Out-of-Bounds Write Vulnerability in OpenCV Package: CVE-2017-12604
Summary
CVE-2017-12604: OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds write error in the FillUniColor function in utils.cpp when reading an image file by using cv::imread. Affects opencv across 3 version ranges.
< 2a9d1b22ed76eb22fad1a5edf6faf4d05f207b13
< 3.2.0+dfsg-6
< e8357c0544c82beda237defc0abc90ee28992ee7
Fixed in 3.2.0+dfsg-6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCV, the Open Source Computer Vision Library, is a widely used library for computer vision and machine learning. It provides a comprehensive set of tools for image processing, video capture, and analysis. The library is designed to facilitate real-time computer vision applications. However, versions up to 3.3 are vulnerable to an out-of-bounds write error, specifically in the FillUniColor function when reading image files using cv::imread.
Vulnerability Detail
The vulnerability, identified as CVE-2017-12604, arises from an out-of-bounds write error in the FillUniColor function located in utils.cpp. This issue occurs when the library attempts to read an image file, potentially leading to memory corruption. The ramifications of this vulnerability can be severe, including crashes, data corruption, or arbitrary code execution, depending on how the library is utilized in applications. The vulnerability affects multiple Debian versions of the OpenCV package.
How To Fix
Minimum fixed version
3.2.0+dfsg-6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade opencvTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the cv::imread function with untrusted image files until the package is updated. Additionally, implementing input validation on image files before processing can help mitigate the risk of exploitation.
Conclusion
CVE-2017-12604 represents a significant vulnerability in the OpenCV library, specifically affecting versions up to 3.3. Users are strongly advised to upgrade to the fixed version to mitigate risks associated with memory corruption and potential exploitation. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for opencv →
FAQ
CVE-2017-12604 is a vulnerability in OpenCV that allows for an out-of-bounds write error when reading image files, potentially leading to memory corruption.
OpenCV versions up to 3.3 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2017-12604 is 8.8, indicating a high severity level.
If an immediate update is not possible, avoid processing untrusted image files with cv::imread and implement input validation as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for opencv.
