Multiple vulnerabilities in Leptonica
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2017-18196 CVE-2018-7442 CVE-2018-7441 |
| CWE-ID | CWE-22 CWE-362 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
Leptonica Universal components / Libraries / Libraries used by multiple products |
| Vendor | DanBloomberg |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) Path traversal
EUVDB-ID: #VU11187
Risk: Low
CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2017-18196
CWE-ID:
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to obtain potentially sensitive information on the target system.
The weakness exists due to improper security restrictions. A local attacker can access a directory in the /tmp directory tree and gain access to potentially sensitive information, including arbitrary files.
Install update from vendor's website.
Vulnerable software versionsLeptonica: 1.68 - 1.74.4
CPE2.3- cpe:2.3:a:danbloomberg:leptonica:1.68:*:*:*:*:*:*:*
- cpe:2.3:a:danbloomberg:leptonica:1.69:*:*:*:*:*:*:*
- cpe:2.3:a:danbloomberg:leptonica:1.70:*:*:*:*:*:*:*
https://bugzilla.redhat.com/show_bug.cgi?id=1549411
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Path traversal
EUVDB-ID: #VU11189
Risk: Low
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2018-7442
CWE-ID:
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Exploit availability: No
DescriptionThe vulnerability allows a remote unauthenticated attacker to conduct path traversal attack on the target system.
The weakness exists in the gplotMakeOutput function due to insufficient validation of characters used in the gplot rootname argument. A remote attacker can trigger path traversal and gain access to potentially sensitive information.
Install update from vendor's website.
Vulnerable software versionsLeptonica: 1.65 - 1.75.2
CPE2.3- cpe:2.3:a:danbloomberg:leptonica:1.65:*:*:*:*:*:*:*
- cpe:2.3:a:danbloomberg:leptonica:1.66:*:*:*:*:*:*:*
- cpe:2.3:a:danbloomberg:leptonica:1.67:*:*:*:*:*:*:*
https://lists.debian.org/debian-lts/2018/02/msg00086.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Race condition
EUVDB-ID: #VU11225
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2018-7441
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to overwrite arbitrary files on the target system.
The weakness exists due to hardcoded /tmp pathnames. A local attacker can create a file in advance, trigger race condition and overwrite arbitrary files.
Install update from vendor's website.
Vulnerable software versionsLeptonica: 1.65 - 1.75.3
CPE2.3- cpe:2.3:a:danbloomberg:leptonica:1.65:*:*:*:*:*:*:*
- cpe:2.3:a:danbloomberg:leptonica:1.66:*:*:*:*:*:*:*
- cpe:2.3:a:danbloomberg:leptonica:1.67:*:*:*:*:*:*:*
https://bugzilla.redhat.com/show_bug.cgi?id=1549742
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
