Lucene search

DebianDEBIAN:DSA-4914-1:43E47

HistoryMay 12, 2021 - 8:31 p.m.

[SECURITY] [DSA 4914-1] graphviz security update

2021-05-1220:31:26

lists.debian.org

graphviz

buffer overflow

security update

cve-2020-18032

debian bug

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.2

Confidence

High

EPSS

0.005

Percentile

77.2%

JSON

Debian Security Advisory DSA-4914-1 [email protected]
https://www.debian.org/security/ Moritz Muehlenhoff
May 12, 2021 https://www.debian.org/security/faq

Package : graphviz
CVE ID : CVE-2020-18032
Debian Bug : 988000

A buffer overflow was discovered in Graphviz, which could potentially
result in the execution of arbitrary code when processing a malformed
file.

For the stable distribution (buster), this problem has been fixed in
version 2.40.1-6+deb10u1.

We recommend that you upgrade your graphviz packages.

For the detailed security status of graphviz please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/graphviz

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian10i386libpathplan4< 2.40.1-6+deb10u1libpathplan4_2.40.1-6+deb10u1_i386.deb
Debian10arm64libgv-php7-dbgsym< 2.40.1-6+deb10u1libgv-php7-dbgsym_2.40.1-6+deb10u1_arm64.deb
Debian10mipsliblab-gamut1-dbgsym< 2.40.1-6+deb10u1liblab-gamut1-dbgsym_2.40.1-6+deb10u1_mips.deb
Debian10arm64libxdot4< 2.40.1-6+deb10u1libxdot4_2.40.1-6+deb10u1_arm64.deb
Debian10mipslibxdot4< 2.40.1-6+deb10u1libxdot4_2.40.1-6+deb10u1_mips.deb
Debian10armellibgvc6-dbgsym< 2.40.1-6+deb10u1libgvc6-dbgsym_2.40.1-6+deb10u1_armel.deb
Debian10armellibgraphviz-dev< 2.40.1-6+deb10u1libgraphviz-dev_2.40.1-6+deb10u1_armel.deb
Debian10mips64ellibgv-lua-dbgsym< 2.40.1-6+deb10u1libgv-lua-dbgsym_2.40.1-6+deb10u1_mips64el.deb
Debian10arm64libgraphviz-dev< 2.40.1-6+deb10u1libgraphviz-dev_2.40.1-6+deb10u1_arm64.deb
Debian10armellibgvc6-plugins-gtk-dbgsym< 2.40.1-6+deb10u1libgvc6-plugins-gtk-dbgsym_2.40.1-6+deb10u1_armel.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	i386	libpathplan4	< 2.40.1-6+deb10u1	libpathplan4_2.40.1-6+deb10u1_i386.deb
Debian	10	arm64	libgv-php7-dbgsym	< 2.40.1-6+deb10u1	libgv-php7-dbgsym_2.40.1-6+deb10u1_arm64.deb
Debian	10	mips	liblab-gamut1-dbgsym	< 2.40.1-6+deb10u1	liblab-gamut1-dbgsym_2.40.1-6+deb10u1_mips.deb
Debian	10	arm64	libxdot4	< 2.40.1-6+deb10u1	libxdot4_2.40.1-6+deb10u1_arm64.deb
Debian	10	mips	libxdot4	< 2.40.1-6+deb10u1	libxdot4_2.40.1-6+deb10u1_mips.deb
Debian	10	armel	libgvc6-dbgsym	< 2.40.1-6+deb10u1	libgvc6-dbgsym_2.40.1-6+deb10u1_armel.deb
Debian	10	armel	libgraphviz-dev	< 2.40.1-6+deb10u1	libgraphviz-dev_2.40.1-6+deb10u1_armel.deb
Debian	10	mips64el	libgv-lua-dbgsym	< 2.40.1-6+deb10u1	libgv-lua-dbgsym_2.40.1-6+deb10u1_mips64el.deb
Debian	10	arm64	libgraphviz-dev	< 2.40.1-6+deb10u1	libgraphviz-dev_2.40.1-6+deb10u1_arm64.deb
Debian	10	armel	libgvc6-plugins-gtk-dbgsym	< 2.40.1-6+deb10u1	libgvc6-plugins-gtk-dbgsym_2.40.1-6+deb10u1_armel.deb