CVE-2011-1136
published 2019-11-14CVE-2011-1136: In tesseract 2.03 and 2.04, an attacker can rewrite an arbitrary user file by guessing the PID and creating a link to the user's file.
PriorityP422medium4.7CVSS 3.1
AVLACHPRLUINSUCNIHAN
EPSS
0.46%
39.2th percentile
In tesseract 2.03 and 2.04, an attacker can rewrite an arbitrary user file by guessing the PID and creating a link to the user's file.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | tesseract | < tesseract 2.04-2.1 (bookworm) | tesseract 2.04-2.1 (bookworm) |
| tesseract-ocr | tesseract_ocr | — | — |
| tesseract-ocr | tesseract_ocr | — | — |
| tesseract_project | tesseract | >= 0 < 2.04-2.1 | 2.04-2.1 |
| tesseract_project | tesseract | >= 0 < 2.04-2.1 | 2.04-2.1 |
| tesseract_project | tesseract | >= 0 < 2.04-2.1 | 2.04-2.1 |
| tesseract_project | tesseract | >= 0 < 2.04-2.1 | 2.04-2.1 |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
nvdv2.06.3MEDIUMAV:L/AC:M/Au:N/C:N/I:C/A:C
osv4.7MEDIUM
vendor_debian4.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
tesseract 2.03/2.04 Link link following
vuldb·2026-09-14·CVSS 4.7
CVE-2011-1136 [MEDIUM] tesseract 2.03/2.04 Link link following
A vulnerability described as critical has been identified in tesseract 2.03/2.04. This issue affects some unknown processing of the component Link Handler. Such manipulation leads to link following.
This vulnerability is documented as CVE-2011-1136. The attack needs to be performed locally. There is not any exploit available.
GHSA
GHSA-mr6c-m5m7-mvxj: In tesseract 2
ghsa_unreviewed·2022-04-22
CVE-2011-1136 [MEDIUM] GHSA-mr6c-m5m7-mvxj: In tesseract 2
In tesseract 2.03 and 2.04, an attacker can rewrite an arbitrary user file by guessing the PID and creating a link to the user's file.
OSV
CVE-2011-1136: In tesseract 2
osv·2019-11-14·CVSS 4.7
CVE-2011-1136 [MEDIUM] CVE-2011-1136: In tesseract 2
In tesseract 2.03 and 2.04, an attacker can rewrite an arbitrary user file by guessing the PID and creating a link to the user's file.
Debian
CVE-2011-1136: tesseract - In tesseract 2.03 and 2.04, an attacker can rewrite an arbitrary user file by gu...
vendor_debian·2011·CVSS 4.7
CVE-2011-1136 [MEDIUM] CVE-2011-1136: tesseract - In tesseract 2.03 and 2.04, an attacker can rewrite an arbitrary user file by gu...
In tesseract 2.03 and 2.04, an attacker can rewrite an arbitrary user file by guessing the PID and creating a link to the user's file.
Scope: local
bookworm: resolved (fixed in 2.04-2.1)
bullseye: resolved (fixed in 2.04-2.1)
forky: resolved (fixed in 2.04-2.1)
sid: resolved (fixed in 2.04-2.1)
trixie: resolved (fixed in 2.04-2.1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=612032https://bugs.launchpad.net/ubuntu/+source/tesseract/+bug/607297https://security-tracker.debian.org/tracker/CVE-2011-1136https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=612032https://bugs.launchpad.net/ubuntu/+source/tesseract/+bug/607297https://security-tracker.debian.org/tracker/CVE-2011-1136
2019-11-14
Published