PT-2021-4616 · Leptonica+1 · Leptonica+1

Published 2021-03-12 · Updated 2025-01-28 · CVE-2020-36279

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Leptonica versions prior to 1.80.0

Description The issue is related to a heap-based buffer over-read in the rasteropGeneralLow component of the Leptonica image processing library. This can be exploited by a remote attacker to cause a denial of service. The vulnerability is associated with the adaptmap reg.c and adaptmap.c files.

Recommendations For versions prior to 1.80.0, update to version 1.80.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the rasteropGeneralLow function until a patch is available.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2021-05304

CVE-2020-36279

DLA-2612-1

MGASA-2021-0290

OESA-2021-1327

ROSA-SA-2025-2626

Affected Products

Astra Linux

Leptonica

References · 38

• 🔥 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22512 · Exploit
• https://github.com/DanBloomberg/leptonica/compare/1.79.0...1.80.0 · Patch
• https://github.com/DanBloomberg/leptonica/commit/3c18c43b6a3f753f0dfff99610d46ad46b8bfac4 · Patch
• https://advisories.mageia.org/MGASA-2021-0290.html · Security Note
• https://osv.dev/vulnerability/MGASA-2021-0290 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36281 · Security Note
• https://ubuntu.com/security/CVE-2020-36279 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36279 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-36278 · Security Note
• https://osv.dev/vulnerability/CVE-2020-36279 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1327 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-36279 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-36279 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-0819SE17 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-36279 · Security Note