GHSA-357f-833m-3f83: Tesseract: File-controlled pointers still reach `delete` in ADAPT_CLASS_STRUCT destructor
Tesseract is an open source OCR engine. Prior to 5.5.4, ReadAdaptedClass in src/classify/adaptive.cpp raw-reads an ADAPTCLASSSTRUCT from a pre-adapted-template .a file without neutralizing TempProtos and Config pointer fields before any destructor path. When the legacy engine is selected, classifyusepreadaptedtemplates is enabled, and an attacker can write the output-basename .a file, the success or rejection path can pass file-controlled pointers to ~ADAPTCLASSSTRUCT and operator delete, causing memory corruption and denial of service. This issue is fixed in version 5.5.4.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tesseractto a version that resolves this vulnerability.Fixed in 5.5.4
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using Tesseract before 5.5.4 are exposed only when the legacy engine is selected, classify_use_pre_adapted_templates is enabled, and an attacker can write the output-basename .a pre-adapted-template file.
What does an attacker need to exploit it?
The attacker needs the ability to write the output-basename .a file used as a pre-adapted template. No authentication or user interaction is indicated by the supplied vector.
What can happen if exploitation succeeds?
File-controlled pointer values can reach the ADAPT_CLASS_STRUCT destructor and operator delete, causing memory corruption and denial of service.
What should be done if an immediate upgrade is not possible?
Avoid the affected condition by not using the legacy engine with classify_use_pre_adapted_templates enabled, and prevent untrusted users or processes from writing the output-basename .a file.
How can I determine whether an installation is affected?
Check whether Tesseract is older than 5.5.4 and whether the legacy engine and classify_use_pre_adapted_templates are in use. Also determine whether an untrusted party can write the output-basename .a file.