CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-46045 – graphviz 2.43.0 Buffer Overflow / Code Execution
https://notcve.org/view.php?id=CVE-2023-46045
29 Jan 2024 — Graphviz 2.36.0 through 9.x before 10.0.1 has an out-of-bounds read via a crafted config6a file. NOTE: exploitability may be uncommon because this file is typically owned by root. Graphviz 2.36 anterior a 10.0.0 tiene una lectura fuera de los límites a través de un archivo config6a manipulado. NOTA: la explotabilidad puede ser poco común porque este archivo normalmente es propiedad del usuario root. graphviz version 2.43.0 has been reported as having a buffer overflow vulnerability. Some debate regarding th... • http://seclists.org/fulldisclosure/2024/Feb/24 • CWE-125: Out-of-bounds Read •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 1CVE-2020-18032 – graphviz: off-by-one in parse_reclbl() in lib/common/shapes.c
https://notcve.org/view.php?id=CVE-2020-18032
29 Apr 2021 — Buffer Overflow in Graphviz Graph Visualization Tools from commit ID f8b9e035 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by loading a crafted file into the "lib/common/shapes.c" component. Un Desbordamiento de Búfer en Graphviz Graph Visualization Tools desde el ID del commit f8b9e035 y versiones anteriores, permite a atacantes remotos ejecutar código arbitrario o provocar una denegación de servicio (bloqueo de la aplicación) al cargar un a... • https://gitlab.com/graphviz/graphviz/-/issues/1700 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-193: Off-by-one Error •
CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 2CVE-2019-11023 – Ubuntu Security Notice USN-5971-1
https://notcve.org/view.php?id=CVE-2019-11023
08 Apr 2019 — The agroot() function in cgraph\obj.c in libcgraph.a in Graphviz 2.39.20160612.1140 has a NULL pointer dereference, as demonstrated by graphml2gv. La función agroot() en cgraph\obj.c en libcgraph.a en Graphviz versión 2.39.20160612.1140 tiene una desreferencia de puntero NULL, como lo demuestra graphml2gv. It was discovered that graphviz contains null pointer dereference vulnerabilities. Exploitation via a specially crafted input file can cause a denial of service. This issue only affected Ubuntu 18.04 LTS.... • http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00054.html • CWE-476: NULL Pointer Dereference •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 2CVE-2019-9904 – Gentoo Linux Security Advisory 202107-04
https://notcve.org/view.php?id=CVE-2019-9904
21 Mar 2019 — An issue was discovered in lib\cdt\dttree.c in libcdt.a in graphviz 2.40.1. Stack consumption occurs because of recursive agclose calls in lib\cgraph\graph.c in libcgraph.a, related to agfstsubg in lib\cgraph\subg.c. Se ha descubierto un problema en lib\cdt\dttree.c en libcdt.a en graphviz 2.40.1. Ocurre un consumo de pila debido a llamadas recursivas agclose en lib\cgraph\graph.c en libcgraph.a, relacionado con agfstsubg en lib\cgraph\subg.c. Multiple vulnerabilities have been found in Graphviz, the worst ... • https://gitlab.com/graphviz/graphviz/issues/1512 • CWE-674: Uncontrolled Recursion •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2018-10196 – Ubuntu Security Notice USN-5971-1
https://notcve.org/view.php?id=CVE-2018-10196
30 May 2018 — NULL pointer dereference vulnerability in the rebuild_vlists function in lib/dotgen/conc.c in the dotgen library in Graphviz 2.40.1 allows remote attackers to cause a denial of service (application crash) via a crafted file. Vulnerabilidad de desreferencia de puntero NULL en la función ebuild_vlists en lib/dotgen/conc.c en la biblioteca dotgen en Graphviz 2.40.1 permite que atacantes remotos provoquen una denegación de servicio (cierre inesperado de la aplicación) mediante un archivo manipulado. It was disc... • https://bugzilla.redhat.com/show_bug.cgi?id=1579254 • CWE-476: NULL Pointer Dereference •
CVSS: 9.8EPSS: 1%CPEs: 3EXPL: 3CVE-2014-9157 – Debian Security Advisory 3098-1
https://notcve.org/view.php?id=CVE-2014-9157
03 Dec 2014 — Format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows remote attackers to have unspecified impact via format string specifiers in unknown vectors, which are not properly handled in an error string. Vulnerabilidad de formato de cadena en la función yyerror en ib/cgraph/scan.l en Graphviz permite a atacantes remotos tener un impacto no especificado a través de especificadores de formatos de cadena en vectores desconocidos, que no están manejados correctamente en una caden... • http://advisories.mageia.org/MGASA-2014-0520.html • CWE-134: Use of Externally-Controlled Format String •
CVSS: 7.8EPSS: 1%CPEs: 1EXPL: 0CVE-2014-1235 – Ubuntu Security Notice USN-2083-1
https://notcve.org/view.php?id=CVE-2014-1235
16 Jan 2014 — Stack-based buffer overflow in the "yyerror" function in Graphviz 2.34.0 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted file. NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-0978. Un desbordamiento de búfer basado en pila en la función "yyerror" de Graphviz 2.34.0 permite que atacantes remotos ejecuten código arbitrario o provoquen una denegación de servicio mediante un archivo manipulado. It was discovered that Graphviz... • http://seclists.org/oss-sec/2014/q1/54 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 9%CPEs: 1EXPL: 1CVE-2014-0978 – Ubuntu Security Notice USN-2083-1
https://notcve.org/view.php?id=CVE-2014-0978
10 Jan 2014 — Stack-based buffer overflow in the yyerror function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impact via a long line in a dot file. Desbordamientos de pila en la función yyerror de lib/cgraph/scan.l en Graphviz 2.34.0 permite a atacantes remotos tener un impacto no especificado a través de una línea larga en un archivo dot. Multiple buffer overflow vulnerabilities in graphviz due to an error within the yyerror() function (lib/cgraph/scan.l) which can be exploited to... • http://seclists.org/oss-sec/2014/q1/28 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 9%CPEs: 1EXPL: 1CVE-2014-1236 – Ubuntu Security Notice USN-2083-1
https://notcve.org/view.php?id=CVE-2014-1236
10 Jan 2014 — Stack-based buffer overflow in the chkNum function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impact via vectors related to a "badly formed number" and a "long digit list." Desbordamiento de pila en la función chkNum de lib/cgraph/scan.l en Graphviz 2.34.0 permite a atacantes remotos tener un impacto no especificado a través de vectores relacionados con un "badly formed number" y "long digit list". Multiple buffer overflow vulnerabilities in graphviz due to an error ... • http://osvdb.org/101851 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.8EPSS: 6%CPEs: 40EXPL: 1CVE-2008-4555
https://notcve.org/view.php?id=CVE-2008-4555
14 Oct 2008 — Stack-based buffer overflow in the push_subg function in parser.y (lib/graph/parser.c) in Graphviz 2.20.2, and possibly earlier versions, allows user-assisted remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a DOT file with a large number of Agraph_t elements. Desbordamiento de búfer en la función push_subg de parser.y (lib/graph/parser.c) en Graphviz 2.20.2 y posiblemente versiones anteriores, permite a atacantes remotos ayudados por el usuario provocar una de... • http://bugs.gentoo.org/show_bug.cgi?id=240636 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •