Format string vulnerability in graphviz
Summary
DSA-3098-1: graphviz - security update. Affects graphviz versions < 2.26.3-14+deb7u2. Fixed in 2.26.3-14+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Graphviz is a rich set of graph drawing tools that allows users to create and manipulate graphs. It provides a collection of command-line tools and libraries for generating and visualizing graphs. The vulnerability in question affects the yyerror function in the lib/cgraph/scan.l file of the Graphviz library. This function is responsible for handling error messages during graph parsing. The vulnerability arises from a format string issue, which can be exploited by an attacker to crash the application or potentially execute arbitrary code.
Vulnerability Detail
The format string vulnerability in Graphviz's yyerror function allows an attacker to manipulate the format string argument in a way that can lead to a crash or arbitrary code execution. By crafting a malicious graph file or input that triggers an error, an attacker can exploit this vulnerability. The impact of this vulnerability can range from denial of service (application crash) to remote code execution, depending on the attacker's ability to control the format string argument.
How To Fix
Minimum fixed version
2.26.3-14+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade graphvizTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring they only process trusted graph files and inputs. Additionally, implementing proper input validation and sanitization can help prevent potential exploitation of this vulnerability.
Conclusion
The format string vulnerability in Graphviz's yyerror function can be exploited by an attacker to crash the application or potentially execute arbitrary code. It is crucial to upgrade the Graphviz package to the recommended versions to address this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for graphviz →
FAQ
Graphviz is a collection of graph drawing tools used for creating and manipulating graphs.
The vulnerability can lead to a crash of the application or potentially allow an attacker to execute arbitrary code.
To fix this vulnerability, upgrade the Graphviz package to the recommended versions mentioned in the 'how_to_fix' section.
While there are no specific workarounds mentioned, users can mitigate the risk by processing only trusted graph files and implementing proper input validation.
There is no information provided about any known exploits for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for graphviz.
