CVE-2019-9904

Name of the Vulnerable Software and Affected Versions graphviz version 2.40.1

Description An issue was discovered in libcdtdttree.c in libcdt.a, related to recursive agclose calls in libcgraphgraph.c in libcgraph.a. This issue is connected to agfstsubg in libcgraphsubg.c, leading to stack consumption.

Recommendations For graphviz version 2.40.1, consider disabling the recursive agclose calls in libcgraphgraph.c as a temporary workaround until a patch is available. Restrict access to the agfstsubg function in libcgraphsubg.c to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.