vulnwire
8.8high

CVE-2016-1516

Double Free in OpenCV

Also known as GHSA-cvhw-2593-5j2q, PYSEC-2026-2816, PYSEC-2026-707

Published 9 y ago · modified 58 d ago · JSON

CVSS
8.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
2.3%
percentile 84%
Public exploits
0
none known

OpenCV 3.0.0 has a double free issue that allows attackers to execute arbitrary code.

Exploit prediction (EPSS)

2.35% probability of exploitation in the next 30 days, higher than 84% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.18.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD2.06.8AV:N/AC:M/Au:N/C:P/I:P/A:P
GitHub3.08.8CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
OSV3.08.8CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
OSV3.08.8CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected packages

EcosystemPackageAffectedFixed in
pypiopencv-python
<3.3.1.11
3.3.1.11
pypiopencv-contrib-python
<3.3.1.11
3.3.1.11

Affected products

  • n/a OpenCV 3.0.0

Classification

Weakness

References

  • lists.debian.org /debian-lts-announce/2018/07/msg00030.html · mailing-list, x_refsource_MLIST, x_transferred
  • github.com /opencv/opencv/issues/5956 · x_refsource_MISC, x_transferred
  • arxiv.org /pdf/1701.04739.pdf · x_refsource_MISC, x_transferred
  • lists.debian.org /debian-lts-announce/2021/10/msg00028.html · mailing-list, x_refsource_MLIST, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2016-1516 · advisory
  • github.com /opencv/opencv/pull/9376 · web
  • github.com /opencv/opencv-python · package
  • pypi.org /project/opencv-contrib-python · package
  • github.com /advisories/GHSA-cvhw-2593-5j2q · advisory
  • pypi.org /project/opencv-python · package

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.