CVE-2018-19492
published 2018-11-23CVE-2018-19492: An issue was discovered in cairo.trm in Gnuplot 5.2.5. This issue allows an attacker to conduct a buffer overflow with an arbitrary amount of data in the…
PriorityP338high7.8CVSS 3.0
AVLACLPRNUIRSUCHIHAH
EPSS
1.55%
72.6th percentile
An issue was discovered in cairo.trm in Gnuplot 5.2.5. This issue allows an attacker to conduct a buffer overflow with an arbitrary amount of data in the cairotrm_options function. This flaw is caused by a missing size check of an argument passed to the "set font" function. This issue occurs when the Gnuplot pngcairo terminal is used as a backend.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | gnuplot | < gnuplot 5.4.0+dfsg1-1 (bookworm) | gnuplot 5.4.0+dfsg1-1 (bookworm) |
| gnuplot | gnuplot | — | — |
| gnuplot | gnuplot | >= 0 < 5.4.0+dfsg1-1 | 5.4.0+dfsg1-1 |
| gnuplot | gnuplot | >= 0 < 5.4.0+dfsg1-1 | 5.4.0+dfsg1-1 |
| gnuplot | gnuplot | >= 0 < 5.4.0+dfsg1-1 | 5.4.0+dfsg1-1 |
| gnuplot | gnuplot | >= 0 < 5.4.0+dfsg1-1 | 5.4.0+dfsg1-1 |
| gnuplot | gnuplot | >= 0 < 4.6.6-3ubuntu0.1 | 4.6.6-3ubuntu0.1 |
| gnuplot | gnuplot | >= 0 < 4.6.4-2ubuntu0.1~esm1 | 4.6.4-2ubuntu0.1~esm1 |
| gnuplot | gnuplot | >= 0 < 4.6.6-3ubuntu0.1+esm1 | 4.6.6-3ubuntu0.1+esm1 |
| gnuplot | gnuplot | >= 0 < 5.2.2+dfsg1-2ubuntu1+esm1 | 5.2.2+dfsg1-2ubuntu1+esm1 |
| gnuplot | gnuplot | >= 0 < 5.2.8+dfsg1-2ubuntu0.1~esm1 | 5.2.8+dfsg1-2ubuntu0.1~esm1 |
| opensuse | leap | — | — |
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv7.8HIGH
vendor_debian7.8LOW
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Gnuplot vulnerabilities
vendor_ubuntu·2025-06-23·CVSS 7.8
CVE-2020-25969 [HIGH] Gnuplot vulnerabilities
Title: Gnuplot vulnerabilities
Summary: Several security issues were fixed in Gnuplot.
Tim Blazytko, Cornelius Aschermann, Sergej Schumilo, and Nils Bars
discovered that Gnuplot had several memory-related issues. An
attacker could possibly use these issues to cause Gnuplot to
experience a buffer overflow, resulting in a denial of service or
arbitrary code execution. These issues only affected Ubuntu
14.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-19490, CVE-2018-19491,
CVE-2018-19492)
It was discovered that Gnuplot could write out-of-bounds due to
the use of strncpy(). An attacker could possibly use this issue
to enable the execution of arbitrary code. This issue only
affected Ubuntu 20.04 LTS. (CVE-2020-25412)
It was discovered that Gnuplot incorrectly freed memory when
executing print_set_
Ubuntu
Gnuplot vulnerabilities
vendor_ubuntu·2020-09-25·CVSS 7.8
CVE-2018-19490 [HIGH] Gnuplot vulnerabilities
Title: Gnuplot vulnerabilities
Summary: Several security issues were fixed in Gnuplot.
