Search for vulnerabilities
Vulnerability details: VCID-a41g-bu5m-aaah
Vulnerability ID VCID-a41g-bu5m-aaah
Aliases CVE-2008-4555
Summary Stack-based buffer overflow in the push_subg function in parser.y (lib/graph/parser.c) in Graphviz 2.20.2, and possibly earlier versions, allows user-assisted remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a DOT file with a large number of Agraph_t elements.
Status Published
Exploitability 0.5
Weighted Severity 7.7
Risk 3.9
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-121 Stack-based Buffer Overflow
System Score Found at
epss 0.00794 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.00794 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.00794 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.00794 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.00794 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.00794 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.00794 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.00794 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.00794 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.00794 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.00794 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.00794 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.01836 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.01836 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.01836 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.01836 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.06789 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
epss 0.10874 https://api.first.org/data/v1/epss?cve=CVE-2008-4555
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=466914
cvssv2 8.5 https://nvd.nist.gov/vuln/detail/CVE-2008-4555
Reference id Reference type URL
http://bugs.gentoo.org/show_bug.cgi?id=240636
http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00012.html
http://roeehay.blogspot.com/2008/10/graphviz-buffer-overflow-code-execution.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2008-4555.json
https://api.first.org/data/v1/epss?cve=CVE-2008-4555
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4555
http://secunia.com/advisories/32186
http://secunia.com/advisories/32656
http://security.gentoo.org/glsa/glsa-200811-04.xml
http://securityreason.com/securityalert/4409
https://exchange.xforce.ibmcloud.com/vulnerabilities/45765
http://www.securityfocus.com/archive/1/497150/100/0/threaded
http://www.securityfocus.com/bid/31648
466914 https://bugzilla.redhat.com/show_bug.cgi?id=466914
cpe:2.3:a:graphviz:graphviz:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:*:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:1.10_2003-09-15_0415_1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:1.10_2003-09-15_0415_1:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:1.10_2003-09-15_0415_2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:1.10_2003-09-15_0415_2:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:1.12.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:1.12.1:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:1.12.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:1.12.2:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:1.12.3:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:1.12.3:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:1.14.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:1.14.1:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:1.16.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:1.16.1:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:1.5.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:1.5.1:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:1.5.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:1.5.2:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:1.5.3:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:1.5.3:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:1.7.16.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:1.7.16.1:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:1.7.16.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:1.7.16.2:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:1.7.5_0.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:1.7.5_0.1:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:1.7.5_0.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:1.7.5_0.2:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:1.7.5_0.3:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:1.7.5_0.3:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:1.7.5.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:1.7.5.1:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:1.7.5.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:1.7.5.2:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:1.7.5.3:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:1.7.5.3:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:1.7.5.4:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:1.7.5.4:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:1.7.5.5:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:1.7.5.5:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:1.7.5.6:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:1.7.5.6:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:1.7.5.7:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:1.7.5.7:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:1.8.5.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:1.8.5.1:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:1.8.5.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:1.8.5.2:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:1.8.9.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:1.8.9.1:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:2.10:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:2.10:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:2.12:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:2.12:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:2.14:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:2.14:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:2.16:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:2.16:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:2.18:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:2.18:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:2.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:2.2:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:2.20.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:2.20.0:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:2.20.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:2.20.1:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:2.2.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:2.2.1:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:2.2.1.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:2.2.1.1:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:2.2.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:2.2.2:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:2.4:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:2.4:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:2.6:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:2.6:*:*:*:*:*:*:*
cpe:2.3:a:graphviz:graphviz:2.8:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:graphviz:graphviz:2.8:*:*:*:*:*:*:*
CVE-2008-4555 https://nvd.nist.gov/vuln/detail/CVE-2008-4555
GLSA-200811-04 https://security.gentoo.org/glsa/200811-04
No exploits are available.
Vector: AV:N/AC:M/Au:S/C:C/I:C/A:C Found at https://nvd.nist.gov/vuln/detail/CVE-2008-4555
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Exploit Prediction Scoring System (EPSS)
Percentile 0.82039
EPSS Score 0.00794
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.