A vulnerability, which was classified as problematic, has been found in OpenCV wechat_qrcode Module up to 4.7.0. Affected by this issue is the function DecodedBitStreamParser::decodeHanziSegment of the file qrcode/decoder/decoded_bit_stream_parser.cpp. The manipulation leads to memory leak. The attack may be launched remotely. The name of the patch is 2b62ff6181163eea029ed1cab11363b4996e9cd6. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-228548.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0353 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-2617:
    A vulnerability classified as problematic was found in OpenCV wechat_qrcode Module up to 4.7.0. Affected     by this vulnerability is the function DecodedBitStreamParser::decodeByteSegment of the file     qrcode/decoder/decoded_bit_stream_parser.cpp. The manipulation leads to null pointer dereference. The     attack can be launched remotely. The exploit has been disclosed to the public and may be used. It is     recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is     VDB-228547.

    CVE-2023-2618:
    A vulnerability, which was classified as problematic, has been found in OpenCV wechat_qrcode Module up to     4.7.0. Affected by this issue is the function DecodedBitStreamParser::decodeHanziSegment of the file     qrcode/decoder/decoded_bit_stream_parser.cpp. The manipulation leads to memory leak. The attack may be     launched remotely. The name of the patch is 2b62ff6181163eea029ed1cab11363b4996e9cd6. It is recommended to     apply a patch to fix this issue. The identifier of this vulnerability is VDB-228548.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7247-1 advisory.

    It was discovered that OpenCV did not properly manage certain XML data, leading to a NULL pointer     dereference. If a user were tricked into loading a specially crafted file, a remote attacker could     possibly use this issue to make OpenCV crash, resulting in a denial of service. This issue only affected     Ubuntu 18.04 LTS. (CVE-2019-14493)

    It was discovered that OpenCV may perform out-of-bounds reads in certain situations. An attacker could     possibly use this issue to cause OpenCV to crash, resulting in a denial of service, or the execution of     arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-16249, CVE-2019-19624)

    It was discovered that the QR code module of OpenCV incorrectly processed certain maliciously crafted QR     codes. A remote attacker could possibly use this issue to cause OpenCV to crash, resulting in a denial of     service. This issue only affected Ubuntu 22.04 LTS. (CVE-2023-2617, CVE-2023-2618)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Application Testing Suite installed on the remote host is affected by a denial of service vulnerability as referenced in the January 2024 CPU advisory:

  - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager (component: Load     Testing for Web Apps (OpenCV)). Easily exploitable vulnerability allows unauthenticated attacker with network     access via TCP to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can     result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle     Application Testing Suite. (CVE-2023-2618)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
239898	TencentOS Server 4: opencv (TSSA-2024:0353)	Nessus	Tencent Local Security Checks	high
214909	Ubuntu 18.04 LTS / 22.04 LTS : OpenCV vulnerabilities (USN-7247-1)	Nessus	Ubuntu Local Security Checks	medium
189181	Oracle Application Testing Suite DoS (January 2024 CPU)	Nessus	Misc.	high

Detections

Analytics

CVE-2023-2618

high

Tenable Plugins

high

medium

high