REDHAT-BUG-1049165: Buffer Overflow

Published Jan 7, 2014

Updated

Graphviz, a collection of tools for the manipulation and layout of graphs, was recently reported to be affected by a buffer overflow vulnerability.

The vulnerability is caused due to an error within the "yyerror()" function (lib/cgraph/scan.l) and can be exploited to cause a stack-based buffer overflow via a specially crafted file.

References: https://bugs.gentoo.org/showbug.cgi?id=497274

Commit: https://github.com/ellson/graphviz/commit/7aaddf52cd98589fb0c3ab72a393f8411838438a

Affected Software

1 affected component

Graphviz graphviz

Event History

Jan 7, 2014

Data Sourced

via Red Hat·07:15 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1049165?

The severity of REDHAT-BUG-1049165 is high due to the potential for a stack-based buffer overflow, which can lead to arbitrary code execution.

How do I fix REDHAT-BUG-1049165?

To address REDHAT-BUG-1049165, you should update to the latest patched version of Graphviz.

What systems are affected by REDHAT-BUG-1049165?

REDHAT-BUG-1049165 affects all versions of Graphviz that are vulnerable to the buffer overflow.

Can REDHAT-BUG-1049165 be exploited remotely?

Yes, REDHAT-BUG-1049165 can potentially be exploited remotely if the vulnerable software is running in an environment that can be accessed over a network.

What components of Graphviz does REDHAT-BUG-1049165 affect?

REDHAT-BUG-1049165 specifically affects the "yyerror()" function in the lib/cgraph/scan.l file.