PT-2017-4223 · Opencv+1 · Opencv+1

Alalek · Published 2017-12-19 · Updated 2021-12-16 · CVE-2017-17760

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions OpenCV version 3.3.1

Description The issue is related to a Buffer Overflow in the cv::PxMDecoder::readData function in grfmt pxm.cpp. This occurs because an incorrect size value is used, allowing a remote attacker to cause a denial of service. The vulnerability is associated with the Open Source Computer Vision Library (OpenCV), which is used for computer vision, image processing, and general-purpose numerical algorithms.

Recommendations For OpenCV version 3.3.1, consider disabling the cv::PxMDecoder::readData function as a temporary workaround until a patch is available. Restrict access to the grfmt pxm.cpp component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2022-06037

CVE-2017-17760

DLA-1235-1

DLA-1438-1

DLA-2799-1

GHSA-JCXV-2J3H-MG59

OPENSUSE-SU-2018_1438-1

Affected Products

Opencv

Suse

References · 82

• 🔥 https://github.com/xiaoqx/pocs/blob/master/opencv.md · Exploit
• 🔥 https://github.com/blendin/pocs/blob/master/opencv/0.OOB_Write_FillUniColor · Exploit
• https://github.com/opencv/opencv/pull/10369/commits/7bbe1a53cfc097b82b1589f7915a2120de39274c · Patch
• https://bdu.fstec.ru/vul/2024-07609 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-17760 · Security Note
• https://bdu.fstec.ru/vul/2024-07601 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12598 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15939 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5269 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12605 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12863 · Security Note
• https://bdu.fstec.ru/vul/2024-07606 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-17760 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17760 · Security Note
• https://bdu.fstec.ru/vul/2024-07608 · Security Note