Detections
Analytics

Ubuntu 16.04 ESM / 18.04 ESM : OpenCV vulnerabilities (USN-4818-1)

high Nessus Plugin ID 183130

Language:

Synopsis

The remote Ubuntu host is missing one or more security updates.

Description

The remote Ubuntu 16.04 ESM / 18.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4818-1 advisory.

 - An issue was discovered in OpenCV 4.1.0. There is a divide-by-zero error in cv::HOGDescriptor::getDescriptorSize in modules/objdetect/src/hog.cpp. (CVE-2019-15939)

 - An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1. There is an out of bounds read in the function cv::predictOrdered<cv::HaarEvaluator> in modules/objdetect/src/cascadedetect.hpp, which leads to denial of service. (CVE-2019-14491)

 - In OpenCV 3.3.1, a heap-based buffer over-read exists in the function cv::HdrDecoder::checkSignature in modules/imgcodecs/src/grfmt_hdr.cpp. (CVE-2017-18009)

 - An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1. There is an out of bounds read/write in the function HaarEvaluator::OptFeature::calc in modules/objdetect/src/cascadedetect.hpp, which leads to denial of service. (CVE-2019-14492)

 - An issue was discovered in OpenCV before 4.1.1. There is a NULL pointer dereference in the function cv::XMLParser::parse at modules/core/src/persistence.cpp. (CVE-2019-14493)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://ubuntu.com/security/notices/USN-4818-1

