Bugzilla – Bug 1160255
VUL-0: CVE-2019-5063, CVE-2019-5064: opencv: heap buffer overflow via a specially crafted XML file in the data structure persistence functionality
Last modified: 2020-07-03 11:41:06 UTC
CVE-2019-5063 An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV 4.1.0. A specially crafted XML file can cause a buffer overflow, resulting in multiple heap corruptions and potential code execution. An attacker can provide a specially crafted file to trigger this vulnerability. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-5063 http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-5063.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5063 https://talosintelligence.com/vulnerability_reports/TALOS-2019-0852
Versions of 3.X and older are not affected. Only TW is affected. The fix is available at [0]. Please upgrade to 4.2.0 [1]. [0] https://github.com/opencv/opencv/pull/15868 [1] https://github.com/opencv/opencv/releases/tag/4.2.0
(In reply to Alexandros Toptsoglou from comment #1) > Versions of 3.X and older are not affected. > Only TW is affected. The fix is available at [0]. > Please upgrade to 4.2.0 [1]. TW is now at 4.2.0 so this should be done.
Done