Robin Larsson

**Name of the Vulnerable Software and Affected Versions** Dia versions prior to 0.98.1 **Description** A stack-based buffer overflow occurs when processing Network Bus objects from XML project files. The `bus load()` function reads the `bus handles` attribute using `attribute num data()` without validating an upper bound. When a bus handle is moved, the `bus handle moved()` function uses `g alloca()` to allocate two temporary arrays on the stack based on the `num handles` variable. An attacker can provide an excessively large value for `num handles` in a malicious .dia file, causing the application to exceed the thread stack limit, leading to a SIGSEGV (segmentation fault) and potential corruption of the stack frame or return address. This same pattern is also present in `objects/Misc/tree.c` and may affect Tree objects. Exploitation occurs when a user opens a malicious file and manipulates a bus handle. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dia (affected versions not specified) **Description** A heap-based buffer overflow exists in the WPG file format importer. The issue occurs in the WPG import renderer within the `plug-ins/wpg/wpg-import.c` component. When processing a WPG COLORMAP record, the parser fails to validate that the start index `i16` and the number of colors `iNum16` do not exceed the fixed palette capacity of 256 entries. A specially crafted WPG file can trigger an overflow by providing values that cause `fread()` to write beyond the allocated buffer, potentially leading to application crashes or arbitrary code execution. **Recommendations** Restrict the use of untrusted WPG files. At the moment, there is no information about a newer version that contains a fix for this vulnerability.