A vulnerability, which was classified as problematic, has been found in OpenCV wechat_qrcode Module up to 4.7.0. Affected by this issue is the function DecodedBitStreamParser::decodeHanziSegment of the file qrcode/decoder/decoded_bit_stream_parser.cpp. The manipulation leads to memory leak. The attack may be launched remotely. The name of the patch is 2b62ff6181163eea029ed1cab11363b4996e9cd6. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-228548.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability, which was classified as problematic, has been found in OpenCV wechat_qrcode Module up to     4.7.0. Affected by this issue is the function DecodedBitStreamParser::decodeHanziSegment of the file     qrcode/decoder/decoded_bit_stream_parser.cpp. The manipulation leads to memory leak. The attack may be     launched remotely. The name of the patch is 2b62ff6181163eea029ed1cab11363b4996e9cd6. It is recommended to     apply a patch to fix this issue. The identifier of this vulnerability is VDB-228548. (CVE-2023-2618)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 18.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7247-1 advisory.

    It was discovered that OpenCV did not properly manage certain XML data, leading to a NULL pointer     dereference. If a user were tricked into loading a specially crafted file, a remote attacker could     possibly use this issue to make OpenCV crash, resulting in a denial of service. This issue only affected     Ubuntu 18.04 LTS. (CVE-2019-14493)

    It was discovered that OpenCV may perform out-of-bounds reads in certain situations. An attacker could     possibly use this issue to cause OpenCV to crash, resulting in a denial of service, or the execution of     arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-16249, CVE-2019-19624)

    It was discovered that the QR code module of OpenCV incorrectly processed certain maliciously crafted QR     codes. A remote attacker could possibly use this issue to cause OpenCV to crash, resulting in a denial of     service. This issue only affected Ubuntu 22.04 LTS. (CVE-2023-2617, CVE-2023-2618)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Application Testing Suite installed on the remote host is affected by a denial of service vulnerability as referenced in the January 2024 CPU advisory:

  - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager (component: Load     Testing for Web Apps (OpenCV)). Easily exploitable vulnerability allows unauthenticated attacker with network     access via TCP to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can     result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle     Application Testing Suite. (CVE-2023-2618)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
251050	Linux Distros Unpatched Vulnerability : CVE-2023-2618	Nessus	Misc.	high
214909	Ubuntu 18.04 LTS / 22.04 LTS : OpenCV vulnerabilities (USN-7247-1)	Nessus	Ubuntu Local Security Checks	medium
189181	Oracle Application Testing Suite DoS (January 2024 CPU)	Nessus	Misc.	high

Detections

Analytics

CVE-2023-2618

high

Tenable Plugins

high

medium

high