Leptonica before 1.80.0 allows a heap-based buffer over-read in findNextBorderPixel in ccbord.c.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Leptonica before 1.80.0 allows a heap-based buffer over-read in findNextBorderPixel in ccbord.c.
    (CVE-2020-36278)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-202107-53 (Leptonica: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Leptonica. Please       review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

Several issues have been found by ClusterFuzz in leptonlib, an image processing library.

All issues are related to heap-based buffer over-read in several functions or a denial of service (application crash) with crafted data.

For Debian 9 stretch, these problems have been fixed in version 1.74.1-1+deb9u1.

We recommend that you upgrade your leptonlib packages.

For the detailed security status of leptonlib please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/leptonlib

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
259757	Linux Distros Unpatched Vulnerability : CVE-2020-36278	Nessus	Misc.	high
157040	GLSA-202107-53 : Leptonica: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
148270	Debian DLA-2612-1 : leptonlib security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2020-36278

high

Tenable Plugins

high

high

high