CVE-2025-3359

Gnuplot is a portable command-line driven graphing utility for Linux, OS/2, MS Windows, OSX, VMS, and many other platforms. The source code is copyrighted but freely distributed (i.e., you don't have to pay for it). It was originally created to allow scientists and students to visualize mathematical functions and data interactively, but has grown to support many non-interactive uses such as web scripting. It is also used as a plotting engine by third-party applications like Octave. Gnuplot has been supported and under active development since 1986.

Security Fix(es):

A flaw was found in gnuplot. The plot3d_points() function may lead to a segmentation fault and cause a system crash.(CVE-2025-31176)

A flaw was found in gnuplot. The xstrftime() function may lead to a segmentation fault, causing a system crash.(CVE-2025-31179)

A flaw was found in gnuplot. The CANVAS_text() function may lead to a segmentation fault and cause a system crash.(CVE-2025-31180)

A flaw was found in gnuplot. The X11_graphics() function may lead to a segmentation fault and cause a system crash.(CVE-2025-31181)

A flaw was found in GNUPlot. A segmentation fault via IO_str_init_static_internal may jeopardize the environment.(CVE-2025-3359)

Gnuplot is a portable command-line driven graphing utility for Linux, OS/2, MS Windows, OSX, VMS, and many other platforms. The source code is copyrighted but freely distributed (i.e., you don't have to pay for it). It was originally created to allow scientists and students to visualize mathematical functions and data interactively, but has grown to support many non-interactive uses such as web scripting. It is also used as a plotting engine by third-party applications like Octave. Gnuplot has been supported and under active development since 1986.

Security Fix(es):

A flaw was found in gnuplot. The plot3d_points() function may lead to a segmentation fault and cause a system crash.(CVE-2025-31176)

A flaw was found in gnuplot. The xstrftime() function may lead to a segmentation fault, causing a system crash.(CVE-2025-31179)

A flaw was found in gnuplot. The CANVAS_text() function may lead to a segmentation fault and cause a system crash.(CVE-2025-31180)

A flaw was found in gnuplot. The X11_graphics() function may lead to a segmentation fault and cause a system crash.(CVE-2025-31181)

A flaw was found in GNUPlot. A segmentation fault via IO_str_init_static_internal may jeopardize the environment.(CVE-2025-3359)

A flaw was found in GNUPlot. A segmentation fault via IO_str_init_static_internal may jeopardize the environment.

A flaw was found in GNUPlot. A segmentation fault via IO_str_init_static_internal may jeopardize the environment.

These are all security issues fixed in the gnuplot-6.0.2-3.1 package on the GA media of openSUSE Tumbleweed.

This update for gnuplot fixes the following issues:

• CVE-2025-31178: unvalidated user input leads to segmentation fault on GetAnnotateString (bsc#1240327).
• CVE-2025-31179: improper verification of time values leads to segmentation fault on xstrftime (bsc#1240328).
• CVE-2025-31181: double fclose() call leads to segmentation fault on X11_graphics (bsc#1240330).
• CVE-2025-3359: out-of-bounds read when parsing font names may lead to a segmentation fault (bsc#1241684).

This update for gnuplot fixes the following issues:

• CVE-2025-31176: invalid read leads to segmentation fault on plot3d_points (bsc#1240325).
• CVE-2025-31177: improper bounds check leads to heap-buffer overflow on utf8_copy_one (bsc#1240326).
• CVE-2025-31178: unvalidated user input leads to segmentation fault on GetAnnotateString (bsc#1240327).
• CVE-2025-31179: improper verification of time values leads to segmentation fault on xstrftime (bsc#1240328).
• CVE-2025-31180: unchecked invalid pointer access leads to segmentation fault on CANVAS_text (bsc#1240329).
• CVE-2025-31181: double fclose() call leads to segmentation fault on X11_graphics (bsc#1240330).
• CVE-2025-3359: out-of-bounds read when parsing font names may lead to a segmentation fault (bsc#1241684).

This update for gnuplot fixes the following issues:

• CVE-2025-31176: invalid read leads to segmentation fault on plot3d_points (bsc#1240325).
• CVE-2025-31177: improper bounds check leads to heap-buffer overflow on utf8_copy_one (bsc#1240326).
• CVE-2025-31178: unvalidated user input leads to segmentation fault on GetAnnotateString (bsc#1240327).
• CVE-2025-31179: improper verification of time values leads to segmentation fault on xstrftime (bsc#1240328).
• CVE-2025-31180: unchecked invalid pointer access leads to segmentation fault on CANVAS_text (bsc#1240329).
• CVE-2025-31181: double fclose() call leads to segmentation fault on X11_graphics (bsc#1240330).
• CVE-2025-3359: out-of-bounds read when parsing font names may lead to a segmentation fault (bsc#1241684).

ChenYiFan Liu discovered that Gnuplot did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service. (CVE-2025-3359, CVE-2025-31178, CVE-2025-31179, CVE-2025-31181)

ChenYiFan Liu discovered that Gnuplot did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.04. (CVE-2025-31176, CVE-2025-31180)

ChenYiFan Liu discovered that Gnuplot did not correctly handle certain memory operations. An attacker could possibly use this issue to execute arbitrary code or cause a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.04. (CVE-2025-31177)