usn-7773-1
Vulnerability from osv_ubuntu
ChenYiFan Liu discovered that Gnuplot did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service. (CVE-2025-3359, CVE-2025-31178, CVE-2025-31179, CVE-2025-31181)
ChenYiFan Liu discovered that Gnuplot did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.04. (CVE-2025-31176, CVE-2025-31180)
ChenYiFan Liu discovered that Gnuplot did not correctly handle certain memory operations. An attacker could possibly use this issue to execute arbitrary code or cause a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.04. (CVE-2025-31177)
{
"affected": [
{
"database_specific": {
"cves_map": {
"cves": [
{
"id": "CVE-2025-3359",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2025-31178",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2025-31179",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2025-31181",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
}
],
"ecosystem": "Ubuntu:Pro:14.04:LTS"
}
},
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "gnuplot",
"binary_version": "4.6.4-2ubuntu0.1~esm2"
},
{
"binary_name": "gnuplot-nox",
"binary_version": "4.6.4-2ubuntu0.1~esm2"
},
{
"binary_name": "gnuplot-qt",
"binary_version": "4.6.4-2ubuntu0.1~esm2"
},
{
"binary_name": "gnuplot-x11",
"binary_version": "4.6.4-2ubuntu0.1~esm2"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:14.04:LTS",
"name": "gnuplot",
"purl": "pkg:deb/ubuntu/gnuplot@4.6.4-2ubuntu0.1~esm2?arch=source\u0026distro=esm-infra-legacy/trusty"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.6.4-2ubuntu0.1~esm2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.6.3-2",
"4.6.4-1",
"4.6.4-2",
"4.6.4-2ubuntu0.1~esm1"
]
},
{
"database_specific": {
"cves_map": {
"cves": [
{
"id": "CVE-2025-3359",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2025-31178",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2025-31179",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2025-31181",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
}
],
"ecosystem": "Ubuntu:Pro:16.04:LTS"
}
},
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "gnuplot",
"binary_version": "4.6.6-3ubuntu0.1+esm2"
},
{
"binary_name": "gnuplot-data",
"binary_version": "4.6.6-3ubuntu0.1+esm2"
},
{
"binary_name": "gnuplot-nox",
"binary_version": "4.6.6-3ubuntu0.1+esm2"
},
{
"binary_name": "gnuplot-qt",
"binary_version": "4.6.6-3ubuntu0.1+esm2"
},
{
"binary_name": "gnuplot-tex",
"binary_version": "4.6.6-3ubuntu0.1+esm2"
},
{
"binary_name": "gnuplot-x11",
"binary_version": "4.6.6-3ubuntu0.1+esm2"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"name": "gnuplot",
"purl": "pkg:deb/ubuntu/gnuplot@4.6.6-3ubuntu0.1+esm2?arch=source\u0026distro=esm-apps/xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.6.6-3ubuntu0.1+esm2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.6.6-2",
"4.6.6-3",
"4.6.6-3ubuntu0.1",
"4.6.6-3ubuntu0.1+esm1"
]
},
{
"database_specific": {
"cves_map": {
"cves": [
{
"id": "CVE-2025-3359",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2025-31176",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2025-31177",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "negligible",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2025-31178",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2025-31179",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2025-31180",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2025-31181",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
}
],
"ecosystem": "Ubuntu:Pro:18.04:LTS"
}
},
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "gnuplot",
"binary_version": "5.2.2+dfsg1-2ubuntu1+esm2"
},
{
"binary_name": "gnuplot-data",
"binary_version": "5.2.2+dfsg1-2ubuntu1+esm2"
},
{
"binary_name": "gnuplot-nox",
"binary_version": "5.2.2+dfsg1-2ubuntu1+esm2"
},
{
"binary_name": "gnuplot-qt",
"binary_version": "5.2.2+dfsg1-2ubuntu1+esm2"
},
{
"binary_name": "gnuplot-x11",
"binary_version": "5.2.2+dfsg1-2ubuntu1+esm2"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:18.04:LTS",
"name": "gnuplot",
"purl": "pkg:deb/ubuntu/gnuplot@5.2.2+dfsg1-2ubuntu1+esm2?arch=source\u0026distro=esm-apps/bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.2.2+dfsg1-2ubuntu1+esm2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"5.0.7+dfsg1-1",
"5.2.2+dfsg1-2",
"5.2.2+dfsg1-2ubuntu1",
"5.2.2+dfsg1-2ubuntu1+esm1"
]
},
{
"database_specific": {
"cves_map": {
"cves": [
{
"id": "CVE-2025-3359",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2025-31176",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2025-31177",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "negligible",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2025-31178",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2025-31179",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2025-31180",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2025-31181",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
}
],
"ecosystem": "Ubuntu:Pro:20.04:LTS"
}
},
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "gnuplot",
"binary_version": "5.2.8+dfsg1-2ubuntu0.1~esm2"
},
{
"binary_name": "gnuplot-data",
"binary_version": "5.2.8+dfsg1-2ubuntu0.1~esm2"
},
{
"binary_name": "gnuplot-nox",
"binary_version": "5.2.8+dfsg1-2ubuntu0.1~esm2"
},
{
