CVE-2018-10196

Name of the Vulnerable Software and Affected Versions Graphviz version 2.40.1

Description The issue is related to a NULL pointer dereference vulnerability in the rebuild vlists function in lib/dotgen/conc.c in the dotgen library. This vulnerability allows remote attackers to cause a denial of service, resulting in an application crash, via a crafted file.

Recommendations For Graphviz version 2.40.1, consider disabling the rebuild vlists function in lib/dotgen/conc.c as a temporary workaround until a patch is available. Restrict access to crafted files that could exploit this vulnerability to minimize the risk of denial of service. At the moment, there is no information about a newer version that contains a fix for this vulnerability.