Vulnerability Details : CVE-2017-17760
OpenCV 3.3.1 has a Buffer Overflow in the cv::PxMDecoder::readData function in grfmt_pxm.cpp, because an incorrect size value is used.
Vulnerability category: Overflow
Products affected by CVE-2017-17760
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:a:opencv:opencv:3.3.1:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-17760
0.44%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 72 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-17760
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:N/A:P |
8.6
|
2.9
|
NIST | |
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
2.8
|
3.6
|
NIST |
CWE ids for CVE-2017-17760
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-17760
-
https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
[SECURITY] [DLA 2799-1] opencv security updateMailing List;Third Party Advisory
-
https://github.com/opencv/opencv/pull/10369/commits/7bbe1a53cfc097b82b1589f7915a2120de39274c
imgcodecs(pxm): fix memcpy size by alalek · Pull Request #10369 · opencv/opencv · GitHubIssue Tracking;Patch;Third Party Advisory
-
http://www.securityfocus.com/bid/102974
Google Android Multiple Qualcomm Components Multiple Security VulnerabilitiesThird Party Advisory;VDB Entry
-
https://github.com/opencv/opencv/issues/10351
Buffer overflow in grfmt_pxm.cpp::PxMDecoder::readData · Issue #10351 · opencv/opencv · GitHubIssue Tracking;Third Party Advisory
-
https://lists.debian.org/debian-lts-announce/2018/01/msg00008.html
[SECURITY] [DLA 1235-1] opencv security updateMailing List;Third Party Advisory
-
https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html
[SECURITY] [DLA 1438-1] opencv security updateMailing List;Third Party Advisory
Jump to