NULL pointer dereference in OpenCV - CVE-2019-14493

Vulnerability identifier: #VU30956

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-14493

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dreference error in function cv::XMLParser::parse at modules/core/src/persistence.cpp. A remote attacker can perform a denial of service (DoS) attack.

OpenCV
Ubuntu
libopencv-contrib4.5d (Ubuntu package)
libopencv-core4.5d (Ubuntu package)
libopencv-dev (Ubuntu package)
libopencv-dnn4.5d (Ubuntu package)
libopencv-flann4.5d (Ubuntu package)
libopencv-imgcodecs4.5d (Ubuntu package)
libopencv-objdetect4.5d (Ubuntu package)
opencv-data (Ubuntu package)
libopencv-core3.2 (Ubuntu package)

Update to version 4.1.1.

OpenCV - update to 4.1.1
libopencv-contrib4.5d (Ubuntu package) - update to Ubuntu Pro
libopencv-core4.5d (Ubuntu package) - update to Ubuntu Pro
libopencv-dev (Ubuntu package) - update to Ubuntu Pro
libopencv-dnn4.5d (Ubuntu package) - update to Ubuntu Pro
libopencv-flann4.5d (Ubuntu package) - update to Ubuntu Pro
libopencv-imgcodecs4.5d (Ubuntu package) - update to Ubuntu Pro
libopencv-objdetect4.5d (Ubuntu package) - update to Ubuntu Pro
opencv-data (Ubuntu package) - update to Ubuntu Pro
libopencv-core3.2 (Ubuntu package) - update to Ubuntu Pro

• https://github.com/opencv/opencv/compare/371bba8...ddbd10c
• https://github.com/opencv/opencv/issues/15127

• Multiple vulnerabilities in Itseez OpenCV
• Ubuntu update for opencv