Source: tesseract Version: 5.5.0-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for tesseract. CVE-2026-73066[0]: | Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted | .traineddata LSTM model component loaded through Tesseract's | deserializer can cause an unchecked signed integer multiplication in | Convolve::DeSerialize in src/lstm/convolve.cpp to wrap the | convolution output-channel count, undersizing the forward-pass | output buffer while writes use the unwrapped element count and | causing a heap out-of-bounds write during OCR recognition. This | issue is fixed in version 5.5.3. CVE-2026-73067[1]: | Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted | .traineddata model loaded through TessBaseAPI::Init can cause | SquishedDawg::read_squished_dawg in src/dict/dawg.cpp to accept an | unterminated forward-edge run, after which SquishedDawg::Load calls | num_forward_edges(0) and last_edge in src/dict/dawg.h reads beyond | edges_, causing a heap out-of-bounds read and process crash before | image processing. This issue is fixed in version 5.5.3. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-73066 https://www.cve.org/CVERecord?id=CVE-2026-73066 [1] https://security-tracker.debian.org/tracker/CVE-2026-73067 https://www.cve.org/CVERecord?id=CVE-2026-73067 Regards, Salvatore
