An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, before version 4.2.0. A specially crafted JSON file can cause a buffer overflow, resulting in multiple heap corruptions and potentially code execution. An attacker can provide a specially crafted file to trigger this vulnerability.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality
    of OpenCV, before version 4.2.0. A specially crafted JSON file can cause a buffer overflow, resulting in
    multiple heap corruptions and potentially code execution. An attacker can provide a specially crafted file
    to trigger this vulnerability. (CVE-2019-5064)

The 13.4.0.0 versions of Enterprise Manager Base Platform installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2021 CPU advisory.

  - Vulnerability in the StorageTek Tape Analytics SW Tool product of Oracle Systems (component: Software     (dom4j)). The supported version that is affected is 2.3. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise StorageTek Tape Analytics SW Tool.
    Successful attacks of this vulnerability can result in takeover of StorageTek Tape Analytics SW Tool.     (CVE-2020-10683)

  - Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component:
    Application Service Level Mgmt (OpenCV)). The supported version that is affected is 13.4.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Enterprise Manager Base Platform. Successful attacks require human interaction from a person other than     the attacker. Successful attacks of this vulnerability can result in takeover of Enterprise Manager Base     Platform. (CVE-2019-5064)

  - Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component:
    Discovery Framework (OpenSSL)). The supported version that is affected is 13.4.0.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Enterprise     Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of Enterprise Manager Base Platform. (CVE-2020-1971)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The 13.3.0.1 versions of Application Testing Suite installed on the remote host are affected by a vulnerability as referenced in the April 2021 CPU advisory.

  - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager (component:
    Load Testing for Web Apps (OpenCV)). The supported version that is affected is 13.3.0.1. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle Application Testing Suite. Successful attacks require human interaction from a person other than     the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Application     Testing Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). (CVE-2019-5064)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
417961	SCA: security update for opencv-contrib-python, opencv-contrib-python-headless, opencv-python, opencv-python-headless (GHSA-q799-q27x-vp7w)	Tenable Cloud Security	SCA Checks	high
417961	SCA: security update for opencv-contrib-python, opencv-contrib-python-headless, opencv-python, opencv-python-headless (GHSA-q799-q27x-vp7w)	Tenable Self-Hosted Container Security	SCA Checks	high
151903	Oracle Enterprise Manager Cloud Control (Jul 2021 CPU)	Nessus	Misc.	critical
148934	Oracle Application Testing Suite (Apr 2021 CPU)	Nessus	Misc.	high

Detections

Analytics

CVE-2019-5064

high

Tenable Plugins

high

high

critical

high