Vulnerabilities > CVE-2017-1000450 - Integer Overflow or Wraparound vulnerability in multiple products
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
In opencv/modules/imgcodecs/src/utils.cpp, functions FillUniColor and FillUniGray do not check the input length, which can lead to integer overflow. If the image is from remote, may lead to remote code execution or denial of service. This affects Opencv 3.3 and earlier.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Forced Integer Overflow This attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out of range. For instance the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value which can lead to unexpected behavior. At worst the attacker can execute arbitrary code.
Nessus
NASL family Fedora Local Security Checks NASL id FEDORA_2018-AC348A00EF.NASL description Security fix for CVE-2017-17760 and CVE-2017-1000450 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-05 modified 2018-05-04 plugin id 109564 published 2018-05-04 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/109564 title Fedora 26 : opencv (2018-ac348a00ef) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Fedora Security Advisory FEDORA-2018-ac348a00ef. # include("compat.inc"); if (description) { script_id(109564); script_version("1.3"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04"); script_cve_id("CVE-2017-1000450", "CVE-2017-17760"); script_xref(name:"FEDORA", value:"2018-ac348a00ef"); script_name(english:"Fedora 26 : opencv (2018-ac348a00ef)"); script_summary(english:"Checks rpm output for the updated package."); script_set_attribute( attribute:"synopsis", value:"The remote Fedora host is missing a security update." ); script_set_attribute( attribute:"description", value: "Security fix for CVE-2017-17760 and CVE-2017-1000450 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://bodhi.fedoraproject.org/updates/FEDORA-2018-ac348a00ef" ); script_set_attribute( attribute:"solution", value:"Update the affected opencv package." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:opencv"); script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:26"); script_set_attribute(attribute:"vuln_publication_date", value:"2017/12/29"); script_set_attribute(attribute:"patch_publication_date", value:"2018/05/03"); script_set_attribute(attribute:"plugin_publication_date", value:"2018/05/04"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Fedora Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora"); os_ver = pregmatch(pattern: "Fedora.*release ([0-9]+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora"); os_ver = os_ver[1]; if (! preg(pattern:"^26([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 26", "Fedora " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu); flag = 0; if (rpm_check(release:"FC26", reference:"opencv-3.2.0-15.fc26")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : rpm_report_get() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "opencv"); }NASL family Fedora Local Security Checks NASL id FEDORA_2018-825D37B810.NASL description Security fix for CVE-2017-17760 and CVE-2017-1000450 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-05 modified 2018-05-04 plugin id 109562 published 2018-05-04 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/109562 title Fedora 27 : opencv (2018-825d37b810) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Fedora Security Advisory FEDORA-2018-825d37b810. # include("compat.inc"); if (description) { script_id(109562); script_version("1.3"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04"); script_cve_id("CVE-2017-1000450", "CVE-2017-17760"); script_xref(name:"FEDORA", value:"2018-825d37b810"); script_name(english:"Fedora 27 : opencv (2018-825d37b810)"); script_summary(english:"Checks rpm output for the updated package."); script_set_attribute( attribute:"synopsis", value:"The remote Fedora host is missing a security update." ); script_set_attribute( attribute:"description", value: "Security fix for CVE-2017-17760 and CVE-2017-1000450 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://bodhi.fedoraproject.org/updates/FEDORA-2018-825d37b810" ); script_set_attribute( attribute:"solution", value:"Update the affected opencv package." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:opencv"); script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:27"); script_set_attribute(attribute:"vuln_publication_date", value:"2017/12/29"); script_set_attribute(attribute:"patch_publication_date", value:"2018/05/03"); script_set_attribute(attribute:"plugin_publication_date", value:"2018/05/04"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Fedora Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora"); os_ver = pregmatch(pattern: "Fedora.*release ([0-9]+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora"); os_ver = os_ver[1]; if (! preg(pattern:"^27([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 27", "Fedora " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu); flag = 0; if (rpm_check(release:"FC27", reference:"opencv-3.2.0-15.fc27")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : rpm_report_get() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "opencv"); }NASL family SuSE Local Security Checks NASL id OPENSUSE-2018-534.NASL description This update for opencv fixes the following issues : - CVE-2018-5268: Fixed a heap-based buffer overflow in incv::Jpeg2KDecoder::readComponent8u in modules/imgcodecs/src/grfmt_jpeg2000.cppwhen parsing a crafted image file. (boo#1075017) - CVE-2017-17760: Fixed an buffer overflow in function cv::PxMDecoder::readData (boo#1074313) - CVE-2017-18009: Fixed a heap-based buffer over-read in function cv::HdrDecoder::checkSignature (boo#1074312) - CVE-2017-1000450: Functions FillUniColor and FillUniGray do not check the input