Vulnerabilities (CVE)

Filtered by vendor Graphviz Subscribe
Total 10 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2020-18032 3 Debian, Fedoraproject, Graphviz 3 Debian Linux, Fedora, Graphviz 2021-05-28 6.8 MEDIUM 7.8 HIGH
Buffer Overflow in Graphviz Graph Visualization Tools from commit ID f8b9e035 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by loading a crafted file into the "lib/common/shapes.c" component.
CVE-2018-10196 3 Canonical, Fedoraproject, Graphviz 3 Ubuntu Linux, Fedora, Graphviz 2021-05-13 4.3 MEDIUM 5.5 MEDIUM
NULL pointer dereference vulnerability in the rebuild_vlists function in lib/dotgen/conc.c in the dotgen library in Graphviz 2.40.1 allows remote attackers to cause a denial of service (application crash) via a crafted file.
CVE-2019-9904 1 Graphviz 1 Graphviz 2020-08-24 4.3 MEDIUM 6.5 MEDIUM
An issue was discovered in lib\cdt\dttree.c in libcdt.a in graphviz 2.40.1. Stack consumption occurs because of recursive agclose calls in lib\cgraph\graph.c in libcgraph.a, related to agfstsubg in lib\cgraph\subg.c.
CVE-2019-11023 1 Graphviz 1 Graphviz 2020-06-30 6.8 MEDIUM 8.8 HIGH
The agroot() function in cgraph\obj.c in libcgraph.a in Graphviz 2.39.20160612.1140 has a NULL pointer dereference, as demonstrated by graphml2gv.
CVE-2008-4555 1 Graphviz 1 Graphviz 2018-10-11 8.5 HIGH N/A
Stack-based buffer overflow in the push_subg function in parser.y (lib/graph/parser.c) in Graphviz 2.20.2, and possibly earlier versions, allows user-assisted remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a DOT file with a large number of Agraph_t elements.
CVE-2005-4803 1 Graphviz 1 Graphviz 2018-10-03 3.6 LOW N/A
graphviz before 2.2.1 allows local users to overwrite arbitrary files via a symlink attack on temporary files. NOTE: this issue was originally associated with a different CVE identifier, CVE-2005-2965, which had been used for multiple different issues. This is the correct identifier.
CVE-2014-9157 2 Debian, Graphviz 2 Debian Linux, Graphviz 2017-09-08 7.5 HIGH N/A
Format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows remote attackers to have unspecified impact via format string specifiers in unknown vectors, which are not properly handled in an error string.
CVE-2014-1235 1 Graphviz 1 Graphviz 2017-08-29 6.8 MEDIUM 7.8 HIGH
Stack-based buffer overflow in the "yyerror" function in Graphviz 2.34.0 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted file. NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-0978.
CVE-2014-0978 1 Graphviz 1 Graphviz 2017-08-29 9.3 HIGH N/A
Stack-based buffer overflow in the yyerror function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impact via a long line in a dot file.
CVE-2014-1236 1 Graphviz 1 Graphviz 2017-07-01 10.0 HIGH N/A
Stack-based buffer overflow in the chkNum function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impact via vectors related to a "badly formed number" and a "long digit list."