Bugzilla – Bug 1213068
VUL-0: CVE-2020-25969: gnuplot: buffer overflow via the function plotrequest().
Last modified: 2023-08-01 12:30:24 UTC
CVE-2020-25969 gnuplot v5.5 was discovered to contain a buffer overflow via the function plotrequest(). Upstream fix: https://github.com/gnuplot/gnuplot/commit/1f36c4fbb3e8e0beb213b4a29ab463e43db9ef42 References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25969 https://www.cve.org/CVERecord?id=CVE-2020-25969 https://sourceforge.net/p/gnuplot/bugs/2311/
SUSE:SLE-15:Update and SUSE:SLE-15-SP4:Update has already been pacthed by the 1f36c4fb.patch, but the following remain affected: - SUSE:SLE-11:Update/gnuplot - SUSE:SLE-12:Update/gnuplot
AFAICS from https://smelt.suse.de/maintained/ the SUSE:SLE-11:Update/gnuplot is not maintained anymore ... beside this there is no v5.5 but 5.4.8
Currently I can not submit a fix for SLE-12 Update/SLE-12> isc up Server returned an error: HTTP Error 401: Unauthorized
(In reply to Dr. Werner Fink from comment #2) > AFAICS from https://smelt.suse.de/maintained/ the SUSE:SLE-11:Update/gnuplot > is not maintained anymore ... Indeed, sorry. > beside this there is no v5.5 but 5.4.8 Indeed again, I don't very know why the CVE description mentions a not-yet-released version
SR#302801
SUSE-SU-2023:3091-1: An update that solves one vulnerability and has one fix can now be installed. Category: security (moderate) Bug References: 1176689, 1213068 CVE References: CVE-2020-25969 Sources used: SUSE Linux Enterprise High Performance Computing 12 SP5 (src): gnuplot-4.6.5-3.6.1 SUSE Linux Enterprise Server 12 SP5 (src): gnuplot-4.6.5-3.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): gnuplot-4.6.5-3.6.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.