Leptonica before 1.80.0 allows a denial of service (application crash) via an incorrect left shift in pixConvert2To8 in pixconv.c.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Leptonica before 1.80.0 allows a denial of service (application crash) via an incorrect left shift in     pixConvert2To8 in pixconv.c. (CVE-2020-36277)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-202107-53 (Leptonica: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Leptonica. Please       review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

Several issues have been found by ClusterFuzz in leptonlib, an image processing library.

All issues are related to heap-based buffer over-read in several functions or a denial of service (application crash) with crafted data.

For Debian 9 stretch, these problems have been fixed in version 1.74.1-1+deb9u1.

We recommend that you upgrade your leptonlib packages.

For the detailed security status of leptonlib please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/leptonlib

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
257314	Linux Distros Unpatched Vulnerability : CVE-2020-36277	Nessus	Misc.	high
157040	GLSA-202107-53 : Leptonica: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
148270	Debian DLA-2612-1 : leptonlib security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2020-36277

high

Tenable Plugins

high

high

high