OpenCV - Heap-based Buffer Overflow and Assertion Failure
Summary
DLA-1354-1: opencv - security update. Affects opencv versions < 2.3.1-11+deb7u4. Fixed in 2.3.1-11+deb7u4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenCV is an open-source computer vision library that provides various functions and algorithms for image and video processing. It is widely used in applications such as robotics, surveillance, and augmented reality. OpenCV 3.3.1 is affected by two vulnerabilities that can lead to a heap-based buffer overflow and an assertion failure.
Vulnerability Detail
The first vulnerability, CVE-2018-5268, occurs in the cv::Jpeg2KDecoder::readComponent8u function in modules/imgcodecs/src/grfmt_jpeg2000.cpp. It is triggered when parsing a specially crafted image file, resulting in a heap-based buffer overflow. An attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service.
The second vulnerability, CVE-2018-5269, is an assertion failure in the cv::RBaseStream::setPos function in modules/imgcodecs/src/bitstrm.cpp. This occurs due to an incorrect integer cast. An attacker could leverage this vulnerability to crash the application or potentially execute arbitrary code.
How To Fix
Minimum fixed version
2.3.1-11+deb7u4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade opencvTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
OpenCV 3.3.1 is affected by two vulnerabilities that can lead to a heap-based buffer overflow and an assertion failure. It is crucial to upgrade to version 2.3.1-11+deb7u4 or later to mitigate these vulnerabilities. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for opencv →
FAQ
OpenCV is an open-source computer vision library that provides functions and algorithms for image and video processing.
The vulnerabilities affect OpenCV version 3.3.1.
CVE-2018-5268 can lead to a heap-based buffer overflow, which may allow an attacker to execute arbitrary code or cause a denial of service.
CVE-2018-5269 can result in an assertion failure, potentially crashing the application or allowing for arbitrary code execution.
To fix the vulnerabilities, upgrade the OpenCV package to version 2.3.1-11+deb7u4 or later.
Related vulnerabilities
Recent vulnerabilities recorded for opencv.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
