GitHub Advisoryadvisory · PyPI

GHSA-267x-w5hx-8hjr Integer Overflow or Wraparound in OpenCV

HIGH Published 2021-10-12 Modified 2021-11-18 Official page ↗
Aliases
CVE-2017-12864
Ecosystem
PyPI
Packages
opencv-python, opencv-contrib-python
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-190
Reviewed
2021-10-07

Affected packages

• PyPI opencv-python: < 3.3.1.11 → fixed in 3.3.1.11 • PyPI opencv-contrib-python: < 3.3.1.11 → fixed in 3.3.1.11

Description

In opencv/modules/imgcodecs/src/grfmt_pxm.cpp, function ReadNumber did not checkout the input length, which lead to integer overflow. If the image is from remote, may lead to remote code execution or denial of service. This affects OpenCV 3.3 (corresponding with OpenCV-Python version 3.3.0.9) and earlier.

Related

Alias · CVE (1)

  • CVE-2017-12864 In opencv/modules/imgcodecs/src/grfmt_pxm.cpp, function ReadNumber did not checkout the input length, which lead to integer overflow. vulnerability

Weakness · CWE (1)

  • CWE-190 Integer Overflow or Wraparound weakness

References