CVE-2019-14491
Fixed in a distro release EPSS 3%
An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1. There is an out of bounds read in the function cv::predictOrdered<cv::HaarEvaluator> in modules/objdetect/src/cascadedetect.hpp, which leads to denial of service.
Products: opencv
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | opencv-contrib-python | 3.4.7.28 |
| PyPI | opencv-contrib-python | 4.1.1.26 |
| PyPI | opencv-contrib-python-headless | 3.4.7.28 |
| PyPI | opencv-contrib-python-headless | 4.1.1.26 |
| PyPI | opencv-python | 3.4.7.28 |
| PyPI | opencv-python | 4.1.1.26 |
| PyPI | opencv-python-headless | 3.4.7.28 |
| PyPI | opencv-python-headless | 4.1.1.26 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | opencv | 4.1.2+dfsg-3 |
| Debian 13 | opencv | 4.1.2+dfsg-3 |
| Debian 14 | opencv | 4.1.2+dfsg-3 |
| SUSE Linux Enterprise Module for Package Hub 15 | opencv | 3.3.1-6.6.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP1 | opencv | 3.3.1-6.6.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP2 | opencv | 3.3.1-6.6.1 |
| SUSE Linux Enterprise Workstation Extension 15 | opencv | 3.3.1-6.6.1 |
| SUSE Linux Enterprise Workstation Extension 15 SP1 | opencv | 3.3.1-6.6.1 |
| SUSE Linux Enterprise Workstation Extension 15 SP2 | opencv | 3.3.1-6.6.1 |
| Ubuntu Pro 14.04 LTS | opencv | no fix |
| Ubuntu Pro 14.04 LTS | opencv | 2.4.8+dfsg1-2ubuntu1.2+esm1 |
| Ubuntu Pro 16.04 LTS | opencv | no fix |
| Ubuntu Pro 16.04 LTS | opencv | 2.4.9.1+dfsg-1.5ubuntu1.1+esm1 |
| Ubuntu Pro 18.04 LTS | opencv | 3.2.0+dfsg-4ubuntu0.1+esm2 |
| Ubuntu Pro 18.04 LTS | opencv | 3.2.0+dfsg-4ubuntu0.1+esm3 |
| openSUSE Leap 15.1 | opencv | 3.3.1-lp151.6.3.1 |
| openSUSE Tumbleweed | opencv | 4.5.2-2.2 |
| openSUSE Tumbleweed | opencv3 | 3.4.10-3.3 |