vulnwire
5.5med

CVE-2016-1517

Improper Input Validation in OpenCV

Also known as GHSA-fffj-9qwg-qmh5, PYSEC-2026-2817, PYSEC-2026-708

Published 9 y ago · modified 58 d ago · JSON

CVSS
5.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.1%
percentile 65%
Public exploits
0
none known

OpenCV 3.0.0 allows remote attackers to cause a denial of service (segfault) via vectors involving corrupt chunks.

Exploit prediction (EPSS)

1.08% probability of exploitation in the next 30 days, higher than 65% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.05.5CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD2.04.3AV:N/AC:M/Au:N/C:N/I:N/A:P
OSV3.05.5CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
GitHub3.05.5CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
OSV3.05.5CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected packages

EcosystemPackageAffectedFixed in
pypiopencv-python
<3.3.1.11
3.3.1.11
pypiopencv-contrib-python
<3.3.1.11
3.3.1.11

Affected products

  • n/a OpenCV 3.0.0

Classification

Weakness
  • CWE-20 Improper Input Validation

References

  • github.com /opencv/opencv/issues/5956 · x_refsource_MISC, x_transferred
  • arxiv.org /pdf/1701.04739.pdf · x_refsource_MISC, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2016-1517 · advisory
  • github.com /opencv/opencv/pull/9376 · web
  • github.com /opencv/opencv-python · package
  • pypi.org /project/opencv-python · package
  • github.com /advisories/GHSA-fffj-9qwg-qmh5 · advisory
  • pypi.org /project/opencv-contrib-python · package

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.