Summary
It was discovered that Leptonica incorrectly handled path names. An
attacker could possibly use this issue to obtain sensitive information.
This issue only affected Ubuntu 16.04 ESM. (CVE-2017-18196)
It was discovered that Leptonica incorrectly handled certain input
arguments. An attacker could possibly use this issue to execute arbitrary
commands. (CVE-2018-3836)
It was discovered that Leptonica incorrectly handled input arguments. An
attacker could possibly use this issue to cause a denial of service or
other unspecified impact. (CVE-2018-7186)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | leptonlib | 1.70.1-1ubuntu0.1~esm1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | leptonlib | 1.73-1ubuntu0.1~esm1 |
Vulnerabilities 3
-
High 7.0
An exploitable command injection vulnerability exists in the gplotMakeOutput function of Leptonica 1.74.4. A specially …
-
Unscored —
Leptonica 1.74.4 constructs unintended pathnames (containing duplicated path components) when operating on files in /tm…
-
Unscored —
Leptonica before 1.75.3 does not limit the number of characters in a %s format argument to fscanf or sscanf, which allo…