The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.
opencv: out-of-bounds write error in the function FillColorRow4 (CVE-2017-12606)
OpenCV 3.0.0 has a double free issue that allows attackers to execute arbitrary code. (CVE-2016-1516)
OpenCV 3.0.0 allows remote attackers to cause a denial of service (segfault) via vectors involving corrupt chunks. (CVE-2016-1517)
In opencv/modules/imgcodecs/src/utils.cpp, functions FillUniColor and FillUniGray do not check the input length, which can lead to integer overflow. If the image is from remote, may lead to remote code execution or denial of service. This affects Opencv 3.3 and earlier. (CVE-2017-1000450)
OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds write error in the function FillColorRow1 in utils.cpp when reading an image file by using cv::imread. (CVE-2017-12597)
OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds read error in the cv::RBaseStream::readBlock function in modules/imgcodecs/src/bitstrm.cpp when reading an image file by using cv::imread, as demonstrated by the 8-opencv-invalid-read-fread test case. (CVE-2017-12598)
OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds read error in the function icvCvt_BGRA2BGR_8u_C4C3R when reading an image file by using cv::imread. (CVE-2017-12599)
OpenCV (Open Source Computer Vision Library) through 3.3 has a denial of service (CPU consumption) issue, as demonstrated by the 11-opencv-dos-cpu-exhaust test case. (CVE-2017-12600)
OpenCV (Open Source Computer Vision Library) through 3.3 has a buffer overflow in the cv::BmpDecoder::readData function in modules/imgcodecs/src/grfmt_bmp.cpp when reading an image file by using cv::imread, as demonstrated by the 4-buf-overflow-readData-memcpy test case. (CVE-2017-12601)
OpenCV (Open Source Computer Vision Library) through 3.3 has a denial of service (memory consumption) issue, as demonstrated by the 10-opencv-dos-memory-exhaust test case. (CVE-2017-12602)
OpenCV (Open Source Computer Vision Library) through 3.3 has an invalid write in the cv::RLByteStream::getBytes function in modules/imgcodecs/src/bitstrm.cpp when reading an image file by using cv::imread, as demonstrated by the 2-opencv-heapoverflow-fseek test case. (CVE-2017-12603)
OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds write error in the FillUniColor function in utils.cpp when reading an image file by using cv::imread. (CVE-2017-12604)
OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds write error in the FillColorRow8 function in utils.cpp when reading an image file by using cv::imread. (CVE-2017-12605)
In OpenCV 3.3.1, a heap-based buffer overflow happens in cv::Jpeg2KDecoder::readComponent8u in modules/imgcodecs/src/grfmt_jpeg2000.cpp when parsing a crafted image file. (CVE-2018-5268)
In OpenCV 3.3.1, an assertion failure happens in cv::RBaseStream::setPos in modules/imgcodecs/src/bitstrm.cpp because of an incorrect integer cast. (CVE-2018-5269)
An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1. There is an out of bounds read in the function cv::predictOrdered<cv::HaarEvaluator> in modules/objdetect/src/cascadedetect.hpp, which leads to denial of service. (CVE-2019-14491)
Note that Nessus has not tested for these issues but has instead relied on the package manager’s report that the package is installed.
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Red Hat Security Advisory opencv. The text
# itself is copyright (C) Red Hat, Inc.
##
include('compat.inc');
if (description)
{
script_id(195660);
script_version("1.0");
script_set_attribute(attribute:"plugin_modification_date", value:"2024/05/11");
script_cve_id(
"CVE-2016-1516",
"CVE-2016-1517",
"CVE-2017-12597",
"CVE-2017-12598",
"CVE-2017-12599",
"CVE-2017-12600",
"CVE-2017-12601",
"CVE-2017-12602",
"CVE-2017-12603",
"CVE-2017-12604",
"CVE-2017-12605",
"CVE-2017-12606",
"CVE-2017-1000450",
"CVE-2018-5268",
"CVE-2018-5269",
"CVE-2019-14491"
);
script_name(english:"RHEL 7 : opencv (Unpatched Vulnerability)");
script_set_attribute(attribute:"synopsis", value:
"The remote Red Hat 7 host is affected by multiple vulnerabilities that will not be patched.");
script_set_attribute(attribute:"description", value:
"The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple
vulnerabilities that have been acknowledged by the vendor but will not be patched.