"binary_name": "gnuplot-qt",
"binary_version": "5.2.8+dfsg1-2ubuntu0.1~esm2"
},
{
"binary_name": "gnuplot-x11",
"binary_version": "5.2.8+dfsg1-2ubuntu0.1~esm2"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:20.04:LTS",
"name": "gnuplot",
"purl": "pkg:deb/ubuntu/gnuplot@5.2.8+dfsg1-2ubuntu0.1~esm2?arch=source\u0026distro=esm-apps/focal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.2.8+dfsg1-2ubuntu0.1~esm2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"5.2.6+dfsg1-2",
"5.2.7+dfsg1-6",
"5.2.8+dfsg1-1",
"5.2.8+dfsg1-2",
"5.2.8+dfsg1-2ubuntu0.1~esm1"
]
},
{
"database_specific": {
"cves_map": {
"cves": [
{
"id": "CVE-2025-3359",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2025-31176",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2025-31177",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "negligible",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2025-31178",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2025-31179",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2025-31180",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2025-31181",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
}
],
"ecosystem": "Ubuntu:Pro:22.04:LTS"
}
},
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "gnuplot",
"binary_version": "5.4.2+dfsg2-2ubuntu0.1~esm1"
},
{
"binary_name": "gnuplot-data",
"binary_version": "5.4.2+dfsg2-2ubuntu0.1~esm1"
},
{
"binary_name": "gnuplot-nox",
"binary_version": "5.4.2+dfsg2-2ubuntu0.1~esm1"
},
{
"binary_name": "gnuplot-qt",
"binary_version": "5.4.2+dfsg2-2ubuntu0.1~esm1"
},
{
"binary_name": "gnuplot-x11",
"binary_version": "5.4.2+dfsg2-2ubuntu0.1~esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:22.04:LTS",
"name": "gnuplot",
"purl": "pkg:deb/ubuntu/gnuplot@5.4.2+dfsg2-2ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/jammy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.4.2+dfsg2-2ubuntu0.1~esm1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"5.4.1+dfsg1-1",
"5.4.2+dfsg2-1",
"5.4.2+dfsg2-2"
]
},
{
"database_specific": {
"cves_map": {
"cves": [
{
"id": "CVE-2025-3359",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2025-31176",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2025-31177",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "negligible",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2025-31178",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2025-31179",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2025-31180",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2025-31181",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
}
],
"ecosystem": "Ubuntu:Pro:24.04:LTS"
}
},
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "gnuplot",
"binary_version": "6.0.0+dfsg1-1ubuntu3+esm1"
},
{
"binary_name": "gnuplot-data",
"binary_version": "6.0.0+dfsg1-1ubuntu3+esm1"
},
{
"binary_name": "gnuplot-nox",
"binary_version": "6.0.0+dfsg1-1ubuntu3+esm1"
},
{
"binary_name": "gnuplot-qt",
"binary_version": "6.0.0+dfsg1-1ubuntu3+esm1"
},
{
"binary_name": "gnuplot-x11",
"binary_version": "6.0.0+dfsg1-1ubuntu3+esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:24.04:LTS",
"name": "gnuplot",
"purl": "pkg:deb/ubuntu/gnuplot@6.0.0+dfsg1-1ubuntu3+esm1?arch=source\u0026distro=esm-apps/noble"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.0.0+dfsg1-1ubuntu3+esm1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"5.4.4+dfsg1-2build1",
"6.0.0+dfsg1-1ubuntu2",
"6.0.0+dfsg1-1ubuntu3"
]
}
],
"aliases": [],
"details": "ChenYiFan Liu discovered that Gnuplot did not correctly handle certain\nmemory operations. An attacker could possibly use this issue to cause a\ndenial of service. (CVE-2025-3359, CVE-2025-31178, CVE-2025-31179,\nCVE-2025-31181)\n\nChenYiFan Liu discovered that Gnuplot did not correctly handle certain\nmemory operations. An attacker could possibly use this issue to cause a\ndenial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04\nLTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.04. (CVE-2025-31176,\nCVE-2025-31180)\n\nChenYiFan Liu discovered that Gnuplot did not correctly handle certain\nmemory operations. An attacker could possibly use this issue to execute\narbitrary code or cause a denial of service. This issue only affected\nUbuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS,\nUbuntu 25.04. (CVE-2025-31177)",
"id": "USN-7773-1",
"modified": "2026-06-25T10:46:57Z",
"published": "2025-09-25T00:56:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-7773-1"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2025-3359"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2025-31176"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2025-31177"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2025-31178"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2025-31179"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2025-31180"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2025-31181"
}
],
"related": [],
"schema_version": "1.7.0",
"summary": "gnuplot vulnerabilities",
"upstream": [
"UBUNTU-CVE-2025-3359",
"UBUNTU-CVE-2025-31176",
"UBUNTU-CVE-2025-31177",
"UBUNTU-CVE-2025-31178",
"UBUNTU-CVE-2025-31179",
"UBUNTU-CVE-2025-31180",
"UBUNTU-CVE-2025-31181"
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.