CVE-2019-14491
CVE-2019-14491
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1. There is an out of bounds read in the function cv::predictOrdered<cv::HaarEvaluator> in modules/objdetect/src/cascadedetect.hpp, which leads to denial of service.
CVSS 8.2 · High · EPSS 2.9% · Fix available
- Published
- Updated
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
opencv Debian:12
- Affected ranges
- ECOSYSTEM: < 4.1.2+dfsg-3
Update to 4.1.2+dfsg-3
opencv Debian:13
- Affected ranges
- ECOSYSTEM: < 4.1.2+dfsg-3
Update to 4.1.2+dfsg-3
opencv Debian:14
- Affected ranges
- ECOSYSTEM: < 4.1.2+dfsg-3
Update to 4.1.2+dfsg-3
opencv-python PyPI
- Versions
- 3.4.0.14
- 3.4.1.15
- 3.4.2.17
- 3.4.3.18
- 3.4.4.19
- 3.4.5.20
- 3.4.6.27
- Affected ranges
- ECOSYSTEM: < 3.4.7.28
Update to 3.4.7.28
opencv-python PyPI
- Versions
- 4.0.0.21
- 4.0.1.23
- 4.0.1.24
- 4.1.0.25
- Affected ranges
- ECOSYSTEM: ≥ 4.0.0.21, < 4.1.1.26
Update to 4.1.1.26
opencv-python-headless PyPI
- Versions
- 3.4.3.18
- 3.4.4.19
- 3.4.5.20
- 3.4.6.27
- Affected ranges
- ECOSYSTEM: < 3.4.7.28
Update to 3.4.7.28
opencv-python-headless PyPI
- Versions
- 4.0.0.21
- 4.0.1.24
- 4.1.0.25
- Affected ranges
- ECOSYSTEM: ≥ 4.0.0.21, < 4.1.1.26
Update to 4.1.1.26
opencv-contrib-python PyPI
- Versions
- 3.4.2.17
- 3.4.3.18
- 3.4.4.19
- 3.4.5.20
- 3.4.6.27
- Affected ranges
- ECOSYSTEM: < 3.4.7.28
Update to 3.4.7.28
opencv-contrib-python PyPI
- Versions
- 4.0.0.21
- 4.0.1.23
- 4.0.1.24
- 4.1.0.25
- Affected ranges
- ECOSYSTEM: ≥ 4.0.0.21, < 4.1.1.26
Update to 4.1.1.26
opencv-contrib-python-headless PyPI
- Versions
- 3.4.0.14
- 3.4.2.17
- 3.4.3.18
- 3.4.4.19
- 3.4.5.20
- 3.4.6.27
- Affected ranges
- ECOSYSTEM: < 3.4.7.28
Update to 3.4.7.28
opencv-contrib-python-headless PyPI
- Versions
- 4.0.0.21
- 4.0.1.23
- 4.0.1.24
- 4.1.0.25
- Affected ranges
- ECOSYSTEM: ≥ 4.0.0.21, < 4.1.1.26
Update to 4.1.1.26
opencv-contrib-python PyPI
- Versions
- 3.4.2.17
- 3.4.3.18
- 3.4.4.19
- 3.4.5.20
- 3.4.6.27
- 4.0.0.21
- 4.0.1.23
- 4.0.1.24
- 4.1.0.25
- Affected ranges
- ECOSYSTEM: < 3.4.7.28 ∪ ≥ 4.0.0.21, < 4.1.1.26
Update to 3.4.7.28; Update to 4.1.1.26
opencv-python PyPI
- Versions
- 3.4.0.14
- 3.4.1.15
- 3.4.2.16
- 3.4.2.17
- 3.4.3.18
- 3.4.4.19
- 3.4.5.20
- 3.4.6.27
- 4.0.0.21
- 4.0.1.23
- 4.0.1.24
- 4.1.0.25
- Affected ranges
- ECOSYSTEM: < 3.4.7.28 ∪ ≥ 4.0.0.21, < 4.1.1.26
Update to 3.4.7.28; Update to 4.1.1.26
opencv-python-headless PyPI
- Versions
- 3.4.3.18
- 3.4.4.19
- 3.4.5.20
- 3.4.6.27
- 4.0.0.21
- 4.0.1.24
- 4.1.0.25
- Affected ranges
- ECOSYSTEM: < 3.4.7.28 ∪ ≥ 4.0.0.21, < 4.1.1.26
Update to 3.4.7.28; Update to 4.1.1.26
opencv-contrib-python-headless PyPI
- Versions
- 3.4.0.14
- 3.4.1.15
- 3.4.2.17
- 3.4.3.18
- 3.4.4.19
- 3.4.5.20
- 3.4.6.27
- 4.0.0.21
- 4.0.1.23
- 4.0.1.24
- 4.1.0.25
- Affected ranges
- ECOSYSTEM: < 3.4.7.28 ∪ ≥ 4.0.0.21, < 4.1.1.26
Update to 3.4.7.28; Update to 4.1.1.26
opencv Ubuntu:Pro:14.04:LTS
- Versions
- 2.4.5+dfsg-0ubuntu4
- 2.4.5+dfsg-0ubuntu5
- 2.4.6.1+dfsg-2ubuntu2
- 2.4.6.1+dfsg-2ubuntu3
- 2.4.6.1+dfsg-2ubuntu4
- 2.4.6.1+dfsg-2ubuntu5
- 2.4.8+dfsg-1ubuntu1
- 2.4.8+dfsg1-2ubuntu1
- 2.4.8+dfsg1-2ubuntu1.2
- 2.4.8+dfsg1-2ubuntu1.2+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
opencv Ubuntu:Pro:16.04:LTS
- Versions
- 2.4.9+dfsg-1ubuntu6
- 2.4.9.1+dfsg-1.2ubuntu1
- 2.4.9.1+dfsg-1.3ubuntu1
- 2.4.9.1+dfsg-1.5ubuntu1
- 2.4.9.1+dfsg-1.5ubuntu1.1
- 2.4.9.1+dfsg-1.5ubuntu1.1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
opencv Ubuntu:Pro:18.04:LTS
- Versions
- 3.1.0+dfsg1-1~exp1ubuntu3
- 3.2.0+dfsg-3
- 3.2.0+dfsg-4
- 3.2.0+dfsg-4build1
- 3.2.0+dfsg-4build2
- 3.2.0+dfsg-4ubuntu0.1
- Affected ranges
- ECOSYSTEM: < 3.2.0+dfsg-4ubuntu0.1+esm2
Update to 3.2.0+dfsg-4ubuntu0.1+esm2
Original sources
- https://github.com/opencv/opencv/issues/15125
- https://github.com/opencv/opencv/compare/33b765d...4a7ca5a
- https://github.com/opencv/opencv/compare/371bba8...ddbd10c
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPFLN6QAX6SUA4XR4NMKKXX26H3TYCVQ/
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00025.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-14491