CVE-2014-9157

Format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows remote attackers to have unspecified impact via format string specifiers in unknown vectors, which are not properly handled in an error string.

• CWE-134

• http://advisories.mageia.org/MGASA-2014-0520.htmlThird Party Advisory
• http://seclists.org/oss-sec/2014/q4/784Exploit, Mailing List, Third Party Advisory
• http://seclists.org/oss-sec/2014/q4/872Exploit, Mailing List, Third Party Advisory
• http://secunia.com/advisories/60166Broken Link
• http://www.debian.org/security/2014/dsa-3098Third Party Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2014:248Broken Link
• http://www.mandriva.com/security/advisories?name=MDVSA-2015:187Broken Link
• http://www.securityfocus.com/bid/71283Broken Link, Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/98949Third Party Advisory, VDB Entry
• https://github.com/ellson/graphviz/commit/99eda421f7ddc27b14e4ac1d2126e5fe41719081Exploit, Third Party Advisory
• http://advisories.mageia.org/MGASA-2014-0520.htmlThird Party Advisory
• http://seclists.org/oss-sec/2014/q4/784Exploit, Mailing List, Third Party Advisory
• http://seclists.org/oss-sec/2014/q4/872Exploit, Mailing List, Third Party Advisory
• http://secunia.com/advisories/60166Broken Link
• http://www.debian.org/security/2014/dsa-3098Third Party Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2014:248Broken Link
• http://www.mandriva.com/security/advisories?name=MDVSA-2015:187Broken Link
• http://www.securityfocus.com/bid/71283Broken Link, Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/98949Third Party Advisory, VDB Entry
• https://github.com/ellson/graphviz/commit/99eda421f7ddc27b14e4ac1d2126e5fe41719081Exploit, Third Party Advisory

Published

Dec 3, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-9151The Services module 7.x-3.x before 7.x-3.10 for Drupal does …
• CVE-2014-9152The _user_resource_create function in the Services module 7.…
• CVE-2014-9153Cross-site scripting (XSS) vulnerability in the Services mod…
• CVE-2014-9154The Notify module 7.x-1.x before 7.x-1.1 for Drupal does not…
• CVE-2014-9155Directory traversal vulnerability in the Avatar Uploader mod…
• CVE-2014-9156The FileField module 6.x-3.x before 6.x-3.13 for Drupal does…
• CVE-2014-9158Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before…
• CVE-2014-9159Heap-based buffer overflow in Adobe Reader and Acrobat 10.x …
• CVE-2014-9160Multiple heap-based buffer overflows in Adobe Reader and Acr…
• CVE-2014-9161CoolType.dll in Adobe Reader and Acrobat 10.x before 10.1.13…
• CVE-2014-9162Adobe Flash Player before 13.0.0.259 and 14.x through 16.x b…
• CVE-2014-9163Stack-based buffer overflow in Adobe Flash Player before 13.…7.8