length which could lead to out of bounds writes and crashes (boo#1074487) - CVE-2018-5269: Fixed an assertion failure happens in cv::RBaseStream::setPos inmodules/imgcodecs/src/bitstrm.cpp because of an incorrect integer cast (bsc#1075019). last seen 2020-06-05 modified 2018-05-29 plugin id 110181 published 2018-05-29 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/110181 title openSUSE Security Update : opencv (openSUSE-2018-534) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from openSUSE Security Update openSUSE-2018-534. # # The text description of this plugin is (C) SUSE LLC. # include("compat.inc"); if (description) { script_id(110181); script_version("1.2"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04"); script_cve_id("CVE-2017-1000450", "CVE-2017-17760", "CVE-2017-18009", "CVE-2018-5268", "CVE-2018-5269"); script_name(english:"openSUSE Security Update : opencv (openSUSE-2018-534)"); script_summary(english:"Check for the openSUSE-2018-534 patch"); script_set_attribute( attribute:"synopsis", value:"The remote openSUSE host is missing a security update." ); script_set_attribute( attribute:"description", value: "This update for opencv fixes the following issues : - CVE-2018-5268: Fixed a heap-based buffer overflow in incv::Jpeg2KDecoder::readComponent8u in modules/imgcodecs/src/grfmt_jpeg2000.cppwhen parsing a crafted image file. (boo#1075017) - CVE-2017-17760: Fixed an buffer overflow in function cv::PxMDecoder::readData (boo#1074313) - CVE-2017-18009: Fixed a heap-based buffer over-read in function cv::HdrDecoder::checkSignature (boo#1074312) - CVE-2017-1000450: Functions FillUniColor and FillUniGray do not check the input length which could lead to out of bounds writes and crashes (boo#1074487) - CVE-2018-5269: Fixed an assertion failure happens in cv::RBaseStream::setPos inmodules/imgcodecs/src/bitstrm.cpp because of an incorrect integer cast (bsc#1075019)." ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1074312" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1074313" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1074487" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1075017" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1075019" ); script_set_attribute( attribute:"solution", value:"Update the affected opencv packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libopencv-qt56_3"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libopencv-qt56_3-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libopencv3_1"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libopencv3_1-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:opencv"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:opencv-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:opencv-debugsource"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:opencv-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:opencv-qt5"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:opencv-qt5-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:opencv-qt5-debugsource"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:opencv-qt5-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-opencv"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-opencv-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-opencv-qt5"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-opencv-qt5-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python3-opencv"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python3-opencv-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python3-opencv-qt5"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python3-opencv-qt5-debuginfo"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:42.3"); script_set_attribute(attribute:"patch_publication_date", value:"2018/05/28"); script_set_attribute(attribute:"plugin_publication_date", value:"2018/05/29"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE"); if (release !~ "^(SUSE42\.3)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "42.3", release); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); ourarch = get_kb_item("Host/cpu"); if (!ourarch) audit(AUDIT_UNKNOWN_ARCH); if (ourarch !~ "^(x86_64)$") audit(AUDIT_ARCH_NOT, "x86_64", ourarch); flag = 0; if ( rpm_check(release:"SUSE42.3", reference:"libopencv-qt56_3-3.1.0-4.11.1") ) flag++; if ( rpm_check(release:"SUSE42.3", reference:"libopencv-qt56_3-debuginfo-3.1.0-4.11.1") ) flag++; if ( rpm_check(release:"SUSE42.3", reference:"libopencv3_1-3.1.0-4.11.1") ) flag++; if ( rpm_check(release:"SUSE42.3", reference:"libopencv3_1-debuginfo-3.1.0-4.11.1") ) flag++; if ( rpm_check(release:"SUSE42.3", reference:"opencv-3.1.0-4.11.1") ) flag++; if ( rpm_check(release:"SUSE42.3", reference:"opencv-debuginfo-3.1.0-4.11.1") ) flag++; if ( rpm_check(release:"SUSE42.3", reference:"opencv-debugsource-3.1.0-4.11.1") ) flag++; if ( rpm_check(release:"SUSE42.3", reference:"opencv-devel-3.1.0-4.11.1") ) flag++; if ( rpm_check(release:"SUSE42.3", reference:"opencv-qt5-3.1.0-4.11.1") ) flag++; if ( rpm_check(release:"SUSE42.3", reference:"opencv-qt5-debuginfo-3.1.0-4.11.1") ) flag++; if ( rpm_check(release:"SUSE42.3", reference:"opencv-qt5-debugsource-3.1.0-4.11.1") ) flag++; if ( rpm_check(release:"SUSE42.3", reference:"opencv-qt5-devel-3.1.0-4.11.1") ) flag++; if ( rpm_check(release:"SUSE42.3", reference:"python-opencv-3.1.0-4.11.1") ) flag++; if ( rpm_check(release:"SUSE42.3", reference:"python-opencv-debuginfo-3.1.0-4.11.1") ) flag++; if ( rpm_check(release:"SUSE42.3", reference:"python-opencv-qt5-3.1.0-4.11.1") ) flag++; if ( rpm_check(release:"SUSE42.3", reference:"python-opencv-qt5-debuginfo-3.1.0-4.11.1") ) flag++; if ( rpm_check(release:"SUSE42.3", reference:"python3-opencv-3.1.0-4.11.1") ) flag++; if ( rpm_check(release:"SUSE42.3", reference:"python3-opencv-debuginfo-3.1.0-4.11.1") ) flag++; if ( rpm_check(release:"SUSE42.3", reference:"python3-opencv-qt5-3.1.0-4.11.1") ) flag++; if ( rpm_check(release:"SUSE42.3", reference:"python3-opencv-qt5-debuginfo-3.1.0-4.11.1") ) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libopencv-qt56_3 / libopencv-qt56_3-debuginfo / opencv-qt5 / etc"); }NASL family Debian Local Security Checks NASL id DEBIAN_DLA-1438.NASL description Early versions of opencv have problems while reading data, which might result in either buffer overflows, out-of bounds errors or integer overflows. Further assertion errors might happen due to incorrect integer cast. For Debian 8 last seen 2020-06-01 modified 2020-06-02 plugin id 111223 published 2018-07-23 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/111223 title Debian DLA-1438-1 : opencv security update code # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Debian Security Advisory DLA-1438-1. The text # itself is copyright (C) Software in the Public Interest, Inc. # include("compat.inc"); if (description) { script_id(111223); script_version("1.3"); script_cvs_date("Date: 2019/07/15 14:20:30"); script_cve_id("CVE-2016-1516", "CVE-2017-1000450", "CVE-2017-12597", "CVE-2017-12598", "CVE-2017-12599", "CVE-2017-12601", "CVE-2017-12603", "CVE-2017-12604", "CVE-2017-12605", "CVE-2017-12606", "CVE-2017-12862", "CVE-2017-12863", "CVE-2017-12864", "CVE-2017-14136", "CVE-2017-17760", "CVE-2018-5268", "CVE-2018-5269"); script_name(english:"Debian DLA-1438-1 : opencv security update"); script_summary(english:"Checks dpkg output for the updated packages."); script_set_attribute( attribute:"synopsis", value:"The remote Debian host is missing a security update." ); script_set_attribute( attribute:"description", value: "Early versions of opencv have problems while reading data, which might result in either buffer overflows, out-of bounds errors or integer overflows. Further assertion errors might happen due to incorrect integer cast. For Debian 8 'Jessie', these problems have been fixed in version 2.4.9.1+dfsg-1+deb8u2. We recommend that you upgrade your opencv packages. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html" ); script_set_attribute( attribute:"see_also", value:"https://packages.debian.org/source/jessie/opencv" ); script_set_attribute(attribute:"solution", value:"Upgrade the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:U/RC:UC"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:U/RC:U"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libcv-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libcv2.4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libcvaux-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libcvaux2.4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libhighgui-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libhighgui2.4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-calib3d-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-calib3d2.4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-contrib-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-contrib2.4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-core-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-core2.4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-features2d-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-features2d2.4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-flann-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-flann2.4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-gpu-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-gpu2.4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-highgui-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-highgui2.4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-imgproc-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-imgproc2.4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-legacy-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-legacy2.4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-ml-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-ml2.4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-objdetect-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-objdetect2.4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-ocl-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-ocl2.4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-photo-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-photo2.4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-stitching-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-stitching2.4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-superres-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-superres2.4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-ts-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-ts2.4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-video-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-video2.4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-videostab-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-videostab2.4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv2.4-java"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv2.4-jni"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:opencv-data"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:opencv-doc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:python-opencv"); script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:8.0"); script_set_attribute(attribute:"vuln_publication_date", value:"2017/04/10"); script_set_attribute(attribute:"patch_publication_date", value:"2018/07/22"); script_set_attribute(attribute:"plugin_publication_date", value:"2018/07/23"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Debian Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l"); exit(0); } include("audit.inc"); include("debian_package.