The matchCurrentInput function inside lou_translateString.c of Liblouis prior to 3.7 does not check the input string's length, allowing attackers to cause a denial of service (application crash via out-of-bounds read) by crafting an input file with certain translation dictionaries.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade liblouis | Jul 30, 2024 | Sep 21, 2018 |
| Oracle Solaris | — | Upgrade library/libsoup to version 2.57.1-11.4.15.0.1.2.0 on Solaris 11.4Upgrade desktop/xdg/xdg-utils to version 1.1.3-11.4.15.0.1.2.0 on Solaris 11.4Upgrade desktop/pdf-viewer/evince to version 3.25.4-11.4.15.0.1.2.0 on Solaris 11.4Upgrade library/liblouis to version 3.5.0-11.4.15.0.1.2.0 on Solaris 11.4Upgrade image/library/librsvg to version 2.40.16-11.4.15.0.1.2.0 on Solaris 11.4 | Nov 20, 2019 | Sep 21, 2018 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 21, 2018 |
| Suse | — | Upgrade liblouis-develUpgrade liblouis-docUpgrade liblouis9Upgrade python-louisUpgrade liblouisUpgrade python3-louisUpgrade liblouis14Upgrade liblouis-dataUpgrade liblouis0Upgrade liblouis-tools | Apr 1, 2019 | Sep 21, 2018 |
| Ubuntu | — | Upgrade liblouis14Upgrade liblouis-binUpgrade liblouis9Upgrade liblouis2 | Oct 12, 2018 | Sep 21, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub