Heap Buffer Overflow Vulnerability in OpenCV 4.1.0
Summary
CVE-2019-5063: An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV 4.1.0. Affects opencv versions < 4.2.0+dfsg-3. Fixed in 4.2.0+dfsg-3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCV is an open-source computer vision and machine learning software library that provides a common infrastructure for computer vision applications. It offers a comprehensive set of tools for image processing, video capture, and analysis, including features for object detection and recognition. The library is widely used in both academic and commercial settings. However, OpenCV 4.1.0 has a critical vulnerability that can be exploited through specially crafted XML files, leading to severe security risks.
Vulnerability Detail
An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV 4.1.0. This vulnerability arises when a specially crafted XML file is processed, causing a buffer overflow that can lead to multiple heap corruptions. The ramifications of this vulnerability include potential code execution, allowing an attacker to execute arbitrary code on the affected system. The vulnerability is particularly concerning due to its ease of exploitation and the potential for significant damage to systems utilizing OpenCV.
How To Fix
Minimum fixed version
4.2.0+dfsg-3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade opencvTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider implementing input validation to sanitize XML files before processing them with OpenCV. This can help mitigate the risk of exploitation until a proper upgrade can be performed.
Conclusion
The heap buffer overflow vulnerability in OpenCV 4.1.0 poses significant security risks due to its potential for code execution through specially crafted XML files. Users are strongly advised to upgrade to version 4.2.0 or later to protect their systems. Additionally, implementing input validation can serve as a temporary measure to reduce the risk of exploitation.
See every vulnerability recorded for opencv →
FAQ
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
OpenCV versions prior to 4.2.0 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Exploitation of this vulnerability can lead to arbitrary code execution, which may compromise the security of the affected system.
Yes, implementing input validation to sanitize XML files can help mitigate the risk until an upgrade is performed.
Related vulnerabilities
Recent vulnerabilities recorded for opencv.
