{
  "threat_severity" : "Moderate",
  "public_date" : "2020-01-02T00:00:00Z",
  "bugzilla" : {
    "description" : "opencv: Heap buffer overflow in persistence_json.cpp while parsing crafted JSON file",
    "id" : "1790059",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1790059"
  },
  "cvss3" : {
    "cvss3_base_score" : "8.8",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
    "status" : "draft"
  },
  "cwe" : "CWE-122",
  "details" : [ "An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, before version 4.2.0. A specially crafted JSON file can cause a buffer overflow, resulting in multiple heap corruptions and potentially code execution. An attacker can provide a specially crafted file to trigger this vulnerability.", "A heap buffer overflow vulnerability was found in the data structure persistence functionality of OpenCV. Specifically, a specially crafted JSON file could cause a buffer overflow, resulting in multiple heap corruptions and potential code execution. A remote attacker could exploit this flaw by providing a specially crafted JSON file to trigger this vulnerability." ],
  "statement" : "This flaw did not affect the versions of OpenCV as shipped with Red Hat Enterprise Linux 6, 7, and 8, as they did not include the vulnerable code, which was introduced in a later version of the library.",
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "opencv",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "opencv",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "opencv",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2019-5064\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-5064\nhttps://talosintelligence.com/vulnerability_reports/TALOS-2019-0853" ],
  "name" : "CVE-2019-5064",
  "mitigation" : {
    "value" : "Avoid loading OpenCV data structures from external untrusted JSON files.",
    "lang" : "en:us"
  },
  "csaw" : false
}