CVE-2023-2618
published 2023-05-10CVE-2023-2618: A vulnerability, which was classified as problematic, has been found in OpenCV wechat_qrcode Module up to 4.7.0. Affected by this issue is the function…
PriorityP337high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.30%
67.3th percentile
A vulnerability, which was classified as problematic, has been found in OpenCV wechat_qrcode Module up to 4.7.0. Affected by this issue is the function DecodedBitStreamParser::decodeHanziSegment of the file qrcode/decoder/decoded_bit_stream_parser.cpp. The manipulation leads to memory leak. The attack may be launched remotely. The name of the patch is 2b62ff6181163eea029ed1cab11363b4996e9cd6. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-228548.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | opencv | < opencv 4.6.0+dfsg-12 (bookworm) | opencv 4.6.0+dfsg-12 (bookworm) |
| opencv | opencv | >= 0 < 4.6.0+dfsg-12 | 4.6.0+dfsg-12 |
| opencv | opencv | >= 0 < 4.6.0+dfsg-12 | 4.6.0+dfsg-12 |
| opencv | opencv | >= 0 < 4.6.0+dfsg-12 | 4.6.0+dfsg-12 |
| opencv | opencv | >= 0 < 3.2.0+dfsg-4ubuntu0.1+esm4 | 3.2.0+dfsg-4ubuntu0.1+esm4 |
| opencv | opencv | >= 0 < 4.5.4+dfsg-9ubuntu4+esm1 | 4.5.4+dfsg-9ubuntu4+esm1 |
| opencv | opencv | >= 4.5.2 < 4.8.0 | 4.8.0 |
| opencv | wechat_qrcode_module | — | — |
| opencv | wechat_qrcode_module | — | — |
| opencv | wechat_qrcode_module | — | — |
| opencv | wechat_qrcode_module | — | — |
| opencv | wechat_qrcode_module | — | — |
| opencv | wechat_qrcode_module | — | — |
| opencv | wechat_qrcode_module | — | — |
| opencv | wechat_qrcode_module | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_oracle7.5MEDIUM
vendor_ubuntu7.5HIGH
vendor_debian5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
opencv vulnerabilities
osv·2025-02-03·CVSS 7.5
CVE-2019-14493 [HIGH] opencv vulnerabilities
opencv vulnerabilities
It was discovered that OpenCV did not properly manage certain XML data,
leading to a NULL pointer dereference. If a user were tricked into
loading a specially crafted file, a remote attacker could possibly use
this issue to make OpenCV crash, resulting in a denial of service.
This issue only affected Ubuntu 18.04 LTS. (CVE-2019-14493)
It was discovered that OpenCV may perform out-of-bounds reads in certain
situations. An attacker could possibly use this issue to cause OpenCV to
crash, resulting in a denial of service, or the execution of arbitrary
code. This issue only affected Ubuntu 18.04 LTS.
(CVE-2019-16249, CVE-2019-19624)
It was discovered that the QR code module of OpenCV incorrectly processed
certain maliciously crafted QR codes. A remote attacker could po
OSV
CVE-2023-2618: A vulnerability, which was classified as problematic, has been found in OpenCV wechat_qrcode Module up to 4
osv·2023-05-10·CVSS 7.5
CVE-2023-2618 [HIGH] CVE-2023-2618: A vulnerability, which was classified as problematic, has been found in OpenCV wechat_qrcode Module up to 4
A vulnerability, which was classified as problematic, has been found in OpenCV wechat_qrcode Module up to 4.7.0. Affected by this issue is the function DecodedBitStreamParser::decodeHanziSegment of the file qrcode/decoder/decoded_bit_stream_parser.cpp. The manipulation leads to memory leak. The attack may be launched remotely. The name of the patch is 2b62ff6181163eea029ed1cab11363b4996e9cd6. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-228548.
GHSA
GHSA-v2pm-rv6h-9g9p: A vulnerability, which was classified as problematic, has been found in OpenCV wechat_qrcode Module up to 4
ghsa_unreviewed·2023-05-10
CVE-2023-2618 [MEDIUM] CWE-401 GHSA-v2pm-rv6h-9g9p: A vulnerability, which was classified as problematic, has been found in OpenCV wechat_qrcode Module up to 4
A vulnerability, which was classified as problematic, has been found in OpenCV wechat_qrcode Module up to 4.7.0. Affected by this issue is the function DecodedBitStreamParser::decodeHanziSegment of the file qrcode/decoder/decoded_bit_stream_parser.cpp. The manipulation leads to memory leak. The attack may be launched remotely. The name of the patch is 2b62ff6181163eea029ed1cab11363b4996e9cd6. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-228548.
