Format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows remote attackers to have unspecified impact via format string specifiers in unknown vectors, which are not properly handled in an error string.
CVSS Details
- CVSS 3.1 Base Score: 7.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade graphviz | Jul 30, 2024 | Dec 3, 2014 |
| Huawei Euleros 2_0_sp2 | — | Upgrade graphviz-tclUpgrade graphviz | Dec 4, 2019 | Dec 3, 2014 |
| Huawei Euleros 2_0_sp3 | — | Upgrade graphviz-tclUpgrade graphviz | Dec 18, 2019 | Dec 3, 2014 |
| Oracle Solaris | — | Upgrade image/graphviz/graphviz-python-27 to version 2.28.0-0.175.3.22.0.2.0 on Solaris 11.3Upgrade image/graphviz/graphviz-sharp to version 2.28.0-0.175.3.22.0.2.0 on Solaris 11.3Upgrade image/graphviz/graphviz-perl-512 to version 2.28.0-0.175.3.22.0.2.0 on Solaris 11.3Upgrade image/graphviz/graphviz-java to version 2.28.0-0.175.3.22.0.2.0 on Solaris 11.3Upgrade image/graphviz/graphviz-ocaml to version 2.28.0-0.175.3.22.0.2.0 on Solaris 11.3Upgrade image/graphviz to version 2.28.0-0.175.3.22.0.2.0 on Solaris 11.3Upgrade image/graphviz/graphviz-php to version 2.28.0-0.175.3.22.0.2.0 on Solaris 11.3Upgrade image/graphviz/graphviz-ruby to version 2.28.0-0.175.3.22.0.2.0 on Solaris 11.3Upgrade image/graphviz/graphviz-tcl to version 2.28.0-0.175.3.22.0.2.0 on Solaris 11.3Upgrade image/graphviz/graphviz-lua to version 2.28.0-0.175.3.22.0.2.0 on Solaris 11.3 | Jul 19, 2017 | Dec 3, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Nov 25, 2014 |
| Suse | — | Upgrade graphviz-guileUpgrade graphviz-python-debuginfoUpgrade graphviz-gnome-debuginfoUpgrade graphviz-rubyUpgrade graphviz-javaUpgrade graphviz-smyrna-debugsourceUpgrade graphviz-gveditUpgrade graphviz-tcl-debuginfoUpgrade graphviz-java-debuginfoUpgrade graphviz-tclUpgrade graphviz-luaUpgrade graphviz-lua-debuginfoUpgrade graphviz-docUpgrade graphviz-debuginfoUpgrade graphviz-debugsourceUpgrade graphviz-ruby-debuginfoUpgrade graphviz-php-debuginfoUpgrade graphviz-smyrnaUpgrade graphvizUpgrade graphviz-gd-debuginfoUpgrade graphviz-phpUpgrade graphviz-guile-debuginfoUpgrade graphviz-gnomeUpgrade graphviz-perl-debuginfoUpgrade graphviz-gdUpgrade graphviz-pythonUpgrade graphviz-perlUpgrade graphviz-develUpgrade graphviz-gvedit-debugsourceUpgrade graphviz-gvedit-debuginfoUpgrade graphviz-plugins-debugsourceUpgrade graphviz-smyrna-debuginfo | Dec 6, 2017 | Dec 3, 2014 |
| Ubuntu | — | Upgrade graphviz | Nov 8, 2024 | Dec 3, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub