search

snykiotcubedev / opencv-4.5.2

Apache License 2.0
0 stars 0 forks source link

CVE-2023-1999 (Medium) detected in opencv4.5.5 #56

Open mend-bolt-for-github[bot] opened 1 year ago

mend-bolt-for-github[bot] commented 1 year ago

CVE-2023-1999 - Medium Severity Vulnerability

Vulnerable Library - opencv4.5.5

Open Source Computer Vision Library

Library home page: https://github.com/opencv/opencv.git

Found in HEAD commit: 7669a0a8c21b0af9a1d641e5e76d43681bb5d0ab

Found in base branch: main

Vulnerable Source Files (3)

/3rdparty/libwebp/src/enc/alpha_enc.c /3rdparty/libwebp/src/enc/alpha_enc.c /3rdparty/libwebp/src/enc/alpha_enc.c

Vulnerability Details

There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free. 

Publish Date: 2023-06-20

URL: CVE-2023-1999

CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here