CVE-2018-19491
published 2018-11-23CVE-2018-19491: An issue was discovered in post.trm in Gnuplot 5.2.5. This issue allows an attacker to conduct a buffer overflow with an arbitrary amount of data in the…
PriorityP338high7.8CVSS 3.0
AVLACLPRNUIRSUCHIHAH
EPSS
1.55%
72.4th percentile
An issue was discovered in post.trm in Gnuplot 5.2.5. This issue allows an attacker to conduct a buffer overflow with an arbitrary amount of data in the PS_options function. This flaw is caused by a missing size check of an argument passed to the "set font" function. This issue occurs when the Gnuplot postscript terminal is used as a backend.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | gnuplot | < gnuplot 5.4.0+dfsg1-1 (bookworm) | gnuplot 5.4.0+dfsg1-1 (bookworm) |
| gnuplot | gnuplot | — | — |
| gnuplot | gnuplot | >= 0 < 5.4.0+dfsg1-1 | 5.4.0+dfsg1-1 |
| gnuplot | gnuplot | >= 0 < 5.4.0+dfsg1-1 | 5.4.0+dfsg1-1 |
| gnuplot | gnuplot | >= 0 < 5.4.0+dfsg1-1 | 5.4.0+dfsg1-1 |
| gnuplot | gnuplot | >= 0 < 5.4.0+dfsg1-1 | 5.4.0+dfsg1-1 |
| gnuplot | gnuplot | >= 0 < 4.6.6-3ubuntu0.1 | 4.6.6-3ubuntu0.1 |
| gnuplot | gnuplot | >= 0 < 4.6.4-2ubuntu0.1~esm1 | 4.6.4-2ubuntu0.1~esm1 |
| gnuplot | gnuplot | >= 0 < 4.6.6-3ubuntu0.1+esm1 | 4.6.6-3ubuntu0.1+esm1 |
| gnuplot | gnuplot | >= 0 < 5.2.2+dfsg1-2ubuntu1+esm1 | 5.2.2+dfsg1-2ubuntu1+esm1 |
| gnuplot | gnuplot | >= 0 < 5.2.8+dfsg1-2ubuntu0.1~esm1 | 5.2.8+dfsg1-2ubuntu0.1~esm1 |
| opensuse | leap | — | — |
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv7.8HIGH
vendor_debian7.8LOW
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
gnuplot vulnerabilities
osv·2025-06-23·CVSS 7.8
CVE-2018-19490 [HIGH] gnuplot vulnerabilities
gnuplot vulnerabilities
Tim Blazytko, Cornelius Aschermann, Sergej Schumilo, and Nils Bars
discovered that Gnuplot had several memory-related issues. An
attacker could possibly use these issues to cause Gnuplot to
experience a buffer overflow, resulting in a denial of service or
arbitrary code execution. These issues only affected Ubuntu
14.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-19490, CVE-2018-19491,
CVE-2018-19492)
It was discovered that Gnuplot could write out-of-bounds due to
the use of strncpy(). An attacker could possibly use this issue
to enable the execution of arbitrary code. This issue only
affected Ubuntu 20.04 LTS. (CVE-2020-25412)
It was discovered that Gnuplot incorrectly freed memory when
executing print_set_output(). An attacker could possibly use this
issue to enable th
GHSA
GHSA-pxmp-9pvp-h94j: An issue was discovered in post
ghsa_unreviewed·2022-05-13
CVE-2018-19491 [HIGH] CWE-119 GHSA-pxmp-9pvp-h94j: An issue was discovered in post
An issue was discovered in post.trm in Gnuplot 5.2.5. This issue allows an attacker to conduct a buffer overflow with an arbitrary amount of data in the PS_options function. This flaw is caused by a missing size check of an argument passed to the "set font" function. This issue occurs when the Gnuplot postscript terminal is used as a backend.
