CVE-2022-38266: Divide by Zero
An issue in the Leptonica linked library (v1.79.0) allows attackers to cause an arithmetic exception leading to a Denial of Service (DoS) via a crafted JPEG file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/leptonlibto a version that resolves this vulnerability.Fixed in 1.82.0-3Fixed in 1.84.1-4Fixed in 1.86.0-1 - Upgrade
Upgrade
debian/leptonlibto a version that resolves this vulnerability.Fixed in 1.82.0-1
Event History
Frequently Asked Questions
What is the severity of CVE-2022-38266?
CVE-2022-38266 is classified as a high severity vulnerability that can lead to Denial of Service.
How do I fix CVE-2022-38266?
To fix CVE-2022-38266, upgrade Leptonica to version 1.80.0 or later.
Which software is affected by CVE-2022-38266?
CVE-2022-38266 affects Leptonica versions up to 1.80.0, Tesseract 5.0.0-alpha-20210401, and Debian 10.0.
What type of vulnerability is CVE-2022-38266?
CVE-2022-38266 is an arithmetic exception vulnerability that can trigger a Denial of Service.
Can I still use Tesseract with CVE-2022-38266?
Using Tesseract with the vulnerable version of Leptonica may expose you to risks, so it is recommended to update.