CVE-2019-14491

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1. There is an out of bounds read in the function cv::predictOrdered<cv::HaarEvaluator> in modules/objdetect/src/cascadedetect.hpp, which leads to denial of service.

Metrics

CVSS 3.0 8.2/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00025.html
https://github.com/opencv/opencv/compare/33b765d...4a7ca5aThird Party Advisory
https://github.com/opencv/opencv/compare/371bba8...ddbd10cThird Party Advisory
https://github.com/opencv/opencv/issues/15125Exploit, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPFLN6QAX6SUA4XR4NMKKXX26H3TYCVQ/
http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00025.html
https://github.com/opencv/opencv/compare/33b765d...4a7ca5aThird Party Advisory
https://github.com/opencv/opencv/compare/371bba8...ddbd10cThird Party Advisory
https://github.com/opencv/opencv/issues/15125Exploit, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPFLN6QAX6SUA4XR4NMKKXX26H3TYCVQ/

Timeline

Published: Aug 1, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-144927.5An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1. There is an out of bounds read/write in the function HaarEvaluator::Opt CVE-2019-144937.5An issue was discovered in OpenCV before 4.1.1. There is a NULL pointer dereference in the function cv::XMLParser::parse at modules/core/src CVE-2019-144947.5An issue was discovered in Poppler through 0.78.0. There is a divide-by-zero error in the function SplashOutputDev::tilingPatternFill at Spl CVE-2019-144959.8webadmin.c in 3proxy before 0.8.13 has an out-of-bounds write in the admin interface.CVE-2019-144967.8LoaderXM::load in LoaderXM.cpp in milkyplay in MilkyTracker 1.02.00 has a stack-based buffer overflow.CVE-2019-144977.8ModuleEditor::convertInstrument in tracker/ModuleEditor.cpp in MilkyTracker 1.02.00 has a heap-based buffer overflow.CVE-2019-144987.8A divide-by-zero error exists in the Control function of demux/caf.c in VideoLAN VLC media player 3.0.7.1. As a result, an FPE can be trigge CVE-2019-145106.7An issue was discovered in Kaseya VSA RMM through 9.5.0.22. When using the default configuration, the LAN Cache feature creates a local acco CVE-2019-145117.5Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet (unless filtered CVE-2019-145126.1LimeSurvey 3.17.7+190627 has XSS via Boxes in application/extensions/PanelBoxWidget/views/box.php or a label title in application/views/admi CVE-2019-145137.5Improper bounds checking in Dnsmasq before 2.76 allows an attacker controlled DNS server to send large DNS packets that result in a read ope CVE-2019-145149.8An issue was discovered in Microvirt MEmu all versions prior to 7.0.2. A guest Android operating system inside the MEmu emulator contains a