CVE-2019-5064

An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, before version 4.2.0. A specially crafted JSON file can cause a buffer overflow, resulting in multiple heap corruptions and potentially code execution. An attacker can provide a specially crafted file to trigger this vulnerability.

References

Affected packages

Git / github.com/opencv/opencv

Affected ranges

Type

GIT

Repo

https://github.com/opencv/opencv

Events

Introduced

e6d9486a6cb3379a0eeb59bd405bea3125ea364d

Fixed

4de7015cfd9462cea82eac35007e541d84e23a27

Database specific

{
    "versions": [
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.2.0"
        }
    ]
}

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "13.3.0.1"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "2.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "13.4.0.0"
            }
        ]
    }
]

vanir_signatures

[
    {
        "target": {
            "function": "getCore",
            "file": "modules/dnn/src/op_inf_engine.cpp"
        },
        "id": "CVE-2019-5064-3d0f94f7",
        "digest": {
            "function_hash": "42391463951113352527122832114488237590",
            "length": 56.0
        },
        "source": "https://github.com/opencv/opencv/commit/4de7015cfd9462cea82eac35007e541d84e23a27",
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "modules/dnn/src/op_inf_engine.cpp"
        },
        "id": "CVE-2019-5064-cde920ea",
        "digest": {
            "line_hashes": [
                "317101903585342046209676890270866796176",
                "4899819219694852016431700102245338623",
                "145431787435142965762058253718854780324",
                "327709608047084872203543569286410968244",
                "150284813203258107715379774141947886599",
                "8203734128214708468098549216124558848",
                "6684646567636119877889396109033940069",
                "82837593067641140679090056088734863650"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/opencv/opencv/commit/4de7015cfd9462cea82eac35007e541d84e23a27",
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Line"
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-5064.json"