CVE-2017-12597 High Severity Vulnerability detected by WhiteSource

[mend-bolt-for-github]

CVE-2017-12597 - High Severity Vulnerability

Vulnerable Library - spring-webmvc-4.3.2.RELEASE.jar

path: /root/.m2/repository/org/springframework/spring-webmvc/4.3.2.RELEASE/spring-webmvc-4.3.2.RELEASE.jar

Dependency Hierarchy:

• spring-boot-starter-web-1.4.0.RELEASE.jar (Root Library)
  • ❌ spring-webmvc-4.3.2.RELEASE.jar (Vulnerable Library)

Vulnerability Details

OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds write error in the function FillColorRow1 in utils.cpp when reading an image file by using cv::imread.

Publish Date: 2017-08-07

URL: CVE-2017-12597

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Change files

Origin: opencv/opencv@aacae20

Release Date: 2017-08-23

Fix Resolution: Replace or update the following files: grfmt_sunras.cpp, grfmt_jpeg.cpp, grfmt_pam.cpp, utils.hpp, grfmt_bmp.cpp, grfmt_exr.cpp, grfmt_jpeg2000.cpp, utils.cpp

---

Step up your Open Source Security Game with WhiteSource here