GHSA-5rpc-gwh9-q9fg

Source

https://github.com/advisories/GHSA-5rpc-gwh9-q9fg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/10/GHSA-5rpc-gwh9-q9fg/GHSA-5rpc-gwh9-q9fg.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-5rpc-gwh9-q9fg

Aliases

CVE-2017-12862

Published

2021-10-12T22:02:21Z

Modified

2023-11-08T03:58:54.395801Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Improper Restriction of Operations within the Bounds of a Memory Buffer in OpenCV

Details

In modules/imgcodecs/src/grfmt_pxm.cpp, the length of buffer AutoBuffer _src is small than expected, which will cause copy buffer overflow later. If the image is from remote, may lead to remote code execution or denial of service. This affects OpenCV 3.3 (corresponding to OpenCV-Python 3.3.0.9) and earlier.

Database specific

{
    "nvd_published_at": "2017-08-15T16:29:00Z",
    "github_reviewed_at": "2021-10-07T20:44:45Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-119",
        "CWE-787"
    ]
}

References

Affected packages

PyPI / opencv-python

Package

Name: opencv-python; View open source insights on deps.dev
Purl: pkg:pypi/opencv-python

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.3.1.11

Affected versions

3.*

3.1.0

3.1.0.0

3.1.0.1

3.1.0.2

3.1.0.3

3.1.0.4

3.1.0.5

3.2.0.6

3.2.0.7

3.2.0.8

3.3.0.9

3.3.0.10

Database specific

{
    "last_known_affected_version_range": "<= 3.3.0.9"
}

PyPI / opencv-contrib-python