CVE-2017-12603: Out-of-bounds Write in OpenCV
Summary
CVE-2017-12603: Out-of-bounds Write in OpenCV. Affects opencv-python versions < 3.3.1.11. Fixed in 3.3.1.11. How to fix ↓
Also tracked for
- opencv-contrib-python · PyPI
- opencv · Debian:11
The same CVE-2017-12603 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCV (Open Source Computer Vision Library) is a popular open-source library for computer vision and image processing tasks. It provides a wide range of functions and algorithms for image and video analysis. OpenCV-Python and OpenCV-Contrib-Python are Python bindings for OpenCV. This vulnerability affects OpenCV versions up to 3.3.0.9. The vulnerability resides in the cv::RLByteStream::getBytes function in the bitstrm.cpp file of the imgcodecs module. It can be triggered when reading an image file using the cv::imread function.
Vulnerability Detail
The vulnerability in OpenCV allows for an out-of-bounds write, leading to a heap overflow. An attacker can exploit this vulnerability by providing a specially crafted image file to the cv::imread function. This can result in arbitrary code execution, denial of service, or other malicious activities. The vulnerability has a CVSSv3 score of 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
3.3.1.11
This is the first release that contains the fix.
pip install --upgrade "opencv-python==3.3.1.11"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed versions of OpenCV-Python and OpenCV-Contrib-Python to mitigate the risk.
Conclusion
The vulnerability in OpenCV can lead to serious security risks, including arbitrary code execution and denial of service. It is crucial to update to the fixed versions of OpenCV-Python and OpenCV-Contrib-Python to mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for opencv-python →
FAQ
OpenCV is an open-source computer vision library that provides functions and algorithms for image and video analysis.
This vulnerability can lead to arbitrary code execution, denial of service, or other malicious activities.
To fix this vulnerability, update OpenCV-Python and OpenCV-Contrib-Python to version 3.3.1.11 or later.
There is no known workaround for this vulnerability. Updating to the fixed versions is the recommended solution.
The vulnerability has a CVSSv3 score of 8.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for opencv-python.
