CVE-2018-10196 — NULL Pointer Dereference in Graphviz

CWE-476 — NULL Pointer Dereference11 documents7 sources
Severity
5.5MEDIUMNVD
EPSS
0.1%
top 67.99%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
GraphvizDebian GraphvizCanonical Ubuntu Linux+1 more
Timeline
PublishedMay 30
Latest updateMar 24

Description

NULL pointer dereference vulnerability in the rebuild_vlists function in lib/dotgen/conc.c in the dotgen library in Graphviz 2.40.1 allows remote attackers to cause a denial of service (application crash) via a crafted file.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages4 packages

▶debiandebian/graphviz< graphviz 2.40.1-6 (bookworm)
▶Debiangraphviz/graphviz< 2.40.1-6+3
▶Ubuntugraphviz/graphviz< 2.36.0-0ubuntu3.2+esm1+3
▶NVDgraphviz/graphviz2.40.1

Also affects: Fedora 27, 28, Ubuntu Linux 14.04, 16.04, 18.04

Patches

Patch: gitlab.com ↗Patch: gitlab.com ↗

🔴Vulnerability Details

4
OSV
graphviz vulnerabilities↗2023-03-24
▶
GHSA
GHSA-9jm3-9x6p-8q48: NULL pointer dereference vulnerability in the rebuild_vlists function in lib/dotgen/conc↗2022-05-13
▶
OSV
graphviz vulnerabilities↗2022-02-03
▶
OSV
CVE-2018-10196: NULL pointer dereference vulnerability in the rebuild_vlists function in lib/dotgen/conc↗2018-05-30
▶

📋Vendor Advisories

4
Ubuntu
Graphviz vulnerabilities↗2023-03-24
▶
Ubuntu
Graphviz vulnerabilities↗2022-02-03
▶
Red Hat
graphviz: NULL pointer dereference in rebuild_vlis↗2018-04-18
▶
Debian
CVE-2018-10196: graphviz - NULL pointer dereference vulnerability in the rebuild_vlists function in lib/dot...↗2018
▶

💬Community

2
Bugzilla
CVE-2018-10196 graphviz: NULL pointer dereference in rebuild_vlis↗2018-05-17
▶
Bugzilla
CVE-2018-10196 graphviz: NULL pointer dereference in rebuild_vlis [fedora-all]↗2018-05-17
▶