Описание
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadIntTemplates in src/classify/intproto.cpp reads NumClassPruners, NumClasses, and NumProtoSets from the TESSDATA_INTTEMP component of a crafted .traineddata file and uses those values as loop bounds without validating them against MAX_NUM_CLASS_PRUNERS, MAX_NUM_CLASSES, and MAX_NUM_PROTO_SETS. The loops store heap pointers into fixed-capacity ClassPruners and ProtoSets arrays in INT_TEMPLATES_STRUCT and INT_CLASS_STRUCT, so an oversized count causes heap out-of-bounds pointer writes during legacy-classifier initialization before OCR begins, resulting in heap corruption, a crash, or potentially controlled corruption. No fixed release is available as of this review.
A flaw was found in Tesseract, an open-source Optical Character Recognition (OCR) engine. A local attacker could provide a specially crafted .traineddata file, which, when processed, could lead to a heap out-of-bounds write. This vulnerability occurs due to unvalidated counts used as loop bounds during legacy-classifier initialization. Successful exploitation could result in heap corruption, causing a crash or potentially controlled corruption of memory.
Меры по смягчению последствий
To mitigate this vulnerability, ensure that Tesseract only processes .traineddata files from trusted sources. Avoid loading or processing .traineddata files from untrusted or unverified origins, as these could be specially crafted to trigger the heap corruption. If Tesseract must process untrusted input, consider running the application in a sandboxed environment to limit the potential impact of successful exploitation.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | tesseract | Affected | ||
| Red Hat Enterprise Linux 8 | tesseract | Affected | ||
| Red Hat Enterprise Linux 9 | tesseract | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
8.4 High
CVSS3
Связанные уязвимости
(Tesseract is an open source OCR engine. In version 5.5.3 and earlier, ...)
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadIntTemplates in src/classify/intproto.cpp reads NumClassPruners, NumClasses, and NumProtoSets from the TESSDATA_INTTEMP component of a crafted .traineddata file and uses those values as loop bounds without validating them against MAX_NUM_CLASS_PRUNERS, MAX_NUM_CLASSES, and MAX_NUM_PROTO_SETS. The loops store heap pointers into fixed-capacity ClassPruners and ProtoSets arrays in INT_TEMPLATES_STRUCT and INT_CLASS_STRUCT, so an oversized count causes heap out-of-bounds pointer writes during legacy-classifier initialization before OCR begins, resulting in heap corruption, a crash, or potentially controlled corruption. No fixed release is available as of this review.
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, ...
EPSS
8.4 High
CVSS3