Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

opencv: CVE-2018-5268

Related Vulnerabilities: CVE-2018-5268  

Source

Debian Bug report logs - #886674
opencv: CVE-2018-5268

version graph

Package: src:opencv; Maintainer for src:opencv is Debian Science Team <debian-science-maintainers@lists.alioth.debian.org>;

Reported by: Salvatore Bonaccorso <carnil@debian.org>

Date: Mon, 8 Jan 2018 21:09:02 UTC

Severity: important

Tags: fixed-in-experimental, fixed-upstream, security, upstream

Found in version opencv/3.2.0+dfsg-1

Fixed in versions opencv/3.2.0+dfsg-5ubuntu1, opencv/3.4.4+dfsg-1~exp1

Done: Mattia Rizzolo <mattia@debian.org>

Bug is archived. No further changes may be made.

Forwarded to https://github.com/opencv/opencv/issues/10541

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox

Report forwarded to debian-bugs-dist@lists.debian.org, carnil@debian.org, team@security.debian.org, secure-testing-team@lists.alioth.debian.org, team@security.debian.org, secure-testing-team@lists.alioth.debian.org, Debian Science Team <debian-science-maintainers@lists.alioth.debian.org>:
Bug#886674; Package src:opencv. (Mon, 08 Jan 2018 21:09:04 GMT) (full text, mbox, link).

Acknowledgement sent to Salvatore Bonaccorso <carnil@debian.org>:
New Bug report received and forwarded. Copy sent to carnil@debian.org, team@security.debian.org, secure-testing-team@lists.alioth.debian.org, team@security.debian.org, secure-testing-team@lists.alioth.debian.org, Debian Science Team <debian-science-maintainers@lists.alioth.debian.org>. (Mon, 08 Jan 2018 21:09:04 GMT) (full text, mbox, link).

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: opencv: CVE-2018-5268
Date: Mon, 08 Jan 2018 22:07:27 +0100
Source: opencv
Version: 3.2.0+dfsg-1
Severity: grave
Tags: security
Forwarded: https://github.com/opencv/opencv/issues/10541

Hi,

the following vulnerability was published for opencv, please
double-check.

CVE-2018-5268[0]:
| In OpenCV 3.3.1, a heap-based buffer overflow happens in
| cv::Jpeg2KDecoder::readComponent8u in
| modules/imgcodecs/src/grfmt_jpeg2000.cpp when parsing a crafted image
| file.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2018-5268
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5268

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Information forwarded to debian-bugs-dist@lists.debian.org, Debian Science Team <debian-science-maintainers@lists.alioth.debian.org>:
Bug#886674; Package src:opencv. (Mon, 08 Jan 2018 21:15:03 GMT) (full text, mbox, link).

Acknowledgement sent to Salvatore Bonaccorso <carnil@debian.org>:
Extra info received and forwarded to list. Copy sent to Debian Science Team <debian-science-maintainers@lists.alioth.debian.org>. (Mon, 08 Jan 2018 21:15:04 GMT) (full text, mbox, link).

Message #10 received at 886674@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>
To: 886674@bugs.debian.org
Subject: Re: Bug#886674: opencv: CVE-2018-5268
Date: Mon, 8 Jan 2018 22:10:53 +0100
Control: severity important
Control: tags -1 + upstream

Adjusting severity, got wrong before sending bug.

Regards,
Salvatore

Added tag(s) upstream. Request was from Salvatore Bonaccorso <carnil@debian.org> to 886674-submit@bugs.debian.org. (Mon, 08 Jan 2018 21:15:04 GMT) (full text, mbox, link).

Severity set to 'important' from 'grave' Request was from Mattia Rizzolo <mattia@debian.org> to control@bugs.debian.org. (Mon, 08 Jan 2018 21:27:03 GMT) (full text, mbox, link).

Added tag(s) fixed-upstream. Request was from bts-link-upstream@lists.alioth.debian.org to control@bugs.debian.org. (Mon, 12 Feb 2018 17:34:04 GMT) (full text, mbox, link).

Information forwarded to debian-bugs-dist@lists.debian.org, Debian Science Team <debian-science-maintainers@lists.alioth.debian.org>:
Bug#886674; Package src:opencv. (Thu, 06 Dec 2018 01:33:06 GMT) (full text, mbox, link).

Acknowledgement sent to Mo Zhou <lumin@debian.org>:
Extra info received and forwarded to list. Copy sent to Debian Science Team <debian-science-maintainers@lists.alioth.debian.org>. (Thu, 06 Dec 2018 01:33:06 GMT) (full text, mbox, link).

Message #21 received at 886674@bugs.debian.org (full text, mbox, reply):

From: Mo Zhou <lumin@debian.org>
To: 886674@bugs.debian.org
Subject: Re: opencv: CVE-2018-5268
Date: Thu, 6 Dec 2018 01:31:21 +0000
control: tags -1 +fixed-in-experimental

3.4.4+dfsg-1~exp1

Added tag(s) fixed-in-experimental. Request was from Mo Zhou <lumin@debian.org> to 886674-submit@bugs.debian.org. (Thu, 06 Dec 2018 01:33:07 GMT) (full text, mbox, link).

Marked as fixed in versions opencv/3.2.0+dfsg-5ubuntu1. Request was from Mattia Rizzolo <mattia@debian.org> to control@bugs.debian.org. (Tue, 12 Feb 2019 11:00:09 GMT) (full text, mbox, link).

Marked Bug as done Request was from Mattia Rizzolo <mattia@debian.org> to control@bugs.debian.org. (Tue, 12 Feb 2019 11:00:10 GMT) (full text, mbox, link).

Notification sent to Salvatore Bonaccorso <carnil@debian.org>:
Bug acknowledged by developer. (Tue, 12 Feb 2019 11:00:10 GMT) (full text, mbox, link).

Marked as fixed in versions opencv/3.4.4+dfsg-1~exp1. Request was from Mattia Rizzolo <mattia@debian.org> to control@bugs.debian.org. (Tue, 12 Feb 2019 11:15:02 GMT) (full text, mbox, link).

Marked as fixed in versions opencv/3.4.4+dfsg-1~exp1; no longer marked as fixed in versions opencv/3.4.4+dfsg-1~exp1. Request was from Mattia Rizzolo <mattia@debian.org> to control@bugs.debian.org. (Tue, 12 Feb 2019 11:15:06 GMT) (full text, mbox, link).

Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Wed, 13 Mar 2019 07:30:54 GMT) (full text, mbox, link).

Send a report that this bug log contains spam.

Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Wed Jun 19 17:20:09 2019; Machine Name: buxtehude

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook

Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started