CVE-2020-18032: Buffer Overflow
Published Apr 29, 2021
·Updated
Buffer Overflow in Graphviz Graph Visualization Tools from commit ID f8b9e035 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by loading a crafted file into the "lib/common/shapes.c" component.
Affected Software
66 affected componentsFixes available
debian/graphviz
2.40.1-6+deb10u12.42.2-52.42.2-7
Graphviz graphviz<2.46.0
Debian Debian Linux=9.0
Debian Debian Linux=10.0
Fedoraproject Fedora=33
Fedoraproject Fedora=34
Microsoft cbl2 graphviz 2.42.4-6
Microsoft azl3 graphviz 2.42.4-10
Microsoft cm1 graphviz 2.42.4-5
Microsoft graphviz-perl-2.42.4-11.azl3.aarch64.rpm
Microsoft graphviz-lua-2.42.4-11.azl3.aarch64.rpm
Microsoft azl3 graphviz 2.42.4-12
Microsoft graphviz-tcl-2.42.4-11.azl3.aarch64.rpm
Microsoft graphviz-perl-2.42.4-11.azl3.x86_64.rpm
Microsoft graphviz-gd-2.42.4-11.azl3.aarch64.rpm
Microsoft graphviz-lua-2.42.4-5.cm1.x86_64.rpm
Microsoft graphviz-devel-2.42.4-11.azl3.aarch64.rpm
Microsoft graphviz-python3-2.42.4-11.azl3.aarch64.rpm
Microsoft graphviz-graphs-2.42.4-11.azl3.aarch64.rpm
Microsoft graphviz-doc-2.42.4-11.azl3.aarch64.rpm
Microsoft graphviz-python3-2.42.4-11.azl3.x86_64.rpm
Microsoft graphviz-2.42.4-11.azl3.aarch64.rpm
Microsoft graphviz-tcl-2.42.4-11.azl3.x86_64.rpm
Microsoft graphviz-lua-2.42.4-11.azl3.x86_64.rpm
Microsoft graphviz-graphs-2.42.4-11.azl3.x86_64.rpm
Microsoft graphviz-doc-2.42.4-11.azl3.x86_64.rpm
Microsoft graphviz-gd-2.42.4-11.azl3.x86_64.rpm
Microsoft graphviz-devel-2.42.4-11.azl3.x86_64.rpm
Microsoft graphviz-2.42.4-11.azl3.x86_64.rpm
Microsoft graphviz-debuginfo-2.42.4-6.cm2.aarch64.rpm
Microsoft graphviz-python3-2.42.4-6.cm2.aarch64.rpm
Microsoft graphviz-tcl-2.42.4-6.cm2.aarch64.rpm
Microsoft graphviz-perl-2.42.4-6.cm2.aarch64.rpm
Microsoft graphviz-devel-2.42.4-6.cm2.aarch64.rpm
Microsoft graphviz-graphs-2.42.4-6.cm2.aarch64.rpm
Microsoft graphviz-doc-2.42.4-6.cm2.aarch64.rpm
Microsoft graphviz-gd-2.42.4-6.cm2.aarch64.rpm
Microsoft graphviz-lua-2.42.4-6.cm2.aarch64.rpm
Microsoft graphviz-2.42.4-6.cm2.aarch64.rpm
Microsoft graphviz-tcl-2.42.4-6.cm2.x86_64.rpm
Microsoft graphviz-debuginfo-2.42.4-6.cm2.x86_64.rpm
Microsoft graphviz-lua-2.42.4-6.cm2.x86_64.rpm
Microsoft graphviz-perl-2.42.4-6.cm2.x86_64.rpm
Microsoft graphviz-python3-2.42.4-6.cm2.x86_64.rpm
Microsoft graphviz-graphs-2.42.4-6.cm2.x86_64.rpm
Microsoft graphviz-doc-2.42.4-6.cm2.x86_64.rpm
Microsoft graphviz-gd-2.42.4-6.cm2.x86_64.rpm
Microsoft graphviz-2.42.4-6.cm2.x86_64.rpm
Microsoft graphviz-devel-2.42.4-6.cm2.x86_64.rpm
Microsoft graphviz-debuginfo-2.42.4-5.cm1.aarch64.rpm
Microsoft graphviz-perl-2.42.4-5.cm1.aarch64.rpm
Microsoft graphviz-lua-2.42.4-5.cm1.aarch64.rpm
Microsoft graphviz-graphs-2.42.4-5.cm1.aarch64.rpm
Microsoft graphviz-tcl-2.42.4-5.cm1.aarch64.rpm
Microsoft graphviz-gd-2.42.4-5.cm1.aarch64.rpm
Microsoft graphviz-doc-2.42.4-5.cm1.aarch64.rpm
Microsoft graphviz-debuginfo-2.42.4-5.cm1.x86_64.rpm
Microsoft graphviz-graphs-2.42.4-5.cm1.x86_64.rpm
Microsoft graphviz-devel-2.42.4-5.cm1.aarch64.rpm
Microsoft graphviz-devel-2.42.4-5.cm1.x86_64.rpm
Microsoft graphviz-2.42.4-5.cm1.aarch64.rpm
Microsoft graphviz-perl-2.42.4-5.cm1.x86_64.rpm
Microsoft graphviz-tcl-2.42.4-5.cm1.x86_64.rpm
Microsoft graphviz-gd-2.42.4-5.cm1.x86_64.rpm
Microsoft graphviz-2.42.4-5.cm1.x86_64.rpm
Microsoft graphviz-doc-2.42.4-5.cm1.x86_64.rpm
Remediation
Patch Available
Event History
Apr 29, 2021
CVE Published
via MITRE·05:20 PM
Data Sourced
via MITRE·05:20 PM
Description
May 3, 2021
Data Sourced
02:57 PM
SeverityAffected Software
Sep 27, 2021
Data Sourced
via Microsoft·12:00 AM
DescriptionSeverityWeaknessAffected Software
Updated
via Microsoft·12:00 AM
Affected Software
Updated
via Microsoft·07:00 AM
SeverityAffected Software
Updated
via Microsoft·07:00 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2020-18032?
CVE-2020-18032 is classified as a high severity vulnerability due to its potential for remote code execution and application crashes.
2
How do I fix CVE-2020-18032?
To resolve CVE-2020-18032, you should upgrade to Graphviz versions 2.40.1-6+deb10u1, 2.42.2-5, or later than 2.46.0.
3
What systems are affected by CVE-2020-18032?
CVE-2020-18032 affects multiple versions of Graphviz, specifically those prior to 2.46.0 as well as Debian 9 and 10.
4
What types of attacks can CVE-2020-18032 facilitate?
CVE-2020-18032 can enable attackers to execute arbitrary code or cause denial of service by exploiting a buffer overflow.
5
Is there a specific component in Graphviz that CVE-2020-18032 targets?
The vulnerability CVE-2020-18032 specifically targets the 'lib/common/shapes.c' component of Graphviz.