CVE-2018-19492: Buffer Overflow
An issue was discovered in cairo.trm in Gnuplot 5.2.5. This issue allows an attacker to conduct a buffer overflow with an arbitrary amount of data in the cairotrmoptions function. This flaw is caused by a missing size check of an argument passed to the "set font" function. This issue occurs when the Gnuplot pngcairo terminal is used as a backend.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2018-19492?
CVE-2018-19492 is classified as a medium severity vulnerability due to its potential to allow buffer overflow attacks.
How do I fix CVE-2018-19492?
To fix CVE-2018-19492, upgrade to gnuplot version 5.4.1+dfsg1-1+deb11u1 or higher on Debian systems, or ensure you are using gnuplot version 4.6.6-3ubuntu0.1 or lower on Ubuntu systems.
Which versions of gnuplot are affected by CVE-2018-19492?
Gnuplot version 5.2.5 is directly affected by CVE-2018-19492, along with several versions on Debian and related systems.
Is CVE-2018-19492 present in openSUSE?
Yes, openSUSE Leap 15.0 is vulnerable to CVE-2018-19492 and requires appropriate updates to mitigate the risk.
What type of attack is possible with CVE-2018-19492?
CVE-2018-19492 allows an attacker to conduct a buffer overflow attack, which can lead to arbitrary code execution.