Heap Buffer Overflow Vulnerability in OpenCV - CVE-2019-5064
Summary
CVE-2019-5064: An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, before version 4.2.0. Affects opencv across 3 version ranges.
< 4.2.0+dfsg-3
>= d511587cf0bc782022db215d20d960afb2e9efe2, < 65abc7090dedc84bbedec4dfd143f0340e52114f
>= e6d9486a6cb3379a0eeb59bd405bea3125ea364d, < 4de7015cfd9462cea82eac35007e541d84e23a27
Fixed in 4.2.0+dfsg-3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCV is an open-source computer vision and machine learning software library that provides a common infrastructure for computer vision applications. It offers a comprehensive set of tools for image processing, video capture, and analysis, making it widely used in various fields such as robotics, artificial intelligence, and image recognition. The library's data structure persistence functionality is crucial for saving and loading complex data structures, but it is vulnerable to a heap buffer overflow, which can lead to severe security issues.
Vulnerability Detail
CVE-2019-5064 is an exploitable heap buffer overflow vulnerability found in OpenCV versions prior to 4.2.0. This vulnerability arises when a specially crafted JSON file is processed, leading to a buffer overflow that can corrupt multiple heap structures and potentially allow an attacker to execute arbitrary code. The vulnerability can be triggered by providing a malicious JSON file, making it critical for users to ensure they are using a patched version of OpenCV to mitigate the risk of exploitation.
How To Fix
Minimum fixed version
4.2.0+dfsg-3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade opencvTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted JSON files until they have upgraded to a secure version of OpenCV. Additionally, implementing strict validation of input files can help mitigate the risk of exploitation.
Conclusion
CVE-2019-5064 represents a significant security risk for users of OpenCV prior to version 4.2.0 due to its potential for code execution through heap buffer overflow. It is crucial for users to upgrade to the latest version to protect their applications from exploitation. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for opencv →
FAQ
CVE-2019-5064 is a heap buffer overflow vulnerability in OpenCV that can lead to code execution when processing specially crafted JSON files.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
All versions of OpenCV prior to 4.2.0 are affected by this vulnerability.
If an immediate upgrade is not possible, avoid processing untrusted JSON files and validate all input files to reduce the risk of exploitation.
The CVSS score of CVE-2019-5064 is 8.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for opencv.
