Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2018-3836 →
DEBIAN-CVE-2018-3836
An exploitable command injection vulnerability exists in the gplotMakeOutput function of Leptonica 1.74.4. A specially crafted gplot rootname argument...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
An exploitable command injection vulnerability exists in the gplotMakeOutput function of Leptonica 1.74.4. A specially crafted gplot rootname argument can cause a command injection resulting in arbitrary code execution. An attacker can provide a malicious path as input to an application that passes attacker data to this function to trigger this vulnerability.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
leptonlib
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.75.3-1"}]}]
Debian:13
leptonlib
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.75.3-1"}]}]
Debian:14
leptonlib
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.75.3-1"}]}]
Références
- advisory security-tracker.debian.org