Tim Blazytko, Cornelius Aschermann, Sergej Schumilo and Nils Bars
discovered that Gnuplot did not properly validate string sizes in the
df_generate_ascii_array_entry function. An attacker could possibly use
this issue to cause a heap buffer overflow, resulting in a denial of
service attack or arbitrary code execution. (CVE-2018-19490)
Tim Blazytko, Cornelius Aschermann, Sergej Schumilo and Nils Bars
discovered that Gnuplot did not properly validate string sizes in the
PS_options function when the Gnuplot postscript terminal is used as a
backend. An attacker could possibly use this issue to cause a buffer
overflow, resulting in a denial of service attack or arbitrary code
execution. (CVE-2018-19491)
T
Red Hat
gnuplot: buffer overflow in cairotrm_options function
vendor_redhat·2018-11-19·CVSS 7.8
CVE-2018-19492 [HIGH] CWE-122 gnuplot: buffer overflow in cairotrm_options function
gnuplot: buffer overflow in cairotrm_options function
An issue was discovered in cairo.trm in Gnuplot 5.2.5. This issue allows an attacker to conduct a buffer overflow with an arbitrary amount of data in the cairotrm_options function. This flaw is caused by a missing size check of an argument passed to the "set font" function. This issue occurs when the Gnuplot pngcairo terminal is used as a backend.
Statement: Gnuplot allows for trivial execution of arbitrary commands from within gnuplot files by design. As such, gnuplot files should be considered as inherently dangerous and users should only execute files from trusted sources.
Package: gnuplot (Red Hat Enterprise Linux 5) - Not affected
Package: gnuplot (Red Hat Enterprise Linux 6) - Not affected
Package: gnuplot (Red Hat Enterprise
Debian
CVE-2018-19492: gnuplot - An issue was discovered in cairo.trm in Gnuplot 5.2.5. This issue allows an atta...
vendor_debian·2018·CVSS 7.8
CVE-2018-19492 [HIGH] CVE-2018-19492: gnuplot - An issue was discovered in cairo.trm in Gnuplot 5.2.5. This issue allows an atta...
An issue was discovered in cairo.trm in Gnuplot 5.2.5. This issue allows an attacker to conduct a buffer overflow with an arbitrary amount of data in the cairotrm_options function. This flaw is caused by a missing size check of an argument passed to the "set font" function. This issue occurs when the Gnuplot pngcairo terminal is used as a backend.
Scope: local
bookworm: resolved (fixed in 5.4.0+dfsg1-1)
bullseye: resolved (fixed in 5.4.0+dfsg1-1)
forky: resolved (fixed in 5.4.0+dfsg1-1)
sid: resolved (fixed in 5.4.0+dfsg1-1)
trixie: resolved (fixed in 5.4.0+dfsg1-1)
OSV
gnuplot vulnerabilities
osv·2025-06-23·CVSS 7.8
CVE-2018-19490 [HIGH] gnuplot vulnerabilities
gnuplot vulnerabilities
Tim Blazytko, Cornelius Aschermann, Sergej Schumilo, and Nils Bars
discovered that Gnuplot had several memory-related issues. An
attacker could possibly use these issues to cause Gnuplot to
experience a buffer overflow, resulting in a denial of service or
arbitrary code execution. These issues only affected Ubuntu
14.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-19490, CVE-2018-19491,
CVE-2018-19492)
It was discovered that Gnuplot could write out-of-bounds due to
the use of strncpy(). An attacker could possibly use this issue
to enable the execution of arbitrary code. This issue only
affected Ubuntu 20.04 LTS. (CVE-2020-25412)
It was discovered that Gnuplot incorrectly freed memory when
executing print_set_output(). An attacker could possibly use this
issue to enable th
GHSA
GHSA-vfqh-j3mg-95c7: An issue was discovered in cairo
ghsa_unreviewed·2022-05-13
CVE-2018-19492 [HIGH] CWE-119 GHSA-vfqh-j3mg-95c7: An issue was discovered in cairo
An issue was discovered in cairo.trm in Gnuplot 5.2.5. This issue allows an attacker to conduct a buffer overflow with an arbitrary amount of data in the cairotrm_options function. This flaw is caused by a missing size check of an argument passed to the "set font" function. This issue occurs when the Gnuplot pngcairo terminal is used as a backend.
