CVE-2019-5064
Fixed in a distro release EPSS 11%CVSS 8.8
An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, before version 4.2.0. A specially crafted JSON file can cause a buffer overflow, resulting in multiple heap corruptions and potentially code execution. An attacker can provide a specially crafted file to trigger this vulnerability.
Products: opencv, oracle application_testing_suite, oracle big_data_spatial_and_graph, oracle enterprise_manager_base_platform
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | opencv-contrib-python | 4.2.0.32 |
| PyPI | opencv-contrib-python-headless | 4.2.0.32 |
| PyPI | opencv-python | 4.2.0.32 |
| PyPI | opencv-python-headless | 4.2.0.32 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | opencv | 4.2.0+dfsg-3 |
| Debian 13 | opencv | 4.2.0+dfsg-3 |
| Debian 14 | opencv | 4.2.0+dfsg-3 |