[SECURITY] [DSA 3098-1] graphviz security update

ID DEBIAN:DSA-3098-1:4281F
Type debian
Reporter Debian
Modified 2014-12-11T16:26:06


Debian Security Advisory DSA-3098-1 security@debian.org http://www.debian.org/security/ Salvatore Bonaccorso December 11, 2014 http://www.debian.org/security/faq

Package : graphviz CVE ID : CVE-2014-9157 Debian Bug : 772648

Joshua Rogers discovered a format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz, a rich set of graph drawing tools. An attacker could use this flaw to cause graphviz to crash or possibly execute arbitrary code.

For the stable distribution (wheezy), this problem has been fixed in version 2.26.3-14+deb7u2.

For the upcoming stable distribution (jessie), this problem will be fixed soon in version 2.38.0-7.

For the unstable distribution (sid), this problem has been fixed in version 2.38.0-7.

We recommend that you upgrade your graphviz packages.

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org