OSV
gnuplot vulnerabilities
osv·2020-09-25·CVSS 7.8
CVE-2018-19490 [HIGH] gnuplot vulnerabilities
gnuplot vulnerabilities
Tim Blazytko, Cornelius Aschermann, Sergej Schumilo and Nils Bars
discovered that Gnuplot did not properly validate string sizes in the
df_generate_ascii_array_entry function. An attacker could possibly use
this issue to cause a heap buffer overflow, resulting in a denial of
service attack or arbitrary code execution. (CVE-2018-19490)
Tim Blazytko, Cornelius Aschermann, Sergej Schumilo and Nils Bars
discovered that Gnuplot did not properly validate string sizes in the
PS_options function when the Gnuplot postscript terminal is used as a
backend. An attacker could possibly use this issue to cause a buffer
overflow, resulting in a denial of service attack or arbitrary code
execution. (CVE-2018-19491)
Tim Blazytko, Cornelius Aschermann, Sergej Schumilo and Nils Bars
OSV
CVE-2018-19492: An issue was discovered in cairo
osv·2018-11-23·CVSS 7.8
CVE-2018-19492 [HIGH] CVE-2018-19492: An issue was discovered in cairo
An issue was discovered in cairo.trm in Gnuplot 5.2.5. This issue allows an attacker to conduct a buffer overflow with an arbitrary amount of data in the cairotrm_options function. This flaw is caused by a missing size check of an argument passed to the "set font" function. This issue occurs when the Gnuplot pngcairo terminal is used as a backend.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2018-19492 gnuplot: buffer overflow in cairotrm_options function [fedora-all]
bugzilla·2018-12-04·CVSS 7.8
CVE-2018-19492 [HIGH] CVE-2018-19492 gnuplot: buffer overflow in cairotrm_options function [fedora-all]
CVE-2018-19492 gnuplot: buffer overflow in cairotrm_options function [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported vers
Bugzilla
CVE-2018-19492 gnuplot44: gnuplot: buffer overflow in cairotrm_options function [epel-6]
bugzilla·2018-12-04·CVSS 7.8
CVE-2018-19492 [HIGH] CVE-2018-19492 gnuplot44: gnuplot: buffer overflow in cairotrm_options function [epel-6]
CVE-2018-19492 gnuplot44: gnuplot: buffer overflow in cairotrm_options function [epel-6]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-6.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Discussion:
Use the following template to fo
Bugzilla
CVE-2018-19492 gnuplot: buffer overflow in cairotrm_options function
bugzilla·2018-12-04·CVSS 7.8
CVE-2018-19492 [HIGH] CVE-2018-19492 gnuplot: buffer overflow in cairotrm_options function
CVE-2018-19492 gnuplot: buffer overflow in cairotrm_options function
An issue was discovered in cairo.trm in Gnuplot 5.2.5. This issue allows an attacker to conduct a buffer overflow with an arbitrary amount of data in the cairotrm_options function. This flaw is caused by a missing size check of an argument passed to the "set font" function. This issue occurs when the Gnuplot pngcairo terminal is used as a backend.
References:
https://sourceforge.net/p/gnuplot/bugs/2089/
https://sourceforge.net/p/gnuplot/gnuplot-main/ci/d5020716834582b20a5e12cdd49f39ee4f9dd949/
Discussion:
Created gnuplot tracking bugs for this issue:
Affects: fedora-all [bug 1656185]
Created gnuplot44 tracking bugs for this issue:
Affects: epel-6 [bug 1656184]
---
Statement:
Gnuplot allows for trivial executio
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00066.htmlhttps://lists.debian.org/debian-lts-announce/2018/11/msg00031.htmlhttps://lists.debian.org/debian-lts-announce/2018/11/msg00035.htmlhttps://sourceforge.net/p/gnuplot/bugs/2089/https://sourceforge.net/p/gnuplot/gnuplot-main/ci/d5020716834582b20a5e12cdd49f39ee4f9dd949/https://usn.ubuntu.com/4541-1/http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00066.htmlhttps://lists.debian.org/debian-lts-announce/2018/11/msg00031.htmlhttps://lists.debian.org/debian-lts-announce/2018/11/msg00035.htmlhttps://sourceforge.net/p/gnuplot/bugs/2089/https://sourceforge.net/p/gnuplot/gnuplot-main/ci/d5020716834582b20a5e12cdd49f39ee4f9dd949/https://usn.ubuntu.com/4541-1/
2018-11-23
Published