Leptonica

This hub aggregates every CVE we track for Leptonica, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 13 most recently published vulnerabilities affecting Leptonica.

• CVE-2022-38266An issue in the Leptonica linked library (v1.79.0) allows attackers to cause an arithmetic exception leading to a Denial of Service (DoS) via a crafted JPEG file.6.5Sep 9, 2022
• CVE-2020-36281Leptonica before 1.80.0 allows a heap-based buffer over-read in pixFewColorsOctcubeQuantMixed in colorquant1.c.7.5Mar 12, 2021
• CVE-2020-36280Leptonica before 1.80.0 allows a heap-based buffer over-read in pixReadFromTiffStream, related to tiffio.c.7.5Mar 12, 2021
• CVE-2020-36279Leptonica before 1.80.0 allows a heap-based buffer over-read in rasteropGeneralLow, related to adaptmap_reg.c and adaptmap.c.7.5Mar 12, 2021
• CVE-2020-36278Leptonica before 1.80.0 allows a heap-based buffer over-read in findNextBorderPixel in ccbord.c.7.5Mar 11, 2021
• CVE-2020-36277Leptonica before 1.80.0 allows a denial of service (application crash) via an incorrect left shift in pixConvert2To8 in pixconv.c.7.5Mar 11, 2021
• CVE-2018-3836An exploitable command injection vulnerability exists in the gplotMakeOutput function of Leptonica 1.74.4. A specially crafted gplot rootname argument can cause a command injection resulting in arb...7.8Apr 24, 2018
• CVE-2017-18196Leptonica 1.74.4 constructs unintended pathnames (containing duplicated path components) when operating on files in /tmp subdirectories, which might allow local users to bypass intended file restri...3.3Feb 23, 2018
• CVE-2018-7441Leptonica through 1.75.3 uses hardcoded /tmp pathnames, which might allow local users to overwrite arbitrary files or have unspecified other impact by creating files in advance or winning a race co...7.0Feb 23, 2018
• CVE-2018-7440An issue was discovered in Leptonica through 1.75.3. The gplotMakeOutput function allows command injection via a $(command) approach in the gplot rootname argument. This issue exists because of an ...9.8Feb 23, 2018
• CVE-2018-7442An issue was discovered in Leptonica through 1.75.3. The gplotMakeOutput function does not block '/' characters in the gplot rootname argument, potentially leading to path traversal and arbitrary f...9.1Feb 23, 2018
• CVE-2018-7247An issue was discovered in pixHtmlViewer in prog/htmlviewer.c in Leptonica before 1.75.3. Unsanitized input (rootname) can overflow a buffer, leading potentially to arbitrary code execution or poss...9.8Feb 19, 2018
• CVE-2018-7186Leptonica before 1.75.3 does not limit the number of characters in a %s format argument to fscanf or sscanf, which allows remote attackers to cause a denial of service (stack-based buffer overflow)...9.8Feb 16, 2018