leptonlib: CVE-2018-7442

Debian Bug report logs - #898439
leptonlib: CVE-2018-7442

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: leptonlib: CVE-2018-7442

Date: Fri, 11 May 2018 19:17:57 +0200

Source: leptonlib
Version: 1.75.3-1
Severity: important
Tags: security upstream

Hi,

The following vulnerability was published for leptonlib, I think this
one was never reported yet directly to the BTS (nor upstream?).

CVE-2018-7442[0]:
| An issue was discovered in Leptonica through 1.75.3. The
| gplotMakeOutput function does not block '/' characters in the gplot
| rootname argument, potentially leading to path traversal and arbitrary
| file overwrite.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2018-7442
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7442
[1] https://lists.debian.org/debian-lts/2018/02/msg00086.html

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #10 received at submit@bugs.debian.org (full text, mbox, reply):

From: Jeff Breidenbach <jeff@jab.org>

To: Salvatore Bonaccorso <carnil@debian.org>, 898439-done@bugs.debian.org

Cc: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: Re: Bug#898439: leptonlib: CVE-2018-7442

Date: Fri, 11 May 2018 12:01:02 -0700

[Message part 1 (text/plain, inline)]

Believed fixed  in Debian package 1.76.0-1

Status of various vulnerabilities, as per upstream:

        * CVE-2018-7442: potential injection attack because '/' is allowed
          in gplot rootdir.
          Functions using this command have been disabled by default in the
          distribution, starting with 1.76.0.  As for the specific issue, it
          is impossible to specify a general path without using the standard
          directory subdivider '/'.
        * CVE-2018-7186: number of characters not limited in fscanf or
sscanf,
          allowing possible attack with buffer overflow.
          This has been fixed in 1.75.3.
        * CVE-2018-3836: command injection vulnerability in
gplotMakeOutput().
          This has been fixed in 1.75.3, using stringCheckForChars() to
block
          rootnames containing any of: ;&|>"?*$()/<
        * CVE-2017-18196: duplicated path components.
          This was fixed in 1.75.3.
        * CVE-2018-7441: hardcoded /tmp pathnames.
          These are all wrapped in special debug functions that are not
          enabled by default in the distribution, starting with 1.76.0.
        * CVE-2018-7247: input 'rootname' can overflow a buffer.
          This was fixed in 1.76.0, using snprintf().
        * CVE-2018-7440: command injection in gplotMakeOutput using
$(command).
          Fixed in 1.75.3, which blocks '$' as well as 11 other characters.

[Message part 2 (text/html, inline)]

Message #22 received at 898439@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Jeff Breidenbach <jeff@jab.org>, 898439@bugs.debian.org

Subject: Re: Bug#898439: leptonlib: CVE-2018-7442

Date: Fri, 11 May 2018 21:14:49 +0200

Hi,

On Fri, May 11, 2018 at 12:01:02PM -0700, Jeff Breidenbach wrote:
> Believed fixed  in Debian package 1.76.0-1
> 
> Status of various vulnerabilities, as per upstream:
> 
>         * CVE-2018-7442: potential injection attack because '/' is allowed
>           in gplot rootdir.
>           Functions using this command have been disabled by default in the
>           distribution, starting with 1.76.0.  As for the specific issue, it
>           is impossible to specify a general path without using the standard
>           directory subdivider '/'.

Ah good, I missed your unstable upload from yesterday.

Regards,
Salvatore

Send a report that this bug log contains spam.