{
  "threat_severity" : "Moderate",
  "public_date" : "2020-01-02T00:00:00Z",
  "bugzilla" : {
    "description" : "opencv: Heap buffer overflow in persistence_xml.cpp while parsing crafted XML file",
    "id" : "1790055",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1790055"
  },
  "cvss3" : {
    "cvss3_base_score" : "8.8",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
    "status" : "draft"
  },
  "cwe" : "CWE-122",
  "details" : [ "An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV 4.1.0. A specially crafted XML file can cause a buffer overflow, resulting in multiple heap corruptions and potential code execution. An attacker can provide a specially crafted file to trigger this vulnerability.", "A heap buffer overflow vulnerability was found in the data structure persistence functionality of OpenCV. Specifically, a specially crafted XML file could cause a buffer overflow, resulting in multiple heap corruptions and potential code execution. A remote attacker could exploit this flaw by providing a specially crafted XML file to trigger this vulnerability." ],
  "statement" : "This flaw did not affect the versions of OpenCV as shipped with Red Hat Enterprise Linux 6, 7, and 8, as they did not include the vulnerable code, which was introduced in a later version of the library.",
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "opencv",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "opencv",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "opencv",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2019-5063\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-5063\nhttps://talosintelligence.com/vulnerability_reports/TALOS-2019-0852" ],
  "name" : "CVE-2019-5063",
  "mitigation" : {
    "value" : "Avoid loading OpenCV data structures from external untrusted XML files.",
    "lang" : "en:us"
  },
  "csaw" : false
}