Graphviz 2.36.0 through 9.x before 10.0.1 has an out-of-bounds read via a crafted config6a file. NOTE: exploitability may be uncommon because this file is typically owned by root.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade graphviz | Mar 21, 2024 | Feb 2, 2024 |
| Amazon_linux_2023 | — | Upgrade graphvizUpgrade graphviz-tclUpgrade graphviz-gd-debuginfoUpgrade graphviz-graphsUpgrade graphviz-perl-debuginfoUpgrade graphviz-tcl-debuginfoUpgrade graphviz-java-debuginfoUpgrade graphviz-develUpgrade graphviz-ocaml-debuginfoUpgrade graphviz-debugsourceUpgrade graphviz-debuginfoUpgrade graphviz-ocamlUpgrade graphviz-lua-debuginfoUpgrade graphviz-gdUpgrade graphviz-docUpgrade graphviz-javaUpgrade graphviz-luaUpgrade graphviz-perl | Feb 17, 2025 | Feb 2, 2024 |
| Debian | — | Upgrade graphviz | May 15, 2025 | Feb 2, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade graphviz | May 13, 2024 | Feb 2, 2024 |
| Huawei Euleros 2_0_sp8 | — | Upgrade graphviz-tclUpgrade graphviz | Jul 23, 2024 | Feb 2, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade graphviz | Apr 9, 2024 | Feb 2, 2024 |
| Suse | — | Upgrade graphviz-javaUpgrade graphviz-tclUpgrade graphviz-rubyUpgrade graphvizUpgrade graphviz-smyrnaUpgrade graphviz-gveditUpgrade graphviz-phpUpgrade graphviz-perlUpgrade graphviz-gdUpgrade graphviz-guileUpgrade libgraphviz6Upgrade python3-gvUpgrade graphviz-plugins-coreUpgrade graphviz-x11Upgrade graphviz-docUpgrade graphviz-webpUpgrade graphviz-develUpgrade graphviz-luaUpgrade graphviz-gnome | Apr 22, 2024 | Feb 2, 2024 |
| Ubuntu | — | Upgrade graphviz (Ubuntu Pro) | Mar 25, 2024 | Feb 2, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub