CVE-2017-12605: Out-of-bounds Write in OpenCV
Summary
CVE-2017-12605: Out-of-bounds Write in OpenCV. Affects opencv-python versions < 3.3.1.11. Fixed in 3.3.1.11. How to fix ↓
Also tracked for
- opencv-contrib-python · PyPI
- opencv · Debian:11
The same CVE-2017-12605 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCV (Open Source Computer Vision Library) is a popular open-source library for computer vision and image processing tasks. It provides a wide range of functions and algorithms for image and video analysis. OpenCV-Python and OpenCV-Contrib-Python are Python bindings for OpenCV. This vulnerability affects OpenCV versions up to 3.3.0.9 and OpenCV-Python and OpenCV-Contrib-Python versions up to 3.3.0.9. The vulnerability resides in the FillColorRow8 function in utils.cpp, which is used when reading an image file with cv::imread. This function has an out-of-bounds write error, which can lead to arbitrary code execution or a crash of the application.
Vulnerability Detail
The out-of-bounds write vulnerability in OpenCV allows an attacker to overwrite memory outside the bounds of an allocated buffer. By exploiting this vulnerability, an attacker can execute arbitrary code or cause a denial-of-service condition. The vulnerability occurs when reading an image file using the cv::imread function, specifically in the FillColorRow8 function in utils.cpp. An attacker can craft a malicious image file that triggers the out-of-bounds write, potentially leading to the compromise of the application or system. The severity of this vulnerability is rated as HIGH with a CVSS score of 8.8.
How To Fix
Minimum fixed version
3.3.1.11
This is the first release that contains the fix.
pip install --upgrade "opencv-python==3.3.1.11"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the latest patched version of OpenCV or OpenCV-Python to mitigate the risk.
Conclusion
The out-of-bounds write vulnerability in OpenCV can lead to arbitrary code execution or a denial-of-service condition. It is crucial to update to the latest patched version of OpenCV or OpenCV-Python to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for opencv-python →
FAQ
OpenCV is an open-source computer vision library that provides functions and algorithms for image and video analysis.
This vulnerability allows an attacker to execute arbitrary code or cause a denial-of-service condition by exploiting an out-of-bounds write error in OpenCV.
To fix this vulnerability, update to the latest patched version of OpenCV or OpenCV-Python.
There is no known workaround for this vulnerability. It is recommended to update to the latest patched version.
This vulnerability is rated as HIGH with a CVSS score of 8.8.
References
Related vulnerabilities
Recent vulnerabilities recorded for opencv-python.
