CVE-2014-0978: Buffer Overflow
Graphviz, a collection of tools for the manipulation and layout of graphs, was recently reported to be affected by a buffer overflow vulnerability.
The vulnerability is caused due to an error within the "yyerror()" function (lib/cgraph/scan.l) and can be exploited to cause a stack-based buffer overflow via a specially crafted file.
References: https://bugs.gentoo.org/showbug.cgi?id=497274
Commit: https://github.com/ellson/graphviz/commit/7aaddf52cd98589fb0c3ab72a393f8411838438a
Other sources
Stack-based buffer overflow in the yyerror function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impact via a long line in a dot file.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0978?
CVE-2014-0978 has been classified as a high severity vulnerability due to the potential for remote code execution.
How do I fix CVE-2014-0978?
To fix CVE-2014-0978, upgrade to Graphviz version 2.34.1 or later, where the vulnerability has been patched.
What type of vulnerability is CVE-2014-0978?
CVE-2014-0978 is a buffer overflow vulnerability that affects the Graphviz toolset.
Which versions of Graphviz are affected by CVE-2014-0978?
Graphviz version 2.34.0 is specifically affected by CVE-2014-0978.
Can CVE-2014-0978 be exploited remotely?
Yes, CVE-2014-0978 can be exploited remotely to execute arbitrary code on the affected system.