An issue was discovered in cairo.trm in Gnuplot 5.2.5. This issue allows an attacker to conduct a buffer overflow with an arbitrary amount of data in the cairotrm_options function. This flaw is caused by a missing size check of an argument passed to the "set font" function. This issue occurs when the Gnuplot pngcairo terminal is used as a backend.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7589-1 advisory.

    Tim Blazytko, Cornelius Aschermann, Sergej Schumilo, and Nils Bars discovered that Gnuplot had several     memory-related issues. An attacker could possibly use these issues to cause Gnuplot to experience a buffer     overflow, resulting in a denial of service or arbitrary code execution. These issues only affected Ubuntu     14.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-19490, CVE-2018-19491, CVE-2018-19492)

    It was discovered that Gnuplot could write out-of-bounds due to the use of strncpy(). An attacker could     possibly use this issue to enable the execution of arbitrary code. This issue only affected Ubuntu 20.04     LTS. (CVE-2020-25412)

    It was discovered that Gnuplot incorrectly freed memory when executing print_set_output(). An attacker     could possibly use this issue to enable the execution of arbitrary code. (CVE-2020-25559)

    It was discovered that Gnuplot's plotrequest() function contained a buffer overflow. An attacker could     possibly use this issue to cause Gnuplot to crash, resulting in a denial of service or arbitrary code     execution. (CVE-2020-25969)

    It was discovered that Gnuplot's boundary3d() function could be made to divide by zero. An attacker could     possibly use this issue to cause Gnuplot to crash, resulting in a denial of service. (CVE-2021-44917)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4541-1 advisory.

    Tim Blazytko, Cornelius Aschermann, Sergej Schumilo and Nils Bars

    discovered that Gnuplot did not properly validate string sizes in the df_generate_ascii_array_entry     function. An attacker could possibly use this issue to cause a heap buffer overflow, resulting in a denial     of

    service attack or arbitrary code execution. (CVE-2018-19490)

    Tim Blazytko, Cornelius Aschermann, Sergej Schumilo and Nils Bars

    discovered that Gnuplot did not properly validate string sizes in the

    PS_options function when the Gnuplot postscript terminal is used as a

    backend. An attacker could possibly use this issue to cause a buffer overflow, resulting in a denial of     service attack or arbitrary code

    execution. (CVE-2018-19491)

    Tim Blazytko, Cornelius Aschermann, Sergej Schumilo and Nils Bars

    discovered that Gnuplot did not properly validate string sizes in the

    cairotrm_options function when the Gnuplot postscript terminal is used as a backend. An attacker could     possibly use this issue to cause a buffer overflow, resulting in a denial of service attack or arbitrary     code

    execution. (CVE-2018-19492)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the gnuplot packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in datafile.c in Gnuplot 5.2.5.
    This issue allows an attacker to conduct a heap-based     buffer overflow with an arbitrary amount of data in     df_generate_ascii_array_entry. To exploit this     vulnerability, an attacker must pass an overlong string     as the right bound of the range argument that is passed     to the plot function.(CVE-2018-19490)

  - An issue was discovered in post.trm in Gnuplot 5.2.5.
    This issue allows an attacker to conduct a buffer     overflow with an arbitrary amount of data in the     PS_options function. This flaw is caused by a missing     size check of an argument passed to the 'set font'     function. This issue occurs when the Gnuplot postscript     terminal is used as a backend.(CVE-2018-19491)

  - An issue was discovered in cairo.trm in Gnuplot 5.2.5.
    This issue allows an attacker to conduct a buffer     overflow with an arbitrary amount of data in the     cairotrm_options function. This flaw is caused by a     missing size check of an argument passed to the 'set     font' function. This issue occurs when the Gnuplot     pngcairo terminal is used as a backend.(CVE-2018-19492)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for gnuplot fixes the following issues :

Following security issues were fixed :

CVE-2018-19492: Fixed a buffer overflow in cairotrm_options function (bsc#1117463)

CVE-2018-19491: Fixed a buffer overlow in the PS_options function (bsc#1117464)

CVE-2018-19490: Fixed a heap-based buffer overflow in the df_generate_ascii_array_entry function (bsc#1117465)

CVE-2017-9670: Fixed a uninitialized stack variable vulnerability which could lead to a Denial of Service (bsc#1044638)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for gnuplot fixes the following issues :

Security issues fixed :

  - CVE-2018-19492: Fixed a buffer overflow in     cairotrm_options function (bsc#1117463)

  - CVE-2018-19491: Fixed a buffer overlow in the PS_options     function (bsc#1117464)

  - CVE-2018-19490: Fixed a heap-based buffer overflow in     the df_generate_ascii_array_entry function (bsc#1117465)

This update was imported from the SUSE:SLE-15:Update update project.

This update for gnuplot fixes the following issues :

Security issues fixed :

CVE-2018-19492: Fixed a buffer overflow in cairotrm_options function (bsc#1117463)

CVE-2018-19491: Fixed a buffer overlow in the PS_options function (bsc#1117464)

CVE-2018-19490: Fixed a heap-based buffer overflow in the df_generate_ascii_array_entry function (bsc#1117465)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

gnuplot, a command-line driven interactive plotting program, has been examined with fuzzing by Tim Blazytko, Cornelius Aschermann, Sergej Schumilo and Nils Bars. They found various overflow cases which might lead to the execution of arbitrary code.

Due to special toolchain hardening in Debian, CVE-2018-19492 is not security relevant, but it is a bug and the patch was applied for the sake of completeness. Probably some downstream project does not have the same toolchain settings.

For Debian 8 'Jessie', these problems have been fixed in version 4.6.6-2+deb8u1.

We recommend that you upgrade your gnuplot packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

gnuplot5, a command-line driven interactive plotting program, has been examined with fuzzing by Tim Blazytko, Cornelius Aschermann, Sergej Schumilo and Nils Bars. They found various overflow cases which might lead to the execution of arbitrary code.

Due to special toolchain hardening in Debian, CVE-2018-19492 is not security relevant, but it is a bug and the patch was applied for the sake of completeness. Probably some downstream project does not have the same toolchain settings.

For Debian 8 'Jessie', these problems have been fixed in version 5.0.0~rc+dfsg2-1+deb8u1.

We recommend that you upgrade your gnuplot5 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
240563	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS : Gnuplot vulnerabilities (USN-7589-1)	Nessus	Ubuntu Local Security Checks	critical
140801	Ubuntu 16.04 LTS : Gnuplot vulnerabilities (USN-4541-1)	Nessus	Ubuntu Local Security Checks	high
139954	EulerOS 2.0 SP8 : gnuplot (EulerOS-SA-2020-1851)	Nessus	Huawei Local Security Checks	high
138268	SUSE SLES12 Security Update : gnuplot (SUSE-SU-2020:1660-1)	Nessus	SuSE Local Security Checks	high
124107	openSUSE Security Update : gnuplot (openSUSE-2019-1216)	Nessus	SuSE Local Security Checks	high
123929	SUSE SLES15 Security Update : gnuplot (SUSE-SU-2019:0904-1)	Nessus	SuSE Local Security Checks	high
119266	Debian DLA-1597-1 : gnuplot security update	Nessus	Debian Local Security Checks	high
119123	Debian DLA-1595-1 : gnuplot5 security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2018-19492

high

Tenable Plugins

critical

high

high

high

high

high

high

high