USN-5971-1: Graphviz vulnerabilities

24080

02 August 2023

02 August 2023

CLOSED

MEDIUM

CVE-2018-10196,CVE-2019-11023,CVE-2020-18032

Severity

medium

Vendor

VMware Tanzu

Versions Affected

  • Canonical Ubuntu 18.04

Description

It was discovered that graphviz contains null pointer dereference vulnerabilities. Exploitation via a specially crafted input file can cause a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-10196) It was discovered that graphviz contains null pointer dereference vulnerabilities. Exploitation via a specially crafted input file can cause a denial of service. These issues only affected Ubuntu 14.04 ESM and Ubuntu 18.04 LTS. (CVE-2019-11023) It was discovered that graphviz contains a buffer overflow vulnerability. Exploitation via a specially crafted input file can cause a denial of service or possibly allow for arbitrary code execution. These issues only affected Ubuntu 14.04 ESM, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-18032) Update Instructions: Run `sudo pro fix USN-5971-1` to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: graphviz - 2.40.1-2ubuntu0.1~esm1 graphviz-doc - 2.40.1-2ubuntu0.1~esm1 libcdt5 - 2.40.1-2ubuntu0.1~esm1 libcgraph6 - 2.40.1-2ubuntu0.1~esm1 libgraphviz-dev - 2.40.1-2ubuntu0.1~esm1 libgv-guile - 2.40.1-2ubuntu0.1~esm1 libgv-lua - 2.40.1-2ubuntu0.1~esm1 libgv-perl - 2.40.1-2ubuntu0.1~esm1 libgv-php7 - 2.40.1-2ubuntu0.1~esm1 libgv-ruby - 2.40.1-2ubuntu0.1~esm1 libgv-tcl - 2.40.1-2ubuntu0.1~esm1 libgvc6 - 2.40.1-2ubuntu0.1~esm1 libgvc6-plugins-gtk - 2.40.1-2ubuntu0.1~esm1 libgvpr2 - 2.40.1-2ubuntu0.1~esm1 liblab-gamut1 - 2.40.1-2ubuntu0.1~esm1 libpathplan4 - 2.40.1-2ubuntu0.1~esm1 libxdot4 - 2.40.1-2ubuntu0.1~esm1 python-gv - 2.40.1-2ubuntu0.1~esm1 python3-gv - 2.40.1-2ubuntu0.1~esm1 Available with Ubuntu Pro: https://ubuntu.com/pro

CVEs contained in this USN include: CVE-2018-10196, CVE-2019-11023, CVE-2020-18032

Affected VMware Products and Versions

Severity is medium unless otherwise noted.

  • Isolation Segment
    • 2.11.x versions prior to 2.11.36
    • 2.13.x versions prior to 2.13.21
    • 3.0.x versions prior to 3.0.14
    • 4.0.x versions prior to 4.0.5
  • VMware Tanzu Application Service for VMs
    • 2.11.x versions prior to 2.11.42
    • 2.13.x versions prior to 2.13.24
    • 3.0.x versions prior to 3.0.14
    • 4.0.x versions prior to 4.0.5

Mitigation

Users of affected products are strongly encouraged to follow the mitigation below. On the Tanzu Network product page for each release, check the Depends On section and/or Release Notes for this information. Releases that have fixed this issue include:
  • Isolation Segment
    • 2.11.36
    • 2.13.21
    • 3.0.14
    • 4.0.5
  • VMware Tanzu Application Service for VMs
    • 2.11.42
    • 2.13.24
    • 3.0.14
    • 4.0.5

References

History

2023-08-02: Initial vulnerability report published.