The matchCurrentInput function inside lou_translateString.c of Liblouis prior to 3.7 does not check the input string's length, allowing attackers to cause a denial of service (application crash via out-of-bounds read) by crafting an input file with certain translation dictionaries.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade liblouis | Jul 30, 2024 | Sep 21, 2018 |
| Oracle Solaris | — | Upgrade library/liblouis to version 3.5.0-11.4.15.0.1.2.0 on Solaris 11.4Upgrade image/library/librsvg to version 2.40.16-11.4.15.0.1.2.0 on Solaris 11.4Upgrade desktop/pdf-viewer/evince to version 3.25.4-11.4.15.0.1.2.0 on Solaris 11.4Upgrade desktop/xdg/xdg-utils to version 1.1.3-11.4.15.0.1.2.0 on Solaris 11.4Upgrade library/libsoup to version 2.57.1-11.4.15.0.1.2.0 on Solaris 11.4 | Nov 20, 2019 | Sep 21, 2018 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 21, 2018 |
| Suse | — | Upgrade liblouis0Upgrade python3-louisUpgrade liblouis14Upgrade liblouis-dataUpgrade liblouis-toolsUpgrade liblouis-docUpgrade python-louisUpgrade liblouis9Upgrade liblouis-develUpgrade liblouis | Apr 1, 2019 | Sep 21, 2018 |
| Ubuntu | — | Upgrade liblouis-binUpgrade liblouis14Upgrade liblouis2Upgrade liblouis9 | Oct 12, 2018 | Sep 21, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub