An issue was discovered in Leptonica through 1.75.3. The gplotMakeOutput function does not block '/' characters in the gplot rootname argument, potentially leading to path traversal and arbitrary file overwrite.
{ "binaries": [ { "binary_name": "leptonica-progs", "binary_version": "1.70.1-1ubuntu0.1~esm1" }, { "binary_name": "liblept4", "binary_version": "1.70.1-1ubuntu0.1~esm1" }, { "binary_name": "libleptonica-dev", "binary_version": "1.70.1-1ubuntu0.1~esm1" } ] }
{ "binaries": [ { "binary_name": "leptonica-progs", "binary_version": "1.73-1ubuntu0.1~esm1" }, { "binary_name": "liblept5", "binary_version": "1.73-1ubuntu0.1~esm1" }, { "binary_name": "libleptonica-dev", "binary_version": "1.73-1ubuntu0.1~esm1" } ] }
{ "binaries": [ { "binary_name": "leptonica-progs", "binary_version": "1.75.3-3ubuntu0.1~esm1" }, { "binary_name": "liblept5", "binary_version": "1.75.3-3ubuntu0.1~esm1" }, { "binary_name": "libleptonica-dev", "binary_version": "1.75.3-3ubuntu0.1~esm1" } ] }