Heap Overflow Vulnerability in OpenCV Package: CVE-2017-12603
Summary
CVE-2017-12603: OpenCV (Open Source Computer Vision Library) through 3.3 has an invalid write in the cv::RLByteStream::getBytes function in modules/imgcodecs/src/bitstrm.cpp when reading an image file by using cv::imread, as demonstrate... Affects opencv across 3 version ranges.
< 2a9d1b22ed76eb22fad1a5edf6faf4d05f207b13
< 3.2.0+dfsg-6
< e8357c0544c82beda237defc0abc90ee28992ee7
Fixed in 3.2.0+dfsg-6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCV, or Open Source Computer Vision Library, is a widely used open-source library designed for computer vision and machine learning tasks. It provides a comprehensive set of tools for image processing, video analysis, and machine learning, making it a popular choice among developers and researchers. The library is utilized in various applications, from robotics to augmented reality. However, OpenCV versions up to 3.3 are susceptible to a critical vulnerability that can lead to heap overflow, potentially compromising the integrity of applications relying on this library.
Vulnerability Detail
CVE-2017-12603 is a heap overflow vulnerability found in the cv::RLByteStream::getBytes function within the imgcodecs module of OpenCV. This issue arises when the cv::imread function is used to read an image file, leading to an invalid write operation. The vulnerability can be exploited by an attacker to manipulate image files, resulting in arbitrary code execution or application crashes. The severity of this vulnerability is underscored by its CVSS score of 8.8, indicating a high risk to affected systems.
How To Fix
Minimum fixed version
3.2.0+dfsg-6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade opencvTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, consider implementing input validation to sanitize image files before processing them with OpenCV functions. This can help prevent the exploitation of the vulnerability by ensuring that only safe and correctly formatted image files are processed.
Conclusion
CVE-2017-12603 represents a significant security risk for applications using OpenCV versions up to 3.3. Users are strongly advised to upgrade to the fixed version to protect against potential exploitation. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in your software.
See every vulnerability recorded for opencv →
FAQ
CVE-2017-12603 is a heap overflow vulnerability in OpenCV that can be exploited through the cv::imread function when reading image files.
Exploitation of this vulnerability can lead to arbitrary code execution, application crashes, or corruption of data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2017-12603 is 8.8, indicating a high severity level.
You can upgrade OpenCV by running the command 'sudo apt-get install opencv=3.2.0+dfsg-6' on Debian-based systems.
Related vulnerabilities
Recent vulnerabilities recorded for opencv.
