View at Official ubuntu advisory, NVD, CVE.org · CVE detail
Freshness: upstream tracker timestamp is available; use API updated time as primary recency signal.
CVE-2017-16899 low priority: Ubuntu including 2 source packages (fig2dev, transfig), 14 status rows across 7 suites (artful, bionic, cosmic, trusty, upstream, xenial, zesty): DNE 7, not-affected 3, ignored 2, needs-triage 1, released 1.
An array index error in the fig2dev program in Xfig 3.2.6a allows remote attackers to cause a denial-of-service attack or information disclosure with a maliciously crafted Fig format file, related to a negative font value in dev/gentikz.c, and the read_textobject functions in read.c and read1_3.c.