NULL pointer dereference vulnerability in the rebuild_vlists function in lib/dotgen/conc.c in the dotgen library in Graphviz 2.40.1 allows remote attackers to cause a denial of service (application crash) via a crafted file.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade graphviz | May 14, 2021 | May 30, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade graphviz-tclUpgrade graphviz | Feb 22, 2021 | May 30, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade graphviz-tclUpgrade graphviz | Apr 30, 2021 | May 30, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade graphvizUpgrade graphviz-tcl | Nov 2, 2020 | May 30, 2018 |
| Suse | — | Upgrade graphviz-javaUpgrade graphviz-perlUpgrade graphviz-tclUpgrade graphvizUpgrade graphviz-smyrnaUpgrade graphviz-luaUpgrade graphviz-gveditUpgrade graphviz-rubyUpgrade graphviz-pythonUpgrade graphviz-develUpgrade graphviz-gnomeUpgrade graphviz-gdUpgrade libgraphviz6Upgrade graphviz-phpUpgrade graphviz-guileUpgrade graphviz-plugins-coreUpgrade graphviz-doc | Aug 31, 2020 | May 30, 2018 |
| Ubuntu | — | Upgrade libgvc6-plugins-gtk (Ubuntu Pro)Upgrade libxdot4 (Ubuntu Pro)Upgrade libcgraph6 (Ubuntu Pro)Upgrade libgvc6 (Ubuntu Pro)Upgrade libpathplan4 (Ubuntu Pro)Upgrade libcdt5 (Ubuntu Pro)Upgrade graphviz (Ubuntu Pro)Upgrade libgvpr2 (Ubuntu Pro) | Feb 4, 2022 | May 30, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub