Buffer overflow in Gnuplot - CVE-2018-19491
Published: November 28, 2018
Vulnerability identifier: #VU16145
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear
CVE-ID: CVE-2018-19491
CWE-ID: CWE-120
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Gnuplot
Affected software:
Gnuplot
Gnuplot
Detailed vulnerability description
The vulnerability allows a local attacker to gain elevated privileges on the target system.
The vulnerability exists in the post.trm source code file due to boundary error in font names when the PostScript terminal is used. A local attacker can make a specially crafted request that sa malicious argument to be passed to the set font function, trigger memory corruption condition and cause a DoS condition or execute arbitrary code with elevated privileges.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
How to mitigate CVE-2018-19491
Install update from vendor's website.