CVE-2014-1235

High

Published: 07/08/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

A stack-based buffer overflow in the 'yyerror' function in Graphviz 2.34.0 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted file. This vulnerability exists due to an incomplete fix for CVE-2014-0978.

Risk Assessment

The organization may be exposed to remote code execution or application crashes, potentially leading to service downtime and financial losses.

Recommendation

It is recommended to update Graphviz to the latest version to mitigate this vulnerability and conduct a security audit of the application.

Other vulnerabilities in Graphviz 2.34.0

CVE-2014-9157High
CVE-2014-9157 is a vulnerability in the yyerror function in the Graphviz library that allows remote attackers to exploit format string specifiers in unknown vectors, leading to unspecified impact.

Original NVD description (English source)

Stack-based buffer overflow in the "yyerror" function in Graphviz 2.34.0 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted file. NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-0978.