Search CVE reports


Toggle filters

11 – 20 of 24 results


CVE-2018-3836

Medium priority

Some fixes available 2 of 3

An exploitable command injection vulnerability exists in the gplotMakeOutput function of Leptonica 1.74.4. A specially crafted gplot rootname argument can cause a command injection resulting in arbitrary code execution. An...

1 affected package

leptonlib

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
leptonlib Not affected Not affected Not affected Fixed
Show less packages

CVE-2018-7442

Medium priority

Some fixes available 13 of 17

An issue was discovered in Leptonica through 1.75.3. The gplotMakeOutput function does not block ‘/’ characters in the gplot rootname argument, potentially leading to path traversal and arbitrary file overwrite.

1 affected package

leptonlib

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
leptonlib Fixed Fixed Fixed Vulnerable Vulnerable
Show less packages

CVE-2018-7441

Low priority

Some fixes available 13 of 17

Leptonica through 1.75.3 uses hardcoded /tmp pathnames, which might allow local users to overwrite arbitrary files or have unspecified other impact by creating files in advance or winning a race condition, as demonstrated by...

1 affected package

leptonlib

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
leptonlib Fixed Fixed Fixed Vulnerable Vulnerable
Show less packages

CVE-2018-7440

Medium priority

Some fixes available 1 of 3

An issue was discovered in Leptonica through 1.75.3. The gplotMakeOutput function allows command injection via a $(command) approach in the gplot rootname argument. This issue exists because of an incomplete fix for CVE-2018-3836.

1 affected package

leptonlib

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
leptonlib Not affected Not affected Not affected Fixed Vulnerable
Show less packages

CVE-2017-18196

Low priority

Some fixes available 1 of 2

Leptonica 1.74.4 constructs unintended pathnames (containing duplicated path components) when operating on files in /tmp subdirectories, which might allow local users to bypass intended file restrictions by leveraging access to a...

1 affected package

leptonlib

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
leptonlib Not affected Not affected Not affected Fixed
Show less packages

CVE-2018-7247

Medium priority

Some fixes available 11 of 12

An issue was discovered in pixHtmlViewer in prog/htmlviewer.c in Leptonica before 1.75.3. Unsanitized input (rootname) can overflow a buffer, leading potentially to arbitrary code execution or possibly unspecified other impact.

1 affected package

leptonlib

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
leptonlib Fixed Fixed Fixed Not affected
Show less packages

CVE-2018-7186

Medium priority

Some fixes available 2 of 3

Leptonica before 1.75.3 does not limit the number of characters in a %s format argument to fscanf or sscanf, which allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified...

1 affected package

leptonlib

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
leptonlib Not affected Not affected Not affected Fixed
Show less packages

CVE-2017-8891

Low priority
Ignored

Dropbox Lepton 1.2.1 allows DoS (SEGV and application crash) via a malformed lepton file because the code does not ensure setup of a correct number of threads.

1 affected package

lepton

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
lepton Not affected Not in release
Show less packages

CVE-2017-7448

Low priority
Ignored

The allocate_channel_framebuffer function in uncompressed_components.hh in Dropbox Lepton 1.2.1 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a malformed JPEG image.

1 affected package

lepton

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
lepton Not affected Not in release
Show less packages

CVE-2016-6238

Medium priority
Ignored

The write_ujpg function in lepton/jpgcoder.cc in Dropbox lepton 1.0 allows remote attackers to cause denial of service (out-of-bounds read) via a crafted jpeg file.

1 affected package

lepton

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
lepton Not affected Not in release
Show less packages