CVE-2018-3836: OS Command Injection

Published Apr 24, 2018

Updated

An exploitable command injection vulnerability exists in the gplotMakeOutput function of Leptonica 1.74.4. A specially crafted gplot rootname argument can cause a command injection resulting in arbitrary code execution. An attacker can provide a malicious path as input to an application that passes attacker data to this function to trigger this vulnerability.

Affected Software

2 affected components

Leptonica Leptonica=1.74.4

Debian Debian Linux=7.0

Event History

Apr 24, 2018

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2018-3836?

CVE-2018-3836 has a high severity rating due to the potential for arbitrary code execution.

How do I fix CVE-2018-3836?

To fix CVE-2018-3836, update Leptonica to versions later than 1.74.4 that address the command injection vulnerability.

What software is affected by CVE-2018-3836?

The affected software includes Leptonica version 1.74.4 and Debian GNU/Linux version 7.0.

Can CVE-2018-3836 be exploited remotely?

Yes, CVE-2018-3836 can be exploited remotely if an attacker can control the input passed to the gplotMakeOutput function.

What type of vulnerability is CVE-2018-3836?

CVE-2018-3836 is a command injection vulnerability that allows attackers to execute arbitrary commands on the system.