Integer Overflow Vulnerability in OpenCV Package Leading to Potential Remote Code Execution
Summary
CVE-2017-12864: In opencv/modules/imgcodecs/src/grfmt_pxm.cpp, function ReadNumber did not checkout the input length, which lead to integer overflow. Affects opencv across 3 version ranges.
< 2a9d1b22ed76eb22fad1a5edf6faf4d05f207b13
< 3.2.0+dfsg-6
< e8357c0544c82beda237defc0abc90ee28992ee7
Fixed in 3.2.0+dfsg-6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCV is an open-source computer vision and machine learning software library that provides a common infrastructure for computer vision applications. It is widely used in real-time image processing and computer vision tasks. The library supports various programming languages and has a large community contributing to its development. However, versions 3.3 and earlier are susceptible to a critical vulnerability that can be exploited if an attacker provides a specially crafted image file.
Vulnerability Detail
The vulnerability identified as CVE-2017-12864 arises from the function ReadNumber in the file grfmt_pxm.cpp within the OpenCV imgcodecs module. This function fails to validate the length of the input, leading to an integer overflow. If an image is received from a remote source, this flaw could allow an attacker to execute arbitrary code on the victim's machine or cause a denial of service. The vulnerability affects OpenCV versions 3.3 and earlier, with a CVSS score of 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
3.2.0+dfsg-6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade opencvTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing images from untrusted or remote sources until they can upgrade to a secure version of OpenCV. Additionally, implementing input validation checks in the application code can help mitigate the risk of exploitation.
Conclusion
CVE-2017-12864 is a critical vulnerability in OpenCV that can lead to severe consequences if exploited. Users are strongly advised to upgrade to a secure version of the library to mitigate risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of applications.
See every vulnerability recorded for opencv →
FAQ
CVE-2017-12864 is a vulnerability in OpenCV that allows for integer overflow due to insufficient input length validation in the ReadNumber function.
OpenCV versions 3.3 and earlier are affected by this vulnerability.
Exploitation of this vulnerability could lead to remote code execution or denial of service on the affected system.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
The CVSS score of CVE-2017-12864 is 8.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for opencv.
