# fig2dev 1:3.2.6a-6ubuntu1.1: fig2dev 1:3.2.6a-6ubuntu1.1 for Ubuntu 18.04.6 LTS (bionic)

fig2dev 1:3.2.6a-6ubuntu1.1, released September 20, 2021, fixes 14 CVEs in fig2dev. None of them is reported as exploited. Patch Radar priority: Routine. The product is no longer supported.

- Web page: https://patchblox.com/security/fix/linux/ubuntu-bionic-fig2dev-1-3.2.6a-6ubuntu1.1
- Platform: Linux
- Released: Sep 20, 2021
- Priority: Routine (Closes 14 CVEs, none high severity)
- CVEs: 14, exploited: 0, on CISA KEV: 0

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [fig2dev](https://patchblox.com/security/data/product/linux/fig2dev.md) | Ubuntu 18.04.6 LTS (bionic) | 1:3.2.6a-6ubuntu1.1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2019-14275](https://patchblox.com/security/data/cve/CVE-2019-14275.md) | Routine | fig2dev: Xfig fig2dev 3.2.7a has a stack-based buffer overflow in the calc_arrow function in bound.c. | n/a | 0.0124 |  |
| [CVE-2021-3561](https://patchblox.com/security/data/cve/CVE-2021-3561.md) | Routine | fig2dev: An Out of Bounds flaw was found fig2dev version 3.2.8a | n/a | 0.0118 |  |
| [CVE-2019-19797](https://patchblox.com/security/data/cve/CVE-2019-19797.md) | Routine | transfig: read_colordef in read.c in Xfig fig2dev 3.2.7b has an out-of-bounds write. | n/a | 0.0117 |  |
| [CVE-2020-21529](https://patchblox.com/security/data/cve/CVE-2020-21529.md) | Routine | fig2dev: fig2dev 3.2.7b contains a stack buffer overflow in the bezier_spline function in genepic.c. | n/a | 0.0109 |  |
| [CVE-2020-21532](https://patchblox.com/security/data/cve/CVE-2020-21532.md) | Routine | fig2dev: fig2dev 3.2.7b contains a global buffer overflow in the setfigfont function in genepic.c. | n/a | 0.0108 |  |
| [CVE-2020-21676](https://patchblox.com/security/data/cve/CVE-2020-21676.md) | Routine | fig2dev: A stack-based buffer overflow in the genpstrx_text() component in genpstricks.c of fig2dev 3.2.7b allows attackers to... | n/a | 0.0107 |  |
| [CVE-2019-19555](https://patchblox.com/security/data/cve/CVE-2019-19555.md) | Routine | fig2dev: read_textobject in read.c in Xfig fig2dev 3.2.7b has a stack-based buffer overflow because of an incorrect sscanf. | n/a | 0.0107 |  |
| [CVE-2020-21531](https://patchblox.com/security/data/cve/CVE-2020-21531.md) | Routine | transfig: fig2dev 3.2.7b contains a global buffer overflow in the conv_pattern_index function in gencgm.c. | n/a | 0.0106 |  |
| [CVE-2020-21675](https://patchblox.com/security/data/cve/CVE-2020-21675.md) | Routine | fig2dev: A stack-based buffer overflow in the genptk_text component in genptk.c of fig2dev 3.2.7b allows attackers to cause a... | n/a | 0.0106 |  |
| [CVE-2021-32280](https://patchblox.com/security/data/cve/CVE-2021-32280.md) | Routine | fig2dev: An issue was discovered in fig2dev before 3.2.8. | n/a | 0.0098 |  |
| [CVE-2020-21535](https://patchblox.com/security/data/cve/CVE-2020-21535.md) | Routine | fig2dev: fig2dev 3.2.7b contains a segmentation fault in the gencgm_start function in gencgm.c. | n/a | 0.0089 |  |
| [CVE-2020-21533](https://patchblox.com/security/data/cve/CVE-2020-21533.md) | Routine | fig2dev: fig2dev 3.2.7b contains a stack buffer overflow in the read_textobject function in read.c. | n/a | 0.0087 |  |
| [CVE-2020-21534](https://patchblox.com/security/data/cve/CVE-2020-21534.md) | Routine | fig2dev: fig2dev 3.2.7b contains a global buffer overflow in the get_line function in read.c. | n/a | 0.0087 |  |
| [CVE-2020-21530](https://patchblox.com/security/data/cve/CVE-2020-21530.md) | Routine | fig2dev: fig2dev 3.2.7b contains a segmentation fault in the read_objects function in read.c. | n/a | 0.0072 |  |

---

Data as of 2026-11-11T07:45:43Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.