Buffer Overflow Vulnerability in Gnuplot: CVE-2018-19492
Summary
UBUNTU-CVE-2018-19492: An issue was discovered in cairo.trm in Gnuplot 5.2.5. Affects gnuplot versions 4.6.3-2 – 4.6.4-2ubuntu0.1~esm2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gnuplot is a portable command-line driven graphing utility that allows users to visualize data in various formats. It supports multiple output formats, including PNG, PDF, and SVG, and is widely used in academic and scientific communities for data analysis and presentation. The vulnerability in question affects Gnuplot versions 5.2.5 and earlier, specifically in the cairo.trm file, which is responsible for handling the pngcairo terminal backend.
Vulnerability Detail
An issue was discovered in the cairo.trm file of Gnuplot 5.2.5 that allows an attacker to conduct a buffer overflow by sending an arbitrary amount of data to the cairotrm_options function. This flaw arises from a missing size check on an argument passed to the 'set font' function, which can lead to potential code execution or denial of service when the Gnuplot pngcairo terminal is used as a backend. The CVSS score for this vulnerability is 7.8, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the pngcairo terminal backend in Gnuplot until the package is updated. Instead, consider using alternative terminal types such as 'pdf' or 'postscript' for generating plots.
Conclusion
The buffer overflow vulnerability CVE-2018-19492 in Gnuplot poses significant risks to users, particularly those utilizing the pngcairo terminal backend. It is crucial to update to the patched version to mitigate these risks. Additionally, users can leverage tools like Vulert to monitor for vulnerabilities in their software.
See every vulnerability recorded for gnuplot →
FAQ
CVE-2018-19492 is a buffer overflow vulnerability found in Gnuplot that can be exploited through the pngcairo terminal backend.
You can check your Gnuplot version by running 'gnuplot --version' in the terminal. If it is 5.2.5 or earlier, it is affected.
Exploitation of this vulnerability could lead to arbitrary code execution or denial of service, compromising system security.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for gnuplot.
