CVE-2018-19492 — HIGH (7.8)

Vulnerability Description

An issue was discovered in cairo.trm in Gnuplot 5.2.5. This issue allows an attacker to conduct a buffer overflow with an arbitrary amount of data in the cairotrm_options function. This flaw is caused by a missing size check of an argument passed to the "set font" function. This issue occurs when the Gnuplot pngcairo terminal is used as a backend.

CVSS Score

7.8

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Gnuplot	Gnuplot	5.2.5
Debian	Debian Linux	8.0
Opensuse	Leap	15.0

Related Weaknesses (CWE)

CWE-119

References

http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00066.htmlMailing ListThird Party Advisory
https://lists.debian.org/debian-lts-announce/2018/11/msg00031.htmlMailing ListThird Party Advisory
https://lists.debian.org/debian-lts-announce/2018/11/msg00035.htmlMailing ListThird Party Advisory
https://sourceforge.net/p/gnuplot/bugs/2089/ExploitThird Party Advisory
https://sourceforge.net/p/gnuplot/gnuplot-main/ci/d5020716834582b20a5e12cdd49f39PatchThird Party Advisory
https://usn.ubuntu.com/4541-1/
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00066.htmlMailing ListThird Party Advisory
https://lists.debian.org/debian-lts-announce/2018/11/msg00031.htmlMailing ListThird Party Advisory
https://lists.debian.org/debian-lts-announce/2018/11/msg00035.htmlMailing ListThird Party Advisory
https://sourceforge.net/p/gnuplot/bugs/2089/ExploitThird Party Advisory
https://sourceforge.net/p/gnuplot/gnuplot-main/ci/d5020716834582b20a5e12cdd49f39PatchThird Party Advisory
https://usn.ubuntu.com/4541-1/

FAQ

What is CVE-2018-19492?

CVE-2018-19492 is a vulnerability with a CVSS score of 7.8 (HIGH). An issue was discovered in cairo.trm in Gnuplot 5.2.5. This issue allows an attacker to conduct a buffer overflow with an arbitrary amount of data in the cairotrm_options function. This flaw is caused...

How severe is CVE-2018-19492?

CVE-2018-19492 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2018-19492?

Check the references section above for vendor advisories and patch information. Affected products include: Gnuplot Gnuplot, Debian Debian Linux, Opensuse Leap.