This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2018-7441 →

DEBIAN-CVE-2018-7441

Leptonica through 1.75.3 uses hardcoded /tmp pathnames, which might allow local users to overwrite arbitrary files or have unspecified other impact by...

Original description

The description as published by the source.

Leptonica through 1.75.3 uses hardcoded /tmp pathnames, which might allow local users to overwrite arbitrary files or have unspecified other impact by creating files in advance or winning a race condition, as demonstrated by /tmp/junk_split_image.ps in prog/splitimage2pdf.c.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 leptonlib

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.76.0-1"}]}]

Debian:13 leptonlib

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.76.0-1"}]}]

Debian:14 leptonlib

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.76.0-1"}]}]

References

advisory security-tracker.debian.org