Graphviz 2.36.0 through 9.x before 10.0.1 has an out-of-bounds read via a crafted config6a file. NOTE: exploitability may be uncommon because this file is typically owned by root.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade graphviz | Mar 21, 2024 | Feb 2, 2024 |
| Amazon_linux_2023 | — | Upgrade graphviz-graphsUpgrade graphviz-tclUpgrade graphviz-perl-debuginfoUpgrade graphviz-tcl-debuginfoUpgrade graphviz-debuginfoUpgrade graphviz-ocaml-debuginfoUpgrade graphviz-ocamlUpgrade graphviz-develUpgrade graphviz-gd-debuginfoUpgrade graphvizUpgrade graphviz-debugsourceUpgrade graphviz-java-debuginfoUpgrade graphviz-gdUpgrade graphviz-lua-debuginfoUpgrade graphviz-javaUpgrade graphviz-perlUpgrade graphviz-docUpgrade graphviz-lua | Feb 17, 2025 | Feb 2, 2024 |
| Debian | — | Upgrade graphviz | May 15, 2025 | Feb 2, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade graphviz | May 13, 2024 | Feb 2, 2024 |
| Huawei Euleros 2_0_sp8 | — | Upgrade graphvizUpgrade graphviz-tcl | Jul 23, 2024 | Feb 2, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade graphviz | Apr 9, 2024 | Feb 2, 2024 |
| Suse | — | Upgrade libgraphviz6Upgrade graphviz-webpUpgrade graphviz-plugins-coreUpgrade python3-gvUpgrade graphviz-docUpgrade graphviz-luaUpgrade graphviz-gnomeUpgrade graphviz-x11Upgrade graphviz-develUpgrade graphviz-guileUpgrade graphvizUpgrade graphviz-tclUpgrade graphviz-smyrnaUpgrade graphviz-gveditUpgrade graphviz-perlUpgrade graphviz-gdUpgrade graphviz-javaUpgrade graphviz-phpUpgrade graphviz-ruby | Apr 22, 2024 | Feb 2, 2024 |
| Ubuntu | — | Upgrade graphviz (Ubuntu Pro) | Mar 25, 2024 | Feb 2, 2024 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub