Heap-Based Buffer Overflow in OpenCV Package: CVE-2018-5268
Summary
CVE-2018-5268: In OpenCV 3.3.1, a heap-based buffer overflow happens in cv::Jpeg2KDecoder::readComponent8u in modules/imgcodecs/src/grfmt_jpeg2000.cpp when parsing a crafted image file. Affects opencv across 3 version ranges.
< 0bd061f07b665a7fb3f744122550393b337c50e5
< 3.2.0+dfsg-6
< af4d6f34d8d05b0a9a0278728823272e49a63898
Fixed in 3.2.0+dfsg-6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCV is an open-source computer vision and machine learning software library that provides a common infrastructure for computer vision applications. It is widely used for real-time image processing and analysis. The library supports various functionalities, including image manipulation, object detection, and machine learning algorithms. However, a vulnerability has been identified in OpenCV versions prior to 3.2.0+dfsg-6, which could lead to severe security risks.
Vulnerability Detail
CVE-2018-5268 is a heap-based buffer overflow vulnerability found in the cv::Jpeg2KDecoder::readComponent8u function within the OpenCV library. This vulnerability arises when the library processes a specially crafted JPEG 2000 image file, leading to potential memory corruption. The ramifications of this vulnerability include the possibility of arbitrary code execution, which could allow an attacker to gain control over the affected system. The vulnerability affects multiple Debian ecosystems, including versions 11, 12, and 13, and has a CVSS score of 5.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
3.2.0+dfsg-6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade opencvTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted or unverified JPEG 2000 image files until the OpenCV library is updated. This precaution can help mitigate the risk of exploitation through this vulnerability.
Conclusion
CVE-2018-5268 represents a significant vulnerability within the OpenCV library, specifically affecting its ability to safely process JPEG 2000 image files. Users are strongly advised to upgrade to the latest version to mitigate potential risks associated with this vulnerability.
See every vulnerability recorded for opencv →
FAQ
CVE-2018-5268 is a vulnerability in the OpenCV library that allows for a heap-based buffer overflow when processing crafted JPEG 2000 image files.
The vulnerability can lead to memory corruption and may allow attackers to execute arbitrary code on the affected system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
OpenCV versions prior to 3.2.0+dfsg-6 are affected by this vulnerability across multiple Debian ecosystems.
The CVSS score for CVE-2018-5268 is 5.5, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for opencv.
