CVE-2014-9157

High

Published: 03/12/2014(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

CVE-2014-9157 is a vulnerability in the yyerror function in the Graphviz library that allows remote attackers to exploit format string specifiers in unknown vectors, leading to unspecified impact.

Risk Assessment

Organizations may be exposed to attacks that could result in information disclosure or other undesirable effects in systems using Graphviz.

Recommendation

It is recommended to update Graphviz to the latest version to mitigate the risks associated with this vulnerability.

Other vulnerabilities in Graphviz

CVE-2014-1235High
A stack-based buffer overflow in the 'yyerror' function in Graphviz 2.34.0 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted file. This vulnerability exists due to an incomplete fix for CVE-2014-0978.

Original NVD description (English source)

Format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows remote attackers to have unspecified impact via format string specifiers in unknown vectors, which are not properly handled in an error string.