CVE-2018-3836

An exploitable command injection vulnerability exists in the gplotMakeOutput function of Leptonica 1.74.4

High · published April 24, 2018

CVSS v3.0
7.0
EPSS
1%
Percentile
72.6
In the wild
Unconfirmed
What it is

An exploitable command injection vulnerability exists in the gplotMakeOutput function of Leptonica 1.74.4. A specially crafted gplot rootname argument can cause a command injection resulting in arbitrary code execution. An attacker can provide a malicious path as input to an application that passes attacker data to this function to trigger this vulnerability.

The record
Technical detail
CVSS v3.0
7.0 · HIGH
Vector
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01429 · 72.6th percentile
Published
2018-04-24T19:00Z
EPSS history
Timeline
  • 24 APR 19:00Z
    An exploitable command injection vulnerability exists in the gplotMakeOutput function of Leptonica 1.74.4
    cvelistv5