Division by zero in Gnuplot - CVE-2021-44917
Published: August 23, 2023
Vulnerability identifier: #VU79882
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-44917
CWE-ID: CWE-369
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a divide by zero error within the boundary3d() function in graph3d.c. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
Affected software
Gnuplot
Amazon Linux AMI
Oracle Solaris
Ubuntu
gnuplot (Ubuntu package)
gnuplot
Amazon Linux AMI
Oracle Solaris
Ubuntu
gnuplot (Ubuntu package)
gnuplot
How to mitigate CVE-2021-44917
Install updates from vendor's website.
Gnuplot - update to 5.4.4
gnuplot (Ubuntu package) - addressed in versions 4.6.4-2ubuntu0.1~esm1, 4.6.6-3ubuntu0.1+esm1, 5.2.2+dfsg1-2ubuntu1+esm1, 5.2.8+dfsg1-2ubuntu0.1~esm1
gnuplot - update to 5.4.3-3
gnuplot (Ubuntu package) - addressed in versions 4.6.4-2ubuntu0.1~esm1, 4.6.6-3ubuntu0.1+esm1, 5.2.2+dfsg1-2ubuntu1+esm1, 5.2.8+dfsg1-2ubuntu0.1~esm1
gnuplot - update to 5.4.3-3