CVE-2014-1236: Buffer Overflow
Graphviz, a collection of tools for the manipulation and layout of graphs, was recently reported to be affected by a buffer overflow vulnerability from user input, which seem to be caused due to the acceptance of arbitrary long digit list by regex.
References: http://seclists.org/oss-sec/2014/q1/46
Commit: https://github.com/ellson/graphviz/commit/1d1bdec6318746f6f19f245db589eddc887ae8ff
Other sources
Stack-based buffer overflow in the chkNum function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impact via vectors related to a "badly formed number" and a "long digit list."
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-1236?
CVE-2014-1236 is classified as a high severity vulnerability due to its potential to cause a buffer overflow from user input.
How do I fix CVE-2014-1236?
To fix CVE-2014-1236, upgrade Graphviz to version 2.34.1 or later where the vulnerability has been addressed.
What versions of Graphviz are affected by CVE-2014-1236?
CVE-2014-1236 affects Graphviz version 2.34.0.
What type of vulnerability is CVE-2014-1236?
CVE-2014-1236 is a buffer overflow vulnerability that arises from improper handling of user input.
Can CVE-2014-1236 be exploited remotely?
Yes, CVE-2014-1236 can potentially be exploited remotely if an attacker sends crafted input to the affected application.