CVE-2019-5063: Buffer Overflow
First published: Fri Jan 03 2020(Updated: )
An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV 4.1.0. A specially crafted XML file can cause a buffer overflow, resulting in multiple heap corruptions and potential code execution. An attacker can provide a specially crafted file to trigger this vulnerability.
Credit: talos-cna@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Opencv Opencv | =4.1.0 | |
| Oracle Application Testing Suite | =13.3.0.1 | |
| Oracle Big Data Spatial And Graph | <2.0 | |
| Oracle Enterprise Manager Base Platform | =13.4.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2019-5063.
What is the severity of CVE-2019-5063?
CVE-2019-5063 has a severity of 8.8 (high).
What is affected by CVE-2019-5063?
OpenCV 4.1.0, Oracle Application Testing Suite 13.3.0.1, Oracle Big Data Spatial And Graph up to version 2.0, and Oracle Enterprise Manager Base Platform 13.4.0.0 are affected by CVE-2019-5063.
How does CVE-2019-5063 vulnerability work?
A specially crafted XML file can cause a buffer overflow, resulting in multiple heap corruptions and potential code execution.
Are there any patches or fixes available for CVE-2019-5063?
Yes, please refer to the following references for patches and fixes: [TALOS-2019-0852](https://talosintelligence.com/vulnerability_reports/TALOS-2019-0852), [Oracle CPU Jul 2021](https://www.oracle.com/security-alerts/cpujul2021.html), [Oracle CPU Apr 2021](https://www.oracle.com/security-alerts/cpuApr2021.html).
- collector/nvd-index
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/type
- agent/description
- agent/event
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/opencv
- canonical/opencv opencv
- version/opencv opencv/4.1.0
- vendor/oracle
- canonical/oracle application testing suite
- version/oracle application testing suite/13.3.0.1
- canonical/oracle big data spatial and graph
- canonical/oracle enterprise manager base platform
- version/oracle enterprise manager base platform/13.4.0.0