PT-2019-6436 · Intel+3 · Opencv+3

Butterfly · Publicado 2019-07-23 · Atualizado 2024-06-15 · CVE-2019-14491

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenCV versions prior to 3.4.7 OpenCV versions 4.x prior to 4.1.1

Description The issue is related to an out of bounds read in the cv::predictOrdered<cv::HaarEvaluator> function in modules/objdetect/src/cascadedetect.hpp. This can lead to denial of service and potentially allow a remote attacker to access confidential data.

Recommendations For OpenCV versions prior to 3.4.7, update to version 3.4.7 or later. For OpenCV versions 4.x prior to 4.1.1, update to version 4.1.1 or later. As a temporary workaround, consider disabling the cv::predictOrdered<cv::HaarEvaluator> function until a patch is available.

Exploit

Correção

DoS

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

BDU:2024-06972

CVE-2019-14491

GHSA-FM39-CW8H-3P63

MGASA-2020-0030

OPENSUSE-SU-2019:2671-1

OPENSUSE-SU-2019_2671-1

OPENSUSE-SU-2024:11115-1

OPENSUSE-SU-2024:11116-1

SUSE-SU-2019:3192-1

SUSE-SU-2019:3192-2

SUSE-SU-2019_3192-1

SUSE-SU-2019_3192-2

USN-4818-1

Produtos afetados

Astra Linux

Opencv

Suse

Ubuntu

Referências · 45

• 🔥 https://github.com/opencv/opencv/issues/15125 · Exploit
• https://github.com/opencv/opencv/compare/371bba8...ddbd10c · Nota
• https://github.com/opencv/opencv/compare/33b765d...4a7ca5a · Nota
• https://github.com/opencv/opencv/commit/ac425f67e4c1d0da9afb9203f0918d8d57c067ed · Nota
• https://github.com/opencv/opencv-python · Nota
• https://osv.dev/vulnerability/USN-4818-1 · Aviso do Fabricante
• http://lists.suse.com/pipermail/sle-security-updates/2019-December/006214.html · Nota
• https://advisories.mageia.org/MGASA-2020-0030.html · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-14491 · Nota de Segurança
• https://osv.dev/vulnerability/openSUSE-SU-2024:11115-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2019:3192-2 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-14491 · Aviso do Fabricante
• https://suse.com/support/update/announcement/2019/suse-su-20193192-1 · Nota
• https://suse.com/support/update/announcement/2019/suse-su-20193192-2 · Nota
• https://osv.dev/vulnerability/GHSA-fm39-cw8h-3p63 · Aviso do Fabricante