Bug 1213068 (CVE-2020-25969) - VUL-0: CVE-2020-25969: gnuplot: buffer overflow via the function plotrequest().
Summary: VUL-0: CVE-2020-25969: gnuplot: buffer overflow via the function plotrequest().
Status: NEW
Alias: CVE-2020-25969
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/371269/
Whiteboard: CVSSv3.1:SUSE:CVE-2020-25969:4.4:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2023-07-06 08:49 UTC by Thomas Leroy
Modified: 2023-08-01 12:30 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Leroy 2023-07-06 08:49:14 UTC
CVE-2020-25969

gnuplot v5.5 was discovered to contain a buffer overflow via the function
plotrequest().

Upstream fix:
https://github.com/gnuplot/gnuplot/commit/1f36c4fbb3e8e0beb213b4a29ab463e43db9ef42

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25969
https://www.cve.org/CVERecord?id=CVE-2020-25969
https://sourceforge.net/p/gnuplot/bugs/2311/
Comment 1 Thomas Leroy 2023-07-06 08:59:52 UTC
SUSE:SLE-15:Update and SUSE:SLE-15-SP4:Update has already been pacthed by the 1f36c4fb.patch, but the following remain affected:
- SUSE:SLE-11:Update/gnuplot
- SUSE:SLE-12:Update/gnuplot
Comment 2 Dr. Werner Fink 2023-07-06 09:13:04 UTC
AFAICS from https://smelt.suse.de/maintained/ the SUSE:SLE-11:Update/gnuplot is not maintained anymore ... beside this there is no v5.5 but 5.4.8
Comment 3 Dr. Werner Fink 2023-07-06 09:26:26 UTC
Currently I can not submit a fix for SLE-12

Update/SLE-12> isc up
Server returned an error: HTTP Error 401: Unauthorized
Comment 4 Thomas Leroy 2023-07-06 09:31:37 UTC
(In reply to Dr. Werner Fink from comment #2)
> AFAICS from https://smelt.suse.de/maintained/ the SUSE:SLE-11:Update/gnuplot
> is not maintained anymore ... 

Indeed, sorry.

> beside this there is no v5.5 but 5.4.8

Indeed again, I don't very know why the CVE description mentions a not-yet-released version
Comment 5 Dr. Werner Fink 2023-07-06 12:17:17 UTC
SR#302801
Comment 7 Maintenance Automation 2023-08-01 12:30:24 UTC
SUSE-SU-2023:3091-1: An update that solves one vulnerability and has one fix can now be installed.

Category: security (moderate)
Bug References: 1176689, 1213068
CVE References: CVE-2020-25969
Sources used:
SUSE Linux Enterprise High Performance Computing 12 SP5 (src): gnuplot-4.6.5-3.6.1
SUSE Linux Enterprise Server 12 SP5 (src): gnuplot-4.6.5-3.6.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): gnuplot-4.6.5-3.6.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.