CVE-2008-4555

描述

Stack-based buffer overflow in the push_subg function in parser.y (lib/graph/parser.c) in Graphviz 2.20.2, and possibly earlier versions, allows user-assisted remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a DOT file with a large number of Agraph_t elements.

如何修補 CVE-2008-4555

要修補 CVE-2008-4555,請將受影響套件升級到下列已修補版本。

• Debian/graphviz—升級至 2.20.2-3 或更新版本

CVE-2008-4555 正在被利用嗎?

中等 — EPSS 為 5.1%,可持續追蹤但非最高優先。

受影響套件(1)

• from 0, < 2.20.2-3

參考連結(1)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2008-4555