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian"); if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (deb_check(release:"8.0", prefix:"libcv-dev", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libcv2.4", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libcvaux-dev", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libcvaux2.4", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libhighgui-dev", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libhighgui2.4", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv-calib3d-dev", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv-calib3d2.4", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv-contrib-dev", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv-contrib2.4", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv-core-dev", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv-core2.4", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv-dev", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv-features2d-dev", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv-features2d2.4", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv-flann-dev", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv-flann2.4", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv-gpu-dev", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv-gpu2.4", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv-highgui-dev", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv-highgui2.4", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv-imgproc-dev", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv-imgproc2.4", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv-legacy-dev", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv-legacy2.4", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv-ml-dev", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv-ml2.4", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv-objdetect-dev", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv-objdetect2.4", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv-ocl-dev", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv-ocl2.4", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv-photo-dev", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv-photo2.4", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv-stitching-dev", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv-stitching2.4", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv-superres-dev", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv-superres2.4", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv-ts-dev", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv-ts2.4", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv-video-dev", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv-video2.4", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv-videostab-dev", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv-videostab2.4", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv2.4-java", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"libopencv2.4-jni", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"opencv-data", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"opencv-doc", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (deb_check(release:"8.0", prefix:"python-opencv", reference:"2.4.9.1+dfsg-1+deb8u2")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get()); else security_warning(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");NASL family Debian Local Security Checks NASL id DEBIAN_DLA-1235.NASL description Opencv 3.3 and earlier has problems while reading data, which might result in either buffer overflows or integer overflows. For Debian 7 last seen 2020-03-17 modified 2018-01-09 plugin id 105662 published 2018-01-09 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/105662 title Debian DLA-1235-1 : opencv security update code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Debian Security Advisory DLA-1235-1. The text # itself is copyright (C) Software in the Public Interest, Inc. # include("compat.inc"); if (description) { script_id(105662); script_version("3.7"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12"); script_cve_id("CVE-2017-1000450", "CVE-2017-17760"); script_name(english:"Debian DLA-1235-1 : opencv security update"); script_summary(english:"Checks dpkg output for the updated packages."); script_set_attribute( attribute:"synopsis", value:"The remote Debian host is missing a security update." ); script_set_attribute( attribute:"description", value: "Opencv 3.3 and earlier has problems while reading data, which might result in either buffer overflows or integer overflows. For Debian 7 'Wheezy', these problems have been fixed in version 2.3.1-11+deb7u3. We recommend that you upgrade your opencv packages. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://lists.debian.org/debian-lts-announce/2018/01/msg00008.html" ); script_set_attribute( attribute:"see_also", value:"https://packages.debian.org/source/wheezy/opencv" ); script_set_attribute(attribute:"solution", value:"Upgrade