Bug 27831 - opencv possible new security issue CVE-2019-19624
Summary: opencv possible new security issue CVE-2019-19624
Status: RESOLVED INVALID
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 7
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: All Packagers
QA Contact: Sec team
URL: https://nvd.nist.gov/vuln/detail/CVE-...
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-12-15 15:19 CET by Zombie Ryushu
Modified: 2021-03-10 22:01 CET (History)
1 user (show)

See Also:
Source RPM: opencv-3.4.5-2.1.mga7.src.rpm
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description Zombie Ryushu 2020-12-15 15:19:37 CET 
An out-of-bounds read was discovered in OpenCV before 4.1.1. Specifically, variable coarsest_scale is assumed to be greater than or equal to finest_scale within the calc()/ocl_calc() functions in dis_flow.cpp. However, this is not true when dealing with small images, leading to an out-of-bounds read of the heap-allocated arrays Ux and Uy.
Comment 1 David Walser 2020-12-15 17:11:11 CET 
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19624

Finding conflicting information on this.  Debian and Ubuntu have a version with 3.2.0 and they think it's vulnerable, but Red Hat says 3.4.10 is not:
https://bugzilla.redhat.com/show_bug.cgi?id=1780543#c11

Summary: opencv security issue CVE-2019-19624 => opencv possible new security issue CVE-2019-19624

Comment 2 Lewis Smith 2020-12-15 20:26:39 CET 
Opencv has no obvious maintainer, so having to assign this globally.

Assignee: bugsquad => pkg-bugs
Source RPM: opencv-3.4.5-2.1.mga7.src => opencv-3.4.5-2.1.mga7.src.rpm

Comment 3 Nicolas Lécureuil 2021-03-10 21:54:51 CET 
from https://github.com/opencv/opencv/issues/14554  our version is not affected.

I looked to debian "fixed" version and there is no commits/patches for this CVE

CC: (none) => mageia
Resolution: (none) => FIXED
Status: NEW => RESOLVED

Comment 4 David Walser 2021-03-10 22:01:28 CET 
INVALID then.  Debian has no fixes because they haven't attempted to fix it...

Resolution: FIXED => INVALID
Note You need to log in before you can comment on or make changes to this bug.