GHSA-267x-w5hx-8hjr

Source

https://github.com/advisories/GHSA-267x-w5hx-8hjr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/10/GHSA-267x-w5hx-8hjr/GHSA-267x-w5hx-8hjr.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-267x-w5hx-8hjr

Aliases

CVE-2017-12864

Published

2021-10-12T22:02:45Z

Modified

2023-11-08T03:58:54.518605Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Integer Overflow or Wraparound in OpenCV

Details

In opencv/modules/imgcodecs/src/grfmt_pxm.cpp, function ReadNumber did not checkout the input length, which lead to integer overflow. If the image is from remote, may lead to remote code execution or denial of service. This affects OpenCV 3.3 (corresponding with OpenCV-Python version 3.3.0.9) and earlier.

Database specific

{
    "nvd_published_at": "2017-08-15T16:29:00Z",
    "github_reviewed_at": "2021-10-07T20:35:35Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-190"
    ]
}

References

Affected packages

PyPI / opencv-python

Package

Name: opencv-python; View open source insights on deps.dev
Purl: pkg:pypi/opencv-python

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.3.1.11

Affected versions

3.*

3.1.0

3.1.0.0

3.1.0.1

3.1.0.2

3.1.0.3

3.1.0.4

3.1.0.5

3.2.0.6

3.2.0.7

3.2.0.8

3.3.0.9

3.3.0.10

Database specific

{
    "last_known_affected_version_range": "<= 3.3.0.9"
}

PyPI / opencv-contrib-python