Bug 829855 (CVE-2021-44917)

Summary:	<sci-visualization/gnuplot-5.4.3: divide by zero vulnerability
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	sci, ulm
Priority:	Normal	Keywords:	UPSTREAM
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://sourceforge.net/p/gnuplot/bugs/2474/
Whiteboard:	B3 [noglsa]
Package list:		Runtime testing required:	---

Description John Helmert III archtester

2021-12-23 08:39:56 UTC

CVE-2021-44917:

A Divide by Zero vulnerability exists in gnuplot 5.4 in the boundary3d function in graph3d.c, which could cause a Arithmetic exception and application crash.

URL says this is patched but can't tell if it's made it into a release yet.

Comment 1 Ulrich Müller gentoo-dev

2021-12-23 12:29:11 UTC

I wonder why this would be labelled as a security vulnerability? It is simply a bug.

Gnuplot is a Turing complete language and the user is not supposed to execute scripts of unknown origin.

(In reply to John Helmert III from comment #0)
> URL says this is patched but can't tell if it's made it into a release yet.

Yeah, this will be fixed after the next upstream release. Backporting the patch doesn't make much sense for a problem that has no practical relevance (it is triggered when setting character size to zero and font size to infinity.)

Comment 2 Ulrich Müller gentoo-dev

2022-07-28 17:40:51 UTC

Fixed upstream in gnuplot-5.4.3.

This version is already stable, and older versions have been dropped.

Comment 3 Ulrich Müller gentoo-dev

2023-08-29 19:57:54 UTC

Ping. Can this be closed, or is any further action required on this bug?