CVE-2017-9670
HighSummary
CVE-2017-9670 describes an uninitialized stack variable vulnerability in the load_tic_series() function in set.c in gnuplot 5.2.rc1. An attacker can cause Denial of Service (segmentation fault and memory corruption) or possibly have unspecified other impacts when a victim opens a specially crafted file.
Risk Assessment
The organization may experience service outages and potential data corruption, leading to loss of user trust and additional recovery costs.
Recommendation
It is recommended to update gnuplot to the latest version to mitigate this vulnerability and to monitor systems for potential attack attempts.
Other vulnerabilities in gnuplot 5.2.rc1
See all- CVE-2025-31177Medium
Gnuplot is affected by a heap buffer overflow at function utf8_copy_one.
- CVE-2025-31181Medium
A flaw was found in gnuplot. The X11_graphics() function may lead to a segmentation fault and cause a system crash.
- CVE-2025-31180Medium
A flaw was found in gnuplot. The CANVAS_text() function may lead to a segmentation fault and cause a system crash.
- CVE-2025-31179Medium
A flaw was found in gnuplot. The xstrftime() function may lead to a segmentation fault, causing a system crash.
- CVE-2025-31178Medium
A flaw was found in gnuplot. The GetAnnotateString() function may lead to a segmentation fault and cause a system crash.
- CVE-2025-31176Medium
A flaw was found in gnuplot. The plot3d_points() function may lead to a segmentation fault and cause a system crash.
- CVE-1999-0409Medium
Buffer overflow in gnuplot in Linux version 3.5 allows local users to obtain root access.
Original NVD description (English source)
An uninitialized stack variable vulnerability in load_tic_series() in set.c in gnuplot 5.2.rc1 allows an attacker to cause Denial of Service (Segmentation fault and Memory Corruption) or possibly have unspecified other impact when a victim opens a specially crafted file.