Plugin Details

Severity: High

ID: 183130

File Name: ubuntu_USN-4818-1.nasl

Version: 1.0

Type: local

Agent: unix

Published: 10/16/2023

Updated: 10/16/2023

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.0

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P

CVSS Score Source: CVE-2019-14491

CVSS v3

Risk Factor: High

Base Score: 8.2

Temporal Score: 7.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:canonical:ubuntu_linux:16.04:-:esm, cpe:/o:canonical:ubuntu_linux:18.04:-:esm, p-cpe:/a:canonical:ubuntu_linux:libcv-dev, p-cpe:/a:canonical:ubuntu_linux:libcv2.4, p-cpe:/a:canonical:ubuntu_linux:libcvaux-dev, p-cpe:/a:canonical:ubuntu_linux:libcvaux2.4, p-cpe:/a:canonical:ubuntu_linux:libhighgui-dev, p-cpe:/a:canonical:ubuntu_linux:libhighgui2.4, p-cpe:/a:canonical:ubuntu_linux:libopencv-calib3d-dev, p-cpe:/a:canonical:ubuntu_linux:libopencv-calib3d2.4, p-cpe:/a:canonical:ubuntu_linux:libopencv-calib3d2.4v5, p-cpe:/a:canonical:ubuntu_linux:libopencv-calib3d3.2, p-cpe:/a:canonical:ubuntu_linux:libopencv-contrib-dev, p-cpe:/a:canonical:ubuntu_linux:libopencv-contrib2.4, p-cpe:/a:canonical:ubuntu_linux:libopencv-contrib2.4v5, p-cpe:/a:canonical:ubuntu_linux:libopencv-contrib3.2, p-cpe:/a:canonical:ubuntu_linux:libopencv-core-dev, p-cpe:/a:canonical:ubuntu_linux:libopencv-core2.4, p-cpe:/a:canonical:ubuntu_linux:libopencv-core2.4v5, p-cpe:/a:canonical:ubuntu_linux:libopencv-core3.2, p-cpe:/a:canonical:ubuntu_linux:libopencv-dev, p-cpe:/a:canonical:ubuntu_linux:libopencv-features2d-dev, p-cpe:/a:canonical:ubuntu_linux:libopencv-features2d2.4, p-cpe:/a:canonical:ubuntu_linux:libopencv-features2d2.4v5, p-cpe:/a:canonical:ubuntu_linux:libopencv-features2d3.2, p-cpe:/a:canonical:ubuntu_linux:libopencv-flann-dev, p-cpe:/a:canonical:ubuntu_linux:libopencv-flann2.4, p-cpe:/a:canonical:ubuntu_linux:libopencv-flann2.4v5, p-cpe:/a:canonical:ubuntu_linux:libopencv-flann3.2, p-cpe:/a:canonical:ubuntu_linux:libopencv-gpu-dev, p-cpe:/a:canonical:ubuntu_linux:libopencv-gpu2.4, p-cpe:/a:canonical:ubuntu_linux:libopencv-gpu2.4v5, p-cpe:/a:canonical:ubuntu_linux:libopencv-highgui-dev, p-cpe:/a:canonical:ubuntu_linux:libopencv-highgui2.4, p-cpe:/a:canonical:ubuntu_linux:libopencv-highgui2.4v5, p-cpe:/a:canonical:ubuntu_linux:libopencv-highgui3.2, p-cpe:/a:canonical:ubuntu_linux:libopencv-imgcodecs-dev, p-cpe:/a:canonical:ubuntu_linux:libopencv-imgcodecs3.2, p-cpe:/a:canonical:ubuntu_linux:libopencv-imgproc-dev, p-cpe:/a:canonical:ubuntu_linux:libopencv-imgproc2.4, p-cpe:/a:canonical:ubuntu_linux:libopencv-imgproc2.4v5, p-cpe:/a:canonical:ubuntu_linux:libopencv-imgproc3.2, p-cpe:/a:canonical:ubuntu_linux:libopencv-legacy-dev, p-cpe:/a:canonical:ubuntu_linux:libopencv-legacy2.4, p-cpe:/a:canonical:ubuntu_linux:libopencv-legacy2.4v5, p-cpe:/a:canonical:ubuntu_linux:libopencv-ml-dev, p-cpe:/a:canonical:ubuntu_linux:libopencv-ml2.4, p-cpe:/a:canonical:ubuntu_linux:libopencv-ml2.4v5, p-cpe:/a:canonical:ubuntu_linux:libopencv-ml3.2, p-cpe:/a:canonical:ubuntu_linux:libopencv-objdetect-dev, p-cpe:/a:canonical:ubuntu_linux:libopencv-objdetect2.4, p-cpe:/a:canonical:ubuntu_linux:libopencv-objdetect2.4v5, p-cpe:/a:canonical:ubuntu_linux:libopencv-objdetect3.2, p-cpe:/a:canonical:ubuntu_linux:libopencv-ocl-dev, p-cpe:/a:canonical:ubuntu_linux:libopencv-ocl2.4, p-cpe:/a:canonical:ubuntu_linux:libopencv-ocl2.4v5, p-cpe:/a:canonical:ubuntu_linux:libopencv-photo-dev, p-cpe:/a:canonical:ubuntu_linux:libopencv-photo2.4, p-cpe:/a:canonical:ubuntu_linux:libopencv-photo2.4v5, p-cpe:/a:canonical:ubuntu_linux:libopencv-photo3.2, p-cpe:/a:canonical:ubuntu_linux:libopencv-shape-dev, p-cpe:/a:canonical:ubuntu_linux:libopencv-shape3.2, p-cpe:/a:canonical:ubuntu_linux:libopencv-stitching-dev, p-cpe:/a:canonical:ubuntu_linux:libopencv-stitching2.4, p-cpe:/a:canonical:ubuntu_linux:libopencv-stitching2.4v5, p-cpe:/a:canonical:ubuntu_linux:libopencv-stitching3.2, p-cpe:/a:canonical:ubuntu_linux:libopencv-superres-dev, p-cpe:/a:canonical:ubuntu_linux:libopencv-superres2.4, p-cpe:/a:canonical:ubuntu_linux:libopencv-superres2.4v5, p-cpe:/a:canonical:ubuntu_linux:libopencv-superres3.2, p-cpe:/a:canonical:ubuntu_linux:libopencv-ts-dev, p-cpe:/a:canonical:ubuntu_linux:libopencv-ts2.4, p-cpe:/a:canonical:ubuntu_linux:libopencv-ts2.4v5, p-cpe:/a:canonical:ubuntu_linux:libopencv-video-dev, p-cpe:/a:canonical:ubuntu_linux:libopencv-video2.4, p-cpe:/a:canonical:ubuntu_linux:libopencv-video2.4v5, p-cpe:/a:canonical:ubuntu_linux:libopencv-video3.2, p-cpe:/a:canonical:ubuntu_linux:libopencv-videoio-dev, p-cpe:/a:canonical:ubuntu_linux:libopencv-videoio3.2, p-cpe:/a:canonical:ubuntu_linux:libopencv-videostab-dev, p-cpe:/a:canonical:ubuntu_linux:libopencv-videostab2.4, p-cpe:/a:canonical:ubuntu_linux:libopencv-videostab2.4v5, p-cpe:/a:canonical:ubuntu_linux:libopencv-videostab3.2, p-cpe:/a:canonical:ubuntu_linux:libopencv-viz-dev, p-cpe:/a:canonical:ubuntu_linux:libopencv-viz3.2, p-cpe:/a:canonical:ubuntu_linux:libopencv2.4-java, p-cpe:/a:canonical:ubuntu_linux:libopencv2.4-jni, p-cpe:/a:canonical:ubuntu_linux:libopencv3.2-java, p-cpe:/a:canonical:ubuntu_linux:libopencv3.2-jni, p-cpe:/a:canonical:ubuntu_linux:opencv-data, p-cpe:/a:canonical:ubuntu_linux:python-opencv, p-cpe:/a:canonical:ubuntu_linux:python3-opencv

Required KB Items: Host/cpu, Host/Debian/dpkg-l, Host/Ubuntu, Host/Ubuntu/release

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/28/2022

Vulnerability Publication Date: 1/1/2018

Reference Information

CVE: CVE-2017-18009, CVE-2019-14491, CVE-2019-14492, CVE-2019-14493, CVE-2019-15939

USN: 4818-1