{"id":"CVE-2017-18196","aliases":["DEBIAN-CVE-2017-18196","EUVD-2017-9330","GHSA-m7cf-9jqx-8xrq","UBUNTU-CVE-2017-18196","USN-4819-1","openSUSE-SU-2024:10914-1"],"status":"published","title":"Leptonica 1.74.4 constructs unintended pathnames (containing duplicated path components) when...","description":"Leptonica 1.74.4 constructs unintended pathnames (containing duplicated path components) when operating on files in /tmp subdirectories, which might allow local users to bypass intended file restrictions by leveraging access to a directory located deeper within the /tmp directory tree, as demonstrated by /tmp/ANY/PATH/ANY/PATH/input.tif.","severity":{"version":"3.0","score":3.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00409,"percentile":0.35432,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2018-02-23T21:00:00Z","modified":"2026-10-24T10:31:06Z","fixes":[{"ecosystem":"Debian:12","package":"leptonlib","fixed_in":["1.74.4-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"leptonlib","fixed_in":["1.74.4-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"leptonlib","fixed_in":["1.74.4-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"leptonlib","fixed_in":["1.73-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"leptonlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.74.4-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"leptonlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.74.4-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"leptonlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.74.4-2"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"leptonlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.73-1ubuntu0.1~esm1"}]}],"versions":["1.72-3","1.72-3build1","1.73-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"leptonlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.70.1-1ubuntu0.1~esm1"}]}],"versions":["1.69-4ubuntu1","1.69-4ubuntu2","1.69-4ubuntu3","1.69-4ubuntu4","1.70.1-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"leptonlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.73-1ubuntu0.1~esm1"}]}],"versions":["1.72-3","1.72-3build1","1.73-1"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"leptonica","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.80.0-1.9"}]}],"bundled":7}],"products":[{"vendor":"leptonica","product":"leptonica"}],"references":[{"url":"https://bugs.debian.org/885704","tags":["x_transferred","Mailing List","Third Party Advisory","advisory","report"]},{"url":"https://security.gentoo.org/glsa/202312-01","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18196"},{"url":"https://github.com/advisories/GHSA-m7cf-9jqx-8xrq"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-18196","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-18196","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-18196","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4819-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-3836","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-7186","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7440","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7442","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-18196","description":"Leptonica 1.74.4 constructs unintended pathnames (containing duplicated path components) when operating on files in /tmp subdirectories, which might allow local users to bypass intended file restrictions by leveraging access to a directory located deeper within the /tmp directory tree, as demonstrated by /tmp/ANY/PATH/ANY/PATH/input.tif.","status":"published","published":"2018-02-23T21:00:00Z","modified":"2024-09-16T17:33:01.263Z","updated_at":"2026-11-02T14:33:22.064284Z"}],"euvd":[{"id":"EUVD-2017-9330","description":"Leptonica 1.74.4 constructs unintended pathnames (containing duplicated path components) when operating on files in /tmp subdirectories, which might allow local users to bypass intended file restrictions by leveraging access to a directory located deeper within the /tmp directory tree, as demonstrated by /tmp/ANY/PATH/ANY/PATH/input.tif.","status":"published","published":"2018-02-23T21:00:00Z","modified":"2024-09-16T17:33:01Z","updated_at":"2026-11-03T00:55:41.00036Z"}],"ghsa":[{"id":"GHSA-m7cf-9jqx-8xrq","title":"Leptonica 1.74.4 constructs unintended pathnames (containing duplicated path components) when...","description":"Leptonica 1.74.4 constructs unintended pathnames (containing duplicated path components) when operating on files in /tmp subdirectories, which might allow local users to bypass intended file restrictions by leveraging access to a directory located deeper within the /tmp directory tree, as demonstrated by /tmp/ANY/PATH/ANY/PATH/input.tif.","status":"published","published":"2022-05-13T01:44:36Z","modified":"2023-02-02T05:01:02Z","cvss":[{"version":"3.0","score":3.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:51:05.943235Z"}],"nvd":[{"id":"CVE-2017-18196","description":"Leptonica 1.74.4 constructs unintended pathnames (containing duplicated path components) when operating on files in /tmp subdirectories, which might allow local users to bypass intended file restrictions by leveraging access to a directory located deeper within the /tmp directory tree, as demonstrated by /tmp/ANY/PATH/ANY/PATH/input.tif.","status":"published","published":"2018-02-23T21:29:00.243Z","modified":"2026-06-17T01:12:22.367Z","cvss":[{"version":"3.0","score":3.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:04:15.877386Z"}],"osv":[{"id":"CVE-2017-18196","description":"Leptonica 1.74.4 constructs unintended pathnames (containing duplicated path components) when operating on files in /tmp subdirectories, which might allow local users to bypass intended file restrictions by leveraging access to a directory located deeper within the /tmp directory tree, as demonstrated by /tmp/ANY/PATH/ANY/PATH/input.tif.","status":"published","published":"2018-02-23T21:29:00.243Z","modified":"2026-10-24T10:31:06.900784874Z","cvss":[{"version":"3.0","score":3.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:44:05.486486Z"},{"id":"DEBIAN-CVE-2017-18196","description":"Leptonica 1.74.4 constructs unintended pathnames (containing duplicated path components) when operating on files in /tmp subdirectories, which might allow local users to bypass intended file restrictions by leveraging access to a directory located deeper within the /tmp directory tree, as demonstrated by /tmp/ANY/PATH/ANY/PATH/input.tif.","status":"published","published":"2018-02-23T21:29:00.243Z","modified":"2026-09-01T20:03:47.46540532Z","cvss":[{"version":"3.0","score":3.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:29.100767Z"},{"id":"UBUNTU-CVE-2017-18196","description":"Leptonica 1.74.4 constructs unintended pathnames (containing duplicated path components) when operating on files in /tmp subdirectories, which might allow local users to bypass intended file restrictions by leveraging access to a directory located deeper within the /tmp directory tree, as demonstrated by /tmp/ANY/PATH/ANY/PATH/input.tif.","status":"published","published":"2018-02-23T21:29:00Z","modified":"2026-04-22T11:21:31.93857Z","cvss":[{"version":"3.0","score":3.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:54:14.977781Z"},{"id":"openSUSE-SU-2024:10914-1","title":"leptonica-devel-1.80.0-1.9 on GA media","description":"These are all security issues fixed in the leptonica-devel-1.80.0-1.9 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:09:40.124008Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"USN-4819-1","title":"leptonlib vulnerabilities","description":"It was discovered that Leptonica incorrectly handled path names. An\nattacker could possibly use this issue to obtain sensitive information.\nThis issue only affected Ubuntu 16.04 ESM. (CVE-2017-18196)\n\nIt was discovered that Leptonica incorrectly handled certain input\narguments. An attacker could possibly use this issue to execute arbitrary\ncommands. (CVE-2018-3836)\n\nIt was discovered that Leptonica incorrectly handled input arguments. An\nattacker could possibly use this issue to cause a denial of service or\nother unspecified impact. (CVE-2018-7186)\n","status":"published","published":"2021-03-15T21:56:16Z","modified":"2026-06-29T13:48:30.87407995Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}