A graphviz security update has been released for openSUSE Leap 15.3.

openSUSE-SU-2021:1651-1: critical: Security update for graphviz

openSUSE Security Update: Security update for graphviz
______________________________________________________________________________

Announcement ID: openSUSE-SU-2021:1651-1
Rating: critical
References: #1185833
Cross-References: CVE-2020-18032
CVSS scores:
CVE-2020-18032 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2020-18032 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products:
openSUSE Leap 15.3
______________________________________________________________________________

An update that fixes one vulnerability is now available.

Description:

This update for graphviz fixes the following issues:

- CVE-2020-18032: Fixed possible remote code execution via buffer overflow
(bsc#1185833).

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.3:

zypper in -t patch openSUSE-SLE-15.3-2021-1651=1


Package List:

- openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):

graphviz-2.40.1-6.9.1
graphviz-addons-debuginfo-2.40.1-6.9.1
graphviz-addons-debugsource-2.40.1-6.9.1
graphviz-debuginfo-2.40.1-6.9.1
graphviz-debugsource-2.40.1-6.9.1
graphviz-devel-2.40.1-6.9.1
graphviz-doc-2.40.1-6.9.1
graphviz-gd-2.40.1-6.9.1
graphviz-gd-debuginfo-2.40.1-6.9.1
graphviz-gnome-2.40.1-6.9.1
graphviz-gnome-debuginfo-2.40.1-6.9.1
graphviz-guile-2.40.1-6.9.1
graphviz-guile-debuginfo-2.40.1-6.9.1
graphviz-gvedit-2.40.1-6.9.1
graphviz-gvedit-debuginfo-2.40.1-6.9.1
graphviz-java-2.40.1-6.9.1
graphviz-java-debuginfo-2.40.1-6.9.1
graphviz-lua-2.40.1-6.9.1
graphviz-lua-debuginfo-2.40.1-6.9.1
graphviz-perl-2.40.1-6.9.1
graphviz-perl-debuginfo-2.40.1-6.9.1
graphviz-php-2.40.1-6.9.1
graphviz-php-debuginfo-2.40.1-6.9.1
graphviz-plugins-core-2.40.1-6.9.1
graphviz-plugins-core-debuginfo-2.40.1-6.9.1
graphviz-python-2.40.1-6.9.1
graphviz-python-debuginfo-2.40.1-6.9.1
graphviz-ruby-2.40.1-6.9.1
graphviz-ruby-debuginfo-2.40.1-6.9.1
graphviz-smyrna-2.40.1-6.9.1
graphviz-smyrna-debuginfo-2.40.1-6.9.1
graphviz-tcl-2.40.1-6.9.1
graphviz-tcl-debuginfo-2.40.1-6.9.1
libgraphviz6-2.40.1-6.9.1
libgraphviz6-debuginfo-2.40.1-6.9.1

References:

  https://www.suse.com/security/cve/CVE-2020-18032.html
  https://bugzilla.suse.com/1185833