CVE-2023-2618 — Missing Release of Memory after Effective Lifetime in Opencv

CWE-401 — Missing Release of Memory after Effective Lifetime9 documents8 sources
Severity
7.5HIGHNVD
CNA5.3
EPSS
0.1%
top 79.22%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
OpencvOpencv Wechat Qrcode Module
Timeline
PublishedMay 10
Latest updateFeb 3

Description

A vulnerability, which was classified as problematic, has been found in OpenCV wechat_qrcode Module up to 4.7.0. Affected by this issue is the function DecodedBitStreamParser::decodeHanziSegment of the file qrcode/decoder/decoded_bit_stream_parser.cpp. The manipulation leads to memory leak. The attack may be launched remotely. The name of the patch is 2b62ff6181163eea029ed1cab11363b4996e9cd6. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-228548…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5opencv/wechat_qrcode_module8 versions+7
▶NVDopencv/opencv4.5.2 — 4.8.0
▶Debianopencv/opencv< 4.6.0+dfsg-12+2

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
CVEList
OpenCV wechat_qrcode Module decoded_bit_stream_parser.cpp decodeHanziSegment memory leak↗2023-05-10
▶
OSV
CVE-2023-2618: A vulnerability, which was classified as problematic, has been found in OpenCV wechat_qrcode Module up to 4↗2023-05-10
▶
GHSA
GHSA-v2pm-rv6h-9g9p: A vulnerability, which was classified as problematic, has been found in OpenCV wechat_qrcode Module up to 4↗2023-05-10
▶

📋Vendor Advisories

5
Ubuntu
OpenCV vulnerabilities↗2025-02-03
▶
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: Accessibility (OpenCV) — CVE-2023-2618↗2024-04-15
▶
Oracle
Oracle Oracle Enterprise Manager Risk Matrix: Load Testing for Web Apps (OpenCV) — CVE-2023-2618↗2024-01-15
▶
Red Hat
OpenCV: memory leak in wechat_qrcode module↗2023-05-10
▶
Debian
CVE-2023-2618: opencv - A vulnerability, which was classified as problematic, has been found in OpenCV w...↗2023
▶
CVE-2023-2618 — Opencv vulnerability | cvebase