CyberSec.Space Logo
Back to CVE Browser

CVE-2008-4555

HIGH
8.5
CVSS Severity Score
EPSS Score0.0960%
EPSS Percentile14.68th
PublishedOct 14, 2008
Last ModifiedApr 23, 2026

Vulnerability Description

Stack-based buffer overflow in the push_subg function in parser.y (lib/graph/parser.c) in Graphviz 2.20.2, and possibly earlier versions, allows user-assisted remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a DOT file with a large number of Agraph_t elements.

Affected Platforms (CPE)

📦
Graphviz

Graphviz

<= 2.20.2
📦
Graphviz

Graphviz

= 1.5.1
📦
Graphviz

Graphviz

= 1.5.2
📦
Graphviz

Graphviz

= 1.5.3
📦
Graphviz

Graphviz

= 1.7.5.1
📦
Graphviz

Graphviz

= 1.7.5.2
📦
Graphviz

Graphviz

= 1.7.5.3
📦
Graphviz

Graphviz

= 1.7.5.4
📦
Graphviz

Graphviz

= 1.7.5.5
📦
Graphviz

Graphviz

= 1.7.5.6
📦
Graphviz

Graphviz

= 1.7.5.7
📦
Graphviz

Graphviz

= 1.7.5_0.1
📦
Graphviz

Graphviz

= 1.7.5_0.2
📦
Graphviz

Graphviz

= 1.7.5_0.3
📦
Graphviz

Graphviz

= 1.7.16.1
📦
Graphviz

Graphviz

= 1.7.16.2
📦
Graphviz

Graphviz

= 1.8.5.1
📦
Graphviz

Graphviz

= 1.8.5.2
📦
Graphviz

Graphviz

= 1.8.9.1
📦
Graphviz

Graphviz

= 1.10_2003-09-15_0415_1
📦
Graphviz

Graphviz

= 1.10_2003-09-15_0415_2
📦
Graphviz

Graphviz

= 1.12.1
📦
Graphviz

Graphviz

= 1.12.2
📦
Graphviz

Graphviz

= 1.12.3
📦
Graphviz

Graphviz

= 1.14.1
📦
Graphviz

Graphviz

= 1.16.1
📦
Graphviz

Graphviz

= 2.2
📦
Graphviz

Graphviz

= 2.2.1
📦
Graphviz

Graphviz

= 2.2.1.1
📦
Graphviz

Graphviz

= 2.2.2
📦
Graphviz

Graphviz

= 2.4
📦
Graphviz

Graphviz

= 2.6
📦
Graphviz

Graphviz

= 2.8
📦
Graphviz

Graphviz

= 2.10
📦
Graphviz

Graphviz

= 2.12
📦
Graphviz

Graphviz

= 2.14
📦
Graphviz

Graphviz

= 2.16
📦
Graphviz

Graphviz

= 2.18
📦
Graphviz

Graphviz

= 2.20.0
📦
Graphviz

Graphviz

= 2.20.1

References & Advisories

🔗 http://bugs.gentoo.org/show_bug.cgi?id=240636
🔗 http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00012.html
🔗 http://roeehay.blogspot.com/2008/10/graphviz-buffer-overflow-code-execution.html
🔗 http://secunia.com/advisories/32186
🔗 http://secunia.com/advisories/32656
🔗 http://security.gentoo.org/glsa/glsa-200811-04.xml
🔗 http://securityreason.com/securityalert/4409
🔗 http://www.securityfocus.com/archive/1/497150/100/0/threaded

Related Vulnerabilities

CVE-2014-123610.0

Stack-based buffer overflow in the chkNum function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspeci...

CVE-2014-09789.3

Stack-based buffer overflow in the yyerror function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspec...

CVE-2019-110238.8

The agroot() function in cgraph\obj.c in libcgraph.a in Graphviz 2.39.20160612.1140 has a NULL pointer dereference, as demonstrate...

CVE-2021-233528.6

This affects the package madge before 4.0.1. It is possible to specify a custom Graphviz path via the graphVizPath option paramete...