Bug 1531268 (CVE-2017-18009) - CVE-2017-18009 opencv: heap-based buffer over-read in function cv::HdrDecoder::checkSignature in modules/imgcodecs/src/grfmt_hdr.cpp
Summary: CVE-2017-18009 opencv: heap-based buffer over-read in function cv::HdrDecoder...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2017-18009
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1531277
Blocks: 1696280
TreeView+ depends on / blocked
 
Reported: 2018-01-04 20:45 UTC by Laura Pardo
Modified: 2021-02-17 01:01 UTC (History)
11 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-06-08 03:36:14 UTC
Embargoed:

Attachments (Terms of Use)

Description Laura Pardo 2018-01-04 20:45:32 UTC 
A flaw was found in OpenCV 3.3.1, a heap-based buffer over-read exists in the function cv::HdrDecoder::checkSignature in modules/imgcodecs/src/grfmt_hdr.cpp. 

[UPSTREAM BUG]
https://github.com/opencv/opencv/issues/10479

[UPSTREAM PATCH]
https://github.com/opencv/opencv/pull/10480
Comment 1 Laura Pardo 2018-01-04 21:15:54 UTC 
Created opencv tracking bugs for this issue:

Affects: fedora-all [bug 1531277]
Comment 2 Stefan Cornelius 2019-06-02 18:44:12 UTC 
RHEL6 and 7 don't ship the affected code, RHEL8 already contains the fix.
Comment 3 Stefan Cornelius 2019-06-02 18:44:14 UTC 
Statement:

This issue did not affect the versions of opencv as shipped with Red Hat Enterprise Linux 6, 7, and 8.
Note You need to log in before you can comment on or make changes to this bug.