UbuntuUSN-2083-1Graphviz vulnerabilities
10 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
8.1 High
AI Score
Confidence
High
0.034 Low
EPSS
Percentile
91.4%
Releases
- Ubuntu 13.10
- Ubuntu 13.04
- Ubuntu 12.10
- Ubuntu 12.04
- Ubuntu 10.04
Packages
- graphviz - rich set of graph drawing tools
Details
It was discovered that Graphviz incorrectly handled memory in the yyerror
function. If a user were tricked into opening a specially crafted dot file,
an attacker could cause Graphviz to crash, or possibly execute arbitrary
code. (CVE-2014-0978, CVE-2014-1235)
It was discovered that Graphviz incorrectly handled memory in the chkNum
function. If a user were tricked into opening a specially crafted dot file,
an attacker could cause Graphviz to crash, or possibly execute arbitrary
code. (CVE-2014-1236)
The default compiler options for affected releases should reduce the
vulnerability to a denial of service.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Ubuntu | 13.10 | noarch | graphviz | < 2.26.3-15ubuntu4.1 | UNKNOWN |
| Ubuntu | 13.10 | noarch | libcdt4 | < 2.26.3-15ubuntu4.1 | UNKNOWN |
| Ubuntu | 13.10 | noarch | libcgraph5 | < 2.26.3-15ubuntu4.1 | UNKNOWN |
| Ubuntu | 13.10 | noarch | libgraph4 | < 2.26.3-15ubuntu4.1 | UNKNOWN |
| Ubuntu | 13.10 | noarch | libgraphviz-dev | < 2.26.3-15ubuntu4.1 | UNKNOWN |
| Ubuntu | 13.10 | noarch | libgv-guile | < 2.26.3-15ubuntu4.1 | UNKNOWN |
| Ubuntu | 13.10 | noarch | libgv-lua | < 2.26.3-15ubuntu4.1 | UNKNOWN |
| Ubuntu | 13.10 | noarch | libgv-perl | < 2.26.3-15ubuntu4.1 | UNKNOWN |
| Ubuntu | 13.10 | noarch | libgv-php5 | < 2.26.3-15ubuntu4.1 | UNKNOWN |
| Ubuntu | 13.10 | noarch | libgv-python | < 2.26.3-15ubuntu4.1 | UNKNOWN |
Related
10 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
8.1 High
AI Score
Confidence
High
0.034 Low
EPSS
Percentile
91.4%