PT-2017-4343 · Intel+1 · Opencv+1

Scdeny · Published 2017-08-15 · Updated 2021-11-30 · CVE-2017-12863

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: OpenCV versions 3.3 and earlier

Description: The issue is related to an integer overflow in the PxMDecoder::readData function in opencv/modules/imgcodecs/src/grfmt pxm.cpp. This can lead to remote code execution or denial of service if the image is from a remote source. The vulnerability may allow an attacker to access confidential data, compromise its integrity, and cause a denial of service using a specially crafted file.

Recommendations: For OpenCV versions 3.3 and earlier, consider disabling the PxMDecoder::readData function until a patch is available to prevent potential remote code execution or denial of service. Restrict access to remote images to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

DoS

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BDU:2024-07608

CVE-2017-12863

DLA-1117-1

DLA-1438-1

DLA-2799-1

GHSA-WQ8F-WVQP-XVVM

OPENSUSE-SU-2018_1385-1

Affected Products

Opencv

Suse

References · 100

• 🔥 https://github.com/xiaoqx/pocs/blob/master/opencv.md · Exploit
• 🔥 https://github.com/blendin/pocs/blob/master/opencv/0.OOB_Write_FillUniColor · Exploit
• 🔥❌ https://github.com/scdeny/opencv_pocs/blob/master/1.PxmDecoder_readData_int_overflow_poc · Exploit, Deleted
• https://github.com/opencv/opencv/issues/9371 · Patch
• https://security.gentoo.org/glsa/201712-02 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-07609 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-12863 · Security Note
• https://osv.dev/vulnerability/CVE-2017-12863 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-12863 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-07601 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12598 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15939 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5269 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12605 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12863 · Security Note