New OCR-ready risk analysis: Why the confusion?

Are you ready for an Office for Civil Rights OCR investigation? Will your risk analysis and risk management methodologies and documents be sufficient to meet the HIPAA Security Rule?...

CVE-2020-10913

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Design/Logic Flaw

Nitro Pro before 13.2 creates a debug.log file in the directory where a .pdf file is located, if the .pdf document was produced by an OCR operation on the JPEG output of a scanner. Reportedly, this can have a security risk if debug.log is later edited and then executed...

CVE-2019-18958

Nitro Pro before 13.2 is affected. The issue arises when a PDF is produced by OCR on the JPEG output of a scanner, causing Nitro Pro to write a debug.log in the same directory as the PDF. Reportedly, if this debug.log is later edited and then executed, it can pose a security risk. Connected docum...

CVE-2019-18958

Nitro Pro before 13.2 creates a debug.log file in the directory where a .pdf file is located, if the .pdf document was produced by an OCR operation on the JPEG output of a scanner. Reportedly, this can have a security risk if debug.log is later edited and then executed...

Malicious App on Google Play Tallies 100 Million Downloads

Call it the case of a good app gone bad! For some time, a handy PDF creator and optical character recognition OCR app available via Google Play offered users utility and convenience. The app, downloaded more than 100 million times, is called CamScanner and allows Android phone owners to snap a...

Apache Tika 1.15 - 1.17 - Header Command Injection Exploit

This Metasploit module exploits a command injection vulnerability in Apache Tika versions 1.15 through 1.17 on Windows. A file with the image/jp2 content-type is used to bypass magic byte checking. When OCR is specified in the request, parameters can be passed to change the parameters passed at...

tesseract-ocr/fuzzer-api: Heap-buffer-overflow in IntegerMatcher::UpdateTablesForFeature

Detailed report: https://oss-fuzz.com/testcase?key=5723894029221888 Project: tesseract-ocr Fuzzer: libFuzzertesseract-ocrfuzzer-api Fuzz target binary: fuzzer-api Job Type: libfuzzerasantesseract-ocr Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x627000344240 Crash...

tesseract-ocr/fuzzer-api: Index-out-of-bounds in ScratchEvidence::UpdateSumOfProtoEvidences

Detailed report: https://oss-fuzz.com/testcase?key=5738676530708480 Project: tesseract-ocr Fuzzer: libFuzzertesseract-ocrfuzzer-api Fuzz target binary: fuzzer-api Job Type: libfuzzerubsantesseract-ocr Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State:...

tesseract-ocr/fuzzer-api: Index-out-of-bounds in IntegerMatcher::UpdateTablesForFeature

Detailed report: https://oss-fuzz.com/testcase?key=5758158432108544 Project: tesseract-ocr Fuzzer: libFuzzertesseract-ocrfuzzer-api Fuzz target binary: fuzzer-api Job Type: libfuzzerubsantesseract-ocr Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State:...

tesseract-ocr/fuzzer-api: Heap-buffer-overflow in GenericVector<int>::size

Detailed report: https://oss-fuzz.com/testcase?key=5664637800939520 Project: tesseract-ocr Fuzzer: libFuzzertesseract-ocrfuzzer-api Fuzz target binary: fuzzer-api Job Type: libfuzzerasantesseract-ocr Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x628000023ce0 Crash...

How Hospitals Can Tie Cost Reduction to a Solid Data Security Program

When I have conversations with hospitals and other organizations subject to HIPAA, one of the first questions asked is "if I have a data breach, will OCR fine me, and if so, how much?" Many organizations decide to gamble: they opt to save time and money by not implementing a robust information ri...

HIPAA Complaints, OCR Investigations, and Security Risk Analysis for Healthcare Delivery Organizations – A Common Thread

Many HIPAA covered entities CEs and business associates BAs may not be meeting the regulatory mandate as defined in §164.308a1iiA of the HIPAA Security Rule. This implementation specification requires that healthcare delivery organizations HDOs "Conduct an accurate and thorough assessment of the...

jiNa OCR Image to Text 1.0 - Denial of Service Exploit

Exploit for windows platform in category dos / poc Exploit Title: jiNa OCR Image to Text 1.0 - Denial of Service PoC Author: Gionathan "John" Reale Software Link: http://www.convertimagetotext.net/downloadsoftware.php Tested Version: 1.0 Tested on OS: Windows 7 32-bit Steps to Reproduce: Run the...

jiNa OCR Image To Text 1.0 Denial Of Service

Exploit Title: jiNa OCR Image to Text 1.0 - Denial of Service PoC Author: Gionathan "John" Reale Discovey Date: 2018-09-10 Software Link: http://www.convertimagetotext.net/downloadsoftware.php Tested Version: 1.0 Tested on OS: Windows 7 32-bit Steps to Reproduce: Run the python exploit script, it...

Denial Of Service (DoS)

Apache OCR is vulnerable to denial of service DoS. A flaw in the JAVA or C++ OCR file parser can cause an infinite recursive loop that triggers a stack overflow if a malicious OCR file is being parsed...

Memory Corruption Vulnerability in WPS Office ocr Module Handling GIF Images

WPS Office is an office software suite independently developed by Kingsoft Corporation Limited, which can realize the most commonly used text, table, presentation and many other functions of office software. A memory corruption vulnerability exists in the OCR module Image to Text of WPS Office wh...

Heap Overflow Vulnerability in WPS Office ocr Module

WPS Office is an office software suite independently developed by Kingsoft Corporation Limited, which can realize the most commonly used text, table, presentation and many other functions of office software. A heap overflow vulnerability exists in the OCR module Image to Text of WPS OFFICE when...

CVE-2017-3012

Adobe Acrobat Reader versions 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier have an insecure library loading DLL hijacking vulnerability in the OCR plugin...

Design/Logic Flaw

Adobe Acrobat Reader versions 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier have an insecure library loading DLL hijacking vulnerability in the OCR plugin...