Out-of-bounds read in graphviz - CVE-2023-46045

Vulnerability identifier: #VU92383

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-46045

CWE-ID: CWE-125

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when parsing the config6a configuration file. A local user with privileges to edit the configuration file can trigger an out-of-bounds read error and read contents of memory on the system.

graphviz
Oracle Solaris
Amazon Linux AMI
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
Ubuntu
Desktop Applications Module
openEuler
Anolis OS
graphviz (Ubuntu package)
graphviz-docs
graphviz
graphviz-python3
graphviz-ruby
graphviz-java
graphviz-python2
graphviz-tcl
graphviz-debugsource
graphviz-debuginfo
graphviz-lua
graphviz-ocaml
graphviz-devel
graphviz-perl
graphviz-gd
graphviz-doc
graphviz-gtk2
graphviz-graphs

Install updates from vendor's website.

graphviz - update to 10.0.1
Oracle Solaris - update to 11.4 SRU 71
graphviz (Ubuntu package) - update to Ubuntu Pro
graphviz-docs - update to 2.44.0-5
graphviz - update to 2.44.0-5
graphviz-python3 - update to 2.44.0-5
graphviz-ruby - update to 2.44.0-5
graphviz-java - update to 2.44.0-5
graphviz-python2 - update to 2.44.0-5
graphviz-tcl - update to 2.44.0-5
graphviz-debugsource - update to 2.44.0-5
graphviz-debuginfo - update to 2.44.0-5
graphviz-lua - update to 2.44.0-5
graphviz-ocaml - update to 2.44.0-5
graphviz-devel - update to 2.44.0-5
graphviz-perl - update to 2.44.0-5
graphviz - update to 2.44.0-25
graphviz-gd - update to 2.48.0-150400.3.3.1
graphviz-doc - update to 8.0.5-3
graphviz-tcl - update to 8.0.5-3
graphviz-ruby - update to 8.0.5-3
graphviz-python3 - update to 8.0.5-3
graphviz-perl - update to 8.0.5-3
graphviz-ocaml - update to 8.0.5-3
graphviz-lua - update to 8.0.5-3
graphviz-java - update to 8.0.5-3
graphviz-gtk2 - update to 8.0.5-3
graphviz-graphs - update to 8.0.5-3
graphviz-gd - update to 8.0.5-3
graphviz-devel - update to 8.0.5-3
graphviz - update to 8.0.5-3

• https://gitlab.com/graphviz/graphviz/-/issues/2441
• https://seclists.org/fulldisclosure/2024/Jan/73
• https://www.openwall.com/lists/oss-security/2024/02/01/2
• http://seclists.org/fulldisclosure/2024/Feb/24
• https://seclists.org/fulldisclosure/2024/Feb/24

• Information disclosure in Graphviz
• openEuler update for graphviz
• Ubuntu update for graphviz
• Amazon Linux AMI update for graphviz
• Oracle Solaris update for thrid-party components
• SUSE update for graphviz
• Anolis OS update for graphviz