CVE-2025-31163
📋 TL;DR
A segmentation fault vulnerability in fig2dev version 3.2.9a allows attackers to cause denial of service through local input manipulation via the put_patternarc function. This affects systems running vulnerable versions of fig2dev, particularly those processing untrusted FIG files. The vulnerability is triggered through local input manipulation.
💻 Affected Systems
- fig2dev
📦 What is this software?
Fig2dev by Fig2dev Project
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service causing fig2dev to crash, potentially disrupting workflows that rely on FIG file conversion.
Likely Case
Application crash when processing malicious FIG files, requiring manual restart of affected processes.
If Mitigated
Minimal impact with proper input validation and sandboxing of fig2dev processes.
🎯 Exploit Status
Exploitation requires local access to create/manipulate FIG files and execute fig2dev.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check upstream repository for patched version
Vendor Advisory: https://sourceforge.net/p/mcj/tickets/186/
Restart Required: No
Instructions:
1. Check current fig2dev version with 'fig2dev -v'
2. Update through package manager: 'sudo apt update && sudo apt upgrade fig2dev' (Debian/Ubuntu)
3. For source installs: download latest version from upstream repository and recompile
🔧 Temporary Workarounds
Restrict file processing
linuxLimit fig2dev to process only trusted FIG files from known sources
chmod 750 /usr/bin/fig2dev
setfacl -m u:trusteduser:rx /usr/bin/fig2dev
Input validation wrapper
linuxCreate a wrapper script that validates FIG files before passing to fig2dev
#!/bin/bash
# Validate FIG file before processing
if [[ "$1" =~ \.fig$ ]] && file "$1" | grep -q "FIG"; then
/usr/bin/fig2dev "$@"
else
echo "Invalid or suspicious FIG file"
exit 1
fi
🧯 If You Can't Patch
- Remove fig2dev from systems where it's not essential
- Run fig2dev in a containerized/sandboxed environment with resource limits
🔍 How to Verify
Check if Vulnerable:
Check fig2dev version: 'fig2dev -v' and verify if it's 3.2.9aCheck Version:
fig2dev -v 2>&1 | head -1Verify Fix Applied:
After update, confirm version changed from 3.2.9a and test with known safe FIG files📡 Detection & Monitoring
Log Indicators:
- Segmentation fault errors in system logs
- fig2dev process crashes
- Core dumps in /var/crash/
Network Indicators:
- None - local vulnerability only
SIEM Query:
process.name:"fig2dev" AND event.action:"segmentation_fault" OR event.action:"crash"