Buffer Overflow Vulnerability in OpenCV Package - CVE-2017-17760
Summary
CVE-2017-17760: OpenCV 3.3.1 has a Buffer Overflow in the cv::PxMDecoder::readData function in grfmt_pxm.cpp, because an incorrect size value is used. Affects opencv across 3 version ranges.
< 0bd061f07b665a7fb3f744122550393b337c50e5
< 3.2.0+dfsg-6
< af4d6f34d8d05b0a9a0278728823272e49a63898
Fixed in 3.2.0+dfsg-6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCV (Open Source Computer Vision Library) is a widely used open-source library designed for computer vision and machine learning tasks. It provides a comprehensive set of tools for image processing, video capture, and analysis. The library is utilized in various applications, from robotics to augmented reality. However, a vulnerability has been identified in version 3.3.1, which can lead to a buffer overflow, potentially compromising the integrity of applications that rely on this library.
Vulnerability Detail
The vulnerability, identified as CVE-2017-17760, originates from the cv::PxMDecoder::readData function in the grfmt_pxm.cpp file of OpenCV. An incorrect size value is used, which can lead to a buffer overflow. This flaw allows an attacker to exploit the vulnerability by crafting specific input data, which may result in arbitrary code execution or application crashes. The severity of this vulnerability is rated with a CVSS score of 6.5, indicating a moderate risk to systems using affected versions of OpenCV.
How To Fix
Minimum fixed version
3.2.0+dfsg-6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade opencvTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, a temporary workaround is to avoid using the specific functionality that relies on the cv::PxMDecoder::readData function until a patch is applied. Additionally, implementing input validation to sanitize data before processing can help mitigate the risk of exploitation.
Conclusion
The CVE-2017-17760 vulnerability in OpenCV poses a significant risk due to the potential for buffer overflow attacks. Users are strongly advised to upgrade to the latest version of OpenCV to mitigate this risk. For those unable to upgrade immediately, implementing workarounds and monitoring for updates is crucial.
See every vulnerability recorded for opencv →
FAQ
CVE-2017-17760 is a buffer overflow vulnerability in OpenCV version 3.3.1 that can lead to arbitrary code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of CVE-2017-17760 is 6.5, indicating a moderate level of risk.
If an upgrade is not feasible, consider implementing input validation and avoiding the use of the affected functionality until a fix is applied.
You can find more information about OpenCV vulnerabilities on the official OpenCV GitHub repository and security advisories.
Related vulnerabilities
Recent vulnerabilities recorded for opencv.
