CVE-2019-9423
Publication date 27 September 2019
Last updated 24 July 2024
Ubuntu priority
In opencv calls that use libpng, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges required. User interaction is not required for exploitation. Product: AndroidVersions: Android-10Android ID: A-110986616
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| opencv | 24.10 oracular |
Vulnerable, fix deferred
|
| 24.04 LTS noble |
Vulnerable, fix deferred
|
|
| 22.04 LTS jammy |
Vulnerable, fix deferred
|
|
| 20.04 LTS focal |
Vulnerable, fix deferred
|
|
| 18.04 LTS bionic |
Vulnerable, fix deferred
|
|
| 16.04 LTS xenial |
Vulnerable, fix deferred
|
|
| 14.04 LTS trusty | Ignored end of ESM support, was deferred [2022-10-24] |
Notes
mdeslaur
no details as of 2020-03-09
ccdm94
no details as of 2022-08-23. This CVE was disclosed by Android and it possibly affects the opencv software. More information was requested by members of the community so that the vulnerability status for the Linux implementation of the opencv software could be determined, however, no response was provided. No known upstream patch is available.
rodrigo-zaiden
no details as of 2022-10-24.
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
7.8 · High
|
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |