Stack-based buffer overflow in the chkNum function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impact via vectors related to a "badly formed number" and a "long digit list."

The remote host is affected by the vulnerability described in GLSA-201702-06 (Graphviz: Multiple vulnerabilities)

    Multiple vulnerabilities in Graphviz were discovered. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker, able to control input matched against a regular       expression or by enticing a user to process a specially crafted file,       could cause unspecified impacts.
  Workaround :

    There is no known workaround at this time.

Stack-based buffer overflow in the chkNum function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impact via vectors related to a 'badly formed number' and a 'long digit list.'

Stack-based buffer overflow in the yyerror function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impact via a long line in a dot file.

Graphviz was recently reported to be affected by a buffer overflow vulnerability, which seem to have introduced in the fix for CVE-2014-0978 .

This is an update that fixes CVE-2014-1235 and CVE-2014-1236. This is an update that fixes overflow in yyerror.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This is an update fixing CVE-2014-1235 and CVE-2014-1236. This is an update that fixes overflow in yyerror.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated graphviz packages fix security vulnerabilities :

Multiple buffer overflow vulnerabilities in graphviz due to an error within the yyerror() function (lib/cgraph/scan.l) which can be exploited to cause a stack-based buffer overflow via a specially crafted file (CVE-2014-0978) and the acceptance of an arbitrarily long digit list by a regular expression matched against user input (CVE-2014-1236).

A build problem was discovered and fixed in swig while building graphviz for Business Server 1, related to the new php-5.5.x version as of the MDVSA-2014:014 advisory. Fixed swig packages is being provided with this advisory as well.

It was discovered that Graphviz incorrectly handled memory in the yyerror function. If a user were tricked into opening a specially crafted dot file, an attacker could cause Graphviz to crash, or possibly execute arbitrary code. (CVE-2014-0978, CVE-2014-1235)

It was discovered that Graphviz incorrectly handled memory in the chkNum function. If a user were tricked into opening a specially crafted dot file, an attacker could cause Graphviz to crash, or possibly execute arbitrary code. (CVE-2014-1236)

The default compiler options for affected releases should reduce the vulnerability to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two buffer overflow vulnerabilities were reported in Graphviz, a rich collection of graph drawing tools. The Common Vulnerabilities and Exposures project identifies the following issues :

  - CVE-2014-0978     It was discovered that user-supplied input used in the     yyerror() function in lib/cgraph/scan.l is not     bound-checked before beeing copied into an     insufficiently sized memory buffer. A context-dependent     attacker could supply a specially crafted input file     containing a long line to cause a stack-based buffer     overlow, resulting in a denial of service (application     crash) or potentially allowing the execution of     arbitrary code.

  - CVE-2014-1236     Sebastian Krahmer reported an overflow condition in the     chkNum() function in lib/cgraph/scan.l that is triggered     as the used regular expression accepts an arbitrary long     digit list. With a specially crafted input file, a     context-dependent attacker can cause a stack-based     buffer overflow, resulting in a denial of service     (application crash) or potentially allowing the     execution of arbitrary code.

ID	Name	Product	Family	Severity
97112	GLSA-201702-06 : Graphviz: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
72945	Amazon Linux AMI : graphviz-php (ALAS-2014-297)	Nessus	Amazon Linux Local Security Checks	high
72944	Amazon Linux AMI : graphviz (ALAS-2014-296)	Nessus	Amazon Linux Local Security Checks	high
72442	Fedora 19 : graphviz-2.30.1-12.fc19 (2014-0621)	Nessus	Fedora Local Security Checks	high
72441	Fedora 20 : graphviz-2.34.0-8.fc20 (2014-0602)	Nessus	Fedora Local Security Checks	high
72136	Mandriva Linux Security Advisory : graphviz (MDVSA-2014:024)	Nessus	Mandriva Local Security Checks	critical
72005	Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 / 13.10 : graphviz vulnerabilities (USN-2083-1)	Nessus	Ubuntu Local Security Checks	high
71934	Debian DSA-2843-1 : graphviz - buffer overflow	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2014-1236

critical

Tenable Plugins

high

high

high

high

high

critical

high

critical