[USN-7589-1] Gnuplot vulnerabilities

[noreply+usn-bot at canonical.com]

==========================================================================
Ubuntu Security Notice USN-7589-1
June 23, 2025

gnuplot vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in Gnuplot.

Software Description:
- gnuplot: A portable command-line driven graphing utility.

Details:

Tim Blazytko, Cornelius Aschermann, Sergej Schumilo, and Nils Bars
discovered that Gnuplot had several memory-related issues. An
attacker could possibly use these issues to cause Gnuplot to
experience a buffer overflow, resulting in a denial of service or
arbitrary code execution. These issues only affected Ubuntu
14.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-19490, CVE-2018-19491,
CVE-2018-19492)

It was discovered that Gnuplot could write out-of-bounds due to
the use of strncpy(). An attacker could possibly use this issue
to enable the execution of arbitrary code. This issue only
affected Ubuntu 20.04 LTS. (CVE-2020-25412)

It was discovered that Gnuplot incorrectly freed memory when
executing print_set_output(). An attacker could possibly use this
issue to enable the execution of arbitrary code. (CVE-2020-25559)

It was discovered that Gnuplot's plotrequest() function contained
a buffer overflow. An attacker could possibly use this issue to
cause Gnuplot to crash, resulting in a denial of service or
arbitrary code execution. (CVE-2020-25969)

It was discovered that Gnuplot's boundary3d() function could be
made to divide by zero. An attacker could possibly use this issue
to cause Gnuplot to crash, resulting in a denial of service.
(CVE-2021-44917)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS
  gnuplot                         5.2.8+dfsg1-2ubuntu0.1~esm1
                                  Available with Ubuntu Pro
  gnuplot-data                    5.2.8+dfsg1-2ubuntu0.1~esm1
                                  Available with Ubuntu Pro
  gnuplot-nox                     5.2.8+dfsg1-2ubuntu0.1~esm1
                                  Available with Ubuntu Pro
  gnuplot-qt                      5.2.8+dfsg1-2ubuntu0.1~esm1
                                  Available with Ubuntu Pro
  gnuplot-x11                     5.2.8+dfsg1-2ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 18.04 LTS
  gnuplot                         5.2.2+dfsg1-2ubuntu1+esm1
                                  Available with Ubuntu Pro
  gnuplot-data                    5.2.2+dfsg1-2ubuntu1+esm1
                                  Available with Ubuntu Pro
  gnuplot-nox                     5.2.2+dfsg1-2ubuntu1+esm1
                                  Available with Ubuntu Pro
  gnuplot-qt                      5.2.2+dfsg1-2ubuntu1+esm1
                                  Available with Ubuntu Pro
  gnuplot-x11                     5.2.2+dfsg1-2ubuntu1+esm1
                                  Available with Ubuntu Pro

Ubuntu 16.04 LTS
  gnuplot                         4.6.6-3ubuntu0.1+esm1
                                  Available with Ubuntu Pro
  gnuplot-data                    4.6.6-3ubuntu0.1+esm1
                                  Available with Ubuntu Pro
  gnuplot-nox                     4.6.6-3ubuntu0.1+esm1
                                  Available with Ubuntu Pro
  gnuplot-qt                      4.6.6-3ubuntu0.1+esm1
                                  Available with Ubuntu Pro
  gnuplot-tex                     4.6.6-3ubuntu0.1+esm1
                                  Available with Ubuntu Pro
  gnuplot-x11                     4.6.6-3ubuntu0.1+esm1
                                  Available with Ubuntu Pro

Ubuntu 14.04 LTS
  gnuplot                         4.6.4-2ubuntu0.1~esm1
                                  Available with Ubuntu Pro
  gnuplot-nox                     4.6.4-2ubuntu0.1~esm1
                                  Available with Ubuntu Pro
  gnuplot-qt                      4.6.4-2ubuntu0.1~esm1
                                  Available with Ubuntu Pro
  gnuplot-x11                     4.6.4-2ubuntu0.1~esm1
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary
changes.

References:
  https://ubuntu.com/security/notices/USN-7589-1
  CVE-2018-19490, CVE-2018-19491, CVE-2018-19492, CVE-2020-25412,
  CVE-2020-25559, CVE-2020-25969, CVE-2021-44917
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20250624/6615b003/attachment.sig>