Dan Bloomberg · Leptonica · CVE-2017-18196
Name of the Vulnerable Software and Affected Versions:
Leptonica version 1.74.4
Description:
The issue allows local users to potentially bypass intended file restrictions by exploiting access to a directory located deeper within the /tmp directory tree. This can occur when Leptonica operates on files in /tmp subdirectories and constructs unintended pathnames containing duplicated path components.
Recommendations:
For Leptonica version 1.74.4, consider restricting access to /tmp subdirectories to minimize the risk of exploitation until a patch is available. Avoid using Leptonica to operate on files in /tmp subdirectories until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.