SUSE has issued an advisory on April 10: https://lwn.net/Articles/969307/ According to https://security-tracker.debian.org/tracker/CVE-2023-45920, the problem is fix in 3.2.9 or with: https://sourceforge.net/p/mcj/xfig/ci/ec49cde00dbd6f7f45d8e386795079d5d636496f/ Mageia 9 is also affected.
Source RPM: (none) => xfig-3.2.8b-3.mga9.src.rpmCVE: (none) => CVE-2023-45920Whiteboard: (none) => MGA9TOOStatus comment: (none) => Fixed upstream in 3.2.9 and patch available from upstream
The URL for xfig should be https://mcj.sourceforge.net/, but https://www.xfig.org/ gets you there. It announces xfig.3.2.9 Aug 2023, but makes no mention of this CVE error in 'bugs fixed'; but the Debian tracker page does say "1:3.2.9-2 fixed". The patch (thanks for finding it) is straightforward. Different packagers commit xfig, so assigning this globally.
Assignee: bugsquad => pkg-bugs
Suggested advisory: ======================== The updated package fixes a security vulnerability: Xfig v3.2.8 was discovered to contain a NULL pointer dereference when calling XGetWMHints(). (CVE-2023-45920) References: https://lwn.net/Articles/969307/ ======================== Updated package in core/updates_testing: ======================== xfig-3.2.8b-3.1.mga9 from SRPM: xfig-3.2.8b-3.1.mga9.src.rpm
Assignee: pkg-bugs => qa-bugsStatus comment: Fixed upstream in 3.2.9 and patch available from upstream => (none)Status: NEW => ASSIGNEDWhiteboard: MGA9TOO => (none)Version: Cauldron => 9
Keywords: (none) => advisory
MGA9-64 Plasma Wayland on HP-Pavillion. No installation issues. Ref bug 31650 Comment 4: Opened xfig, draw some shapes, rotated anf flipped some objects, saved the file and re-opened it. All my scriblings were there. Tried this time krita to open this file, but no go. Good enough to let go.
Whiteboard: (none) => MGA9-64-OKCC: (none) => herman.viaene
Validating.
CC: (none) => andrewsfarm, sysadmin-bugsKeywords: (none) => validated_update
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2024-0125.html
Resolution: (none) => FIXEDStatus: ASSIGNED => RESOLVED