Out-of-Bounds Read Vulnerability in OpenCV Package
Summary
CVE-2017-12598: OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds read error in the cv::RBaseStream::readBlock function in modules/imgcodecs/src/bitstrm.cpp when reading an image file by using cv::imread, as... Affects opencv across 3 version ranges.
< 2a9d1b22ed76eb22fad1a5edf6faf4d05f207b13
< 3.2.0+dfsg-6
< e8357c0544c82beda237defc0abc90ee28992ee7
Fixed in 3.2.0+dfsg-6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenCV, or Open Source Computer Vision Library, is a widely used open-source library designed for computer vision and machine learning tasks. It provides a comprehensive set of tools for image processing, video capture, and analysis. The library is utilized in various applications, from robotics to augmented reality. However, in version 3.3 and earlier, OpenCV is susceptible to an out-of-bounds read vulnerability that can be exploited when reading image files using the cv::imread function.
Vulnerability Detail
The vulnerability, identified as CVE-2017-12598, arises from an out-of-bounds read error in the cv::RBaseStream::readBlock function located in the modules/imgcodecs/src/bitstrm.cpp file. This issue occurs when the library attempts to read an image file, potentially leading to information disclosure or application crashes. The vulnerability can be triggered by specially crafted image files, making it a significant risk for applications relying on OpenCV for image processing.
How To Fix
Minimum fixed version
3.2.0+dfsg-6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade opencvTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider validating image files before processing them with OpenCV to ensure they do not contain malicious content. This can be done by implementing checks on the file size and format before invoking the cv::imread function.
Conclusion
CVE-2017-12598 represents a significant vulnerability in OpenCV that can lead to serious security issues. It is crucial for developers and users of OpenCV to upgrade to a fixed version to protect their applications. Additionally, implementing file validation can serve as a temporary measure to mitigate risks until an upgrade is possible.
See every vulnerability recorded for opencv →
FAQ
CVE-2017-12598 is a vulnerability in OpenCV that allows for an out-of-bounds read error when reading image files, potentially leading to information disclosure.
OpenCV versions up to and including 3.3 are affected by this vulnerability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The CVSS score for CVE-2017-12598 is 8.8, indicating a high severity level.
Yes, you can implement file validation checks before processing images with OpenCV to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for opencv.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
