Miggo Logo
Miggo Vulnerability Database
→
CVE-2019-14492

CVE-2019-14492:
Out-of-bounds Read and Out-of-bounds Write in OpenCV

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2019-14492
GHSA ID
GHSA-fw99-f933-rgh8
EPSS Score
0.67017%
CWE
CWE-125
Published
10/12/2021
Updated
2/1/2023
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
opencv-pythonpip<= 3.4.6.273.4.7.28
opencv-pythonpip>= 4.0.0.21, <= 4.1.0.254.1.1.26
opencv-python-headlesspip<= 3.4.6.273.4.7.28
opencv-python-headlesspip>= 4.0.0.21, <= 4.1.0.254.1.1.26
opencv-contrib-pythonpip<= 3.4.6.273.4.7.28
opencv-contrib-pythonpip>= 4.0.0.21, <= 4.1.0.254.1.1.26
opencv-contrib-python-headlesspip<= 3.4.6.273.4.7.28
opencv-contrib-python-headlesspip>= 4.0.0.21, <= 4.1.0.254.1.1.26

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

  1. The CVE description explicitly names HaarEvaluator::OptFeature::calc as the vulnerable function.
  2. The GitHub issue #15124 provides a code snippet showing the function implementation with CALC_SUM_OFS macro usage and a crash trace.
  3. The OpenSUSE security announcement directly references this function in CVE-2019-14492 context.
  4. All sources consistently point to cascadedetect.hpp as the vulnerable file location.
  5. The combination of OOB read/write CWEs aligns with the macro-based pointer arithmetic shown in the code snippet.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*n issu* w*s *is*ov*r** in Op*n*V ***or* *.*.* *n* *.x ***or* *.*.* (Op*n*V-Pyt*on ***or* *.*.*.** *n* *.x ***or* *.*.*.**). T**r* is *n out o* *oun*s r***/writ* in t** *un*tion ***r*v*lu*tor::Opt***tur*::**l* in mo*ul*s/o*j**t**t/sr*/**s******t**t.*

Reasoning

*. T** *V* **s*ription *xpli*itly n*m*s ***r*v*lu*tor::Opt***tur*::**l* *s t** vuln*r**l* *un*tion. *. T** *it*u* issu* #***** provi**s * *o** snipp*t s*owin* t** *un*tion impl*m*nt*tion wit* **L*_SUM_O*S m**ro us*** *n* * *r*s* tr***. *. T** Op*nSUS