PT-2019-19925 · At&T+1 · Graphviz+1

Published 2019-03-21 · Updated 2025-01-17 · CVE-2019-9904

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions graphviz version 2.40.1

Description An issue was discovered in libcdtdttree.c in libcdt.a, related to recursive agclose calls in libcgraphgraph.c in libcgraph.a. This issue is connected to agfstsubg in libcgraphsubg.c, leading to stack consumption.

Recommendations For graphviz version 2.40.1, consider disabling the recursive agclose calls in libcgraphgraph.c as a temporary workaround until a patch is available. Restrict access to the agfstsubg function in libcgraphsubg.c to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

ALT-PU-2020-1430

ALT-PU-2020-3007

ALT-PU-2025-1286

CVE-2019-9904

Affected Products

Alt Linux

Graphviz

References · 18

• 🔥 https://research.loginsoft.com/bugs/stack-buffer-overflow-in-function-agclose-graphviz · Exploit
• 🔥 https://gitlab.com/graphviz/graphviz/issues/1512 · Exploit
• https://ubuntu.com/security/CVE-2019-9904 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2020-3007 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2025-1286 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-9904 · Security Note
• https://security.gentoo.org/glsa/202107-04 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01391 · Security Note
• https://errata.altlinux.org/ALT-PU-2020-1430 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10196 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-9904 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9904 · Security Note
• https://osv.dev/vulnerability/CVE-2019-9904 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-9904 · Vendor Advisory
• https://packages.altlinux.org/ru/vuln/CVE-2019-9904 · Note