CVE-2008-4555
High
Description
Stack-based buffer overflow in the push_subg function in parser.y (lib/graph/parser.c) in Graphviz 2.20.2, and possibly earlier versions, allows user-assisted remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a DOT file with a large number of Agraph_t elements.
SeverityHigh
CVSS8.5
Exploit probability—
ProductGraphviz
PublishedOct 14, 2008
First seenOct 14, 2008
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| graphviz graphviz | v ≤ 2.20.2, 1.5.1, 1.5.2, 1.5.3, 1.7.5.1, 1.7.5.2, 1.7.5.3, 1.7.5.4, 1.7.5.5, 1.7.5.6, 1.7.5.7, 1.7.5_0.1, 1.7.5_0.2, 1.7.5_0.3, 1.7.16.1, 1.7.16.2, 1.8.5.1, 1.8.5.2, 1.8.9.1, 1.10_2003-09-15_0415_1, 1.10_2003-09-15_0415_2, 1.12.1, 1.12.2, 1.12.3, 1.14.1, 1.16.1, 2.2, 2.2.1, 2.2.1.1, 2.2.2, 2.4, 2.6, 2.8, 2.10, 2.12, 2.14, 2.16, 2.18, 2.20.0, 2.20.1 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.