CVE-2017-12601 Information

Description

OpenCV (Open Source Computer Vision Library) through 3.3 has a buffer overflow in the cv::BmpDecoder::readData function in modules/imgcodecs/src/grfmt_bmp.cpp when reading an image file by using cv::imread as demonstrated by the 4-buf-overflow-readData-memcpy test case.

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Reference

https://github.com/opencv/opencv/issues/9309 https://github.com/xiaoqx/pocs/blob/master/opencv.md https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html https://security.gentoo.org/glsa/201712-02

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

REQUIRED

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

8.8