The vulnerability affects the file function /tmp/out of the Tesseract component of the software suite for processing, transforming, and generating Ghostscript documents. This vulnerability allows an attacker to gain unauthorized access to protected information.

The vulnerability of the software for processing, transforming, and generating Ghostscript documents is related to incorrect restrictions on the path to the restricted directory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information through...

Artifex Software Ghostscript Directory Traversal Vulnerability

Artifex Software Ghostscript is an open source parser for Postscript a page description language and programming language used in the electronics industry and desktop publishing from Artifex Software, Inc. The product can display Postscript files as well as print Postscript files on non-PostScrip...

SUSE CVE-2024-29511

Artifex Ghostscript before 10.03.1, when Tesseract is used for OCR, has a directory traversal issue that allows arbitrary file reading and writing of error messages to arbitrary files via OCRLanguage. For example, exploitation can use debugfile /tmp/out and userpatternsfile /etc/passwd...

DEBIAN-CVE-2024-29511

Artifex Ghostscript before 10.03.1, when Tesseract is used for OCR, has a directory traversal issue that allows arbitrary file reading and writing of error messages to arbitrary files via OCRLanguage. For example, exploitation can use debugfile /tmp/out and userpatternsfile /etc/passwd...

[slackware-security] ghostscript

New ghostscript packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/ghostscript-9.55.0-i586-2slack15.0.txz: Rebuilt. Fixes security issues: A vulnerability was identified in the way...

Remote code execution in dawnsparks-node-tesseract

dawnsparks-node-tesseract before 0.4.1 was discovered to contain a remote code execution RCE vulnerability via the childprocess function...

GHSA-88QF-5F3V-PM6M Remote code execution in dawnsparks-node-tesseract

dawnsparks-node-tesseract before 0.4.1 was discovered to contain a remote code execution RCE vulnerability via the childprocess function...

Remote code execution

huedawn-tesseract 0.3.3 and dawnsparks-node-tesseract 0.4.0 to 0.4.1 was discovered to contain a remote code execution RCE vulnerability via the childprocess function...

CVE-2023-29566

huedawn-tesseract 0.3.3 and dawnsparks-node-tesseract 0.4.0 to 0.4.1 was discovered to contain a remote code execution RCE vulnerability via the childprocess function...

PT-2023-22308 · Unknown · Huedawn-Tesseract +1

Name of the Vulnerable Software and Affected Versions: huedawn-tesseract version 0.3.3 dawnsparks-node-tesseract versions 0.4.0 through 0.4.1 Description: The issue is related to a remote code execution RCE vulnerability via the child process function. Recommendations: For huesdawn-tesseract...

tesseract 命令注入漏洞

tesseract is an open source OCR Optical Character Recognition engine. A security vulnerability exists in huedawn-tesseract version 0.3.3, dawnsparks-node-tesseract versions 0.4.0 through 0.4.1, which stems from the discovery of a Remote Code Execution RCE vulnerability via the childprocess functi...

CVE-2023-29566

CVE-2023-29566 affects huedawn-tesseract 0.3.3 and dawnsparks-node-tesseract 0.4.0–0.4.1. Root cause: remote code execution via the child_process function, enabling potential arbitrary code execution. Documents indicate exploitation through unsafely handling image file names/exec usage. Impact is...

SUSE CVE-2021-36081

Tesseract OCR 5.0.0-alpha-20201231 has a oneellconflict use-after-free during a strpbrk call...

CVE-2022-38266

A vulnerability was found in the Leptonica linked library in Tesseract. A divide by zero in the pixBlockconvGray function causes an arithmetic exception, leading to a denial of service...

tesseract 数字错误漏洞

tesseract is an open source OCR Optical Character Recognition engine. A numeric error vulnerability exists in the Leptonica linked library v1.79.0 in tesseract v5.0.0, which can be exploited by an attacker to cause an arithmetic anomaly via a specially crafted JPEG file, leading to a denial of...

Command Injection

npos-tesseract is vulnerable to command injection. The vulnerability exists because the module.export function of ocr.js does not properly sanitize the options and image parameters, allowing an attacker to inject and execute malicious code...

npos-cli (>=0.0.5 <=0.0.6) potentially affected by CVE-2020-28453 via npos-tesseract (=0.0.3)

npos-tesseract NPM version =0.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on npos-tesseract and may be impacted: - npos-cli =0.0.5, =0.0.6 Source cves: CVE-2020-28453 Source advisory: OSV:GHSA-MPWP-PF96-9G4R...

GHSA-MPWP-PF96-9G4R npos-tesseract Command Injection vulnerability

A command injection vulnerability affects all versions of package npos-tesseract. The injection point is located in line 55 in lib/ocr.js...

npos-tesseract Command Injection vulnerability

A command injection vulnerability affects all versions of package npos-tesseract. The injection point is located in line 55 in lib/ocr.js...

CVE-2020-28453

This affects all versions of package npos-tesseract. The injection point is located in line 55 in lib/ocr.js...