CVE-2017-12597 (High) detected in opencv.net.3.3.1.nupkg

[mend-bolt-for-github]

CVE-2017-12597 - High Severity Vulnerability

Vulnerable Library - opencv.net.3.3.1.nupkg

A .NET interface for the popular OpenCV computer vision and image processing library.

Library home page: https://api.nuget.org/packages/opencv.net.3.3.1.nupkg

Path to dependency file: /NetFabric.Vision/src/NetFabric.Vision/NetFabric.Vision.csproj

Path to vulnerable library: /NetFabric.Vision/src/NetFabric.Vision/NetFabric.Vision.csproj

Dependency Hierarchy:

• ❌ opencv.net.3.3.1.nupkg (Vulnerable Library)

Found in HEAD commit: d1757d4b744ef49b8c5a9d943c8bc69fc6c237d7

Vulnerability Details

OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds write error in the function FillColorRow1 in utils.cpp when reading an image file by using cv::imread.

Publish Date: 2017-08-07

URL: CVE-2017-12597

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://security.gentoo.org/glsa/201712-02

Release Date: 2017-12-14

Fix Resolution: All OpenCV users should upgrade to the latest version >= opencv-2.4.13-r3

---

Step up your Open Source Security Game with WhiteSource here