CVE-2018-7712

Published: Mar 5, 2018Modified: Nov 21, 2024

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The validateInputImageSize function in modules/imgcodecs/src/loadsave.cpp in OpenCV 3.4.1 allows remote attackers to cause a denial of service (assertion failure) because (size.height <= (1<<20)) may be false. Note: “OpenCV CV_Assert is not an assertion (C-like assert()), it is regular C++ exception which can raised in case of invalid or non-supported parameters.

Affected (1)

Products: Opencv: Opencv

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Opencv Opencv	Version 3.4.1

Related CWEs

Reachable Assertion

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

References (4)

https://github.com/opencv/opencv/issues/10998

Source: cve@mitre.org

https://github.com/xiaoqx/pocs/tree/master/opencv/dos-by-assert

Source: cve@mitre.org

Third Party Advisory

https://github.com/opencv/opencv/issues/10998

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/xiaoqx/pocs/tree/master/opencv/dos-by-assert

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.