CVE-2017-12603
HighSummary
OpenCV through version 3.3 has an invalid write in the cv::RLByteStream::getBytes function, which may lead to a buffer overflow when reading an image file using cv::imread.
Risk Assessment
Exploitation of this vulnerability may lead to unauthorized memory access, creating a risk of executing malicious code and potentially taking control of the system.
Recommendation
It is recommended to update OpenCV to the latest version to mitigate this vulnerability and conduct a code audit to identify other potential security issues.
Other vulnerabilities in OpenCV
See all- CVE-2017-12606High
OpenCV through version 3.3 has an out-of-bounds write error in the FillColorRow4 function in utils.cpp when reading an image file using cv::imread.
- CVE-2017-12605High
OpenCV versions up to 3.3 contain an out-of-bounds write error in the FillColorRow8 function in utils.cpp when reading an image file using cv::imread.
- CVE-2017-12604High
OpenCV up to version 3.3 has an out-of-bounds write error in the FillUniColor function in utils.cpp when reading an image file using cv::imread.
- CVE-2017-12602High
OpenCV through version 3.3 has a denial of service issue related to memory consumption, as demonstrated by the 10-opencv-dos-memory-exhaust test case.
- CVE-2017-12601High
OpenCV through version 3.3 has a buffer overflow in the cv::BmpDecoder::readData function that can occur when reading an image file using cv::imread. This issue is demonstrated by the 4-buf-overflow-readData-memcpy test case.
- CVE-2017-12600High
OpenCV versions up to 3.3 have a denial of service issue leading to excessive CPU consumption. This issue is demonstrated by the 11-opencv-dos-cpu-exhaust test case.
- CVE-2017-12599High
OpenCV through version 3.3 has an out-of-bounds read error in the function icvCvt_BGRA2BGR_8u_C4C3R when reading an image file using cv::imread.
- CVE-2017-12598High
OpenCV through version 3.3 has an out-of-bounds read error in the cv::RBaseStream::readBlock function when reading an image file using cv::imread. This issue is demonstrated by the 8-opencv-invalid-read-fread test case.
- CVE-2017-12597High
OpenCV through version 3.3 has an out-of-bounds write error in the FillColorRow1 function in utils.cpp when reading an image file using cv::imread.
- CVE-2016-1516High
OpenCV version 3.0.0 has a double free issue that allows attackers to execute arbitrary code.
Original NVD description (English source)
OpenCV (Open Source Computer Vision Library) through 3.3 has an invalid write in the cv::RLByteStream::getBytes function in modules/imgcodecs/src/bitstrm.cpp when reading an image file by using cv::imread, as demonstrated by the 2-opencv-heapoverflow-fseek test case.