7.8

CVE-2018-19490

Exploit
An issue was discovered in datafile.c in Gnuplot 5.2.5. This issue allows an attacker to conduct a heap-based buffer overflow with an arbitrary amount of data in df_generate_ascii_array_entry. To exploit this vulnerability, an attacker must pass an overlong string as the right bound of the range argument that is passed to the plot function.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gnuplot ≫ Gnuplot Version5.2.5
Debian ≫ Debian Linux Version8.0
Opensuse ≫ Leap Version15.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.55% 0.719
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00066.html
Third Party Advisory
Mailing List
https://lists.debian.org/debian-lts-announce/2018/11/msg00031.html
Third Party Advisory
Mailing List
https://lists.debian.org/debian-lts-announce/2018/11/msg00035.html
Third Party Advisory
Mailing List
https://sourceforge.net/p/gnuplot/bugs/2093/
Third Party Advisory
Exploit
https://sourceforge.net/p/gnuplot/gnuplot-main/ci/d5020716834582b20a5e12cdd49f39ee4f9dd949/
Patch
Third Party Advisory
https://usn.ubuntu.com/4541-1/