OS Command Injection Vulnerability in GNOME OCRFeeder Software
CVE-2022-27811

9.8CRITICAL

Key Information:

Vendor
Gnome
Status
Ocrfeeder
Vendor
CVE Published:
24 March 2022

Summary

An OS command injection vulnerability exists in GNOME OCRFeeder, enabling attackers to exploit shell metacharacters in PDF or image filenames. This flaw allows unauthorized command execution, potentially compromising system integrity. Users are encouraged to upgrade to version 0.8.4 or later to mitigate the risk. For further details, refer to the official GitLab merge request and related issues.

References

https://gitlab.gnome.org/GNOME/ocrfeeder/-/merge_requests/13
https://gitlab.gnome.org/GNOME/ocrfeeder/-/commit/5286120...
https://gitlab.gnome.org/GNOME/ocrfeeder/-/issues/20

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.