CVE-2018-19490: Buffer Overflow
An issue was discovered in datafile.c in Gnuplot 5.2.5. This issue allows an attacker to conduct a heap-based buffer overflow with an arbitrary amount of data in dfgenerateasciiarrayentry. To exploit this vulnerability, an attacker must pass an overlong string as the right bound of the range argument that is passed to the plot function.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2018-19490?
CVE-2018-19490 is categorized as a critical vulnerability due to its potential to allow heap-based buffer overflow attacks.
How do I fix CVE-2018-19490?
To mitigate CVE-2018-19490, users should upgrade to Gnuplot version 4.6.6-3ubuntu0.1 or a later version.
Who is affected by CVE-2018-19490?
CVE-2018-19490 affects Gnuplot versions up to and including 5.2.5 and certain distributions like Debian and openSUSE.
What kind of attacks can exploit CVE-2018-19490?
CVE-2018-19490 can be exploited to conduct arbitrary code execution attacks due to buffer overflow.
Is CVE-2018-19490 exploitable remotely?
Yes, CVE-2018-19490 can be exploited remotely if an attacker manipulates the input string passed to the vulnerable Gnuplot function.