-2021-3561 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2021-3561, GHSA-w359-m9m3-v2w3, MGASA-2021-0379, UBUNTU-CVE-2021-3561.