PT-2014-8857 · At&T+1 · Graphviz+1

Published 2014-12-03 · Updated 2024-07-19 · CVE-2014-9157

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Graphviz (affected versions not specified)

Description The issue is related to a format string vulnerability in the yyerror function in lib/cgraph/scan.l of Graphviz. This vulnerability allows remote attackers to have an unspecified impact via format string specifiers in unknown vectors, which are not properly handled in an error string.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

CVE-2014-9157

DLA-105-1

DSA-3098-1

MGASA-2014-0520

USN-2435-1

Affected Products

Graphviz

Ubuntu

References · 25

• 🔥 https://github.com/ellson/graphviz/commit/99eda421f7ddc27b14e4ac1d2126e5fe41719081 · Exploit
• 🔥 http://seclists.org/oss-sec/2014/q4/784 · Exploit
• 🔥 http://seclists.org/oss-sec/2014/q4/872 · Exploit
• http://mandriva.com/security/advisories?name=MDVSA-2014:248 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-9157 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-9157 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2015:187 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0520 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-9157 · Security Note
• http://debian.org/security/2014/dsa-3098 · Vendor Advisory
• https://osv.dev/vulnerability/USN-2435-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-9157 · Security Note
• https://ubuntu.com/security/CVE-2014-9157 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-9157 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-9157 · Vendor Advisory