GitHub Advisoryadvisory · PyPI

GHSA-m43c-649m-pm48 Integer Overflow or Wraparound in OpenCV.

HIGH Published 2021-10-12 Modified 2021-11-18 Official page ↗
Aliases
CVE-2017-1000450
Ecosystem
PyPI
Packages
opencv-python, opencv-contrib-python
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-190
Reviewed
2021-10-07

Affected packages

• PyPI opencv-python: < 3.3.1.11 → fixed in 3.3.1.11 • PyPI opencv-contrib-python: < 3.3.1.11 → fixed in 3.3.1.11

Description

In opencv/modules/imgcodecs/src/utils.cpp, functions FillUniColor and FillUniGray do not check the input length, which can lead to integer overflow. If the image is from remote, may lead to remote code execution or denial of service. This affects Opencv 3.3 (corresponding with OpenCV-Python 3.3.0.9) and earlier.

Related

Alias · CVE (1)

  • CVE-2017-1000450 In opencv/modules/imgcodecs/src/utils.cpp, functions FillUniColor and FillUniGray do not check the input length, which can lead to integer… vulnerability

Weakness · CWE (1)

  • CWE-190 Integer Overflow or Wraparound weakness

References