An issue was discovered in lib\cdt\dttree.c in libcdt.a in graphviz 2.40.1. Stack consumption occurs because of recursive agclose calls in lib\cgraph\graph.c in libcgraph.a, related to agfstsubg in lib\cgraph\subg.c.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - graphviz: format string vulnerability in yyerror() (CVE-2014-9157)

  - graphviz: null pointer dereference in function agroot() in cgraph\obj.c (CVE-2019-11023)

  - An issue was discovered in lib\cdt\dttree.c in libcdt.a in graphviz 2.40.1. Stack consumption occurs     because of recursive agclose calls in lib\cgraph\graph.c in libcgraph.a, related to agfstsubg in     lib\cgraph\subg.c. (CVE-2019-9904)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - graphviz: stack-based buffer overflow in chkNum() (CVE-2014-1236)

  - graphviz: recursive function call in agclose in lib\cgraph\graph.c causing stack consumption     (CVE-2019-9904)

  - Stack-based buffer overflow in the yyerror function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote     attackers to have unspecified impact via a long line in a dot file. (CVE-2014-0978)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - graphviz: null pointer dereference in function agroot() in cgraph\obj.c (CVE-2019-11023)

  - An issue was discovered in lib\cdt\dttree.c in libcdt.a in graphviz 2.40.1. Stack consumption occurs     because of recursive agclose calls in lib\cgraph\graph.c in libcgraph.a, related to agfstsubg in     lib\cgraph\subg.c. (CVE-2019-9904)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote host is affected by the vulnerability described in GLSA-202107-04 (Graphviz: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Graphviz. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to process a specially crafted       file using Graphviz, possibly resulting in execution of arbitrary code       with the privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
198666	RHEL 7 : graphviz (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198639	RHEL 6 : graphviz (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
198614	RHEL 8 : graphviz (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
157018	GLSA-202107-04 : Graphviz: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2019-9904

medium

Tenable Plugins

high

medium

high

high