CVE-2023-46045

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-46045
Graphviz 2.36.0 through 9.x before 10.0.1 has an out-of-bounds read via a crafted config6a file. NOTE: exploitability may be uncommon because this file is typically owned by root.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
http://seclists.org/fulldisclosure/2024/Feb/24
https://gitlab.com/graphviz/graphviz/-/issues/2441 Exploit Issue Tracking
https://seclists.org/fulldisclosure/2024/Feb/24
https://seclists.org/fulldisclosure/2024/Jan/73 Mailing List Third Party Advisory
https://www.openwall.com/lists/oss-security/2024/02/01/2 Mailing List
Configurations

Configuration 1 (hide)

cpe:2.3:a:graphviz:graphviz:*:*:*:*:*:*:*:*
History

21 Mar 2024, 02:49

Type Values Removed Values Added
References
  • () https://seclists.org/fulldisclosure/2024/Feb/24 -
Summary (en) Graphviz 2.36 before 10.0.0 has an out-of-bounds read via a crafted config6a file. NOTE: exploitability may be uncommon because this file is typically owned by root. (en) Graphviz 2.36.0 through 9.x before 10.0.1 has an out-of-bounds read via a crafted config6a file. NOTE: exploitability may be uncommon because this file is typically owned by root.

21 Feb 2024, 07:15

Type Values Removed Values Added
References
  • () http://seclists.org/fulldisclosure/2024/Feb/24 -

10 Feb 2024, 04:06

Type Values Removed Values Added
First Time Graphviz
Graphviz graphviz
CPE cpe:2.3:a:graphviz:graphviz:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
References () https://gitlab.com/graphviz/graphviz/-/issues/2441 - () https://gitlab.com/graphviz/graphviz/-/issues/2441 - Exploit, Issue Tracking
References () https://seclists.org/fulldisclosure/2024/Jan/73 - () https://seclists.org/fulldisclosure/2024/Jan/73 - Mailing List, Third Party Advisory
References () https://www.openwall.com/lists/oss-security/2024/02/01/2 - () https://www.openwall.com/lists/oss-security/2024/02/01/2 - Mailing List
CWE CWE-125

02 Feb 2024, 13:36

Type Values Removed Values Added
Summary
  • (es) Graphviz 2.36 anterior a 10.0.0 tiene una lectura fuera de los límites a través de un archivo config6a manipulado. NOTA: la explotabilidad puede ser poco común porque este archivo normalmente es propiedad del usuario root.

02 Feb 2024, 06:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-02 06:15

Updated : 2024-03-21 02:49

NVD link : CVE-2023-46045

Mitre link : CVE-2023-46045

CVE.ORG link : CVE-2023-46045

JSON object : View

Products Affected

graphviz

  • graphviz
CWE
CWE-125

Out-of-bounds Read