Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2017-1000450

Good to know:

icon

Date: January 2, 2018

In opencv/modules/imgcodecs/src/utils.cpp, functions FillUniColor and FillUniGray do not check the input length, which can lead to integer overflow. If the image is from remote, may lead to remote code execution or denial of service. This affects Opencv 3.3 and earlier.

Language: C++

Severity Score

Related Resources (9)

https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
https://github.com/opencv/opencv/issues/9723
https://access.redhat.com/security/cve/CVE-2017-1000450
https://nvd.nist.gov/vuln/detail/CVE-2017-1000450
https://github.com/blendin/pocs/blob/master/opencv/0.OOB_Write_FillUniColor
https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html
https://lists.debian.org/debian-lts-announce/2018/01/msg00008.html
https://security-tracker.debian.org/tracker/CVE-2017-1000450
https://www.mend.io/vulnerability-database/CVE-2017-1000450

Severity Score

Weakness Type (CWE)

Integer Overflow or Wraparound

CWE-190

Top Fix

icon

Upgrade Version

Upgrade to version 3.3.1-cvsdk

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): HIGH

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): MEDIUM
Authentication (AU): NONE
Confidentiality (C): PARTIAL
Integrity (I): PARTIAL
Availability (A): PARTIAL
Additional information:

Do you need more information?

Contact Us