CVE-2017-18009: Out-of-bounds Read in OpenCV
Summary
CVE-2017-18009: Out-of-bounds Read in OpenCV. Affects opencv-python versions < 3.4.1.15. Fixed in 3.4.1.15. How to fix ↓
Also tracked for
- opencv-contrib-python · PyPI
- opencv · Debian:11
The same CVE-2017-18009 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCV is an open-source computer vision library that provides a wide range of functions for image and video processing. It is widely used in various applications, including robotics, augmented reality, and machine learning. OpenCV-Python is a Python wrapper for the OpenCV library, allowing developers to utilize OpenCV functionalities in Python applications. However, OpenCV-Python versions up to 3.3.1.11 are vulnerable to an out-of-bounds read vulnerability.
Vulnerability Detail
The vulnerability exists in the function cv::HdrDecoder::checkSignature in the grfmt_hdr.cpp file of the imgcodecs module in OpenCV 3.3.1. It is caused by a heap-based buffer over-read, which occurs when the function reads data beyond the bounds of a heap buffer. An attacker can exploit this vulnerability by crafting a specially crafted image file and tricking a user or application into opening it using the vulnerable version of OpenCV-Python. Successful exploitation of this vulnerability could lead to information disclosure or potentially allow remote code execution.
How To Fix
Minimum fixed version
3.4.1.15
This is the first release that contains the fix.
pip install --upgrade "opencv-python==3.4.1.15"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can avoid opening untrusted or malicious image files using the vulnerable version of OpenCV-Python. Additionally, it is recommended to implement proper input validation and sanitization when processing image files to mitigate the risk of exploitation.
Conclusion
The out-of-bounds read vulnerability in OpenCV-Python versions up to 3.3.1.11 can be mitigated by updating the package to version 3.4.1.15 or later. It is important to promptly apply the recommended fix to ensure the security and integrity of applications utilizing OpenCV-Python. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for opencv-python →
FAQ
OpenCV is an open-source computer vision library that provides functions for image and video processing.
OpenCV-Python is a Python wrapper for the OpenCV library, allowing developers to use OpenCV functionalities in Python applications.
The vulnerability could potentially lead to information disclosure or remote code execution if exploited successfully.
To fix this vulnerability, update the OpenCV-Python package to version 3.4.1.15 or later.
As a workaround, avoid opening untrusted or malicious image files using the vulnerable version of OpenCV-Python.
References
Related vulnerabilities
Recent vulnerabilities recorded for opencv-python.
