CVE-2019-9423: Out-of-bounds Write in OpenCV
Summary
CVE-2019-9423: Out-of-bounds Write in OpenCV. Affects opencv-python versions < 4.1.1.26. No fix is published. How to fix ↓
Also tracked for
- opencv-contrib-python · PyPI
- opencv-python-headless · PyPI
- opencv-contrib-python-headless · PyPI
The same CVE-2019-9423 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCV is an open-source computer vision library widely used for image and video processing tasks. It provides various functions and algorithms for image manipulation, object detection, and machine learning. The vulnerability identified as CVE-2019-9423 affects the Android version of OpenCV and is related to the usage of libpng. This vulnerability allows an attacker to perform an out-of-bounds write due to a missing bounds check. Exploiting this vulnerability could lead to a local escalation of privilege without requiring additional execution privileges. It is important to note that user interaction is not necessary for exploitation.
Vulnerability Detail
The vulnerability arises from a missing bounds check in OpenCV calls that utilize libpng. This allows an attacker to write data beyond the allocated memory, potentially leading to memory corruption and arbitrary code execution. The impact of this vulnerability is significant, as it enables an attacker to gain elevated privileges on the affected Android device. The vulnerability has a CVSS score of 7.8, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is recommended to follow the steps mentioned in the 'how_to_fix' section to update the affected packages.
Conclusion
The CVE-2019-9423 vulnerability in OpenCV poses a significant risk to Android devices, allowing an attacker to gain elevated privileges. It is crucial to update the affected packages to a secure version to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for opencv-python →
FAQ
OpenCV is an open-source computer vision library used for image and video processing tasks.
The vulnerability allows an attacker to perform an out-of-bounds write, potentially leading to local escalation of privilege on Android devices.
No, user interaction is not required for exploiting this vulnerability.
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
To fix this vulnerability, update the affected packages to a version beyond 4.1.1.26.
Related vulnerabilities
Recent vulnerabilities recorded for opencv-python.
