CVE-2017-12862

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

In modules/imgcodecs/src/grfmt_pxm.cpp, the length of buffer AutoBuffer _src is small than expected, which will cause copy buffer overflow later. If the image is from remote, may lead to remote code execution or denial of service. This affects Opencv 3.3 and earlier.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/opencv/opencv/issues/9370Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/07/msg00030.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/10/msg00028.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/201712-02Third Party Advisory
https://github.com/opencv/opencv/issues/9370Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/07/msg00030.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/10/msg00028.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/201712-02Third Party Advisory

Timeline

Published: Aug 15, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-128638.8In opencv/modules/imgcodecs/src/grfmt_pxm.cpp, function PxMDecoder::readData has an integer overflow when calculate src_pitch. If the image CVE-2017-128648.8In opencv/modules/imgcodecs/src/grfmt_pxm.cpp, function ReadNumber did not checkout the input length, which lead to integer overflow. If the CVE-2017-128659.8Stack-based buffer overflow in "dnsproxy.c" in connman 1.34 and earlier allows remote attackers to cause a denial of service (crash) or exec CVE-2017-128675.9The SimpleSAML_Auth_TimeLimitedToken class in SimpleSAMLphp 1.14.14 and earlier allows attackers with access to a secret token to extend its CVE-2017-128689.8The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows atta CVE-2017-128697.5The multiauth module in SimpleSAMLphp 1.14.13 and earlier allows remote attackers to bypass authentication context restrictions and use an a CVE-2017-12875.4IBM Rhapsody DM 5.0 and 6.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim CVE-2017-128705.9SimpleSAMLphp 1.14.12 and earlier make it easier for man-in-the-middle attackers to obtain sensitive information by leveraging use of the ae CVE-2017-128715.9The aesEncrypt method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.x through 1.14.11 makes it easier for context-dependent attac CVE-2017-128725.9The (1) Htpasswd authentication source in the authcrypt module and (2) SimpleSAML_Session class in SimpleSAMLphp 1.14.11 and earlier allow r CVE-2017-128739.8SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to obtain sensitive information, gain unauthorized access, or have unspecified oth CVE-2017-128747.5The InfoCard module 1.0 for SimpleSAMLphp allows attackers to spoof XML messages by leveraging an incorrect check of return values in signat