CVE-2018-7440
leptonica-progs: An issue was discovered in Leptonica through 1.75.3
CVE-2018-7440 is fixed in 2 products on 1 platform, first by leptonica-progs 1.75.3-3, released February 23, 2018. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0374
89th percentile
An issue was discovered in Leptonica through 1.75.3. The gplotMakeOutput function allows command injection via a $(command) approach in the gplot rootname argument. This issue exists because of an incomplete fix for CVE-2018-3836.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| leptonica-progs · Ubuntu 18.04.6 LTS (bionic) | 1.75.3-3 | leptonica-progs 1.75.3-3 | Feb 23, 2018 |
| liblept5 · Ubuntu 18.04.6 LTS (bionic) | 1.75.3-3 | liblept5 1.75.3-3 | Feb 23, 2018 |