CVE-2014-1235 — HIGH (7.8) — White Hats Nepal

Vulnerability Description

Stack-based buffer overflow in the "yyerror" function in Graphviz 2.34.0 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted file. NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-0978.

CVSS Score

7.8

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Graphviz	Graphviz	2.34.0

Related Weaknesses (CWE)

CWE-119

References

http://seclists.org/oss-sec/2014/q1/54Mailing ListThird Party Advisory
http://www.securityfocus.com/bid/64736Third Party AdvisoryVDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1050871Issue TrackingPatchThird Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/90198
https://github.com/ellson/graphviz/commit/d266bb2b4154d11c27252b56d86963aef44347Issue TrackingPatchThird Party Advisory
https://security.gentoo.org/glsa/201702-06MitigationPatchThird Party Advisory
http://seclists.org/oss-sec/2014/q1/54Mailing ListThird Party Advisory
http://www.securityfocus.com/bid/64736Third Party AdvisoryVDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1050871Issue TrackingPatchThird Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/90198
https://github.com/ellson/graphviz/commit/d266bb2b4154d11c27252b56d86963aef44347Issue TrackingPatchThird Party Advisory
https://security.gentoo.org/glsa/201702-06MitigationPatchThird Party Advisory

FAQ

What is CVE-2014-1235?

CVE-2014-1235 is a vulnerability with a CVSS score of 7.8 (HIGH). Stack-based buffer overflow in the "yyerror" function in Graphviz 2.34.0 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted file. NOTE: T...

How severe is CVE-2014-1235?

CVE-2014-1235 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2014-1235?

Check the references section above for vendor advisories and patch information. Affected products include: Graphviz Graphviz.