CVE-2017-12863: Integer Overflow or Wraparound in OpenCV
Summary
CVE-2017-12863: Integer Overflow or Wraparound in OpenCV. Affects opencv-python versions < 3.3.1.11. Fixed in 3.3.1.11. How to fix ↓
Also tracked for
- opencv-contrib-python · PyPI
- opencv · Debian:11
The same CVE-2017-12863 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCV is an open-source computer vision library that provides a wide range of functions and algorithms for image and video processing. It is widely used in various applications, including robotics, augmented reality, and surveillance systems. OpenCV-Python is a Python wrapper for OpenCV, allowing developers to utilize OpenCV's functionality in Python-based projects. However, OpenCV versions 3.3 and earlier are vulnerable to an integer overflow or wraparound in the imgcodecs module's grfmt_pxm.cpp file. This vulnerability can be exploited remotely and may lead to remote code execution or denial of service.
Vulnerability Detail
The vulnerability resides in the PxMDecoder::readData function in grfmt_pxm.cpp. When calculating the src_pitch value, an integer overflow occurs. If an attacker can provide a malicious image from a remote source, they can exploit this vulnerability to execute arbitrary code on the target system or cause a denial of service. The affected versions of OpenCV-Python are 3.3.0.9 and earlier.
How To Fix
Minimum fixed version
3.3.1.11
This is the first release that contains the fix.
pip install --upgrade "opencv-python==3.3.1.11"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not immediately possible, users can mitigate the risk by avoiding the use of OpenCV-Python with images from untrusted or remote sources. By only processing images from trusted sources, the likelihood of exploitation can be reduced.
Conclusion
The integer overflow vulnerability in OpenCV-Python versions 3.3 and earlier can be exploited remotely to execute arbitrary code or cause a denial of service. It is crucial to update to the latest version of OpenCV-Python to mitigate this vulnerability. If immediate updating is not possible, users should exercise caution when processing images from untrusted or remote sources. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for opencv-python →
FAQ
OpenCV is an open-source computer vision library that provides functions and algorithms for image and video processing.
OpenCV-Python is a Python wrapper for OpenCV, allowing developers to utilize OpenCV's functionality in Python-based projects.
The vulnerability can be exploited remotely and may lead to remote code execution or denial of service.
OpenCV-Python versions 3.3.0.9 and earlier are affected by this vulnerability.
To fix this vulnerability, update OpenCV-Python to version 3.3.1.11 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for opencv-python.
