CVE-2023-2617
published 2023-05-10CVE-2023-2617: A vulnerability classified as problematic was found in OpenCV wechat_qrcode Module up to 4.7.0. Affected by this vulnerability is the function…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.36%
68.5th percentile
A vulnerability classified as problematic was found in OpenCV wechat_qrcode Module up to 4.7.0. Affected by this vulnerability is the function DecodedBitStreamParser::decodeByteSegment of the file qrcode/decoder/decoded_bit_stream_parser.cpp. The manipulation leads to null pointer dereference. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-228547.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | opencv | < opencv 4.6.0+dfsg-12 (bookworm) | opencv 4.6.0+dfsg-12 (bookworm) |
| opencv | opencv | >= 0 < 4.6.0+dfsg-12 | 4.6.0+dfsg-12 |
| opencv | opencv | >= 0 < 4.6.0+dfsg-12 | 4.6.0+dfsg-12 |
| opencv | opencv | >= 0 < 4.6.0+dfsg-12 | 4.6.0+dfsg-12 |
| opencv | opencv | >= 0 < 3.2.0+dfsg-4ubuntu0.1+esm4 | 3.2.0+dfsg-4ubuntu0.1+esm4 |
| opencv | opencv | >= 0 < 4.5.4+dfsg-9ubuntu4+esm1 | 4.5.4+dfsg-9ubuntu4+esm1 |
| opencv | opencv | 4.5.2 – 4.7.0 | — |
| opencv | wechat_qrcode_module | — | — |
| opencv | wechat_qrcode_module | — | — |
| opencv | wechat_qrcode_module | — | — |
| opencv | wechat_qrcode_module | — | — |
| opencv | wechat_qrcode_module | — | — |
| opencv | wechat_qrcode_module | — | — |
| opencv | wechat_qrcode_module | — | — |
| opencv | wechat_qrcode_module | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_ubuntu7.5HIGH
vendor_debian5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
OpenCV vulnerabilities
vendor_ubuntu·2025-02-03·CVSS 7.5
CVE-2023-2618 [HIGH] OpenCV vulnerabilities
Title: OpenCV vulnerabilities
Summary: Several security issues were fixed in OpenCV.
It was discovered that OpenCV did not properly manage certain XML data,
leading to a NULL pointer dereference. If a user were tricked into
loading a specially crafted file, a remote attacker could possibly use
this issue to make OpenCV crash, resulting in a denial of service.
This issue only affected Ubuntu 18.04 LTS. (CVE-2019-14493)
It was discovered that OpenCV may perform out-of-bounds reads in certain
situations. An attacker could possibly use this issue to cause OpenCV to
crash, resulting in a denial of service, or the execution of arbitrary
code. This issue only affected Ubuntu 18.04 LTS.
(CVE-2019-16249, CVE-2019-19624)
It was discovered that the QR code module of OpenCV incorrectly processed
c
Red Hat
OpenCV: NULL pointer dereference in wechat_qrcode module
vendor_redhat·2023-05-10·CVSS 5.3
CVE-2023-2617 [MEDIUM] CWE-476 OpenCV: NULL pointer dereference in wechat_qrcode module
OpenCV: NULL pointer dereference in wechat_qrcode module
A vulnerability classified as problematic was found in OpenCV wechat_qrcode Module up to 4.7.0. Affected by this vulnerability is the function DecodedBitStreamParser::decodeByteSegment of the file qrcode/decoder/decoded_bit_stream_parser.cpp. The manipulation leads to null pointer dereference. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-228547.
Statement: The OpenCV packages as shipped with Red Hat Enterprise Linux 6, 7 and 8 versions are not affected by this issue as Red Hat doesn't ship wechat_qrcode module within opencv-contrib package.
Package: opencv (Red Hat Enter
Debian
CVE-2023-2617: opencv - A vulnerability classified as problematic was found in OpenCV wechat_qrcode Modu...
vendor_debian·2023·CVSS 5.3
CVE-2023-2617 [MEDIUM] CVE-2023-2617: opencv - A vulnerability classified as problematic was found in OpenCV wechat_qrcode Modu...
A vulnerability classified as problematic was found in OpenCV wechat_qrcode Module up to 4.7.0. Affected by this vulnerability is the function DecodedBitStreamParser::decodeByteSegment of the file qrcode/decoder/decoded_bit_stream_parser.cpp. The manipulation leads to null pointer dereference. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-228547.
Scope: local
bookworm: resolved (fixed in 4.6.0+dfsg-12)
bullseye: resolved
forky: resolved (fixed in 4.6.0+dfsg-12)
sid: resolved (fixed in 4.6.0+dfsg-12)
trixie: resolved (fixed in 4.6.0+dfsg-12)
OSV
opencv vulnerabilities
osv·2025-02-03·CVSS 7.5
CVE-2019-14493 [HIGH] opencv vulnerabilities
opencv vulnerabilities
It was discovered that OpenCV did not properly manage certain XML data,
leading to a NULL pointer dereference. If a user were tricked into
loading a specially crafted file, a remote attacker could possibly use
this issue to make OpenCV crash, resulting in a denial of service.
This issue only affected Ubuntu 18.04 LTS. (CVE-2019-14493)
It was discovered that OpenCV may perform out-of-bounds reads in certain
situations. An attacker could possibly use this issue to cause OpenCV to
crash, resulting in a denial of service, or the execution of arbitrary
code. This issue only affected Ubuntu 18.04 LTS.
(CVE-2019-16249, CVE-2019-19624)
It was discovered that the QR code module of OpenCV incorrectly processed
certain maliciously crafted QR codes. A remote attacker could po
OSV
CVE-2023-2617: A vulnerability classified as problematic was found in OpenCV wechat_qrcode Module up to 4
osv·2023-05-10·CVSS 7.5
CVE-2023-2617 [HIGH] CVE-2023-2617: A vulnerability classified as problematic was found in OpenCV wechat_qrcode Module up to 4
A vulnerability classified as problematic was found in OpenCV wechat_qrcode Module up to 4.7.0. Affected by this vulnerability is the function DecodedBitStreamParser::decodeByteSegment of the file qrcode/decoder/decoded_bit_stream_parser.cpp. The manipulation leads to null pointer dereference. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-228547.
GHSA
GHSA-3r96-chfr-mwjp: A vulnerability classified as problematic was found in OpenCV wechat_qrcode Module up to 4
ghsa_unreviewed·2023-05-10
CVE-2023-2617 [MEDIUM] CWE-476 GHSA-3r96-chfr-mwjp: A vulnerability classified as problematic was found in OpenCV wechat_qrcode Module up to 4
A vulnerability classified as problematic was found in OpenCV wechat_qrcode Module up to 4.7.0. Affected by this vulnerability is the function DecodedBitStreamParser::decodeByteSegment of the file qrcode/decoder/decoded_bit_stream_parser.cpp. The manipulation leads to null pointer dereference. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-228547.
No detection rules found.
No public exploits indexed.
https://gist.github.com/GZTimeWalker/3ca70a8af2f5830711e9cccc73fb5270https://github.com/opencv/opencv_contrib/pull/3480https://vuldb.com/?ctiid.228547https://vuldb.com/?id.228547https://gist.github.com/GZTimeWalker/3ca70a8af2f5830711e9cccc73fb5270https://github.com/opencv/opencv_contrib/pull/3480https://vuldb.com/?ctiid.228547https://vuldb.com/?id.228547https://github.com/opencv/opencv_contrib/pull/3480
2023-05-10
Published