« Volver al listado

CVE-2014-0978

Estado: ModificadaAlta (9.3)—

Desbordamientos de pila en la función yyerror de lib/cgraph/scan.l en Graphviz 2.34.0 permite a atacantes remotos tener un impacto no especificado a través de una línea larga en un archivo dot.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Graphviz — Graphviz

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-0978",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-01-10T17:55:03.237",
  "references": [
    {
      "url": "http://seclists.org/oss-sec/2014/q1/28",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://seclists.org/oss-sec/2014/q1/38",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/55666",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/56244",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.debian.org/security/2014/dsa-2843",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:024",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/64674",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://bugs.gentoo.org/show_bug.cgi?id=497274",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049165",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90085",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/ellson/graphviz/commit/7aaddf52cd98589fb0c3ab72a393f8411838438a",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://security.gentoo.org/glsa/201702-06",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://seclists.org/oss-sec/2014/q1/28",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://seclists.org/oss-sec/2014/q1/38",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/55666",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/56244",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2014/dsa-2843",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:024",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/64674",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugs.gentoo.org/show_bug.cgi?id=497274",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049165",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90085",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/ellson/graphviz/commit/7aaddf52cd98589fb0c3ab72a393f8411838438a",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.gentoo.org/glsa/201702-06",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Stack-based buffer overflow in the yyerror function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impact via a long line in a dot file."
    },
    {
      "lang": "es",
      "value": "Desbordamientos de pila en la función yyerror de lib/cgraph/scan.l en Graphviz 2.34.0 permite a atacantes remotos tener un impacto no especificado a través de una línea larga en un archivo dot."
    }
  ],
  "lastModified": "2026-06-17T00:03:57.280",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:graphviz:graphviz:2.34.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EC614024-7FE5-4798-997B-84ACA06CD48B"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}