An out-of-bounds read was discovered in OpenCV before 4.1.1. Specifically, variable coarsest_scale is assumed to be greater than or equal to finest_scale within the calc()/ocl_calc() functions in dis_flow.cpp. However, this is not true when dealing with small images, leading to an out-of-bounds read of the heap-allocated arrays Ux and Uy.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An out-of-bounds read was discovered in OpenCV before 4.1.1. Specifically, variable coarsest_scale is     assumed to be greater than or equal to finest_scale within the calc()/ocl_calc() functions in     dis_flow.cpp. However, this is not true when dealing with small images, leading to an out-of-bounds read     of the heap-allocated arrays Ux and Uy. (CVE-2019-19624)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 18.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7247-1 advisory.

    It was discovered that OpenCV did not properly manage certain XML data, leading to a NULL pointer     dereference. If a user were tricked into loading a specially crafted file, a remote attacker could     possibly use this issue to make OpenCV crash, resulting in a denial of service. This issue only affected     Ubuntu 18.04 LTS. (CVE-2019-14493)

    It was discovered that OpenCV may perform out-of-bounds reads in certain situations. An attacker could     possibly use this issue to cause OpenCV to crash, resulting in a denial of service, or the execution of     arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-16249, CVE-2019-19624)

    It was discovered that the QR code module of OpenCV incorrectly processed certain maliciously crafted QR     codes. A remote attacker could possibly use this issue to cause OpenCV to crash, resulting in a denial of     service. This issue only affected Ubuntu 22.04 LTS. (CVE-2023-2617, CVE-2023-2618)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An out-of-bounds read was discovered in OpenCV before 4.1.1. Specifically, variable coarsest_scale is
    assumed to be greater than or equal to finest_scale within the calc()/ocl_calc() functions in
    dis_flow.cpp. However, this is not true when dealing with small images, leading to an out-of-bounds read
    of the heap-allocated arrays Ux and Uy. (CVE-2019-19624)

ID	Name	Product	Family	Severity
222721	Linux Distros Unpatched Vulnerability : CVE-2019-19624	Nessus	Misc.	medium
214909	Ubuntu 18.04 LTS / 22.04 LTS : OpenCV vulnerabilities (USN-7247-1)	Nessus	Ubuntu Local Security Checks	medium
416354	SCA: security update for opencv-contrib-python, opencv-contrib-python-headless, opencv-python, opencv-python-headless (GHSA-jggw-2q6g-c3m6)	Tenable Cloud Security	SCA Checks	medium
416354	SCA: security update for opencv-contrib-python, opencv-contrib-python-headless, opencv-python, opencv-python-headless (GHSA-jggw-2q6g-c3m6)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2019-19624

medium

Tenable Plugins

medium

medium

medium

medium