OSV
gnuplot vulnerabilities
osv·2020-09-25·CVSS 7.8
CVE-2018-19490 [HIGH] gnuplot vulnerabilities
gnuplot vulnerabilities
Tim Blazytko, Cornelius Aschermann, Sergej Schumilo and Nils Bars
discovered that Gnuplot did not properly validate string sizes in the
df_generate_ascii_array_entry function. An attacker could possibly use
this issue to cause a heap buffer overflow, resulting in a denial of
service attack or arbitrary code execution. (CVE-2018-19490)
Tim Blazytko, Cornelius Aschermann, Sergej Schumilo and Nils Bars
discovered that Gnuplot did not properly validate string sizes in the
PS_options function when the Gnuplot postscript terminal is used as a
backend. An attacker could possibly use this issue to cause a buffer
overflow, resulting in a denial of service attack or arbitrary code
execution. (CVE-2018-19491)
Tim Blazytko, Cornelius Aschermann, Sergej Schumilo and Nils Bars
OSV
CVE-2018-19491: An issue was discovered in post
osv·2018-11-23·CVSS 7.8
CVE-2018-19491 [HIGH] CVE-2018-19491: An issue was discovered in post
An issue was discovered in post.trm in Gnuplot 5.2.5. This issue allows an attacker to conduct a buffer overflow with an arbitrary amount of data in the PS_options function. This flaw is caused by a missing size check of an argument passed to the "set font" function. This issue occurs when the Gnuplot postscript terminal is used as a backend.
Ubuntu
Gnuplot vulnerabilities
vendor_ubuntu·2025-06-23·CVSS 7.8
CVE-2020-25969 [HIGH] Gnuplot vulnerabilities
Title: Gnuplot vulnerabilities
Summary: Several security issues were fixed in Gnuplot.
Tim Blazytko, Cornelius Aschermann, Sergej Schumilo, and Nils Bars
discovered that Gnuplot had several memory-related issues. An
attacker could possibly use these issues to cause Gnuplot to
experience a buffer overflow, resulting in a denial of service or
arbitrary code execution. These issues only affected Ubuntu
14.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-19490, CVE-2018-19491,
CVE-2018-19492)
It was discovered that Gnuplot could write out-of-bounds due to
the use of strncpy(). An attacker could possibly use this issue
to enable the execution of arbitrary code. This issue only
affected Ubuntu 20.04 LTS. (CVE-2020-25412)
It was discovered that Gnuplot incorrectly freed memory when
executing print_set_
Ubuntu
Gnuplot vulnerabilities
vendor_ubuntu·2020-09-25·CVSS 7.8
CVE-2018-19490 [HIGH] Gnuplot vulnerabilities
Title: Gnuplot vulnerabilities
Summary: Several security issues were fixed in Gnuplot.
Tim Blazytko, Cornelius Aschermann, Sergej Schumilo and Nils Bars
discovered that Gnuplot did not properly validate string sizes in the
df_generate_ascii_array_entry function. An attacker could possibly use
this issue to cause a heap buffer overflow, resulting in a denial of
service attack or arbitrary code execution. (CVE-2018-19490)
Tim Blazytko, Cornelius Aschermann, Sergej Schumilo and Nils Bars
discovered that Gnuplot did not properly validate string sizes in the
PS_options function when the Gnuplot postscript terminal is used as a
backend. An attacker could possibly use this issue to cause a buffer
overflow, resulting in a denial of service attack or arbitrary code
execution. (CVE-2018-19491)
T
Red Hat
gnuplot: buffer overflow with an arbitrary amount of data in the PS_options
vendor_redhat·2018-11-19·CVSS 7.8
CVE-2018-19491 [HIGH] CWE-122 gnuplot: buffer overflow with an arbitrary amount of data in the PS_options
gnuplot: buffer overflow with an arbitrary amount of data in the PS_options
An issue was discovered in post.trm in Gnuplot 5.2.5. This issue allows an attacker to conduct a buffer overflow with an arbitrary amount of data in the PS_options function. This flaw is caused by a missing size check of an argument passed to the "set font" function. This issue occurs when the Gnuplot postscript terminal is used as a backend.
Statement: Gnuplot allows for trivial execution of arbitrary commands from within gnuplot files by design. As such, gnuplot files should be considered as inherently dangerous and users should only execute files from trusted sources.
