CVE-2017-18009 - opencv: heap-based buffer over-read in function cv::HdrDecoder::checkSignature in modules/imgcodecs/src/grfmt_hdr.cpp

HIGH

opencv: heap-based buffer over-read in function cv::HdrDecoder::checkSignature in modules/imgcodecs/src/grfmt_hdr.cpp

Published Jan 1, 2018

7.5

HIGH

CVSS 3.0

EPSS 2.33%

In OpenCV 3.3.1, a heap-based buffer over-read exists in the function cv::HdrDecoder::checkSignature in modules/imgcodecs/src/grfmt_hdr.cpp.

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	opencv	Not affected	n/a
Red Hat Enterprise Linux 7	opencv	Not affected	n/a
Red Hat Enterprise Linux 8	opencv	Not affected	n/a

Red Hat statement

This issue did not affect the versions of opencv as shipped with Red Hat Enterprise Linux 6, 7, and 8.

Weaknesses (1)

CWE-125

Out-of-bounds Read

Link	Providers	Tags
http://www.securityfocus.com/bid/106945		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://access.redhat.com/security/cve/CVE-2017-18009		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1531268		Issue Tracking
https://github.com/advisories/GHSA-83rh-hx5x-q9p5		Advisory
https://github.com/opencv/opencv/issues/10479		x_refsource_MISCIssue TrackingThird Party Advisory
https://github.com/opencv/opencv/pull/10480/commits/4ca89db22dea962690f31c1781bce5937ee91837
https://nvd.nist.gov/vuln/detail/CVE-2017-18009
https://www.cve.org/CVERecord?id=CVE-2017-18009