CVE catalog

CVE-2020-21529

fig2dev: CVE-2020-21529

[CVE catalog]

Severity
Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.09% · Oct 25, 2026

fig2dev 3.2.7b contains a stack buffer overflow in the bezier_spline function in genepic.c.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianfig2devsid1:3.2.9a-5fixed
Debianfig2devforky1:3.2.9a-5fixed
Debianfig2devtrixie1:3.2.9a-4fixed
Debianfig2devbookworm1:3.2.8b-3+deb12u2fixed
Opensusetransfigtumbleweed3.2.8b-2.1fixed
Susetransfighpe helion openstack 83.2.8b-2.20.1fixed
Susetransfigopenstack cloud 83.2.8b-2.20.1fixed
Susetransfigopenstack cloud 93.2.8b-2.20.1fixed
Susetransfigopenstack cloud crowbar 83.2.8b-2.20.1fixed
Susetransfigopenstack cloud crowbar 93.2.8b-2.20.1fixed
Susetransfiglinux enterprise server for sap applications 12 sp33.2.8b-2.20.1fixed
Susetransfiglinux enterprise server for sap applications 12 sp43.2.8b-2.20.1fixed
Susetransfiglinux enterprise server 12 sp2-bcl3.2.8b-2.20.1fixed
Susetransfiglinux enterprise server 12 sp3-ltss3.2.8b-2.20.1fixed
Susetransfiglinux enterprise server 12 sp3-bcl3.2.8b-2.20.1fixed
Susetransfiglinux enterprise server 12 sp4-ltss3.2.8b-2.20.1fixed
Susetransfiglinux enterprise server 12 sp53.2.8b-2.20.1fixed
Susetransfiglinux enterprise server for sap applications 12 sp53.2.8b-2.20.1fixed
Susetransfiglinux enterprise point of sale 11 sp33.2.8b-160.16.2fixed
Susetransfiglinux enterprise server 11 sp4-ltss3.2.8b-160.16.2fixed
Ubuntutransfig16.041:3.2.5.e-4vulnerable
Ubuntutransfig16.041:3.2.5.e-5vulnerable
Ubuntutransfig16.041:3.2.5.e-5ubuntu0.1vulnerable
Ubuntufig2dev18.041:3.2.6a-3vulnerable
Ubuntufig2dev18.041:3.2.6a-4vulnerable
Ubuntufig2dev18.041:3.2.6a-4ubuntu1vulnerable
Ubuntufig2dev18.041:3.2.6a-6ubuntu1vulnerable
Ubuntufig2dev18.041:3.2.6a-6ubuntu1.1fixed
Ubuntufig2dev20.041:3.2.7a-7vulnerable
Ubuntufig2dev20.041:3.2.7a-7ubuntu0.1fixed
Susetransfigpackage hub 15 sp23.2.8b-bp152.3.6.2fixed
Opensusetransfigleap 15.23.2.8b-lp152.6.9.1fixed
Opensusetransfigleap 15.33.2.8b-4.15.1fixed
Susetransfigpackage hub 15 sp33.2.8b-bp153.3.6.3fixed
Opensusetransfigleap 15.33.2.8b-bp153.3.6.3fixed
Susetransfiglinux enterprise workstation extension 15 sp23.2.8b-4.15.1fixed
Susetransfiglinux enterprise workstation extension 15 sp33.2.8b-4.15.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianfig2devsourcesid1:3.2.8-1not yet assignedNot reportedNot reported
Debianfig2devsourceforky1:3.2.8-1not yet assignedNot reportedNot reported
Debianfig2devsourcetrixie1:3.2.8-1not yet assignedNot reportedNot reported
Debianfig2devsourcebookworm1:3.2.8-1not yet assignedNot reportedNot reported
Opensusetransfigrpmtumbleweed3.2.8b-2.1Not reportedOPENSUSE-SU-2024:11595-1Not reported
Susetransfigrpmhpe helion openstack 83.2.8b-2.20.1Not reportedSUSE-SU-2021:3585-1Not reported
Susetransfigrpmopenstack cloud 83.2.8b-2.20.1Not reportedSUSE-SU-2021:3585-1Not reported
Susetransfigrpmopenstack cloud 93.2.8b-2.20.1Not reportedSUSE-SU-2021:3585-1Not reported
