Vulnerability · Published Feb 2, 2024 · Assigned by mitre
CVE-2023-46045
High 7.8
In plain English
A high-severity out-of-bounds read in the graphviz package (Debian). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.8%top 42.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Graphviz 2.36.0 through 9.x before 10.0.1 has an out-of-bounds read via a crafted config6a file. NOTE: exploitability may be uncommon because this file is typically owned by root.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | graphviz | no fix listed | DEBIAN-CVE-2023-46045 |
| Debian:13 | graphviz | 2.42.2-8 | DEBIAN-CVE-2023-46045 |
| Debian:14 | graphviz | 2.42.2-8 | DEBIAN-CVE-2023-46045 |
Affected products (as reported)
Weakness: CWE-125 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://gitlab.com/graphviz/graphviz/-/issues/2441
- https://seclists.org/fulldisclosure/2024/Jan/73
- https://www.openwall.com/lists/oss-security/2024/02/01/2
- 20240220 Re: Buffer Overflow in graphviz via via a crafted config6a file mailing-list
- https://seclists.org/fulldisclosure/2024/Feb/24
- http://packetstormsecurity.com/files/176816/graphviz-2.43.0-Buffer-Overflow-Code-Execution.html
- http://seclists.org/fulldisclosure/2024/Jan/73
- http://seclists.org/fulldisclosure/2024/Jan/62