Symlink Attack Affecting ocrodjvu package, versions [0,]
Threat Intelligence
EPSS
0.04% (6th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-OCRODJVU-6233823
- published 8 Feb 2024
- disclosed 17 May 2022
- credit Unknown
Introduced: 17 May 2022
CVE-2010-4338 Open this link in a new tabHow to fix?
There is no fixed version for ocrodjvu.
Overview
ocrodjvu is an OCR for DjVu (Python 3 fork)
Affected versions of this package are vulnerable to Symlink Attack due to the improper handling of temporary files when invoking Cuneiform as the OCR engine. An attacker can modify arbitrary files via a symlink attack on these temporary files.
Note:
This is only exploitable if the attacker has local access to the system.
References
CVSS Scores
version 3.1