Description
In tesseract 2.03 and 2.04, an attacker can rewrite an arbitrary user file by guessing the PID and creating a link to the user's file.
Affected products
tesseract-ocr: tesseract ocr; debian: debian linux
References6
- bugs.debian.org/cgi-bin/bugreport.cgi?bug=612032 ExploitMailing ListPatchThird Party Advisory
- bugs.debian.org/cgi-bin/bugreport.cgi?bug=612032 ExploitMailing ListPatchThird Party Advisory
- bugs.launchpad.net/ubuntu/+source/tesseract/+bug/607297 ExploitIssue TrackingThird Party Advisory
- bugs.launchpad.net/ubuntu/+source/tesseract/+bug/607297 ExploitIssue TrackingThird Party Advisory
- security-tracker.debian.org/tracker/CVE-2011-1136 Third Party Advisory
- security-tracker.debian.org/tracker/CVE-2011-1136 Third Party Advisory
Metrics
- CVSS 3.1
-
4.7
MEDIUM
Score source: NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N - EPSS — exploit probability
- 0% percentile: 40 · as of 4 November 2026
- CWE
- CWE-59
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.