CVE-2017-17760: Buffer Overflow in OpenCV
Summary
CVE-2017-17760: Improper Restriction of Operations within the Bounds of a Memory Buffer in OpenCV. Affects opencv-python versions < 3.4.0.12. Fixed in 3.4.0.12. How to fix ↓
Also tracked for
- opencv-contrib-python · PyPI
- opencv · Debian:11
The same CVE-2017-17760 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCV is an open-source computer vision library that provides various functions and algorithms for image and video processing. It is widely used in applications such as robotics, surveillance, and augmented reality. OpenCV 3.3.1, specifically opencv-python and opencv-contrib-python versions 3.3.1.11, is affected by a buffer overflow vulnerability in the cv::PxMDecoder::readData function in grfmt_pxm.cpp. This vulnerability arises due to the incorrect usage of a size value.
Vulnerability Detail
The buffer overflow vulnerability in OpenCV 3.3.1 can be exploited by an attacker to overwrite adjacent memory locations, potentially leading to arbitrary code execution or a system crash. The vulnerability is rated as moderate severity with a CVSS score of 6.5. It falls under the Common Weakness Enumeration (CWE) category CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer.
How To Fix
Minimum fixed version
3.4.0.12
This is the first release that contains the fix.
pip install --upgrade "opencv-python==3.4.0.12"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is recommended to apply the fix by updating the affected packages.
Conclusion
OpenCV 3.3.1 (opencv-python and opencv-contrib-python versions 3.3.1.11) is affected by a buffer overflow vulnerability. To mitigate the risk, users should update the packages to version 3.4.0.12 or higher. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for opencv-python →
FAQ
OpenCV is an open-source computer vision library used for image and video processing.
The vulnerability can allow an attacker to execute arbitrary code or cause a system crash.
The vulnerability is rated as moderate severity with a CVSS score of 6.5.
To fix this vulnerability, update the affected packages to version 3.4.0.12 or higher.
No specific workaround is provided. It is recommended to update the affected packages.
References
Related vulnerabilities
Recent vulnerabilities recorded for opencv-python.
