CVE-2017-14136: Out-of-bounds Write in OpenCV
Summary
CVE-2017-14136: Out-of-bounds Write in OpenCV. Affects opencv-python versions < 3.3.1.11. Fixed in 3.3.1.11. How to fix ↓
Also tracked for
- opencv-contrib-python · PyPI
The same CVE-2017-14136 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCV (Open Source Computer Vision Library) is a popular open-source library for computer vision and image processing tasks. It provides a wide range of functions and algorithms for image and video analysis. OpenCV-Python is the Python wrapper for OpenCV, allowing developers to use OpenCV functionalities in Python applications. However, OpenCV 3.3 (corresponding to OpenCV-Python 3.3.0.9) is vulnerable to an out-of-bounds write error in the FillColorRow1 function in utils.cpp. This vulnerability is a result of an incomplete fix for CVE-2017-12597.
Vulnerability Detail
The out-of-bounds write vulnerability in OpenCV can be exploited when reading an image file using the cv::imread function. An attacker can craft a malicious image file that triggers the vulnerability, potentially leading to arbitrary code execution or a denial of service. The FillColorRow1 function in utils.cpp is responsible for writing pixel data to the image buffer, and the vulnerability occurs when writing beyond the bounds of the buffer. This can result in overwriting adjacent memory, causing unexpected behavior or crashes.
How To Fix
Minimum fixed version
3.3.1.11
This is the first release that contains the fix.
pip install --upgrade "opencv-python==3.3.1.11"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the OpenCV-Python packages to the fixed versions to mitigate the risk of exploitation.
Conclusion
OpenCV-Python version 3.3.0.9 and earlier are vulnerable to an out-of-bounds write vulnerability. It is crucial to update the packages to version 3.3.1.11 or later to mitigate the risk of exploitation. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for opencv-python →
FAQ
OpenCV is an open-source computer vision library that provides various functions and algorithms for image and video analysis.
OpenCV-Python is the Python wrapper for OpenCV, allowing developers to use OpenCV functionalities in Python applications.
An out-of-bounds write vulnerability occurs when a program writes data beyond the boundaries of a buffer, potentially overwriting adjacent memory and causing unexpected behavior or crashes.
CVE-2017-14136 is the identifier for the out-of-bounds write vulnerability in OpenCV-Python version 3.3.0.9.
To fix the vulnerability, update the affected OpenCV-Python packages to version 3.3.1.11 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for opencv-python.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.