Описание
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, the callback form of GenericVector::read in src/ccutil/genericvector.h reads the independent int32 fields reserved and size_used_ from a .traineddata model without a cap or an invariant check. reserve(reserved) allocates the backing array, but the callback loop writes size_used_ elements. A crafted TESSDATA_INTTEMP component with version_id 4 or later can therefore set reserved to a small value and size_used_ to a large value when fontinfo_table_.read(fp, read_info) is called from src/classify/intproto.cpp, causing a heap out-of-bounds write of FontInfo structures, heap corruption, a crash, or potentially controlled corruption. No fixed release is available as of this review.
A flaw was found in Tesseract, an open-source Optical Character Recognition (OCR) engine. A heap out-of-bounds write vulnerability exists in the GenericVector::read function when processing a specially crafted .traineddata model. By manipulating the reserved and size_used_ fields, a local attacker can cause heap corruption, a crash, or potentially controlled corruption, which could lead to arbitrary code execution.
Меры по смягчению последствий
To mitigate this issue, avoid processing .traineddata model files from untrusted or unknown sources. Ensure that Tesseract only processes models from trusted origins. If Tesseract is not required, consider removing the tesseract package to eliminate the attack surface.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | tesseract | Affected | ||
| Red Hat Enterprise Linux 8 | tesseract | Affected | ||
| Red Hat Enterprise Linux 9 | tesseract | Affected |
Показывать по
Дополнительная информация
Статус:
7.8 High
CVSS3
Связанные уязвимости
(Tesseract is an open source OCR engine. In version 5.5.3 and earlier, ...)
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, the callback form of GenericVector::read in src/ccutil/genericvector.h reads the independent int32 fields reserved and size_used_ from a .traineddata model without a cap or an invariant check. reserve(reserved) allocates the backing array, but the callback loop writes size_used_ elements. A crafted TESSDATA_INTTEMP component with version_id 4 or later can therefore set reserved to a small value and size_used_ to a large value when fontinfo_table_.read(fp, read_info) is called from src/classify/intproto.cpp, causing a heap out-of-bounds write of FontInfo structures, heap corruption, a crash, or potentially controlled corruption. No fixed release is available as of this review.
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, ...
7.8 High
CVSS3