CVE-2017-12862 Improper Restriction of Operations within the Bounds of a Memory Buffer in OpenCV
HighCVSS 8.8
EPSS 3.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In modules/imgcodecs/src/grfmt_pxm.cpp, the length of buffer AutoBuffer _src is small than expected, which will cause copy buffer overflow later. If the image is from remote, may lead to remote code execution or denial of service. This affects Opencv 3.3 and earlier.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi opencv-python(PyPI) | <= 3.3.0.9 | No fix listed |
| pypi opencv-contrib-python(PyPI) | <= 3.3.0.9 | No fix listed |
| pypi opencv-python(PyPI) | < 3.3.1.11 | 3.3.1.11 |
| pypi opencv-contrib-python(PyPI) | < 3.3.1.11 | 3.3.1.11 |
| debian/opencv(Debian:12) | < 3.2.0+dfsg-6 | 3.2.0+dfsg-6 |
| debian/opencv(Debian:13) | < 3.2.0+dfsg-6 | 3.2.0+dfsg-6 |
| debian/opencv(Debian:14) | < 3.2.0+dfsg-6 | 3.2.0+dfsg-6 |
| opencv | <= 3.3.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking patch third-party-advisory
- github.com patch
- [debian-lts-announce] 20180722 [SECURITY] [DLA 1438-1] opencv security update mailing-list third-party-advisory
- GLSA-201712-02 third-party-advisory vendor-advisory
- [debian-lts-announce] 20211030 [SECURITY] [DLA 2799-1] opencv security update mailing-list third-party-advisory
- github.com vendor-advisory
- github.com product
- pypi.org product
- pypi.org product
- Debian Security Tracker CVE-2017-12862 vendor-advisory
- bugs.debian.org issue-tracking