CVE-2018-19490
gnuplot: An issue was discovered in datafile.c in Gnuplot 5.2.5
CVE-2018-19490 is fixed in 5 products on 1 platform, first by gnuplot 5.2.2+dfsg1-2ubuntu1+esm1, released July 5, 2023. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Low
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0177
78th percentile
An issue was discovered in datafile.c in Gnuplot 5.2.5. This issue allows an attacker to conduct a heap-based buffer overflow with an arbitrary amount of data in df_generate_ascii_array_entry. To exploit this vulnerability, an attacker must pass an overlong string as the right bound of the range argument that is passed to the plot function.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| gnuplot · Ubuntu 18.04.6 LTS (bionic) | 5.2.2+dfsg1-2ubuntu1+esm1 | gnuplot 5.2.2+dfsg1-2ubuntu1+esm1 | Jul 5, 2023 |
| gnuplot-data · Ubuntu 18.04.6 LTS (bionic) | 5.2.2+dfsg1-2ubuntu1+esm1 | gnuplot-data 5.2.2+dfsg1-2ubuntu1+esm1 | Jul 5, 2023 |
| gnuplot-nox · Ubuntu 18.04.6 LTS (bionic) | 5.2.2+dfsg1-2ubuntu1+esm1 | gnuplot-nox 5.2.2+dfsg1-2ubuntu1+esm1 | Jul 5, 2023 |
| gnuplot-qt · Ubuntu 18.04.6 LTS (bionic) | 5.2.2+dfsg1-2ubuntu1+esm1 | gnuplot-qt 5.2.2+dfsg1-2ubuntu1+esm1 | Jul 5, 2023 |
| gnuplot-x11 · Ubuntu 18.04.6 LTS (bionic) | 5.2.2+dfsg1-2ubuntu1+esm1 | gnuplot-x11 5.2.2+dfsg1-2ubuntu1+esm1 | Jul 5, 2023 |