CVE-2019-5064: Out-of-bounds Write in OpenCV
Summary
CVE-2019-5064: Out-of-bounds Write in OpenCV. Affects opencv-python versions < 4.2.0.32. Fixed in 4.2.0.32. How to fix ↓
Also tracked for
- opencv-contrib-python · PyPI
- opencv-python-headless · PyPI
- opencv-contrib-python-headless · PyPI
- opencv · Debian:11
The same CVE-2019-5064 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCV is an open-source computer vision and machine learning software library. It provides various functions and algorithms for image and video processing, object detection, and more. OpenCV-Python is a Python wrapper for OpenCV, allowing developers to use OpenCV functionalities in Python applications. However, OpenCV version 4.1.0 (corresponding with OpenCV-Python version 4.1.2.30) is vulnerable to an out-of-bounds write vulnerability in its data structure persistence functionality.
Vulnerability Detail
The vulnerability arises from a heap buffer overflow in OpenCV's data structure persistence. By providing a specially crafted JSON file, an attacker can trigger a buffer overflow, leading to multiple heap corruptions and potentially enabling code execution. This vulnerability has a CVSS score of 8.8, indicating a high severity level. The CWE IDs associated with this vulnerability are CWE-120 (Buffer Copy without Checking Size of Input) and CWE-787 (Out-of-bounds Write).
How To Fix
Minimum fixed version
4.2.0.32
This is the first release that contains the fix.
pip install --upgrade "opencv-python==4.2.0.32"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to a patched version of OpenCV.
Conclusion
OpenCV version 4.1.0 (OpenCV-Python version 4.1.2.30) is vulnerable to an out-of-bounds write vulnerability. This can be exploited by providing a specially crafted JSON file, potentially leading to code execution. It is crucial to upgrade to a fixed version of OpenCV (4.2.0.32 or above) and update the OpenCV-Python package to mitigate this vulnerability. For further assistance on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for opencv-python →
FAQ
OpenCV is an open-source computer vision and machine learning software library that provides various functions and algorithms for image and video processing, object detection, and more.
The vulnerability allows an attacker to trigger a heap buffer overflow, potentially leading to code execution. This can result in unauthorized access, data theft, or system compromise.
OpenCV versions 4.1.0 (corresponding with OpenCV-Python version 4.1.2.30) and earlier are affected by this vulnerability.
Yes, upgrading to OpenCV version 4.2.0.32 or above resolves this vulnerability. It is recommended to update the OpenCV-Python package to a fixed version.
No, there are no known workarounds for this vulnerability. Applying the recommended fix by upgrading to a patched version is necessary.
Related vulnerabilities
Recent vulnerabilities recorded for opencv-python.
