CVE-2014-9157
Format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows...
Format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows remote attackers to have unspecified impact via format string specifiers in unknown vectors, which are not properly handled in an error string.
Exploit likelihood
What each source reports
NVD Score used
Format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows remote attackers to have unspecified impact via format string specifiers in unknown vectors, which are not properly handled in an error string.
- Record
CVE-2014-9157- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-134
- Updated
- 2026-11-02
CVE List No score
Format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows remote attackers to have unspecified impact via format string specifiers in unknown vectors, which are not properly handled in an error string.
- Record
CVE-2014-9157- Updated
- 2026-11-02
EUVDEUVD-2014-8982 No score
Format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows remote attackers to have unspecified impact via format string specifiers in unknown vectors, which are not properly handled in an error string.
- Record
EUVD-2014-8982- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h5f2-wwmp-f73m No score
Format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows...
Format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows remote attackers to have unspecified impact via format string specifiers in unknown vectors, which are not properly handled in an error string.
- Record
GHSA-h5f2-wwmp-f73m- Weakness
- CWE-134
- Updated
- 2026-11-02
OSV No score
Format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows remote attackers to have unspecified impact via format string specifiers in unknown vectors, which are not properly handled in an error string.
- Record
CVE-2014-9157- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-9157 No score
Format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows remote attackers to have unspecified impact via format string specifiers in unknown vectors, which are not properly handled in an error string.
- Record
DEBIAN-CVE-2014-9157- Updated
- 2026-11-02
OSVMGASA-2014-0520 No score
Updated graphviz packages fix CVE-2014-9157
Updated graphviz packages fix security vulnerability:
Format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows remote attackers to have unspecified impact via format string specifiers in unknown vector, which are not properly handled in an error string (CVE-2014-9157).
- Record
MGASA-2014-0520- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-9157 No score
Format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows remote attackers to have unspecified impact via format string specifiers in unknown vectors, which are not properly handled in an error string.
- Record
UBUNTU-CVE-2014-9157- Updated
- 2026-11-02
OSVUSN-2435-1 No score
graphviz vulnerability
It was discovered that graphviz incorrectly handled parsing errors. An attacker could use this issue to cause graphviz to crash or possibly execute arbitrary code.
- Record
USN-2435-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
graphvizDebian:12 |
before 2.38.0-7 | 2.38.0-7 |
graphvizDebian:13 |
before 2.38.0-7 | 2.38.0-7 |
graphvizDebian:14 |
before 2.38.0-7 | 2.38.0-7 |
graphvizDebian:6.0 |
before 2.26.3-5+squeeze3, plus listed versions 2.26.3-52.26.3-5+hurd.12.26.3-5+squeeze12.26.3-5+squeeze2 |
2.26.3-5+squeeze3 |
graphvizDebian:7 |
before 2.26.3-14+deb7u2, plus listed versions 2.26.3-142.26.3-14+deb7u1 |
2.26.3-14+deb7u2 |
graphvizMageia:4 |
before 2.34.0-6.1.mga4 | 2.34.0-6.1.mga4 |
graphvizUbuntu:14.04:LTS |
before 2.36.0-0ubuntu3.1, plus listed versions 2.26.3-15ubuntu42.34.0-0ubuntu42.34.0-0ubuntu52.36.0-0ubuntu12.36.0-0ubuntu22.36.0-0ubuntu3 |
2.36.0-0ubuntu3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-9157 is a high vulnerability (CVSS 7.5) in Graphviz, published December 3, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.57%, the 92nd percentile. Fixed in graphviz 2.38.0-7.
References
mandriva.com/security/advisories?name=MDVSA-2014:248
exchange.xforce.ibmcloud.com/vulnerabilities/98949
seclists.org/oss-sec/2014/q4/872
advisories.mageia.org/MGASA-2014-0520.html
securityfocus.com/bid/71283
Show 13 moreShow less
github.com/ellson/graphviz/commit/99eda421f7ddc27b14e4ac1d2126e5fe41719081
debian.org/security/2014/dsa-3098
secunia.com/advisories/60166
nvd.nist.gov/vuln/detail/CVE-2014-9157
security-tracker.debian.org/tracker/CVE-2014-9157
bugs.mageia.org/show_bug.cgi?id=14756
lists.fedoraproject.org/pipermail/package-announce/2014-December/145217.html
ubuntu.com/security/CVE-2014-9157
openwall.com/lists/oss-security/2014/12/09/16
cve.org/CVERecord?id=CVE-2014-9157