Ubuntu
OpenCV vulnerabilities
vendor_ubuntu·2025-02-03·CVSS 7.5
CVE-2023-2618 [HIGH] OpenCV vulnerabilities
Title: OpenCV vulnerabilities
Summary: Several security issues were fixed in OpenCV.
It was discovered that OpenCV did not properly manage certain XML data,
leading to a NULL pointer dereference. If a user were tricked into
loading a specially crafted file, a remote attacker could possibly use
this issue to make OpenCV crash, resulting in a denial of service.
This issue only affected Ubuntu 18.04 LTS. (CVE-2019-14493)
It was discovered that OpenCV may perform out-of-bounds reads in certain
situations. An attacker could possibly use this issue to cause OpenCV to
crash, resulting in a denial of service, or the execution of arbitrary
code. This issue only affected Ubuntu 18.04 LTS.
(CVE-2019-16249, CVE-2019-19624)
It was discovered that the QR code module of OpenCV incorrectly processed
c
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: Accessibility (OpenCV) — CVE-2023-2618
vendor_oracle·2024-04-15·CVSS 7.5
CVE-2023-2618 [MEDIUM] Oracle Oracle Financial Services Applications Risk Matrix: Accessibility (OpenCV) — CVE-2023-2618
Oracle Oracle Financial Services Applications Risk Matrix: Accessibility (OpenCV) vulnerability
CVE: CVE-2023-2618
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2024 (APR 2024)
Oracle
Oracle Oracle Enterprise Manager Risk Matrix: Load Testing for Web Apps (OpenCV) — CVE-2023-2618
vendor_oracle·2024-01-15·CVSS 7.5
CVE-2023-2618 [MEDIUM] Oracle Oracle Enterprise Manager Risk Matrix: Load Testing for Web Apps (OpenCV) — CVE-2023-2618
Oracle Oracle Enterprise Manager Risk Matrix: Load Testing for Web Apps (OpenCV) vulnerability
CVE: CVE-2023-2618
CVSS: 7.5
Protocol: TCP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2024 (JAN 2024)
Red Hat
OpenCV: memory leak in wechat_qrcode module
vendor_redhat·2023-05-10·CVSS 5.3
CVE-2023-2618 [MEDIUM] OpenCV: memory leak in wechat_qrcode module
OpenCV: memory leak in wechat_qrcode module
A vulnerability, which was classified as problematic, has been found in OpenCV wechat_qrcode Module up to 4.7.0. Affected by this issue is the function DecodedBitStreamParser::decodeHanziSegment of the file qrcode/decoder/decoded_bit_stream_parser.cpp. The manipulation leads to memory leak. The attack may be launched remotely. The name of the patch is 2b62ff6181163eea029ed1cab11363b4996e9cd6. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-228548.
Statement: The OpenCV packages as shipped with Red Hat Enterprise Linux 6, 7 and 8 versions are not affected by this issue as Red Hat doesn't ship wechat_qrcode module within opencv-contrib package.
Package: opencv (Red Hat Enterprise Linux 6) - Not a
Debian
CVE-2023-2618: opencv - A vulnerability, which was classified as problematic, has been found in OpenCV w...
vendor_debian·2023·CVSS 5.3
CVE-2023-2618 [MEDIUM] CVE-2023-2618: opencv - A vulnerability, which was classified as problematic, has been found in OpenCV w...
A vulnerability, which was classified as problematic, has been found in OpenCV wechat_qrcode Module up to 4.7.0. Affected by this issue is the function DecodedBitStreamParser::decodeHanziSegment of the file qrcode/decoder/decoded_bit_stream_parser.cpp. The manipulation leads to memory leak. The attack may be launched remotely. The name of the patch is 2b62ff6181163eea029ed1cab11363b4996e9cd6. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-228548.
Scope: local
bookworm: resolved (fixed in 4.6.0+dfsg-12)
bullseye: resolved
forky: resolved (fixed in 4.6.0+dfsg-12)
sid: resolved (fixed in 4.6.0+dfsg-12)
trixie: resolved (fixed in 4.6.0+dfsg-12)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/opencv/opencv_contrib/pull/3484https://github.com/opencv/opencv_contrib/pull/3484/commits/2b62ff6181163eea029ed1cab11363b4996e9cd6https://vuldb.com/?ctiid.228548https://vuldb.com/?id.228548https://github.com/opencv/opencv_contrib/pull/3484https://github.com/opencv/opencv_contrib/pull/3484/commits/2b62ff6181163eea029ed1cab11363b4996e9cd6https://vuldb.com/?ctiid.228548https://vuldb.com/?id.228548
2023-05-10
Published