Heap-based Buffer Over-read in OpenCV
Summary
CVE-2017-18009: In OpenCV 3.3.1, a heap-based buffer over-read exists in the function cv::HdrDecoder::checkSignature in modules/imgcodecs/src/grfmt_hdr.cpp. Affects opencv across 3 version ranges.
< 0bd061f07b665a7fb3f744122550393b337c50e5
< 4.1.2+dfsg-3
< af4d6f34d8d05b0a9a0278728823272e49a63898
Fixed in 4.1.2+dfsg-3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCV is an open-source computer vision and machine learning software library. It provides a wide range of functions and algorithms for image and video processing. OpenCV is widely used in various applications, including robotics, surveillance, and augmented reality. However, OpenCV versions 3.3.1 and earlier are vulnerable to a heap-based buffer over-read in the HdrDecoder module of the imgcodecs component.
Vulnerability Detail
The vulnerability (CVE-2017-18009) exists in the function cv::HdrDecoder::checkSignature in modules/imgcodecs/src/grfmt_hdr.cpp. It allows an attacker to read beyond the boundaries of a heap-based buffer, potentially leading to information disclosure or a crash. The vulnerability has a CVSSv3 score of 7.5, indicating a high severity.
How To Fix
Minimum fixed version
4.1.2+dfsg-3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade opencvTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating OpenCV is not immediately feasible, a possible workaround is to avoid using the vulnerable function or module. However, this may limit the functionality of the affected application. It is strongly recommended to apply the official fix as soon as possible.
Conclusion
OpenCV versions 3.3.1 and earlier are vulnerable to a heap-based buffer over-read. It is crucial to update to version 4.1.2+dfsg-3 or later to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for opencv →
FAQ
OpenCV is an open-source computer vision and machine learning software library used for image and video processing.
The vulnerability allows an attacker to read beyond the boundaries of a heap-based buffer, potentially leading to information disclosure or a crash.
The CVSSv3 score of this vulnerability is 7.5, indicating a high severity.
To fix this vulnerability, update OpenCV to version 4.1.2+dfsg-3 or later.
A possible workaround is to avoid using the vulnerable function or module, but it is recommended to apply the official fix.
Related vulnerabilities
Recent vulnerabilities recorded for opencv.
