CVE-2018-7442

An issue was discovered in Leptonica through 1.75.3. The gplotMakeOutput function does not block '/' characters in the gplot rootname argument, potentially leading to path traversal and arbitrary file overwrite.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.1 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 42%
VendorProductVersion
leptonicaleptonica
𝑥
≤ 1.75.3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
leptonlib
bullseye
1.79.0-1.1+deb11u1
fixed
wheezy
ignored
bookworm
1.82.0-3
fixed
sid
1.84.1-4
fixed
trixie
1.84.1-4
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
leptonlib
noble
Fixed 1.76.0-1
released
mantic
Fixed 1.76.0-1
released
lunar
Fixed 1.76.0-1
released
kinetic
Fixed 1.76.0-1
released
jammy
Fixed 1.76.0-1
released
impish
Fixed 1.76.0-1
released
hirsute
Fixed 1.76.0-1
released
groovy
Fixed 1.76.0-1
released
focal
Fixed 1.76.0-1
released
eoan
Fixed 1.76.0-1
released
disco
Fixed 1.76.0-1
released
cosmic
Fixed 1.76.0-1
released
bionic
needed
artful
ignored
xenial
needed
trusty
needed