CVE-2018-7442
leptonica-progs: An issue was discovered in Leptonica through 1.75.3
CVE-2018-7442 is fixed in 2 products on 1 platform, first by leptonica-progs 1.76.0-1, released January 16, 2026. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0200
80th percentile
An issue was discovered in Leptonica through 1.75.3. The gplotMakeOutputfunction does not block '/' characters in the gplot rootname argument,potentially leading to path traversal and arbitrary file overwrite.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| leptonica-progs · Ubuntu 24.10 (oracular) | 1.76.0-1 | leptonica-progs 1.76.0-1 | Jan 16, 2026 |
| leptonica-progs · Ubuntu 25.04 (plucky) | 1.76.0-1 | leptonica-progs 1.76.0-1 | Jan 16, 2026 |
| liblept5 · Ubuntu 24.10 (oracular) | 1.76.0-1 | liblept5 1.76.0-1 | Jan 16, 2026 |
| liblept5 · Ubuntu 25.04 (plucky) | 1.76.0-1 | liblept5 1.76.0-1 | Jan 16, 2026 |