SB2018112704 - Privilege escalation in Gnuplot
Published: November 27, 2018 Updated: November 28, 2018
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Heap-based buffer overflow (CVE-ID: CVE-2018-19490)
The vulnerability allows a local attacker to gain elevated privileges on the target system.
The vulnerability exists in the datafile.c source code file due to boundary error when handling maliciou input. A local attacker can make a specially crafted request that submits a long string as the right bound of the range option to be passed to the plot function, trigger memory corruption condition and cause a DoS condition or execute arbitrary code with elevated privileges.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
2) Buffer overflow (CVE-ID: CVE-2018-19492)
The vulnerability allows a local attacker to gain elevated privileges on the target system.
The vulnerability exists in the cairo.trm source code file due to boundary error when the pngcairo terminal is used. A local attacker can make a specially crafted request that sa malicious argument to be passed to the set font function, trigger memory corruption condition and cause a DoS condition or execute arbitrary code with elevated privileges.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
3) Buffer overflow (CVE-ID: CVE-2018-19491)
The vulnerability allows a local attacker to gain elevated privileges on the target system.
The vulnerability exists in the post.trm source code file due to boundary error in font names when the PostScript terminal is used. A local attacker can make a specially crafted request that sa malicious argument to be passed to the set font function, trigger memory corruption condition and cause a DoS condition or execute arbitrary code with elevated privileges.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Install update from vendor's website.