CVE-2019-9904

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue was discovered in lib\cdt\dttree.c in libcdt.a in graphviz 2.40.1. Stack consumption occurs because of recursive agclose calls in lib\cgraph\graph.c in libcgraph.a, related to agfstsubg in lib\cgraph\subg.c.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-674

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gitlab.com/graphviz/graphviz/issues/1512Exploit, Issue Tracking, Third Party Advisory
https://research.loginsoft.com/bugs/stack-buffer-overflow-in-function-agclose-graphviz/Exploit, Third Party Advisory
https://security.gentoo.org/glsa/202107-04Third Party Advisory
https://gitlab.com/graphviz/graphviz/issues/1512Exploit, Issue Tracking, Third Party Advisory
https://research.loginsoft.com/bugs/stack-buffer-overflow-in-function-agclose-graphviz/Exploit, Third Party Advisory
https://security.gentoo.org/glsa/202107-04Third Party Advisory

Timeline

Published: Mar 21, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-99086.1The font-organizer plugin 2.1.1 for WordPress has wp-admin/options-general.php manage_font_id XSS.CVE-2019-99096.1The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS.CVE-2019-99106.1The kingcomposer plugin 2.7.6 for WordPress has wp-admin/admin.php?page=kc-mapper id XSS.CVE-2019-99116.1The social-networks-auto-poster-facebook-twitter-g plugin before 4.2.8 for WordPress has wp-admin/admin.php?page=nxssnap-reposter&action=edi CVE-2019-99126.1The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATH_INFO.CVE-2019-99136.1The wp-live-chat-support plugin before 8.0.18 for WordPress has wp-admin/admin.php?page=wplivechat-menu-gdpr-page term XSS.CVE-2019-99146.1The yop-poll plugin before 6.0.3 for WordPress has wp-admin/admin.php?page=yop-polls&action=view-votes poll_id XSS.CVE-2019-99156.1GetSimpleCMS 3.3.13 has an Open Redirect via the admin/index.php redirect parameter.CVE-2019-99176.5ZNC before 1.7.3-rc1 allows an existing remote user to cause a Denial of Service (crash) via invalid encoding.CVE-2019-99189.1An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. Input does not get validated and queries are not written in CVE-2019-99195.4An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. It is possible to craft messages in a way that JavaScript ge CVE-2019-99208.8An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. It is possible to perform an action within the context of th