CVE-2017-18196

Leptonica 1.74.4 constructs unintended pathnames (containing duplicated path components) when operating on files in /tmp subdirectories, which might allow local users to bypass intended file restrictions by leveraging access to a directory located deeper within the /tmp directory tree, as demonstrated by /tmp/ANY/PATH/ANY/PATH/input.tif.

Score

CVSS 3.0 3.3 Low

Status

Modified - cve@mitre.org

Published

2018-02-23

Last modified

2024-09-16

Weaknesses

CWE-22

Affected products

• Leptonica (Leptonica)

References

• https://bugs.debian.org/885704
• https://security.gentoo.org/glsa/202312-01