Leptonica Leptonica
13 CVEs affecting Leptonica Leptonica. Latest disclosed: 2022-09-09. Critical: 4, High: 7.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-7440 | Critical | 9.8 | 2018-02-23 | An issue was discovered in Leptonica through 1.75.3. The gplotMakeOutput function allows command injection via a $(command) approach in the gplot rootname argu… |
CVE-2018-7247 | Critical | 9.8 | 2018-02-19 | An issue was discovered in pixHtmlViewer in prog/htmlviewer.c in Leptonica before 1.75.3. Unsanitized input (rootname) can overflow a buffer, leading potential… |
CVE-2018-7186 | Critical | 9.8 | 2018-02-16 | Leptonica before 1.75.3 does not limit the number of characters in a %s format argument to fscanf or sscanf, which allows remote attackers to cause a denial of… |
CVE-2018-7442 | Critical | 9.1 | 2018-02-23 | An issue was discovered in Leptonica through 1.75.3. The gplotMakeOutput function does not block '/' characters in the gplot rootname argument, potentially lea… |
CVE-2018-3836 | High | 7.8 | 2018-04-24 | An exploitable command injection vulnerability exists in the gplotMakeOutput function of Leptonica 1.74.4. A specially crafted gplot rootname argument can caus… |
CVE-2020-36281 | High | 7.5 | 2021-03-12 | Leptonica before 1.80.0 allows a heap-based buffer over-read in pixFewColorsOctcubeQuantMixed in colorquant1.c. |
CVE-2020-36280 | High | 7.5 | 2021-03-12 | Leptonica before 1.80.0 allows a heap-based buffer over-read in pixReadFromTiffStream, related to tiffio.c. |
CVE-2020-36279 | High | 7.5 | 2021-03-12 | Leptonica before 1.80.0 allows a heap-based buffer over-read in rasteropGeneralLow, related to adaptmap_reg.c and adaptmap.c. |
CVE-2020-36278 | High | 7.5 | 2021-03-12 | Leptonica before 1.80.0 allows a heap-based buffer over-read in findNextBorderPixel in ccbord.c. |
CVE-2020-36277 | High | 7.5 | 2021-03-11 | Leptonica before 1.80.0 allows a denial of service (application crash) via an incorrect left shift in pixConvert2To8 in pixconv.c. |
CVE-2018-7441 | High | 7.0 | 2018-02-23 | Leptonica through 1.75.3 uses hardcoded /tmp pathnames, which might allow local users to overwrite arbitrary files or have unspecified other impact by creating… |
CVE-2022-38266 | Medium | 6.5 | 2022-09-09 | An issue in the Leptonica linked library (v1.79.0) allows attackers to cause an arithmetic exception leading to a Denial of Service (DoS) via a crafted JPEG fi… |
CVE-2017-18196 | Low | 3.3 | 2018-02-23 | Leptonica 1.74.4 constructs unintended pathnames (containing duplicated path components) when operating on files in /tmp subdirectories, which might allow loca… |