openSUSE Security Update: Security update for opencv
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2018:1438-1
Rating:             important
References:         #1074312 #1074313 #1074487 #1075017 #1075019 
                    
Cross-References:   CVE-2017-1000450 CVE-2017-17760 CVE-2017-18009
                    CVE-2018-5268 CVE-2018-5269
Affected Products:
                    openSUSE Leap 42.3
______________________________________________________________________________

   An update that fixes 5 vulnerabilities is now available.

Description:

   This update for opencv fixes the following issues:

   - CVE-2018-5268: Fixed a heap-based buffer overflow in
     incv::Jpeg2KDecoder::readComponent8u in
     modules/imgcodecs/src/grfmt_jpeg2000.cppwhen parsing a crafted image
     file. (boo#1075017)
   - CVE-2017-17760: Fixed an buffer overflow in function
     cv::PxMDecoder::readData (boo#1074313)
   - CVE-2017-18009: Fixed a heap-based buffer over-read in function
     cv::HdrDecoder::checkSignature (boo#1074312)
   - CVE-2017-1000450: Functions FillUniColor and FillUniGray do not check
     the input length which could lead to out of bounds writes and crashes
     (boo#1074487)
   - CVE-2018-5269: Fixed an assertion failure happens in
     cv::RBaseStream::setPos inmodules/imgcodecs/src/bitstrm.cpp because of
     an incorrect integer cast (bsc#1075019).


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended
 installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Leap 42.3:

      zypper in -t patch openSUSE-2018-534=1



Package List:

   - openSUSE Leap 42.3 (x86_64):

      libopencv-qt56_3-3.1.0-4.11.1
      libopencv-qt56_3-debuginfo-3.1.0-4.11.1
      libopencv3_1-3.1.0-4.11.1
      libopencv3_1-debuginfo-3.1.0-4.11.1
      opencv-3.1.0-4.11.1
      opencv-debuginfo-3.1.0-4.11.1
      opencv-debugsource-3.1.0-4.11.1
      opencv-devel-3.1.0-4.11.1
      opencv-doc-3.1.0-4.11.1
      opencv-qt5-3.1.0-4.11.1
      opencv-qt5-debuginfo-3.1.0-4.11.1
      opencv-qt5-debugsource-3.1.0-4.11.1
      opencv-qt5-devel-3.1.0-4.11.1
      opencv-qt5-doc-3.1.0-4.11.1
      python-opencv-3.1.0-4.11.1
      python-opencv-debuginfo-3.1.0-4.11.1
      python-opencv-qt5-3.1.0-4.11.1
      python-opencv-qt5-debuginfo-3.1.0-4.11.1
      python3-opencv-3.1.0-4.11.1
      python3-opencv-debuginfo-3.1.0-4.11.1
      python3-opencv-qt5-3.1.0-4.11.1
      python3-opencv-qt5-debuginfo-3.1.0-4.11.1


References:

   https://www.suse.com/security/cve/CVE-2017-1000450.html
   https://www.suse.com/security/cve/CVE-2017-17760.html
   https://www.suse.com/security/cve/CVE-2017-18009.html
   https://www.suse.com/security/cve/CVE-2018-5268.html
   https://www.suse.com/security/cve/CVE-2018-5269.html
   https://bugzilla.suse.com/1074312
   https://bugzilla.suse.com/1074313
   https://bugzilla.suse.com/1074487
   https://bugzilla.suse.com/1075017
   https://bugzilla.suse.com/1075019

-- 
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org