CVE-2019-5064 — Classic Buffer Overflow in Opencv

CWE-120 — Classic Buffer OverflowCWE-787 — Out-of-bounds WriteCWE-122 — Heap-based Buffer Overflow11 documents8 sources
Severity
8.8HIGHNVD
EPSS
2.6%
top 14.27%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
OpencvOracle BIG Data Spatial AND GraphOracle Application Testing Suite+1 more
Timeline
PublishedJan 3
Latest updateOct 12

Description

An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, before version 4.2.0. A specially crafted JSON file can cause a buffer overflow, resulting in multiple heap corruptions and potentially code execution. An attacker can provide a specially crafted file to trigger this vulnerability.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages6 packages

▶NVDopencv/opencv4.0.0 — 4.2.0
▶Debianopencv/opencv< 4.2.0+dfsg-3+3
▶CVEListV5opencv/opencvOpenCV 4.1.0

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

4
OSV
Out-of-bounds Write in OpenCV↗2021-10-12
▶
GHSA
Out-of-bounds Write in OpenCV↗2021-10-12
▶
OSV
CVE-2019-5064: An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, before version 4↗2020-01-03
▶
CVEList
CVE-2019-5064: An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, before version 4↗2020-01-03
▶

📋Vendor Advisories

4
Oracle
Oracle Oracle Big Data Graph Risk Matrix: Big Data Graph (OpenCV) — CVE-2019-5064↗2021-07-15
▶
Oracle
Oracle Oracle Enterprise Manager Risk Matrix: Load Testing for Web Apps (OpenCV) — CVE-2019-5064↗2021-04-15
▶
Red Hat
opencv: Heap buffer overflow in persistence_json.cpp while parsing crafted JSON file↗2020-01-02
▶
Debian
CVE-2019-5064: opencv - An exploitable heap buffer overflow vulnerability exists in the data structure p...↗2019
▶

💬Community

2
Bugzilla
CVE-2019-5064 opencv: Heap buffer overflow in persistence_json.cpp while parsing crafted JSON file↗2020-01-11
▶
Bugzilla
CVE-2019-5064 opencv: Heap buffer overflow in persistence_json.cpp while parsing crafted JSON file [fedora-all]↗2020-01-11
▶
CVE-2019-5064 — Classic Buffer Overflow in Opencv | cvebase