CVE-2018-7442

An issue was discovered in Leptonica through 1.75.3. The gplotMakeOutput function does not block '/' characters in the gplot rootname argument, potentially leading to path traversal and arbitrary file overwrite.

Score

CVSS 3.0 9.1 Critical

Status

Modified - cve@mitre.org

Published

2018-02-23

Last modified

2024-08-05

Weaknesses

CWE-22

Affected products

• Leptonica (Leptonica)

References

• https://lists.debian.org/debian-lts/2018/02/msg00086.html
• https://security.gentoo.org/glsa/202312-01