CVE-2020-18032

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-18032
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-18032.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-18032
Downstream
ALPINE (1)
AZL (2)
BELL (1)
CGA (12)
CLEANSTART (1)
DEBIAN (1)
MGASA (1)
OESA (1)
openSUSE (2)
RHSA (1)
RLSA (1)
SUSE (2)
UBUNTU (1)
Related
ALSA (1)
openSUSE (2)
SUSE (2)
Published
2021-04-29T18:15:08Z
Modified
2026-10-22T02:48:16Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Buffer Overflow in Graphviz Graph Visualization Tools from commit ID f8b9e035 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by loading a crafted file into the "lib/common/shapes.c" component.

Database specific 
{
    "unresolved_ranges":  [
        {
            "cpes":  [
                "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
                "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "33"
                        },
                        {
                            "last_affected":  "33"
                        },
                        {
                            "introduced":  "34"
                        },
                        {
                            "last_affected":  "34"
                        }
                    ],
                    "source":  "CPE_STRING"
                }
            ],
            "vendor_product":  "fedoraproject:fedora"
        }
    ]
}
References

Affected packages

Git / gitlab.com/graphviz/graphviz

Affected ranges

Type
GIT
Repo
https://gitlab.com/graphviz/graphviz
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4f263aeb7fccdfac1e71a305f437a997385bdf59
Introduced
5733d3a95898f1380424ab15f966ace9a283d506
Last Affected
1c6cb9d3de553bd3e3caeea9a61ebe04034d07ee
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:graphviz:graphviz:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2.46.0"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "9.0"
                },
                {
                    "last_affected":  "9.0"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "10.0"
                },
                {
                    "last_affected":  "10.0"
                }
            ],
            "source":  "CPE_STRING"
        }
    ]
}

Affected versions

10.*
10.0
10.0.1
2.*
2.38.0
2.42.0
2.42.2
2.42.3
2.42.4
2.44.0
2.44.1
9.*
9.0
9.0.0
Other
TRAVIS_CI_BUILD_EXPERIMENTAL
stable_release_2.*
stable_release_2.42.0
stable_release_2.42.2
stable_release_2.42.3
stable_release_2.42.4
stable_release_2.44.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-18032.json"