CVE-2018-10196

Vulnerability

A NULL pointer dereference vulnerability exists in the rebuild_vlists function in lib/dotgen/conc.c within the dotgen library of Graphviz version 2.40.1. The flaw can be triggered when processing a specially crafted file, leading to a denial of service via application crash. The issue is identified as CVE-2018-10196 [1][2].

Exploitation

An attacker can exploit this vulnerability by providing a maliciously crafted DOT file to Graphviz. No special privileges or authentication are required; the attacker only needs to convince the victim to open or process the file using Graphviz. Upon processing, the rebuild_vlists function dereferences a NULL pointer, causing the application to crash [1][2].

Impact

Successful exploitation results in a denial of service condition. The application crashes, potentially disrupting services that rely on Graphviz for graph rendering. The impact is limited to availability; confidentiality and integrity are not affected according to available references [1][2].

Mitigation

As of the available references, Red Hat has classified this as a low-severity issue and closed the bug as NOTABUG, indicating that no fix has been released [1]. Ubuntu's security notice (USN-3731-1) covers a different package (LFTP) and is not directly related [2]. Users should monitor the Graphviz project for future updates or consider limiting exposure to untrusted DOT files. No workaround is documented [1][2].