Search CVE reports
11 – 20 of 24 results
CVE-2018-3836
Medium prioritySome fixes available 2 of 3
An exploitable command injection vulnerability exists in the gplotMakeOutput function of Leptonica 1.74.4. A specially crafted gplot rootname argument can cause a command injection resulting in arbitrary code execution. An...
1 affected package
leptonlib
Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
---|---|---|---|---|---|
leptonlib | — | Not affected | Not affected | Not affected | Fixed |
CVE-2018-7442
Medium prioritySome fixes available 13 of 17
An issue was discovered in Leptonica through 1.75.3. The gplotMakeOutput function does not block ‘/’ characters in the gplot rootname argument, potentially leading to path traversal and arbitrary file overwrite.
1 affected package
leptonlib
Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
---|---|---|---|---|---|
leptonlib | Fixed | Fixed | Fixed | Vulnerable | Vulnerable |
CVE-2018-7441
Low prioritySome fixes available 13 of 17
Leptonica through 1.75.3 uses hardcoded /tmp pathnames, which might allow local users to overwrite arbitrary files or have unspecified other impact by creating files in advance or winning a race condition, as demonstrated by...
1 affected package
leptonlib
Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
---|---|---|---|---|---|
leptonlib | Fixed | Fixed | Fixed | Vulnerable | Vulnerable |
CVE-2018-7440
Medium prioritySome fixes available 1 of 3
An issue was discovered in Leptonica through 1.75.3. The gplotMakeOutput function allows command injection via a $(command) approach in the gplot rootname argument. This issue exists because of an incomplete fix for CVE-2018-3836.
1 affected package
leptonlib
Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
---|---|---|---|---|---|
leptonlib | Not affected | Not affected | Not affected | Fixed | Vulnerable |
CVE-2017-18196
Low prioritySome fixes available 1 of 2
Leptonica 1.74.4 constructs unintended pathnames (containing duplicated path components) when operating on files in /tmp subdirectories, which might allow local users to bypass intended file restrictions by leveraging access to a...
1 affected package
leptonlib
Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
---|---|---|---|---|---|
leptonlib | — | Not affected | Not affected | Not affected | Fixed |
CVE-2018-7247
Medium prioritySome fixes available 11 of 12
An issue was discovered in pixHtmlViewer in prog/htmlviewer.c in Leptonica before 1.75.3. Unsanitized input (rootname) can overflow a buffer, leading potentially to arbitrary code execution or possibly unspecified other impact.
1 affected package
leptonlib
Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
---|---|---|---|---|---|
leptonlib | — | Fixed | Fixed | Fixed | Not affected |
CVE-2018-7186
Medium prioritySome fixes available 2 of 3
Leptonica before 1.75.3 does not limit the number of characters in a %s format argument to fscanf or sscanf, which allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified...
1 affected package
leptonlib
Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
---|---|---|---|---|---|
leptonlib | — | Not affected | Not affected | Not affected | Fixed |
CVE-2017-8891
Low priorityDropbox Lepton 1.2.1 allows DoS (SEGV and application crash) via a malformed lepton file because the code does not ensure setup of a correct number of threads.
1 affected package
lepton
Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
---|---|---|---|---|---|
lepton | — | — | — | Not affected | Not in release |
CVE-2017-7448
Low priorityThe allocate_channel_framebuffer function in uncompressed_components.hh in Dropbox Lepton 1.2.1 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a malformed JPEG image.
1 affected package
lepton
Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
---|---|---|---|---|---|
lepton | — | — | — | Not affected | Not in release |
CVE-2016-6238
Medium priorityThe write_ujpg function in lepton/jpgcoder.cc in Dropbox lepton 1.0 allows remote attackers to cause denial of service (out-of-bounds read) via a crafted jpeg file.
1 affected package
lepton
Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
---|---|---|---|---|---|
lepton | — | — | — | Not affected | Not in release |