PT-2018-1097 · Leptonica+2 · Leptonica+2

Ben Hutchings · Published 2018-02-14 · Updated 2024-12-19 · CVE-2018-7186

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Leptonica versions prior to 1.75.3

Description The issue is related to the gplotRead and ptaReadStream functions in the Leptonica library, which does not limit the number of characters in a %s format argument to fscanf or sscanf. This allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a long string.

Recommendations For versions prior to 1.75.3, update to version 1.75.3 or later to resolve the issue. As a temporary workaround, consider restricting the input to the gplotRead and ptaReadStream functions to prevent the use of long strings that could cause a stack-based buffer overflow.

Fix

DoS

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-119

CWE-787

Related Identifiers

ALT-PU-2021-3559

ALT-PU-2022-1147

ALT-PU-2024-16902

BDU:2018-00494

CVE-2018-7186

DLA-1302-1

MGASA-2018-0175

OPENSUSE-SU-2024:10914-1

USN-4819-1

Affected Products

Alt Linux

Leptonica

Ubuntu

References · 28

• https://github.com/DanBloomberg/leptonica/commit/ee301cb2029db8a6289c5295daa42bba7715e99a · Patch
• https://osv.dev/vulnerability/MGASA-2018-0175 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-3836 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-18196 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4819-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-7186 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0175.html · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-7186 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-7186 · Security Note
• https://cve.org/CVERecord?id=CVE-2018-7186 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10914-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4819-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-7186 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-7186 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-7186 · Vendor Advisory