GitHub Advisoryadvisory · PyPI

GHSA-5pjj-7m4p-wfh2 ocrodjvu is vulnerable to Arbitrary File Modification via symlink attack

MEDIUM Published 2022-05-17 Modified 2024-02-07 Official page ↗
Aliases
CVE-2010-4338
Ecosystem
PyPI
Packages
ocrodjvu
Severity
Moderate
Weaknesses
CWE-59
Reviewed
2024-02-07

Affected packages

• PyPI ocrodjvu: >= 0.4.6-1, < 0.4.6-2 → fixed in 0.4.6-2

Description

ocrodjvu 0.4.6-1 on Debian GNU/Linux allows local users to modify arbitrary files via a symlink attack on temporary files that are generated when Cuneiform is invoked as the OCR engine.

Related

Alias · CVE (1)

  • CVE-2010-4338 ocrodjvu 0.4.6-1 on Debian GNU/Linux allows local users to modify arbitrary files via a symlink attack on temporary files that are… vulnerability

Weakness · CWE (1)

  • CWE-59 Improper Link Resolution Before File Access weakness

References