Vulnerability Details CVE-2019-9904
An issue was discovered in lib\cdt\dttree.c in libcdt.a in graphviz 2.40.1. Stack consumption occurs because of recursive agclose calls in lib\cgraph\graph.c in libcgraph.a, related to agfstsubg in lib\cgraph\subg.c.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 40.6%
CVSS Severity
CVSS v3 Score 6.5
CVSS v2 Score 4.3
References
- https://gitlab.com/graphviz/graphviz/issues/1512
- https://research.loginsoft.com/bugs/stack-buffer-overflow-in-function-agclose-graphviz/
- https://security.gentoo.org/glsa/202107-04
- https://gitlab.com/graphviz/graphviz/issues/1512
- https://research.loginsoft.com/bugs/stack-buffer-overflow-in-function-agclose-graphviz/
- https://security.gentoo.org/glsa/202107-04