the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libcv-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libcv2.3"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libcvaux-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libcvaux2.3"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libhighgui-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libhighgui2.3"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-calib3d-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-calib3d2.3"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-contrib-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-contrib2.3"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-core-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-core2.3"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-features2d-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-features2d2.3"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-flann-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-flann2.3"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-gpu-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-gpu2.3"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-highgui-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-highgui2.3"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-imgproc-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-imgproc2.3"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-legacy-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-legacy2.3"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-ml-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-ml2.3"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-objdetect-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-objdetect2.3"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-video-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libopencv-video2.3"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:opencv-doc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:python-opencv"); script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:7.0"); script_set_attribute(attribute:"patch_publication_date", value:"2018/01/08"); script_set_attribute(attribute:"plugin_publication_date", value:"2018/01/09"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Debian Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l"); exit(0); } include("audit.inc"); include("debian_package.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian"); if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (deb_check(release:"7.0", prefix:"libcv-dev", reference:"2.3.1-11+deb7u3")) flag++; if (deb_check(release:"7.0", prefix:"libcv2.3", reference:"2.3.1-11+deb7u3")) flag++; if (deb_check(release:"7.0", prefix:"libcvaux-dev", reference:"2.3.1-11+deb7u3")) flag++; if (deb_check(release:"7.0", prefix:"libcvaux2.3", reference:"2.3.1-11+deb7u3")) flag++; if (deb_check(release:"7.0", prefix:"libhighgui-dev", reference:"2.3.1-11+deb7u3")) flag++; if (deb_check(release:"7.0", prefix:"libhighgui2.3", reference:"2.3.1-11+deb7u3")) flag++; if (deb_check(release:"7.0", prefix:"libopencv-calib3d-dev", reference:"2.3.1-11+deb7u3")) flag++; if (deb_check(release:"7.0", prefix:"libopencv-calib3d2.3", reference:"2.3.1-11+deb7u3")) flag++; if (deb_check(release:"7.0", prefix:"libopencv-contrib-dev", reference:"2.3.1-11+deb7u3")) flag++; if (deb_check(release:"7.0", prefix:"libopencv-contrib2.3", reference:"2.3.1-11+deb7u3")) flag++; if (deb_check(release:"7.0", prefix:"libopencv-core-dev", reference:"2.3.1-11+deb7u3")) flag++; if (deb_check(release:"7.0", prefix:"libopencv-core2.3", reference:"2.3.1-11+deb7u3")) flag++; if (deb_check(release:"7.0", prefix:"libopencv-dev", reference:"2.3.1-11+deb7u3")) flag++; if (deb_check(release:"7.0", prefix:"libopencv-features2d-dev", reference:"2.3.1-11+deb7u3")) flag++; if (deb_check(release:"7.0", prefix:"libopencv-features2d2.3", reference:"2.3.1-11+deb7u3")) flag++; if (deb_check(release:"7.0", prefix:"libopencv-flann-dev", reference:"2.3.1-11+deb7u3")) flag++; if (deb_check(release:"7.0", prefix:"libopencv-flann2.3", reference:"2.3.1-11+deb7u3")) flag++; if (deb_check(release:"7.0", prefix:"libopencv-gpu-dev", reference:"2.3.1-11+deb7u3")) flag++; if (deb_check(release:"7.0", prefix:"libopencv-gpu2.3", reference:"2.3.1-11+deb7u3")) flag++; if (deb_check(release:"7.0", prefix:"libopencv-highgui-dev", reference:"2.3.1-11+deb7u3")) flag++; if (deb_check(release:"7.0", prefix:"libopencv-highgui2.3", reference:"2.3.1-11+deb7u3")) flag++; if (deb_check(release:"7.0", prefix:"libopencv-imgproc-dev", reference:"2.3.1-11+deb7u3")) flag++; if (deb_check(release:"7.0", prefix:"libopencv-imgproc2.3", reference:"2.3.1-11+deb7u3")) flag++; if (deb_check(release:"7.0", prefix:"libopencv-legacy-dev", reference:"2.3.1-11+deb7u3")) flag++; if (deb_check(release:"7.0", prefix:"libopencv-legacy2.3", reference:"2.3.1-11+deb7u3")) flag++; if (deb_check(release:"7.0", prefix:"libopencv-ml-dev", reference:"2.3.1-11+deb7u3")) flag++; if (deb_check(release:"7.0", prefix:"libopencv-ml2.3", reference:"2.3.1-11+deb7u3")) flag++; if (deb_check(release:"7.0", prefix:"libopencv-objdetect-dev", reference:"2.3.1-11+deb7u3")) flag++; if (deb_check(release:"7.0", prefix:"libopencv-objdetect2.3", reference:"2.3.1-11+deb7u3")) flag++; if (deb_check(release:"7.0", prefix:"libopencv-video-dev", reference:"2.3.1-11+deb7u3")) flag++; if (deb_check(release:"7.0", prefix:"libopencv-video2.3", reference:"2.3.1-11+deb7u3")) flag++; if (deb_check(release:"7.0", prefix:"opencv-doc", reference:"2.3.1-11+deb7u3")) flag++; if (deb_check(release:"7.0", prefix:"python-opencv", reference:"2.3.1-11+deb7u3")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get()); else security_warning(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");
References
- https://github.com/blendin/pocs/blob/master/opencv/0.OOB_Write_FillUniColor
- https://github.com/blendin/pocs/blob/master/opencv/0.OOB_Write_FillUniColor
- https://github.com/opencv/opencv/issues/9723
- https://github.com/opencv/opencv/issues/9723
- https://lists.debian.org/debian-lts-announce/2018/01/msg00008.html
- https://lists.debian.org/debian-lts-announce/2018/01/msg00008.html
- https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html
- https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html
- https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
- https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html