An updated Dia package that fixes several buffer overflow bugs are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Dia drawing program is designed to draw various types of diagrams.

infamous41md discovered three buffer overflow bugs in Dia's xfig file format importer. If an attacker is able to trick a Dia user into opening a carefully crafted xfig file, it may be possible to execute arbitrary code as the user running Dia. (CVE-2006-1550)

Users of Dia should update to these erratum packages, which contain backported patches and are not vulnerable to these issues.

この更新では、CVE-2006-1550、CVE-2006-2453、CVE-2006-2480 が修正されます。

注意：Tenable Network Security は、前述の記述ブロックを Fedora セキュリティアドバイザリから直接抽出しています。Tenable では、できる限り新たな問題を持ち込まないように、自動的に整理して書式設定するようにしています。

此更新修复了 CVE-2006-1550、CVE-2006-2453、CVE-2006-2480

请注意，Tenable Network Security 已直接从 Fedora 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

Fixes CVE-2006-1550 Dia multiple buffer overflows

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200604-14 (Dia: Arbitrary code execution through XFig import)

    infamous41md discovered multiple buffer overflows in Dia's XFig     file import plugin.
  Impact :

    By enticing a user to import a specially crafted XFig file into     Dia, an attacker could exploit this issue to execute arbitrary code     with the rights of the user running Dia.
  Workaround :

    There is no known workaround at this time.

此更新可修正 CVE-2006-1550、CVE-2006-2453、CVE-2006-2480

請注意，Tenable Network Security 已直接從 Fedora 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

This update fixes CVE-2006-1550, CVE-2006-2453, CVE-2006-2480

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

'infamous41md' discovered three buffer overflow errors in the xfig import code of dia, a diagram editor, that can lead to the execution of arbitrary code.

Secunia reports :

Some vulnerabilities have been reported in Dia, which potentially can be exploited by malicious people to compromise a user's system.

The vulnerabilities are caused due to boundary errors within the XFig import plugin. This can be exploited to cause buffer overflows and may allow arbitrary code execution when a specially crafted FIG file is imported.

Three buffer overflows were discovered by infamous41md in dia's xfig import code. This could allow for user-complicit attackers to have an unknown impact via a crafted xfig file, possibly involving an invalid color index, number of points, or depth.

Updated packages have been patched to correct this issue.

Three buffer overflows were discovered in the Xfig file format importer. By tricking a user into opening a specially crafted .fig file with dia, an attacker could exploit this to execute arbitrary code with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
21362	RHEL 2.1 / 4 : dia (RHSA-2006:0280)	Nessus	Red Hat Local Security Checks	2006/5/13	2021/1/14	high
62280	Fedora Extras 5：dia-0.95-3	Nessus	Fedora Local Security Checks	2012/9/24	2021/1/11	high
62280	Fedora Extras 5：dia-0.95-3	Nessus	Fedora Local Security Checks	2012/9/24	2021/1/11	high
21192	Fedora Core 4 : dia-0.94-13.fc4 (2006-261)	Nessus	Fedora Local Security Checks	2006/4/8	2021/1/11	high
21279	GLSA-200604-14 : Dia: Arbitrary code execution through XFig import	Nessus	Gentoo Local Security Checks	2006/4/26	2021/1/6	high
62280	Fedora Extras 5 : dia-0.95-3	Nessus	Fedora Local Security Checks	2012/9/24	2021/1/11	high
62280	Fedora Extras 5 : dia-0.95-3	Nessus	Fedora Local Security Checks	2012/9/24	2021/1/11	high
22567	Debian DSA-1025-1 : dia - programming error	Nessus	Debian Local Security Checks	2006/10/14	2021/1/4	high
21498	FreeBSD : dia -- XFig Import Plugin Buffer Overflow (b5fc63ad-c4c3-11da-9699-00123ffe8333)	Nessus	FreeBSD Local Security Checks	2006/5/13	2021/1/6	high
21177	Mandrake Linux Security Advisory : dia (MDKSA-2006:062)	Nessus	Mandriva Local Security Checks	2006/4/4	2021/1/6	high
21183	Ubuntu 4.10 / 5.04 / 5.10 : dia vulnerabilities (USN-266-1)	Nessus	Ubuntu Local Security Checks	2006/4/4	2021/1/19	high
21991	CentOS 4 : dia (CESA-2006:0280)	Nessus	CentOS Local Security Checks	2006/7/5	2021/1/4	high

検出

プラグインの検索

high

high

high

high

high

high

high

high

high

high

high

high