Out-of-Bounds Write Vulnerability in OpenCV Package
Summary
CVE-2017-12597: OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds write error in the function FillColorRow1 in utils.cpp when reading an image file by using cv::imread. Affects opencv across 3 version ranges.
< 2a9d1b22ed76eb22fad1a5edf6faf4d05f207b13
< 3.2.0+dfsg-6
< e8357c0544c82beda237defc0abc90ee28992ee7
Fixed in 3.2.0+dfsg-6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenCV, or Open Source Computer Vision Library, is a widely used open-source library designed for computer vision and machine learning tasks. It provides a comprehensive set of tools for image processing, object detection, and real-time computer vision applications. The library is utilized in various industries, including robotics, automotive, and healthcare. However, a critical vulnerability has been identified in versions up to 3.3, which could lead to severe security risks if exploited.
Vulnerability Detail
The vulnerability, identified as CVE-2017-12597, is an out-of-bounds write error that occurs in the function FillColorRow1 within utils.cpp when reading an image file using the cv::imread function. This flaw can allow an attacker to write data outside the allocated memory bounds, potentially leading to arbitrary code execution, data corruption, or crashes. The vulnerability affects multiple Debian ecosystems and can compromise the integrity and availability of applications relying on OpenCV.
How To Fix
Minimum fixed version
3.2.0+dfsg-6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade opencvTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the cv::imread function for reading untrusted image files until the package is updated. It is advisable to validate and sanitize input files before processing them with OpenCV functions.
Conclusion
The out-of-bounds write vulnerability in OpenCV poses significant risks to applications utilizing this library. It is crucial for users to upgrade to the fixed version to mitigate potential threats. Additionally, employing workarounds can help reduce exposure until the update is applied.
See every vulnerability recorded for opencv →
FAQ
CVE-2017-12597 is a vulnerability in OpenCV that allows for out-of-bounds writes when reading image files, potentially leading to security risks.
OpenCV versions up to 3.3 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
If an immediate update is not possible, avoid using the cv::imread function for untrusted image files and validate inputs before processing.
Related vulnerabilities
Recent vulnerabilities recorded for opencv.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
