CVE-2017-12601
HighSummary
OpenCV through version 3.3 has a buffer overflow in the cv::BmpDecoder::readData function that can occur when reading an image file using cv::imread. This issue is demonstrated by the 4-buf-overflow-readData-memcpy test case.
Risk Assessment
Buffer overflow may lead to the execution of malicious code, posing a serious security threat to applications using OpenCV. Organizations should be aware of the risks associated with processing unknown or untrusted image files.
Recommendation
It is recommended to update the OpenCV library to the latest version to mitigate this vulnerability. Additionally, appropriate security controls should be implemented when processing image files.
Other vulnerabilities in OpenCV
See all- CVE-2017-12606High
OpenCV through version 3.3 has an out-of-bounds write error in the FillColorRow4 function in utils.cpp when reading an image file using cv::imread.
- CVE-2017-12605High
OpenCV versions up to 3.3 contain an out-of-bounds write error in the FillColorRow8 function in utils.cpp when reading an image file using cv::imread.
- CVE-2017-12604High
OpenCV up to version 3.3 has an out-of-bounds write error in the FillUniColor function in utils.cpp when reading an image file using cv::imread.
- CVE-2017-12603High
OpenCV through version 3.3 has an invalid write in the cv::RLByteStream::getBytes function, which may lead to a buffer overflow when reading an image file using cv::imread.
- CVE-2017-12602High
OpenCV through version 3.3 has a denial of service issue related to memory consumption, as demonstrated by the 10-opencv-dos-memory-exhaust test case.
- CVE-2017-12600High
OpenCV versions up to 3.3 have a denial of service issue leading to excessive CPU consumption. This issue is demonstrated by the 11-opencv-dos-cpu-exhaust test case.
- CVE-2017-12599High
OpenCV through version 3.3 has an out-of-bounds read error in the function icvCvt_BGRA2BGR_8u_C4C3R when reading an image file using cv::imread.
- CVE-2017-12598High
OpenCV through version 3.3 has an out-of-bounds read error in the cv::RBaseStream::readBlock function when reading an image file using cv::imread. This issue is demonstrated by the 8-opencv-invalid-read-fread test case.
- CVE-2017-12597High
OpenCV through version 3.3 has an out-of-bounds write error in the FillColorRow1 function in utils.cpp when reading an image file using cv::imread.
- CVE-2016-1516High
OpenCV version 3.0.0 has a double free issue that allows attackers to execute arbitrary code.
Original NVD description (English source)
OpenCV (Open Source Computer Vision Library) through 3.3 has a buffer overflow in the cv::BmpDecoder::readData function in modules/imgcodecs/src/grfmt_bmp.cpp when reading an image file by using cv::imread, as demonstrated by the 4-buf-overflow-readData-memcpy test case.