PT-2017-4336 · Intel+1 · Opencv+1
Blendin
·
Publicado
2017-09-27
·
Atualizado
2021-11-30
·
CVE-2017-1000450
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
OpenCV versions 3.3 and earlier
Description:
The issue is related to an integer overflow in the utils.cpp component of the OpenCV library, specifically in the
FillUniColor and FillUniGray functions. These functions do not check the input length, which can lead to integer overflow. If the image is from a remote source, this could result in remote code execution or denial of service.Recommendations:
For OpenCV versions 3.3 and earlier, consider updating to a newer version that includes a fix for this issue. As a temporary workaround, restrict the use of the
FillUniColor and FillUniGray functions in opencv/modules/imgcodecs/src/utils.cpp to minimize the risk of exploitation. Avoid processing images from remote sources until the issue is resolved.Exploit
Correção
RCE
DoS
Integer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Opencv
Suse