Buffer Overflow Vulnerability in OpenCV Package: CVE-2017-12862
Summary
CVE-2017-12862: In modules/imgcodecs/src/grfmt_pxm.cpp, the length of buffer AutoBuffer _src is small than expected, which will cause copy buffer overflow later. Affects opencv across 3 version ranges.
< 2a9d1b22ed76eb22fad1a5edf6faf4d05f207b13
< 3.2.0+dfsg-6
< e8357c0544c82beda237defc0abc90ee28992ee7
Fixed in 3.2.0+dfsg-6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCV is an open-source computer vision and machine learning software library that provides a common infrastructure for computer vision applications. It is widely used for real-time image processing and analysis. The library supports various programming languages and is known for its efficiency and ease of use. However, versions 3.3 and earlier of OpenCV are susceptible to a critical buffer overflow vulnerability, which can lead to severe security risks.
Vulnerability Detail
The vulnerability identified as CVE-2017-12862 arises from a flaw in the imgcodecs module, specifically in the grfmt_pxm.cpp file. The issue is caused by the length of the AutoBuffer _src being smaller than expected, leading to a buffer overflow during a copy operation. If an attacker sends a specially crafted image from a remote location, it could result in remote code execution or denial of service. This vulnerability affects OpenCV versions 3.3 and earlier, posing a significant risk to applications relying on these versions.
How To Fix
Minimum fixed version
3.2.0+dfsg-6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade opencvTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid processing images from untrusted sources to mitigate the risk of exploitation until they can upgrade to a secure version of OpenCV.
Conclusion
CVE-2017-12862 is a critical vulnerability in OpenCV that can lead to severe security risks if not addressed. Users are strongly advised to upgrade to a secure version of the library to protect their applications from potential exploitation. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for opencv →
FAQ
CVE-2017-12862 is a buffer overflow vulnerability in OpenCV that can lead to remote code execution or denial of service.
OpenCV versions 3.3 and earlier are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The CVSS score for CVE-2017-12862 is 8.8, indicating a high severity level.
If immediate upgrading is not possible, avoid processing images from untrusted sources as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for opencv.
