—
PYSEC-2026-886
ocrodjvu is vulnerable to Arbitrary File Modification via symlink attack
Details
ocrodjvu 0.4.6-1 on Debian GNU/Linux allows local users to modify arbitrary files via a symlink attack on temporary files that are generated when Cuneiform is invoked as the OCR engine.
Are you affected?
Enter the version of the package you're using.
Affected packages
PyPI / ocrodjvu
Introduced in:
0.4.6-1 Fixed in: 0.4.6-2 Fix
pip install --upgrade 'ocrodjvu>=0.4.6-2' References
- https://nvd.nist.gov/vuln/detail/CVE-2010-4338 [ADVISORY]
- https://exchange.xforce.ibmcloud.com/vulnerabilities/64892 [WEB]
- https://github.com/jwilk-archive/ocrodjvu [PACKAGE]
- https://web.archive.org/web/20200229160520/http://www.securityfocus.com/bid/45234 [WEB]
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598134 [WEB]
- https://pypi.org/project/ocrodjvu [PACKAGE]
- https://github.com/advisories/GHSA-5pjj-7m4p-wfh2 [ADVISORY]