CVE-2018-7441

HIGH

leptonica < 1.75.3 - Arbitrary File Write via Hardcoded /tmp Pathnames

Title source: llm
STIX 2.1

Description

Leptonica through 1.75.3 uses hardcoded /tmp pathnames, which might allow local users to overwrite arbitrary files or have unspecified other impact by creating files in advance or winning a race condition, as demonstrated by /tmp/junk_split_image.ps in prog/splitimage2pdf.c.

References (2)

Core 2
Core References
Third Party Advisory vendor-advisory
https://security.gentoo.org/glsa/202312-01

Scores

CVSS v3 7.0
EPSS 0.0026
EPSS Percentile 17.5%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-362
Status published
Products (1)
leptonica/leptonica < 1.75.3
Published Feb 23, 2018
Tracked Since Feb 18, 2026