Out-of-Bounds Read Vulnerability in OpenCV Package
Summary
CVE-2017-12599: OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds read error in the function icvCvt_BGRA2BGR_8u_C4C3R when reading an image file by using cv::imread. Affects opencv across 3 version ranges.
< 2a9d1b22ed76eb22fad1a5edf6faf4d05f207b13
< 3.2.0+dfsg-6
< e8357c0544c82beda237defc0abc90ee28992ee7
Fixed in 3.2.0+dfsg-6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCV, or Open Source Computer Vision Library, is a widely-used open-source library designed for computer vision and machine learning tasks. It provides tools for image processing, video capture, and analysis, including features for object detection and recognition. The library is utilized in various applications, from robotics to augmented reality. However, OpenCV versions up to 3.3 are susceptible to a critical vulnerability that can lead to security risks when handling image files.
Vulnerability Detail
The vulnerability, identified as CVE-2017-12599, is an out-of-bounds read error found in the function icvCvt_BGRA2BGR_8u_C4C3R. This issue arises when the library attempts to read an image file using the cv::imread function. If exploited, this vulnerability can lead to unauthorized access to sensitive data or cause application crashes, potentially allowing attackers to execute arbitrary code or disrupt service.
How To Fix
Minimum fixed version
3.2.0+dfsg-6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade opencvTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not feasible, consider implementing input validation to ensure that only properly formatted image files are processed. This can help mitigate the risk of triggering the vulnerability. Additionally, avoid using the cv::imread function with untrusted image sources until the library is updated.
Conclusion
The CVE-2017-12599 vulnerability in OpenCV poses a significant risk to applications that utilize this library for image processing. Users are strongly advised to upgrade to the fixed version to safeguard against potential exploitation. Utilizing tools like Vulert can further enhance security by providing real-time monitoring of open-source vulnerabilities.
See every vulnerability recorded for opencv →
FAQ
CVE-2017-12599 is a vulnerability in OpenCV that allows for an out-of-bounds read error when processing certain image files, potentially leading to security risks.
OpenCV versions up to 3.3 are affected by this vulnerability. Users should upgrade to version 3.2.0+dfsg-6 or later to mitigate the risk.
You can use Vulert, which monitors open-source vulnerabilities in your software. By simply using a manifest file like package-lock.json, Vulert can alert you in real-time. Visit Vulert Scanner to check if your application is affected without any signup.
Exploitation of this vulnerability can lead to unauthorized access to sensitive data, application crashes, or even arbitrary code execution, posing significant security risks.
Yes, implementing input validation to ensure only properly formatted image files are processed can help mitigate the risk until an upgrade is performed.
Related vulnerabilities
Recent vulnerabilities recorded for opencv.
