CVE-2014-9157

Description

From CVE.org

Format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows remote attackers to have unspecified impact via format string specifiers in unknown vectors, which are not properly handled in an error string.

Statement

This issue affects the versions of the graphviz package as shipped with Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this issue as having Low security impact and therefore it is not planned to be addressed in future updates.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v2 Score Breakdown

Red HatNVDcve.org
Base Score4.37.5N/A
Attack VectorNetworkNetworkN/A
Access ComplexityMediumLowN/A
AuthenticationNoneNoneN/A
Confidentiality ImpactNonePartialN/A
Integrity ImpactNonePartialN/A
Availability ImpactPartialPartialN/A

Vector

Red Hat: AV:N/AC:M/Au:N/C:N/I:N/A:P

NVD: AV:N/AC:L/Au:N/C:P/I:P/A:P

Understanding the Weakness (CWE)

CWE-134

Confidentiality

Technical Impact: Read Memory

Format string problems allow for information disclosure which can severely simplify exploitation of the program.

Integrity,Confidentiality,Availability

Technical Impact: Modify Memory; Execute Unauthorized Code or Commands

Format string problems can result in the execution of arbitrary code, buffer overflows, denial of service, or incorrect data representation.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.