CVE-2019-14491High· 8.2▾ TwilightOut-of-bounds Read in OpenCV
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0.5 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
2.6%
2.6% → 2.7%
Last analysed / modified upstream
An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1 (OpenCV-Python before 3.4.7.28 and 4.x before 4.1.1.26). There is an out of bounds read in the function cv::predictOrderedcv::HaarEvaluator in modules/objdetect/src/cascadedetect.hpp, which leads to denial of service.
opencv-python < 3.4.7.28opencv-python >= 4.0.0.21, < 4.1.1.26opencv-python-headless < 3.4.7.28opencv-python-headless >= 4.0.0.21, < 4.1.1.26opencv-contrib-python < 3.4.7.28opencv-contrib-python >= 4.0.0.21, < 4.1.1.26opencv-contrib-python-headless < 3.4.7.28opencv-contrib-python-headless >= 4.0.0.21, < 4.1.1.26Upgrade to a patched release:
opencv-python 3.4.7.28opencv-python 4.1.1.26opencv-python-headless 3.4.7.28opencv-python-headless 4.1.1.26opencv-contrib-python 3.4.7.28opencv-contrib-python 4.1.1.26opencv-contrib-python-headless 3.4.7.28opencv-contrib-python-headless 4.1.1.26Connected by shared product, vendor, weakness, or advisory.
CVE-2019-14492High· 7.5Out-of-bounds Read and Out-of-bounds Write in OpenCV
CVE-2019-14493High· 7.5NULL Pointer Dereference in OpenCV.
GHSA-qr4w-53vh-m672High· 8.8opencv-python bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863
CVE-2019-16249Medium· 5.3Out-of-bounds Read in OpenCV
CVE-2017-12863High· 8.8Integer Overflow or Wraparound in OpenCV
CVE-2017-12601High· 8.8Improper Restriction of Operations within the Bounds of a Memory Buffer in OpenCV