opencv-python-headless bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863

Description

References

• nvd.nist.gov/vuln/detail/CVE-2023-4863 · ADVISORY
• opencv/opencv#24274 · WEB
• opencv/opencv commit 687fc11 · WEB
• GitHub Advisory GHSA-j7hp-h8jx-5ppr · ADVISORY
• opencv/opencv-python · PACKAGE
• opencv/opencv · WEB
• pypa/advisory-database · WEB

More vulnerabilities in opencv-python-headless

• PYSEC-2023-184opencv-python-headless versions before v4.8.1.78 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863. opencv-python-head…
• CVE-2019-5064HIGH 8.8An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, before version 4.2.0. A …
• CVE-2019-5063HIGH 8.8An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV 4.1.0. A specially crafte…
• CVE-2019-19624MEDIUM 6.5An out-of-bounds read was discovered in OpenCV before 4.1.1. Specifically, variable coarsest_scale is assumed to be greater than or equal to…
• CVE-2019-9423HIGH 7.8In opencv calls that use libpng, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation …