{"id":"CVE-2025-46397","state":"PUBLISHED","title":"Xfig: xfig: stack-overflow allows possible code execution via local input manipulation","description":"A flaw was found in xfig. This vulnerability allows possible code execution via local input manipulation via bezier_spline function.","publishedAt":"2025-04-23T20:55:09.795Z","updatedAt":"2026-06-30T03:06:34.628Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"redhat"},"assigner":"redhat","products":["xfig","Red Hat Red Hat Enterprise Linux 8","Red Hat Red Hat Enterprise Linux 9","Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support","Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support","Red Hat Red Hat Enterprise Linux 6","Red Hat Red Hat Enterprise Linux 7"],"affected":[{"packageName":"xfig","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.2.9a","versionType":"semver"}],"collectionURL":"https://sourceforge.net/projects/mcj/"},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"transfig","defaultStatus":"affected","versions":[{"version":"1:3.2.6a-5.el8_10","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::crb"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"transfig","defaultStatus":"affected","versions":[{"version":"1:3.2.7b-11.el9_7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::crb"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.4 Extended Update Support","packageName":"transfig","defaultStatus":"affected","versions":[{"version":"1:3.2.7b-10.el9_4.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.4::crb"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","packageName":"transfig","defaultStatus":"affected","versions":[{"version":"1:3.2.7b-10.el9_6.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6::crb"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"transfig","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"transfig","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]}],"references":["https://access.redhat.com/errata/RHSA-2026:0700","https://access.redhat.com/errata/RHSA-2026:0704","https://access.redhat.com/errata/RHSA-2026:0705","https://access.redhat.com/errata/RHSA-2026:0756","https://access.redhat.com/security/cve/CVE-2025-46397","https://bugzilla.redhat.com/show_bug.cgi?id=2362058","https://sourceforge.net/p/mcj/tickets/192/","https://lists.debian.org/debian-lts-announce/2025/04/msg00043.html"],"weaknesses":["CWE-120"],"ingestedAt":"2026-10-29T20:09:17.366Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/46xxx/CVE-2025-46397.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-46397","state":"PUBLISHED","datePublished":"2025-04-23T20:55:09.795Z","dateUpdated":"2026-06-30T03:06:34.628Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2025-04-23T20:32:36.306Z"},"containers":{"cna":{"title":"Xfig: xfig: stack-overflow allows possible code execution via local input manipulation","descriptions":[{"lang":"en","value":"A flaw was found in xfig. This vulnerability allows possible code execution via local input manipulation via bezier_spline function."}],"affected":[{"packageName":"xfig","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.2.9a","versionType":"semver"}],"collectionURL":"https://sourceforge.net/projects/mcj/"},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"transfig","defaultStatus":"affected","versions":[{"version":"1:3.2.6a-5.el8_10","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::crb"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"transfig","defaultStatus":"affected","versions":[{"version":"1:3.2.7b-11.el9_7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::crb"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.4 Extended Update Support","packageName":"transfig","defaultStatus":"affected","versions":[{"version":"1:3.2.7b-10.el9_4.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.4::crb"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","packageName":"transfig","defaultStatus":"affected","versions":[{"version":"1:3.2.7b-10.el9_6.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6::crb"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"transfig","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"transfig","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:0700","name":"RHSA-2026:0700","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:0704","name":"RHSA-2026:0704","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:0705","name":"RHSA-2026:0705","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:0756","name":"RHSA-2026:0756","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-46397","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2362058","name":"RHBZ#2362058","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://sourceforge.net/p/mcj/tickets/192/"}],"metrics":[{"other":{"content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-120","description":"Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-06-30T03:06:34.628Z"},"datePublic":"2025-04-23T20:55:09.795Z","x_redhatCweChain":"CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')","timeline":[{"lang":"en","time":"2025-04-24T14:00:57.583Z","value":"Reported to Red Hat."},{"lang":"en","time":"2025-04-23T20:55:09.795Z","value":"Made public."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-05-23T18:27:20.844727Z","id":"CVE-2025-46397","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-05-23T18:27:45.302Z"}},{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00043.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T20:04:27.187Z"}}]}}}