CVE catalog

CVE-2023-46045

graphviz: CVE-2023-46045

[CVE catalog]

Severity
Low · CVSS 3.4CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.81% · Oct 25, 2026

Graphviz 2.36.0 through 9.x before 10.0.1 has an out-of-bounds read via a crafted config6a file. NOTE: exploitability may be uncommon because this file is typically owned by root.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangraphvizsid14.1.2-1fixed
Debiangraphvizforky14.1.2-1fixed
Debiangraphviztrixie2.42.4-3fixed
Debiangraphvizbookworm2.42.2-7+deb12u1vulnerable
Ubuntugraphvizpro2.42.2-5vulnerable
Ubuntugraphvizpro2.42.2-5build1vulnerable
Ubuntugraphvizpro2.42.2-6vulnerable
Ubuntugraphvizpro2.42.2-6ubuntu0.1~esm1fixed
Ubuntugraphvizpro2.42.2-5vulnerable
Ubuntugraphvizpro2.42.2-5build1vulnerable
Ubuntugraphvizpro2.42.2-6vulnerable
Ubuntugraphvizpro2.42.2-6ubuntu0.1~esm1vulnerable
Ubuntugraphvizpro2.42.2-6ubuntu0.1vulnerable
Ubuntugraphvizpro2.42.2-6ubuntu0.1+esm1fixed
Susegraphvizlinux enterprise module for basesystem 15 sp52.48.0-150400.3.3.1fixed
Susegraphviz-addonslinux enterprise module for development tools 15 sp52.48.0-150400.3.3.1fixed
Susegraphviz-addonslinux enterprise module for package hub 15 sp52.48.0-150400.3.3.1fixed
Susegraphviz-addonslinux enterprise module for server applications 15 sp52.48.0-150400.3.3.1fixed
Susegraphviz-addonslinux enterprise high availability extension 15 sp42.48.0-150400.3.3.1fixed
Susegraphviz-addonslinux enterprise high availability extension 15 sp52.48.0-150400.3.3.1fixed
Opensusegraphvizleap 15.52.48.0-150400.3.3.1fixed
Opensusegraphviz-addonsleap 15.52.48.0-150400.3.3.1fixed
Susegraphviz-addonslinux enterprise module for desktop applications 15 sp52.48.0-150400.3.3.1fixed
Susegraphviz-addonslinux enterprise module for desktop applications 15 sp62.48.0-150400.3.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangraphvizsourcesid2.42.2-8unimportantNot reportedNot reported
Debiangraphvizsourceforky2.42.2-8unimportantNot reportedNot reported
Debiangraphvizsourcetrixie2.42.2-8unimportantNot reportedNot reported
Debiangraphvizsourcebookworm(unfixed)unimportantNot reportedNot reported
Ubuntugraphvizdebpro2.42.2-6ubuntu0.1~esm1Not reportedUSN-6708-1Not reported
Ubuntugraphvizdebpro2.42.2-6ubuntu0.1+esm1Not reportedUBUNTU-CVE-2023-46045Not reported
Susegraphvizrpmlinux enterprise module for basesystem 15 sp52.48.0-150400.3.3.1Not reportedSUSE-SU-2024:1351-1Not reported
Susegraphviz-addonsrpmlinux enterprise module for development tools 15 sp52.48.0-150400.3.3.1Not reportedSUSE-SU-2024:1351-1Not reported
Susegraphviz-addonsrpmlinux enterprise module for package hub 15 sp52.48.0-150400.3.3.1Not reportedSUSE-SU-2024:1351-1Not reported
Susegraphviz-addonsrpmlinux enterprise module for server applications 15 sp52.48.0-150400.3.3.1Not reportedSUSE-SU-2024:1351-1Not reported
Susegraphviz-addonsrpmlinux enterprise high availability extension 15 sp42.48.0-150400.3.3.1Not reportedSUSE-SU-2024:1351-1Not reported
Susegraphviz-addonsrpmlinux enterprise high availability extension 15 sp52.48.0-150400.3.3.1Not reportedSUSE-SU-2024:1351-1Not reported
Opensusegraphvizrpmleap 15.52.48.0-150400.3.3.1Not reportedSUSE-SU-2024:1351-1Not reported
Opensusegraphviz-addonsrpmleap 15.52.48.0-150400.3.3.1Not reportedSUSE-SU-2024:1351-1Not reported
Susegraphviz-addonsrpmlinux enterprise module for desktop applications 15 sp52.48.0-150400.3.3.1Not reportedSUSE-SU-2024:1351-2Not reported
Susegraphviz-addonsrpmlinux enterprise module for desktop applications 15 sp62.48.0-150400.3.3.1Not reportedSUSE-SU-2024:1351-2Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]