PT-2019-6436 · Intel+3 · Opencv+3

Butterfly · Published 2019-07-23 · Updated 2024-06-15 · CVE-2019-14491

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenCV versions prior to 3.4.7 OpenCV versions 4.x prior to 4.1.1

Description The issue is related to an out of bounds read in the cv::predictOrdered<cv::HaarEvaluator> function in modules/objdetect/src/cascadedetect.hpp. This can lead to denial of service and potentially allow a remote attacker to access confidential data.

Recommendations For OpenCV versions prior to 3.4.7, update to version 3.4.7 or later. For OpenCV versions 4.x prior to 4.1.1, update to version 4.1.1 or later. As a temporary workaround, consider disabling the cv::predictOrdered<cv::HaarEvaluator> function until a patch is available.

Exploit

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2024-06972

CVE-2019-14491

GHSA-FM39-CW8H-3P63

MGASA-2020-0030

OPENSUSE-SU-2019:2671-1

OPENSUSE-SU-2019_2671-1

OPENSUSE-SU-2024:11115-1

OPENSUSE-SU-2024:11116-1

SUSE-SU-2019:3192-1

SUSE-SU-2019:3192-2

SUSE-SU-2019_3192-1

SUSE-SU-2019_3192-2

USN-4818-1

Affected Products

Astra Linux

Opencv

Suse

Ubuntu

References · 45

• 🔥 https://github.com/opencv/opencv/issues/15125 · Exploit
• https://osv.dev/vulnerability/USN-4818-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0030.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-14491 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:11115-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:3192-2 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-14491 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fm39-cw8h-3p63 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0030 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-14492 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00025.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-14491 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-15939 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-14493 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-18009 · Vendor Advisory