CVE-2010-4338 ocrodjvu is vulnerable to Arbitrary File Modification via symlink attack
MediumCVSS 6.2
EPSS 0.32%
- Published
- Updated
- Exploit status
- No public exploit known
Description
ocrodjvu 0.4.6-1 on Debian GNU/Linux allows local users to modify arbitrary files via a symlink attack on temporary files that are generated when Cuneiform is invoked as the OCR engine.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi ocrodjvu(PyPI) | >= 0.4.6-1, < 0.4.6-2 | 0.4.6-2 |
| pypi ocrodjvu(PyPI) | = 0.4.6-1 | No fix listed |
| debian/ocrodjvu(Debian:10) | < 0.4.6-2 | 0.4.6-2 |
| jwilk ocrodjvu | = 0.4.6-1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- ocrodjvu-cuneiform-symlink(64892) vdb-entry
- github.com product
- web.archive.org
- bugs.debian.org
- pypi.org product
- github.com vendor-advisory
- 45234 vdb-entry