Medium CVE-2010-4338 EUVD-2022-2628GHSA-5pjj-7m4p-wfh2PYSEC-2026-886

ocrodjvu is vulnerable to Arbitrary File Modification via symlink attack

Published Jan 20, 2011 · Updated Aug 7, 2024 · Assigned by redhat

Description

ocrodjvu 0.4.6-1 on Debian GNU/Linux allows local users to modify arbitrary files via a symlink attack on temporary files that are generated when Cuneiform is invoked as the OCR engine.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
PyPI	ocrodjvu	>= 0.4.6-1, < 0.4.6-2	0.4.6-2	GHSA-5pjj-7m4p-wfh2

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598134
45234 vdb-entry
ocrodjvu-cuneiform-symlink(64892) vdb-entry