CVE-2017-12863
Fixed in a distro release EPSS 3%
In opencv/modules/imgcodecs/src/grfmt_pxm.cpp, function PxMDecoder::readData has an integer overflow when calculate src_pitch. If the image is from remote, may lead to remote code execution or denial of service. This affects Opencv 3.3 and earlier.
Products: opencv, debian_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | opencv-contrib-python | 3.3.1.11 |
| PyPI | opencv-python | 3.3.1.11 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | opencv | 3.2.0+dfsg-6 |
| Debian 13 | opencv | 3.2.0+dfsg-6 |
| Debian 14 | opencv | 3.2.0+dfsg-6 |
| Debian 7 | opencv | 2.3.1-11+deb7u2 |
| Debian 8 | opencv | 2.4.9.1+dfsg-1+deb8u2 |
| Debian 9 | opencv | 2.4.9.1+dfsg1-2+deb9u1 |
| Ubuntu 16.04 LTS | opencv | 2.4.9.1+dfsg-1.5ubuntu1.1 |
| Ubuntu 18.04 LTS | opencv | 3.2.0+dfsg-4ubuntu0.1 |