Source: tesseract Version: 5.5.0-1 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerabilities were published for tesseract. CVE-2026-119338[0]: | Tesseract is an open source OCR engine. From 5.4.0 until 5.5.4, | AppendLinePolygon in src/api/pagerenderer.cpp destroys the caller- | owned right-to-left Pta accumulator while receiving it by value, | leaving line_top_rtl_pts and line_bottom_rtl_pts dangling. On an | upright Hebrew or Arabic page at the default PAGE XML level, | POLYGONFLAG with a false skewed_flag enters the vulnerable calls, | while LEVELFLAG greater than zero provides an alternative gate. The | calls repeatedly read and free the stale object, causing a double | free and use after free and allowing corrupted coordinates to reach | RecalcPolygonline. This issue is fixed in version 5.5.4. CVE-2026-119339[1]: | Tesseract is an open source OCR engine. Prior to 5.5.4, | WeightMatrix::DeSerialize trusts a mode byte from a traineddata LSTM | network and calls WeightMatrix::DeSerializeOld when kDoubleFlag is | clear. In default FAST_FLOAT builds, DeSerializeOld invokes | ASSERT_HOST instead of returning an error, so loading a crafted | model through TessBaseAPI::Init terminates the process and causes | denial of service. This issue is fixed in version 5.5.4. CVE-2026-119340[2]: | Tesseract is an open source OCR engine. Prior to 5.5.4, | GENERIC_2D_ARRAY::DeSerializeSize in src/ccstruct/matrix.h reads | matrix dimensions as signed int32_t values and compares them only | with UINT16_MAX, allowing negative values to reach ResizeNoInit. | Negative dimensions or a 65535 by 65535 product can create | inconsistent allocation state and later out-of-bounds accesses while | loading a crafted traineddata file, causing denial of service. This | issue is fixed in version 5.5.4. CVE-2026-119341[3]: | Tesseract is an open source OCR engine. Prior to 5.5.4, | ReadAdaptedClass in src/classify/adaptive.cpp raw-reads an | ADAPT_CLASS_STRUCT from a pre-adapted-template .a file without | neutralizing TempProtos and Config pointer fields before any | destructor path. When the legacy engine is selected, | classify_use_pre_adapted_templates is enabled, and an attacker can | write the output-basename .a file, the success or rejection path can | pass file-controlled pointers to ~ADAPT_CLASS_STRUCT and operator | delete, causing memory corruption and denial of service. This issue | is fixed in version 5.5.4. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-119338 https://www.cve.org/CVERecord?id=CVE-2026-119338 [1] https://security-tracker.debian.org/tracker/CVE-2026-119339 https://www.cve.org/CVERecord?id=CVE-2026-119339 [2] https://security-tracker.debian.org/tracker/CVE-2026-119340 https://www.cve.org/CVERecord?id=CVE-2026-119340 [3] https://security-tracker.debian.org/tracker/CVE-2026-119341 https://www.cve.org/CVERecord?id=CVE-2026-119341 Regards, Salvatore