- opencv: out-of-bounds write error in the function FillColorRow4 (CVE-2017-12606)
- OpenCV 3.0.0 has a double free issue that allows attackers to execute arbitrary code. (CVE-2016-1516)
- OpenCV 3.0.0 allows remote attackers to cause a denial of service (segfault) via vectors involving corrupt
chunks. (CVE-2016-1517)
- In opencv/modules/imgcodecs/src/utils.cpp, functions FillUniColor and FillUniGray do not check the input
length, which can lead to integer overflow. If the image is from remote, may lead to remote code execution
or denial of service. This affects Opencv 3.3 and earlier. (CVE-2017-1000450)
- OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds write error in the function
FillColorRow1 in utils.cpp when reading an image file by using cv::imread. (CVE-2017-12597)
- OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds read error in the
cv::RBaseStream::readBlock function in modules/imgcodecs/src/bitstrm.cpp when reading an image file by
using cv::imread, as demonstrated by the 8-opencv-invalid-read-fread test case. (CVE-2017-12598)
- OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds read error in the function
icvCvt_BGRA2BGR_8u_C4C3R when reading an image file by using cv::imread. (CVE-2017-12599)
- OpenCV (Open Source Computer Vision Library) through 3.3 has a denial of service (CPU consumption) issue,
as demonstrated by the 11-opencv-dos-cpu-exhaust test case. (CVE-2017-12600)
- OpenCV (Open Source Computer Vision Library) through 3.3 has a buffer overflow in the
cv::BmpDecoder::readData function in modules/imgcodecs/src/grfmt_bmp.cpp when reading an image file by
using cv::imread, as demonstrated by the 4-buf-overflow-readData-memcpy test case. (CVE-2017-12601)
- OpenCV (Open Source Computer Vision Library) through 3.3 has a denial of service (memory consumption)
issue, as demonstrated by the 10-opencv-dos-memory-exhaust test case. (CVE-2017-12602)
- OpenCV (Open Source Computer Vision Library) through 3.3 has an invalid write in the
cv::RLByteStream::getBytes function in modules/imgcodecs/src/bitstrm.cpp when reading an image file by
using cv::imread, as demonstrated by the 2-opencv-heapoverflow-fseek test case. (CVE-2017-12603)
- OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds write error in the
FillUniColor function in utils.cpp when reading an image file by using cv::imread. (CVE-2017-12604)
- OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds write error in the
FillColorRow8 function in utils.cpp when reading an image file by using cv::imread. (CVE-2017-12605)
- In OpenCV 3.3.1, a heap-based buffer overflow happens in cv::Jpeg2KDecoder::readComponent8u in
modules/imgcodecs/src/grfmt_jpeg2000.cpp when parsing a crafted image file. (CVE-2018-5268)
- In OpenCV 3.3.1, an assertion failure happens in cv::RBaseStream::setPos in
modules/imgcodecs/src/bitstrm.cpp because of an incorrect integer cast. (CVE-2018-5269)
- An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1. There is an out of bounds read in the
function cv::predictOrdered<cv::HaarEvaluator> in modules/objdetect/src/cascadedetect.hpp, which leads to
denial of service. (CVE-2019-14491)
Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package
is installed.");
script_set_attribute(attribute:"solution", value:
"The vendor has acknowledged the vulnerabilities but no solution has been provided. Refer to the vendor for remediation
guidance.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-12606");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"vendor_unpatched", value:"true");
script_set_attribute(attribute:"vuln_publication_date", value:"2017/04/10");
script_set_attribute(attribute:"plugin_publication_date", value:"2024/05/11");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6");
script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7");
script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:8");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:opencv");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Red Hat Local Security Checks");
script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info.nasl", "redhat_repos.nasl");
script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
exit(0);
}
include('rpm.inc');
include('rhel.inc');
if (!get_kb_item("global_settings/vendor_unpatched"))
exit(0, "Unpatched Vulnerabilities Detection not active.");
if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/RedHat/release');
if (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');
var os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:os_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');
os_ver = os_ver[1];
if (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '7')) audit(AUDIT_OS_NOT, 'Red Hat 7.x', 'Red Hat ' + os_ver);
if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu && 'ppc' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);
var constraints = [
{
'pkgs': [
{'reference':'opencv', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'unpatched_pkg':'opencv'}
]
}
];
var flag = 0;
foreach var constraint_array ( constraints ) {
var repo_relative_urls = NULL;
var enterprise_linux_flag = rhel_repo_urls_has_content_dist_rhel(repo_urls:repo_relative_urls);
foreach var pkg ( constraint_array['pkgs'] ) {
var unpatched_pkg = NULL;
var _release = NULL;
var sp = NULL;
var el_string = NULL;
var rpm_spec_vers_cmp = NULL;
var exists_check = NULL;
var cves = NULL;
if (!empty_or_null(pkg['unpatched_pkg'])) unpatched_pkg = pkg['unpatched_pkg'];
if (!empty_or_null(pkg['release'])) _release = 'RHEL' + pkg['release'];
if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
if (unpatched_pkg &&
_release &&
(!exists_check || rpm_exists(release:_release, rpm:exists_check)) &&
unpatched_package_exists(release:_release, package:unpatched_pkg, cves: cves)) flag++;
}
}
if (flag)
{
var extra = NULL;
security_report_v4(
port : 0,
severity : SECURITY_WARNING,
extra : unpatched_packages_report()
);
exit(0);
}
else
{
var tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'opencv');
}
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1516
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1517
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000450
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12597
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12598
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12599
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12600
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12601
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12602
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12603
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12604
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12605
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12606
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5268
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5269
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14491