Susetransfigrpmopenstack cloud crowbar 83.2.8b-2.20.1Not reportedSUSE-SU-2021:3585-1Not reported
Susetransfigrpmopenstack cloud crowbar 93.2.8b-2.20.1Not reportedSUSE-SU-2021:3585-1Not reported
Susetransfigrpmlinux enterprise server for sap applications 12 sp33.2.8b-2.20.1Not reportedSUSE-SU-2021:3585-1Not reported
Susetransfigrpmlinux enterprise server for sap applications 12 sp43.2.8b-2.20.1Not reportedSUSE-SU-2021:3585-1Not reported
Susetransfigrpmlinux enterprise server 12 sp2-bcl3.2.8b-2.20.1Not reportedSUSE-SU-2021:3585-1Not reported
Susetransfigrpmlinux enterprise server 12 sp3-ltss3.2.8b-2.20.1Not reportedSUSE-SU-2021:3585-1Not reported
Susetransfigrpmlinux enterprise server 12 sp3-bcl3.2.8b-2.20.1Not reportedSUSE-SU-2021:3585-1Not reported
Susetransfigrpmlinux enterprise server 12 sp4-ltss3.2.8b-2.20.1Not reportedSUSE-SU-2021:3585-1Not reported
Susetransfigrpmlinux enterprise server 12 sp53.2.8b-2.20.1Not reportedSUSE-SU-2021:3585-1Not reported
Susetransfigrpmlinux enterprise server for sap applications 12 sp53.2.8b-2.20.1Not reportedSUSE-SU-2021:3585-1Not reported
Susetransfigrpmlinux enterprise point of sale 11 sp33.2.8b-160.16.2Not reportedSUSE-SU-2021:14836-1Not reported
Susetransfigrpmlinux enterprise server 11 sp4-ltss3.2.8b-160.16.2Not reportedSUSE-SU-2021:14836-1Not reported
Ubuntufig2devdeb18.041:3.2.6a-6ubuntu1.1Not reportedUBUNTU-CVE-2020-21529Not reported
Ubuntufig2devdeb20.041:3.2.7a-7ubuntu0.1Not reportedUBUNTU-CVE-2020-21529Not reported
Susetransfigrpmpackage hub 15 sp23.2.8b-bp152.3.6.2Not reportedOPENSUSE-SU-2021:1458-1Not reported
Opensusetransfigrpmleap 15.23.2.8b-lp152.6.9.1Not reportedOPENSUSE-SU-2021:1439-1Not reported
Opensusetransfigrpmleap 15.33.2.8b-4.15.1Not reportedOPENSUSE-SU-2021:3584-1Not reported
Susetransfigrpmpackage hub 15 sp33.2.8b-bp153.3.6.3Not reportedOPENSUSE-SU-2021:1481-1Not reported
Opensusetransfigrpmleap 15.33.2.8b-bp153.3.6.3Not reportedOPENSUSE-SU-2021:1481-1Not reported
Susetransfigrpmlinux enterprise workstation extension 15 sp23.2.8b-4.15.1Not reportedSUSE-SU-2021:3584-1Not reported
Susetransfigrpmlinux enterprise workstation extension 15 sp33.2.8b-4.15.1Not reportedSUSE-SU-2021:3584-1Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [fig2dev]Fixed
    Details (2)

    • 1:3.2.8b-3+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 1:3.2.8-1

      dsa · fig2dev · debian · bookworm; dsa · fig2dev · debian · 12

    • 1:3.2.8b-3+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 1:3.2.8-1

      dsa · fig2dev · debian · bookworm; dsa · fig2dev · debian · 12

[Debian 13 (Trixie)]

  • [fig2dev]Fixed
    Details (2)

    • 1:3.2.9a-4 · amd64 · trixie

      Fixed · Fixed: 1:3.2.8-1

      dsa · fig2dev · debian · 13

    • 1:3.2.9a-4 · arm64 · trixie

      Fixed · Fixed: 1:3.2.8-1

      dsa · fig2dev · debian · 13

[openSUSE Tumbleweed]

  • [transfig]Fixed

    Source package: [transfig]

    Details (1)

    • 3.2.9a-3.6 · x86_64 · tumbleweed

      Fixed · Fixed: 3.2.8b-2.1

      dsa · transfig · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]