Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
30 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
opencv-python versions before v4.8.1.78 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863. opencv-python v4.8.1.78 upgrades the bundled libwebp binary to v1.3.2.
Recommended action: Upgrade to 4.8.1.78 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
opencv-python versions before v4.8.1.78 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863. opencv-python v4.8.1.78 upgrades the bundled libwebp binary to v1.3.2.
Recommended action: Upgrade to 4.8.1.78 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In OpenCV 3.3.1 (corresponding with OpenCV-Python 3.3.1.11), a heap-based buffer overflow happens in cv::Jpeg2KDecoder::readComponent8u in modules/imgcodecs/src/grfmtjpeg2000.cpp when parsing a crafted image file.
Recommended action: Upgrade to 3.4.1.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, version 4.1.0 (corresponds with OpenCV-Python version 4.1.2.30). A specially crafted JSON file can cause a buffer overflow, resulting in multiple heap corruptions and potentially code execution. An attacker can provide a specially crafted file to trigger this vulnerability.
Recommended action: Upgrade to 4.2.0.32 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An out-of-bounds read was discovered in OpenCV before 4.1.1 (OpenCV-Python before 4.1.0.25). Specifically, variable coarsestscale is assumed to be greater than or equal to finestscale within the calc()/oclcalc() functions in disflow.cpp. However, this is not true when dealing with small images, leading to an out-of-bounds read of the heap-allocated arrays Ux and Uy.
Recommended action: Upgrade to 4.1.0.25 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenCV 4.1.1 has an out-of-bounds read in halbaseline::vload in core/hal/intrinsse.hpp when called from computeSSDMeanNorm in modules/video/src/disflow.cpp.
Recommended action: Upgrade to 4.1.2.30 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in OpenCV 4.1.0 (OpenCV-Python 4.1.0.25). There is a divide-by-zero error in cv::HOGDescriptor::getDescriptorSize in modules/objdetect/src/hog.cpp.
Recommended action: Upgrade to 4.1.1.26 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in OpenCV before 4.1.1 (OpenCV-Python before 4.1.1.26). There is a NULL pointer dereference in the function cv::XMLParser::parse at modules/core/src/persistence.cpp.
Recommended action: Upgrade to 4.1.1.26 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1 (OpenCV-Python before 3.4.7.28 and 4.x before 4.1.1.26). There is an out of bounds read/write in the function HaarEvaluator::OptFeature::calc in modules/objdetect/src/cascadedetect.hpp, which leads to denial of service.
Recommended action: Upgrade to 4.1.1.26 or 3.4.7.28 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1 (OpenCV-Python before 3.4.7.28 and 4.x before 4.1.1.26). There is an out of bounds read in the function cv::predictOrdered<cv::HaarEvaluator in modules/objdetect/src/cascadedetect.hpp, which leads to denial of service.
Recommended action: Upgrade to 4.1.1.26 or 3.4.7.28 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In OpenCV 3.3.1 (corresponds with OpenCV-Python 3.3.1.11), an assertion failure happens in cv::RBaseStream::setPos in modules/imgcodecs/src/bitstrm.cpp because of an incorrect integer cast.
Recommended action: Upgrade to 3.4.1.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In opencv/modules/imgcodecs/src/utils.cpp, functions FillUniColor and FillUniGray do not check the input length, which can lead to integer overflow. If the image is from remote, may lead to remote code execution or denial of service. This affects Opencv 3.3 (corresponding with OpenCV-Python 3.3.0.9) and earlier.
Recommended action: Upgrade to 3.3.1.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In OpenCV 3.3.1 (corresponding with OpenCV-Python 3.3.1.11), a heap-based buffer over-read exists in the function cv::HdrDecoder::checkSignature in modules/imgcodecs/src/grfmthdr.cpp.
Recommended action: Upgrade to 3.4.1.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenCV 3.3.1 (corresponding with opencv-python and opencv-contrib-python 3.3.1.11) has a Buffer Overflow in the cv::PxMDecoder::readData function in grfmtpxm.cpp, because an incorrect size value is used.
Recommended action: Upgrade to 3.4.0.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenCV (Open Source Computer Vision Library) 3.3 (corresponding to OpenCV-Python 3.3.0.9) has an out-of-bounds write error in the function FillColorRow1 in utils.cpp when reading an image file by using cv::imread. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12597.
Recommended action: Upgrade to 3.3.1.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In opencv/modules/imgcodecs/src/grfmtpxm.cpp, function ReadNumber did not checkout the input length, which lead to integer overflow. If the image is from remote, may lead to remote code execution or denial of service. This affects OpenCV 3.3 (corresponding with OpenCV-Python version 3.3.0.9) and earlier.
Recommended action: Upgrade to 3.3.1.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In opencv/modules/imgcodecs/src/grfmtpxm.cpp, function PxMDecoder::readData has an integer overflow when calculate srcpitch. If the image is from remote, may lead to remote code execution or denial of service. This affects OpenCV 3.3 (corresponding to OpenCV-Python 3.3.0.9) and earlier.
Recommended action: Upgrade to 3.3.1.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In modules/imgcodecs/src/grfmtpxm.cpp, the length of buffer AutoBuffer src is small than expected, which will cause copy buffer overflow later. If the image is from remote, may lead to remote code execution or denial of service. This affects OpenCV 3.3 (corresponding to OpenCV-Python 3.3.0.9) and earlier.
Recommended action: Upgrade to 3.3.1.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python and OpenCV-Contrib-Python 3.3.0.9) has an out-of-bounds write error in the function FillColorRow4 in utils.cpp when reading an image file by using cv::imread.
Recommended action: Upgrade to 3.3.1.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python and OpenCV-Contrib-Python 3.3.0.9) has an out-of-bounds write error in the FillColorRow8 function in utils.cpp when reading an image file by using cv::imread.
Recommended action: Upgrade to 3.3.1.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python and OpenCV-Contrib-Python 3.3.0.9) has an out-of-bounds write error in the FillUniColor function in utils.cpp when reading an image file by using cv::imread.
Recommended action: Upgrade to 3.3.1.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python and OpenCV-Contrib-Python 3.3.0.9) has an invalid write in the cv::RLByteStream::getBytes function in modules/imgcodecs/src/bitstrm.cpp when reading an image file by using cv::imread, as demonstrated by the 2-opencv-heapoverflow-fseek test case.
Recommended action: Upgrade to 3.3.1.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python 3.3.0.9) has a denial of service (memory consumption) issue, as demonstrated by the 10-opencv-dos-memory-exhaust test case.
Recommended action: Upgrade to 3.3.1.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python 3.3.0.9) has a buffer overflow in the cv::BmpDecoder::readData function in modules/imgcodecs/src/grfmtbmp.cpp when reading an image file by using cv::imread, as demonstrated by the 4-buf-overflow-readData-memcpy test case.
Recommended action: Upgrade to 3.3.1.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python 3.3.0.9) has a denial of service (CPU consumption) issue, as demonstrated by the 11-opencv-dos-cpu-exhaust test case.
Recommended action: Upgrade to 3.3.1.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.