CVE-2017-12597: Out-of-bounds Write in OpenCV
Summary
CVE-2017-12597: Out-of-bounds Write in OpenCV. Affects opencv-python versions < 3.3.1.11. Fixed in 3.3.1.11. How to fix ↓
Also tracked for
- opencv-contrib-python · PyPI
- opencv · Debian:11
The same CVE-2017-12597 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCV (Open Source Computer Vision Library) is a popular open-source library used for computer vision and image processing tasks. It provides a wide range of functions and algorithms for image and video analysis. OpenCV versions up to 3.3 (including opencv-python and opencv-contrib-python up to version 3.3.0.9) are affected by a vulnerability that allows an out-of-bounds write error in the FillColorRow1 function in utils.cpp when reading an image file using cv::imread.
Vulnerability Detail
The vulnerability in OpenCV can be exploited by an attacker to write data beyond the boundaries of an allocated buffer. This can lead to various consequences, including remote code execution, denial of service, or information disclosure. The issue originates from a flaw in the FillColorRow1 function in utils.cpp, which fails to properly validate input data. By providing a specially crafted image file, an attacker can trigger the out-of-bounds write and potentially execute arbitrary code or crash the application.
How To Fix
Minimum fixed version
3.3.1.11
This is the first release that contains the fix.
pip install --upgrade "opencv-python==3.3.1.11"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the cv::imread function with untrusted or unknown image files. Instead, they can implement additional input validation and sanitization checks before processing image files. This can help mitigate the risk of exploitation until the packages are updated.
Conclusion
The out-of-bounds write vulnerability in OpenCV can have severe consequences, including remote code execution and denial of service. It is crucial to update the affected packages to the latest versions as soon as possible. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for opencv-python →
FAQ
OpenCV is an open-source computer vision library used for image and video analysis tasks.
OpenCV versions up to 3.3 (including opencv-python and opencv-contrib-python up to version 3.3.0.9) are affected.
The vulnerability can potentially allow an attacker to execute arbitrary code, cause a denial of service, or disclose sensitive information.
To fix the vulnerability, update the opencv-python and opencv-contrib-python packages to version 3.3.1.11 or higher.
As a temporary workaround, avoid using the cv::imread function with untrusted or unknown image files.
References
Related vulnerabilities
Recent vulnerabilities recorded for opencv-python.
