CVE-2018-7440: Debian Linux

Critical severity, CVSS 9.8. EPSS: 3.7% chance of exploitation in the next 30 days.

An issue was discovered in Leptonica through 1.75.3. The gplotMakeOutput function allows command injection via a $(command) approach in the gplot rootname argument. This issue exists because of an incomplete fix for CVE-2018-3836.

Affected products

• Debian Debian Linux: version 7.0 only
• Leptonica Leptonica: up to and including 1.75.3

Published 2018-02-23. Last modified 2026-06-17.