Описание
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, RecodedCharID::DeSerialize in src/ccutil/unicharcompress.h validates length_ but accepts negative code_ values from a crafted .traineddata recoder component. UnicharCompress::ComputeCodeRange in src/ccutil/unicharcompress.cpp can consequently produce code_range_ equal to zero, after which SetupDecoder indexes is_valid_start_ with the negative code on a size-zero vector. The resulting out-of-bounds bit write uses a large wrapped index and reliably causes a wild-address crash or allocation failure on the default LSTM engine. No fixed release is available as of this review.
A flaw was found in Tesseract. It was discovered that the RecodedCharID::DeSerialize function accepts negative code values from a specially crafted .traineddata recoder component. This can lead to an out-of-bounds write when SetupDecoder attempts to index a zero-sized vector with a negative code. A local attacker providing a malicious .traineddata file could exploit this to reliably cause a wild-address crash or an allocation failure, resulting in a denial of service (DoS).
Меры по смягчению последствий
To mitigate this issue, avoid processing untrusted or unverified .traineddata files with the Tesseract OCR engine. If processing untrusted input is unavoidable, consider running the Tesseract application within a sandboxed environment to limit the potential impact of a denial of service.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | tesseract | Fix deferred | ||
| Red Hat Enterprise Linux 8 | tesseract | Fix deferred | ||
| Red Hat Enterprise Linux 9 | tesseract | Fix deferred |
Показывать по
Дополнительная информация
Статус:
5.5 Medium
CVSS3
Связанные уязвимости
(Tesseract is an open source OCR engine. In version 5.5.3 and earlier, ...)
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, RecodedCharID::DeSerialize in src/ccutil/unicharcompress.h validates length_ but accepts negative code_ values from a crafted .traineddata recoder component. UnicharCompress::ComputeCodeRange in src/ccutil/unicharcompress.cpp can consequently produce code_range_ equal to zero, after which SetupDecoder indexes is_valid_start_ with the negative code on a size-zero vector. The resulting out-of-bounds bit write uses a large wrapped index and reliably causes a wild-address crash or allocation failure on the default LSTM engine. No fixed release is available as of this review.
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, ...
5.5 Medium
CVSS3