Stack-based buffer overflow in the yyerror function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impact via a long line in a dot file.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade graphviz | Aug 30, 2017 | Jan 10, 2014 |
| Debian | — | Upgrade graphviz | Jul 30, 2024 | Jan 10, 2014 |
| Gentoo Linux | — | Upgrade media-gfx/graphviz. | Oct 30, 2017 | Jan 10, 2014 |
| Oracle Solaris | — | Upgrade image/graphviz/graphviz-java to version 2.28.0-0.175.3.22.0.2.0 on Solaris 11.3Upgrade image/graphviz/graphviz-python-27 to version 2.28.0-0.175.3.22.0.2.0 on Solaris 11.3Upgrade image/graphviz/graphviz-ocaml to version 2.28.0-0.175.3.22.0.2.0 on Solaris 11.3Upgrade image/graphviz/graphviz-php to version 2.28.0-0.175.3.22.0.2.0 on Solaris 11.3Upgrade image/graphviz to version 2.28.0-0.175.3.22.0.2.0 on Solaris 11.3Upgrade image/graphviz/graphviz-perl-512 to version 2.28.0-0.175.3.22.0.2.0 on Solaris 11.3Upgrade image/graphviz/graphviz-sharp to version 2.28.0-0.175.3.22.0.2.0 on Solaris 11.3Upgrade image/graphviz/graphviz-tcl to version 2.28.0-0.175.3.22.0.2.0 on Solaris 11.3Upgrade image/graphviz/graphviz-lua to version 2.28.0-0.175.3.22.0.2.0 on Solaris 11.3Upgrade image/graphviz/graphviz-ruby to version 2.28.0-0.175.3.22.0.2.0 on Solaris 11.3 | Jul 19, 2017 | Jan 10, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jan 6, 2014 |
| Ubuntu | — | Upgrade graphviz | Nov 8, 2024 | Jan 10, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub