CVE-2018-7186 Leptonica before 1.75.3 does not limit the number of characters in a %s format argument to fscanf or sscanf, which allows remote attackers to cause a denial of service (stack-based buffer overflow) or...
CriticalCVSS 9.8
EPSS 3.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Leptonica before 1.75.3 does not limit the number of characters in a %s format argument to fscanf or sscanf, which allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a long string, as demonstrated by the gplotRead and ptaReadStream functions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/leptonlib(Debian:12) | < 1.75.3-2 | 1.75.3-2 |
| debian/leptonlib(Debian:13) | < 1.75.3-2 | 1.75.3-2 |
| debian/leptonlib(Debian:14) | < 1.75.3-2 | 1.75.3-2 |
| leptonica | < 1.75.3 | 1.75.3 |
| debian linux | = 7.0 | No fix listed |
References
- Debian Security Tracker CVE-2018-7186 vendor-advisory
- bugs.debian.org issue-tracking third-party-advisory
- github.com patch third-party-advisory
- [debian-lts-announce] 20180307 [SECURITY] [DLA 1302-1] leptonlib security update mailing-list third-party-advisory
- lists.debian.org mailing-list third-party-advisory
- GLSA-202312-01 vendor-advisory