What’s Vulnerable › Vulnerabilities

CVE-2018-10196

• Severity: medium (CVSS 5.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-05-30 · updated 2026-06-17
• Weakness: CWE-476

Description

NULL pointer dereference vulnerability in the rebuild_vlists function in lib/dotgen/conc.c in the dotgen library in Graphviz 2.40.1 allows remote attackers to cause a denial of service (application crash) via a crafted file.

Affected products

• Canonical Ubuntu Linux: 14.04, 16.04, 18.04
• Fedoraproject Fedora: 27, 28
• Graphviz: 2.40.1

References

• https://bugzilla.redhat.com/show_bug.cgi?id=1579254
• https://gitlab.com/graphviz/graphviz/issues/1367
• https://lists.debian.org/debian-lts-announce/2021/05/msg00014.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VR2CT3LD52GWAQUZAOSEXSYE3O7HGN/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TWUEEJPMS5LAROYJYY6FREOTI6VPN3M4/
• https://usn.ubuntu.com/3731-1/
• https://bugzilla.redhat.com/show_bug.cgi?id=1579254
• https://gitlab.com/graphviz/graphviz/issues/1367
• https://lists.debian.org/debian-lts-announce/2021/05/msg00014.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VR2CT3LD52GWAQUZAOSEXSYE3O7HGN/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TWUEEJPMS5LAROYJYY6FREOTI6VPN3M4/
• https://usn.ubuntu.com/3731-1/

Get alerted when CVE-2018-10196 or the next vulnerability affects your stack