Out-of-Bounds Write Vulnerability in OpenCV Package
Summary
CVE-2017-12605: OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds write error in the FillColorRow8 function in utils.cpp when reading an image file by using cv::imread. Affects opencv across 3 version ranges.
< 2a9d1b22ed76eb22fad1a5edf6faf4d05f207b13
< 3.2.0+dfsg-6
< e8357c0544c82beda237defc0abc90ee28992ee7
Fixed in 3.2.0+dfsg-6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCV (Open Source Computer Vision Library) is a widely used library for computer vision and machine learning tasks. It provides tools for image processing, video capture, and analysis, including features for object detection and recognition. The library is essential for developers working on applications that require real-time image processing. However, a vulnerability has been identified in versions up to 3.3, which could lead to severe security issues.
Vulnerability Detail
The vulnerability, identified as CVE-2017-12605, is an out-of-bounds write error in the FillColorRow8 function located in utils.cpp. This issue arises when the library attempts to read an image file using the cv::imread function. If exploited, this vulnerability can lead to memory corruption, potentially allowing an attacker to execute arbitrary code or crash the application. The severity of this vulnerability is reflected in its CVSS score of 8.8, indicating a high risk to systems using affected versions of OpenCV.
How To Fix
Minimum fixed version
3.2.0+dfsg-6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade opencvTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider using an alternative image processing library or implementing input validation to ensure that only safe image files are processed. Additionally, avoid using the cv::imread function until the library is updated.
Conclusion
The CVE-2017-12605 vulnerability in OpenCV poses a significant risk to applications that rely on this library for image processing. It is crucial for developers to upgrade to a secure version of OpenCV to mitigate potential security threats. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for opencv →
FAQ
CVE-2017-12605 is a security vulnerability in the OpenCV library that allows for out-of-bounds writes, potentially leading to memory corruption and arbitrary code execution.
Versions of OpenCV up to 3.3 are affected by this vulnerability. Users should upgrade to version 3.2.0+dfsg-6 or later.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By simply uploading a manifest file like package-lock.json, you can check if your application is affected by CVE-2017-12605.
Exploitation of this vulnerability can lead to memory corruption, which may allow attackers to execute arbitrary code or crash the application, posing significant security risks.
Yes, you can implement input validation to ensure only safe image files are processed or temporarily switch to another image processing library until an upgrade is feasible.
Related vulnerabilities
Recent vulnerabilities recorded for opencv.
