REDHAT-BUG-1050872: Buffer Overflow

Published Jan 9, 2014

Updated

Graphviz, a collection of tools for the manipulation and layout of graphs, was recently reported to be affected by a buffer overflow vulnerability from user input, which seem to be caused due to the acceptance of arbitrary long digit list by regex.

References: http://seclists.org/oss-sec/2014/q1/46

Commit: https://github.com/ellson/graphviz/commit/1d1bdec6318746f6f19f245db589eddc887ae8ff

Affected Software

1 affected component

Graphviz graphviz

Event History

Jan 9, 2014

Data Sourced

via Red Hat·09:38 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1050872?

The severity of REDHAT-BUG-1050872 is classified as critical due to the potential for remote code execution from the buffer overflow.

How do I fix REDHAT-BUG-1050872?

To fix REDHAT-BUG-1050872, update Graphviz to the latest version provided by the vendor that addresses this vulnerability.

What causes the REDHAT-BUG-1050872 vulnerability?

REDHAT-BUG-1050872 is caused by a buffer overflow resulting from the acceptance of arbitrarily long digit lists through regular expressions.

Which versions of Graphviz are affected by REDHAT-BUG-1050872?

All versions of Graphviz before the patch addressing REDHAT-BUG-1050872 are affected by this vulnerability.

Is there a known exploit for REDHAT-BUG-1050872?

Yes, there are known exploits associated with REDHAT-BUG-1050872 that could allow an attacker to execute arbitrary code.