CVE-2022-38266: Divide By Zero

September 9, 2022 (updated December 18, 2023)

An issue in the Leptonica linked library (v1.79.0) allows attackers to cause an arithmetic exception leading to a Denial of Service (DoS) via a crafted JPEG file.

References

github.com/DanBloomberg/leptonica/commit/f062b42c0ea8dddebdc6a152fd16152de215d614
github.com/tesseract-ocr/tesseract/issues/3498
lists.debian.org/debian-lts-announce/2022/12/msg00018.html
nvd.nist.gov/vuln/detail/CVE-2022-38266

Detect and mitigate CVE-2022-38266 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →