CVE-2014-9157

HIGH 7.5CVE-2014-9157 · Published 03/12/2014 · updated 17/06/2026

In short

CVE-2014-9157 is a HIGH (CVSS 7.5) vulnerability affecting graphviz (graphviz).
Chance of exploitation in the next 30 days (EPSS): 5.6%, higher than 92.9% of all vulnerabilities.
Fix: update to 2.42.4 or later.

Package	Affected versions	Patched versions
graphviz graphviz	`< 2.42.4`	`2.42.4`

Description

Format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows remote attackers to have unspecified impact via format string specifiers in unknown vectors, which are not properly handled in an error string.

References

advisories.mageia.org/MGASA-2014-0520.html · Third Party Advisory
seclists.org/oss-sec/2014/q4/784 · Exploit
seclists.org/oss-sec/2014/q4/872 · Exploit
secunia.com/advisories/60166 · Broken Link
debian.org/security/2014/dsa-3098 · Third Party Advisory
mandriva.com/security/advisories · Broken Link
mandriva.com/security/advisories · Broken Link
securityfocus.com/bid/71283 · Broken Link
exchange.xforce.ibmcloud.com/vulnerabilities/98949 · Third Party Advisory
ellson/graphviz commit 99eda42 · Exploit

More vulnerabilities in graphviz

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

graphviz

< 2.42.4

2.42.4

More vulnerabilities in graphviz

See all →