Bug 1483698 (CVE-2017-12864)

Summary:	CVE-2017-12864 opencv: Integer overflow in ReadNumber function in opencv/modules/imgcodecs/src/grfmt_pxm.cpp
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	databases-maint, hhorak, jmlich83, jridky, karlthered, kwizart, nomis80, sergio
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-11-25 04:49:09 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1483700
Bug Blocks:

Description Pedro Sampaio 2017-08-21 18:41:54 UTC

In opencv/modules/imgcodecs/src/grfmt_pxm.cpp, function ReadNumber did
not checkout the input length, which lead to integer overflow. If the
image is from remote, may lead to remote code execution or denial of
service. This affects Opencv 3.3 and earlier.

Upstream bug:

https://github.com/opencv/opencv/issues/9372

Comment 1 Pedro Sampaio 2017-08-21 18:46:01 UTC

Created opencv tracking bugs for this issue:

Affects: fedora-all [bug 1483700]