CVE-2017-14136

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

OpenCV (Open Source Computer Vision Library) 3.3 has an out-of-bounds write error in the function FillColorRow1 in utils.cpp when reading an image file by using cv::imread. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12597.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/opencv/opencv/issues/9443Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/opencv/opencv/pull/9448Issue Tracking, Patch, Third Party Advisory
https://github.com/xiaoqx/pocs/blob/master/opencv.mdExploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/07/msg00030.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/201712-02Third Party Advisory
https://github.com/opencv/opencv/issues/9443Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/opencv/opencv/pull/9448Issue Tracking, Patch, Third Party Advisory
https://github.com/xiaoqx/pocs/blob/master/opencv.mdExploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/07/msg00030.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/201712-02Third Party Advisory

Timeline

Published: Sep 4, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-141377.5ReadWEBPImage in coders/webp.c in ImageMagick 7.0.6-5 has an issue where memory allocation is excessive because it depends only on a length CVE-2017-141389.8ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in certain error cases, as CVE-2017-141396.5ImageMagick 7.0.6-2 has a memory leak vulnerability in WriteMSLImage in coders/msl.c.CVE-2017-141405.5The move_pages system call in mm/migrate.c in the Linux kernel before 4.12.9 doesn't check the effective uid of the target process, enabling CVE-2017-141417.2The wiki_decode Developer System Helper function in the admin panel in Kaltura before 13.2.0 allows remote attackers to conduct PHP object i CVE-2017-141426.1Multiple cross-site scripting (XSS) vulnerabilities in Kaltura before 13.2.0 allow remote attackers to inject arbitrary web script or HTML v CVE-2017-141439.8The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote at CVE-2017-141459.8HelpDEZk 1.1.1 has SQL Injection in app\modules\admin\controllers\loginController.php via the admin/login/getWarningInfo/id/ PATH_INFO, rela CVE-2017-141468.8HelpDEZk 1.1.1 allows remote authenticated users to execute arbitrary PHP code by uploading a .php attachment and then requesting it in the CVE-2017-141479.8An issue was discovered on FiberHome User End Routers Bearing Model Number AN1020-25 which could allow an attacker to easily restore a route CVE-2017-141497.5GoAhead 3.4.0 through 3.6.5 has a NULL Pointer Dereference in the websDecodeUrl function in http.c, leading to a crash for a "POST / HTTP/1.CVE-2017-141518.8An off-by-one error was discovered in opj_tcd_code_block_enc_allocate_data in lib/openjp2/tcd.c in OpenJPEG 2.2.0. The vulnerability causes