CVE-2019-11023 — NULL Pointer Dereference in Graphviz

CWE-476 — NULL Pointer Dereference11 documents7 sources
Severity
8.8HIGHNVD
OSV5.5
EPSS
1.5%
top 19.08%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
GraphvizDebian Graphviz
Timeline
PublishedApr 8
Latest updateMar 24

Description

The agroot() function in cgraph\obj.c in libcgraph.a in Graphviz 2.39.20160612.1140 has a NULL pointer dereference, as demonstrated by graphml2gv.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶Ubuntugraphviz/graphviz< 2.36.0-0ubuntu3.2+esm1+3
▶NVDgraphviz/graphviz2.39.20160612.1140

🔴Vulnerability Details

4
OSV
graphviz vulnerabilities↗2023-03-24
▶
GHSA
GHSA-5j8x-q537-j965: The agroot() function in cgraph\obj↗2022-05-13
▶
OSV
graphviz vulnerabilities↗2022-02-03
▶
OSV
CVE-2019-11023: The agroot() function in cgraph\obj↗2019-04-08
▶

📋Vendor Advisories

4
Ubuntu
Graphviz vulnerabilities↗2023-03-24
▶
Ubuntu
Graphviz vulnerabilities↗2022-02-03
▶
Red Hat
graphviz: null pointer dereference in function agroot() in cgraph\obj.c↗2019-04-09
▶
Debian
CVE-2019-11023: graphviz - The agroot() function in cgraph\obj.c in libcgraph.a in Graphviz 2.39.20160612.1...↗2019
▶

💬Community

2
Bugzilla
CVE-2019-11023 graphviz: null pointer dereference in function agroot() in cgraph\obj.c↗2019-04-15
▶
Bugzilla
CVE-2019-11023 graphviz: null pointer dereference in function agroot() in cgraph\obj.c [fedora-all]↗2019-04-15
▶