PT-2020-16080 · Gnu+4 · Gnuplot+4

Lxumei · Published 2020-09-16 · Updated 2025-08-04 · CVE-2020-25412

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions gnuplot version 5.4

Description The issue is related to the com line() function in command.c which leads to an out-of-bounds write from strncpy(), potentially resulting in arbitrary code execution.

Recommendations For gnuplot version 5.4, consider disabling the com line() function in command.c as a temporary workaround until a patch is available. Restrict access to the command.c module to minimize the risk of exploitation. Avoid using the strncpy() function in sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALT-PU-2020-3260

ALT-PU-2020-3542

CVE-2020-25412

OPENSUSE-SU-2024:10800-1

ROSA-SA-2024-2460

USN-7589-1

Affected Products

Alt Linux

Debian

Linuxmint

Ubuntu

Gnuplot

References · 23

• 🔥 https://sourceforge.net/p/gnuplot/bugs/2303 · Exploit
• https://ubuntu.com/security/CVE-2018-19490 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7589-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-19492 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-44917 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-25412 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-25969 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-25412 · Security Note
• https://ubuntu.com/security/CVE-2018-19491 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-25412 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-25412 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-25412 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10800-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-25559 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25412 · Security Note