CVE-2018-17294: Canonical Ubuntu Linux

Medium severity, CVSS 6.5. EPSS: 2.7% chance of exploitation in the next 30 days.

The matchCurrentInput function inside lou_translateString.c of Liblouis prior to 3.7 does not check the input string's length, allowing attackers to cause a denial of service (application crash via out-of-bounds read) by crafting an input file with certain translation dictionaries.

Affected products

• Canonical Ubuntu Linux: version 14.04 only; version 16.04 only; version 18.04 only
• Liblouis Liblouis: before 3.7.0 (fixed in 3.7.0)
• Opensuse Leap: version 15.0 only

Published 2018-09-21. Last modified 2026-06-17.