Description
In opencv calls that use libpng, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges required. User interaction is not required for exploitation. Product: AndroidVersions: Android-10Android ID: A-110986616
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Android | Android-10 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | opencv | No fix yet | — |
| Ubuntu 26.04 LTS | opencv | No fix yet | — |
| Ubuntu 25.10 | opencv | No fix yet | — |
| Ubuntu 24.04 LTS | opencv | No fix yet | — |
| Ubuntu 20.04 LTS | opencv | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | opencv | No fix yet | — |
| Ubuntu Pro 18.04 LTS | opencv | No fix yet | — |
| Ubuntu Pro 16.04 LTS | opencv | No fix yet | — |
| Ubuntu Pro 14.04 LTS | opencv | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | opencv-contrib-python | <= 4.1.1.26 | — | GHSA-8849-5h85-98qw |
| PyPI | opencv-contrib-python-headless | <= 4.1.1.26 | — | GHSA-8849-5h85-98qw |
| PyPI | opencv-python | <= 4.1.1.26 | — | GHSA-8849-5h85-98qw |
| PyPI | opencv-python-headless | <= 4.1.1.26 | — | GHSA-8849-5h85-98qw |
References
- https://source.android.com/security/bulletin/android-10
- [oss-security] 20191025 Security fixes from Android 10 release which are relevant outside the Android ecosystem? mailing-list
- [oss-security] 20191026 Re: Security fixes from Android 10 release which are relevant outside the Android ecosystem? mailing-list
- [oss-security] 20191107 Re: Security fixes from Android 10 release which are relevant outside the Android ecosystem? mailing-list
- [oss-security] 20201205 Re: Security fixes from Android 10 release which are relevant outside the Android ecosystem? mailing-list