CVE-2019-5064

Description

An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, before version 4.2.0. A specially crafted JSON file can cause a buffer overflow, resulting in multiple heap corruptions and potentially code execution. An attacker can provide a specially crafted file to trigger this vulnerability.

How to fix CVE-2019-5064

To remediate CVE-2019-5064, upgrade the affected package to a fixed version below.

• —upgrade to 4.2.0.32 or later
• —upgrade to 4.2.0.32 or later
• —upgrade to 4.2.0.32 or later
• —upgrade to 4.2.0.32 or later
• —upgrade to 4.2.0.32 or later
• —upgrade to 4.2.0.32 or later
• —upgrade to 4.2.0.32 or later
• —upgrade to 4.2.0.32 or later

Is CVE-2019-5064 being exploited?

Moderate — EPSS is 10.6%. Track this CVE but it's not at the top of the prioritisation list.

Affected packages (8)

• from 0, < 4.2.0.32
• from 0, < 4.2.0.32
• from 0, < 4.2.0.32
• from 0, < 4.2.0.32
• from 0, < 4.2.0.32
• from 0, < 4.2.0.32
• from 0, < 4.2.0.32
• from 0, < 4.2.0.32

CVSS scores

References (13)

• ADVISORYgithub.com/advisories/GHSA-q799-q27x-vp7w
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2019-5064
• PATCHgithub.com/opencv/opencv-python
• PATCHpypi.org/project/opencv-contrib-python
• PATCH