CVE-2017-1000450: Integer Overflow
First published: Tue Jan 02 2018(Updated: )
In opencv/modules/imgcodecs/src/utils.cpp, functions FillUniColor and FillUniGray do not check the input length, which can lead to integer overflow. If the image is from remote, may lead to remote code execution or denial of service. This affects Opencv 3.3 and earlier.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Opencv Opencv | <=3.3.0 | |
| Debian Debian Linux | =7.0 | |
| Debian Debian Linux | =8.0 | |
| Debian Debian Linux | =9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/blendin/pocs/blob/master/opencv/0.OOB_Write_FillUniColor
- https://github.com/opencv/opencv/issues/9723
- https://lists.debian.org/debian-lts-announce/2018/01/msg00008.html
- https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html
- https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
Frequently Asked Questions
What is CVE-2017-1000450?
CVE-2017-1000450 is a vulnerability in the OpenCV library that allows for integer overflow, potentially leading to remote code execution or denial of service.
What functions in OpenCV are affected by CVE-2017-1000450?
The functions FillUniColor and FillUniGray in opencv/modules/imgcodecs/src/utils.cpp are affected by CVE-2017-1000450.
Which versions of OpenCV are affected by CVE-2017-1000450?
OpenCV 3.3 and earlier versions are affected by CVE-2017-1000450.
How severe is CVE-2017-1000450?
CVE-2017-1000450 has a severity rating of 8.8 (high) out of 10.
How can I fix CVE-2017-1000450?
To fix CVE-2017-1000450, you should update to a version of OpenCV that is not affected by this vulnerability.
- collector/nvd-index
- agent/softwarecombine
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/weakness
- agent/references
- agent/last-modified-date
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/opencv
- canonical/opencv opencv
- version/opencv opencv/3.3.0
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/7.0
- version/debian debian linux/8.0
- version/debian debian linux/9.0