—

PYSEC-2026-886

ocrodjvu is vulnerable to Arbitrary File Modification via symlink attack

상세

ocrodjvu 0.4.6-1 on Debian GNU/Linux allows local users to modify arbitrary files via a symlink attack on temporary files that are generated when Cuneiform is invoked as the OCR engine.

이 버전이 영향받나요?

사용 중인 패키지 버전을 입력하면 즉시 평가합니다.

영향 패키지

PyPI / ocrodjvu

최초 영향 버전: 0.4.6-1 수정 버전: 0.4.6-2

수정 pip install --upgrade 'ocrodjvu>=0.4.6-2'

참고

https://nvd.nist.gov/vuln/detail/CVE-2010-4338 [ADVISORY]
https://exchange.xforce.ibmcloud.com/vulnerabilities/64892 [WEB]
https://github.com/jwilk-archive/ocrodjvu [PACKAGE]
https://web.archive.org/web/20200229160520/http://www.securityfocus.com/bid/45234 [WEB]
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598134 [WEB]
https://pypi.org/project/ocrodjvu [PACKAGE]
https://github.com/advisories/GHSA-5pjj-7m4p-wfh2 [ADVISORY]