Package: gnuplot (Red Hat Enterprise Linux 5) - Not affected
Package: gnuplot (Red Hat Enterprise Linux 6) - Not affected
Package: gnuplot (R
Debian
CVE-2018-19491: gnuplot - An issue was discovered in post.trm in Gnuplot 5.2.5. This issue allows an attac...
vendor_debian·2018·CVSS 7.8
CVE-2018-19491 [HIGH] CVE-2018-19491: gnuplot - An issue was discovered in post.trm in Gnuplot 5.2.5. This issue allows an attac...
An issue was discovered in post.trm in Gnuplot 5.2.5. This issue allows an attacker to conduct a buffer overflow with an arbitrary amount of data in the PS_options function. This flaw is caused by a missing size check of an argument passed to the "set font" function. This issue occurs when the Gnuplot postscript terminal is used as a backend.
Scope: local
bookworm: resolved (fixed in 5.4.0+dfsg1-1)
bullseye: resolved (fixed in 5.4.0+dfsg1-1)
forky: resolved (fixed in 5.4.0+dfsg1-1)
sid: resolved (fixed in 5.4.0+dfsg1-1)
trixie: resolved (fixed in 5.4.0+dfsg1-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2018-19491 gnuplot44: gnuplot: buffer overflow with an arbitrary amount of data in the PS_options [epel-6]
bugzilla·2018-12-04·CVSS 7.8
CVE-2018-19491 [HIGH] CVE-2018-19491 gnuplot44: gnuplot: buffer overflow with an arbitrary amount of data in the PS_options [epel-6]
CVE-2018-19491 gnuplot44: gnuplot: buffer overflow with an arbitrary amount of data in the PS_options [epel-6]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-6.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Discussion:
Use the fo
Bugzilla
CVE-2018-19491 gnuplot: buffer overflow with an arbitrary amount of data in the PS_options [fedora-all]
bugzilla·2018-12-04·CVSS 7.8
CVE-2018-19491 [HIGH] CVE-2018-19491 gnuplot: buffer overflow with an arbitrary amount of data in the PS_options [fedora-all]
CVE-2018-19491 gnuplot: buffer overflow with an arbitrary amount of data in the PS_options [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects m
Bugzilla
CVE-2018-19491 gnuplot: buffer overflow with an arbitrary amount of data in the PS_options
bugzilla·2018-12-04·CVSS 7.8
CVE-2018-19491 [HIGH] CVE-2018-19491 gnuplot: buffer overflow with an arbitrary amount of data in the PS_options
CVE-2018-19491 gnuplot: buffer overflow with an arbitrary amount of data in the PS_options
An issue was discovered in post.trm in Gnuplot 5.2.5. This issue allows an attacker to conduct a buffer overflow with an arbitrary amount of data in the PS_options function. This flaw is caused by a missing size check of an argument passed to the "set font" function. This issue occurs when the Gnuplot postscript terminal is used as a backend.
References:
https://sourceforge.net/p/gnuplot/bugs/2094/
https://sourceforge.net/p/gnuplot/gnuplot-main/ci/d5020716834582b20a5e12cdd49f39ee4f9dd949/
Discussion:
Created gnuplot tracking bugs for this issue:
Affects: fedora-all [bug 1656181]
Created gnuplot44 tracking bugs for this issue:
Affects: epel-6 [bug 1656180]
---
Statement:
Gnuplot allows for
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00066.htmlhttps://lists.debian.org/debian-lts-announce/2018/11/msg00031.htmlhttps://lists.debian.org/debian-lts-announce/2018/11/msg00035.htmlhttps://sourceforge.net/p/gnuplot/bugs/2094/https://sourceforge.net/p/gnuplot/gnuplot-main/ci/d5020716834582b20a5e12cdd49f39ee4f9dd949/https://usn.ubuntu.com/4541-1/http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00066.htmlhttps://lists.debian.org/debian-lts-announce/2018/11/msg00031.htmlhttps://lists.debian.org/debian-lts-announce/2018/11/msg00035.htmlhttps://sourceforge.net/p/gnuplot/bugs/2094/https://sourceforge.net/p/gnuplot/gnuplot-main/ci/d5020716834582b20a5e12cdd49f39ee4f9dd949/https://usn.ubuntu.com/4541-1/
2018-11-23
Published