Stack-based buffer overflow in the "yyerror" function in Graphviz 2.34.0 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted file. NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-0978.

The remote host is affected by the vulnerability described in GLSA-201702-06 (Graphviz: Multiple vulnerabilities)

    Multiple vulnerabilities in Graphviz were discovered. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker, able to control input matched against a regular       expression or by enticing a user to process a specially crafted file,       could cause unspecified impacts.
  Workaround :

    There is no known workaround at this time.

Stack-based buffer overflow in the chkNum function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impact via vectors related to a 'badly formed number' and a 'long digit list.'

Stack-based buffer overflow in the yyerror function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impact via a long line in a dot file.

Graphviz was recently reported to be affected by a buffer overflow vulnerability, which seem to have introduced in the fix for CVE-2014-0978 .

This is an update that fixes CVE-2014-1235 and CVE-2014-1236. This is an update that fixes overflow in yyerror.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This is an update fixing CVE-2014-1235 and CVE-2014-1236. This is an update that fixes overflow in yyerror.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Graphviz incorrectly handled memory in the yyerror function. If a user were tricked into opening a specially crafted dot file, an attacker could cause Graphviz to crash, or possibly execute arbitrary code. (CVE-2014-0978, CVE-2014-1235)

It was discovered that Graphviz incorrectly handled memory in the chkNum function. If a user were tricked into opening a specially crafted dot file, an attacker could cause Graphviz to crash, or possibly execute arbitrary code. (CVE-2014-1236)

The default compiler options for affected releases should reduce the vulnerability to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
97112	GLSA-201702-06 : Graphviz: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
72945	Amazon Linux AMI : graphviz-php (ALAS-2014-297)	Nessus	Amazon Linux Local Security Checks	high
72944	Amazon Linux AMI : graphviz (ALAS-2014-296)	Nessus	Amazon Linux Local Security Checks	high
72442	Fedora 19 : graphviz-2.30.1-12.fc19 (2014-0621)	Nessus	Fedora Local Security Checks	high
72441	Fedora 20 : graphviz-2.34.0-8.fc20 (2014-0602)	Nessus	Fedora Local Security Checks	high
72005	Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 / 13.10 : graphviz vulnerabilities (USN-2083-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2014-1235

high

Tenable Plugins

high

high

high

high

high

high