Back to Database
Status published
High
CVE-2008-4555
Stack-based buffer overflow in the push_subg function in parser.y (lib/graph/parser.c)...
Vulnerability Description
Stack-based buffer overflow in the push_subg function in parser.y (lib/graph/parser.c) in Graphviz 2.20.2, and possibly earlier versions, allows user-assisted remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a DOT file with a large number of Agraph_t elements.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2008-4555
Credits & Attribution
No credits recorded in the NVD database.
References
- http://security.gentoo.org/glsa/glsa-200811-04.xml
- http://secunia.com/advisories/32186
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45765
- http://roeehay.blogspot.com/2008/10/graphviz-buffer-overflow-code-execution.html
- http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00012.html
- http://www.securityfocus.com/bid/31648
- http://www.securityfocus.com/archive/1/497150/100/0/threaded
- http://bugs.gentoo.org/show_bug.cgi?id=240636
- http://securityreason.com/securityalert/4409
- http://secunia.com/advisories/32656
More from graphviz
View All →CVE-2020-18032
Buffer Overflow in Graphviz Graph Visualization Tools from commit ID...
High
7.8
CVE-2019-9904
An issue was discovered in lib\cdt\dttree.c in libcdt.a in graphviz...
Medium
6.5
CVE-2019-11023
The agroot() function in cgraph\obj.c in libcgraph.a in Graphviz 2.39.20160612.1140...
High
8.8
CVE-2018-10196
NULL pointer dereference vulnerability in the rebuild_vlists function in lib/dotgen/conc.c...
Medium
5.5
CVE-2014-1236
Stack-based buffer overflow in the chkNum function in lib/cgraph/scan.l in...
Critical
10
Affected Vendor
graphviz
View all reports →Affected Software
graphviz
Vulnerable Versions:
0, 1.5.1, 1.5.2, 1.5.3, 1.7.5.1, 1.7.5.2, 1.7.5.3, 1.7.5.4, 1.7.5.5, 1.7.5.6, 1.7.5.7, 1.7.5_0.1, 1.7.5_0.2, 1.7.5_0.3, 1.7.16.1, 1.7.16.2, 1.8.5.1, 1.8.5.2, 1.8.9.1, 1.10_2003-09-15_0415_1, 1.10_2003-09-15_0415_2, 1.12.1, 1.12.2, 1.12.3, 1.14.1, 1.16.1, 2.2, 2.2.1, 2.2.1.1, 2.2.2, 2.4, 2.6, 2.8, 2.10, 2.12, 2.14, 2.16, 2.18, 2.20.0, 2.20.1
Timeline
Official Publish:
October 14th, 2008
Last Modified:
August 7th, 2024
Added to House:
July 18th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.