CVE-2017-9670

Published: 15 June 2017

An uninitialized stack variable vulnerability in load_tic_series() in set.c in gnuplot 5.2.rc1 allows an attacker to cause Denial of Service (Segmentation fault and Memory Corruption) or possibly have unspecified other impact when a victim opens a specially crafted file.

Priority

CVSS 3 base score: 7.8

Status

Package	Release	Status
gnuplot Launchpad, Ubuntu, Debian	Upstream	Released (5.0.5+dfsg1-7)



	Ubuntu 18.04 LTS (Bionic Beaver)	Not vulnerable (5.2.2+dfsg1-2ubuntu1)
	Ubuntu 16.04 LTS (Xenial Xerus)	Not vulnerable (incr_token is only used when initialized)
	Ubuntu 14.04 ESM (Trusty Tahr)	Not vulnerable (incr_token is only used when initialized)
	Patches: Upstream: https://sourceforge.net/p/gnuplot/bugs/_discuss/thread/44ec637c/af0f/attachment/uninitialized_variables_%28Bug1933%29.patch

Notes

Author	Note
tyhicks	This CVE is specifically for the incr_token variable in load_tic_series()

References

Bugs

https://sourceforge.net/p/gnuplot/bugs/1933/

Join the discussion

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu 14.04 Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM