Summary
It was discovered that OpenCV did not properly manage certain XML data,
leading to a NULL pointer dereference. If a user were tricked into
loading a specially crafted file, a remote attacker could possibly use
this issue to make OpenCV crash, resulting in a denial of service.
This issue only affected Ubuntu 18.04 LTS. (CVE-2019-14493)
It was discovered that OpenCV may perform out-of-bounds reads in certain
situations. An attacker could possibly use this issue to cause OpenCV to
crash, resulting in a denial of service, or the execution of arbitrary
code. This issue only affected Ubuntu 18.04 LTS.
(CVE-2019-16249, CVE-2019-19624)
It was discovered that the QR code module of OpenCV incorrectly processed
certain maliciously crafted QR codes. A remote attacker could possibly use
this issue to cause OpenCV to crash, resulting in a denial of service.
This issue only affected Ubuntu 22.04 LTS. (CVE-2023-2617, CVE-2023-2618)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | opencv | 3.2.0+dfsg-4ubuntu0.1+esm4 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | opencv | 4.5.4+dfsg-9ubuntu4+esm1 |
Vulnerabilities 5
-
High 7.5
NULL Pointer Dereference in OpenCV.
An issue was discovered in OpenCV before 4.1.1. There is a NULL pointer dereference in the function cv::XMLParser::parse at modules/core/src/persistence.cpp.
-
Medium 6.5
Out-of-bounds Read in OpenCV
An out-of-bounds read was discovered in OpenCV before 4.1.1. Specifically, variable coarsest_scale is assumed to be greater than or equal to finest_scale within the calc()/ocl_calc() functions in dis_flow.cpp. However, this is not true when dealing with small…
-
Medium 5.3
Out-of-bounds Read in OpenCV
OpenCV 4.1.1 has an out-of-bounds read in hal_baseline::v_load in core/hal/intrin_sse.hpp when called from computeSSDMeanNorm in modules/video/src/dis_flow.cpp.
-
Medium 5.3
OpenCV wechat_qrcode Module decoded_bit_stream_parser.cpp decodeByteSegment null pointer dereference
A vulnerability classified as problematic was found in OpenCV wechat_qrcode Module up to 4.7.0. Affected by this vulnerability is the function DecodedBitStreamParser::decodeByteSegment of the file qrcode/decoder/decoded_bit_stream_parser.cpp. The manipulation…
-
Medium 5.3
OpenCV wechat_qrcode Module decoded_bit_stream_parser.cpp decodeHanziSegment memory leak
A vulnerability, which was classified as problematic, has been found in OpenCV wechat_qrcode Module up to 4.7.0. Affected by this issue is the function DecodedBitStreamParser::decodeHanziSegment of the file qrcode/decoder/decoded_bit_stream_parser.cpp. The ma…