CVE catalog

CVE-2019-14491

opencv: CVE-2019-14491

Severity: Medium · CVSS 6.2CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: Aug 1, 2019, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 2.89% · Oct 25, 2026

An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1. There is an out of bounds read in the function cv::predictOrdered<cv::HaarEvaluator> in modules/objdetect/src/cascadedetect.hpp, which leads to denial of service.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	opencv	sid	`4.10.0+dfsg-9`	fixed
Debian	opencv	forky	`4.10.0+dfsg-9`	fixed
Debian	opencv	trixie	`4.10.0+dfsg-5`	fixed
Debian	opencv	bookworm	`4.6.0+dfsg-12`	fixed
Ubuntu	opencv	pro	`3.1.0+dfsg1-1~exp1ubuntu3`	vulnerable
Ubuntu	opencv	pro	`3.2.0+dfsg-3`	vulnerable
Ubuntu	opencv	pro	`3.2.0+dfsg-4`	vulnerable
Ubuntu	opencv	pro	`3.2.0+dfsg-4build1`	vulnerable
Ubuntu	opencv	pro	`3.2.0+dfsg-4build2`	vulnerable
Ubuntu	opencv	pro	`3.2.0+dfsg-4ubuntu0.1`	vulnerable
Ubuntu	opencv	pro	`3.2.0+dfsg-4ubuntu0.1+esm2`	fixed
Suse	opencv	linux enterprise module for package hub 15	`3.3.1-6.6.1`	fixed
Suse	opencv	linux enterprise workstation extension 15	`3.3.1-6.6.1`	fixed
Suse	opencv	linux enterprise workstation extension 15 sp1	`3.3.1-6.6.1`	fixed
Opensuse	opencv3	tumbleweed	`3.4.10-3.3`	fixed
Opensuse	opencv	leap 15.1	`3.3.1-lp151.6.3.1`	fixed
Suse	opencv	linux enterprise module for package hub 15 sp1	`3.3.1-6.6.1`	fixed
Suse	opencv	linux enterprise module for package hub 15 sp2	`3.3.1-6.6.1`	fixed
Suse	opencv	linux enterprise workstation extension 15 sp2	`3.3.1-6.6.1`	fixed
Opensuse	opencv	tumbleweed	`4.5.2-2.2`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	opencv	source	sid	`4.1.2+dfsg-3`	not yet assigned	Not reported	Not reported
Debian	opencv	source	forky	`4.1.2+dfsg-3`	not yet assigned	Not reported	Not reported
Debian	opencv	source	trixie	`4.1.2+dfsg-3`	not yet assigned	Not reported	Not reported
Debian	opencv	source	bookworm	`4.1.2+dfsg-3`	not yet assigned	Not reported	Not reported
Ubuntu	opencv	deb	pro	`3.2.0+dfsg-4ubuntu0.1+esm2`	Not reported	UBUNTU-CVE-2019-14491	Not reported
Suse	opencv	rpm	linux enterprise module for package hub 15	`3.3.1-6.6.1`	Not reported	SUSE-SU-2019:3192-1	Not reported
Suse	opencv	rpm	linux enterprise workstation extension 15	`3.3.1-6.6.1`	Not reported	SUSE-SU-2019:3192-1	Not reported
Suse	opencv	rpm	linux enterprise workstation extension 15 sp1	`3.3.1-6.6.1`	Not reported	SUSE-SU-2019:3192-1	Not reported
Opensuse	opencv3	rpm	tumbleweed	`3.4.10-3.3`	Not reported	OPENSUSE-SU-2024:11116-1	Not reported
Opensuse	opencv	rpm	leap 15.1	`3.3.1-lp151.6.3.1`	Not reported	OPENSUSE-SU-2019:2671-1	Not reported
Suse	opencv	rpm	linux enterprise module for package hub 15 sp1	`3.3.1-6.6.1`	Not reported	SUSE-SU-2019:3192-2	Not reported
Suse	opencv	rpm	linux enterprise module for package hub 15 sp2	`3.3.1-6.6.1`	Not reported	SUSE-SU-2019:3192-2	Not reported
Suse	opencv	rpm	linux enterprise workstation extension 15 sp2	`3.3.1-6.6.1`	Not reported	SUSE-SU-2019:3192-2	Not reported
Opensuse	opencv	rpm	tumbleweed	`4.5.2-2.2`	Not reported	OPENSUSE-SU-2024:11115-1	Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

[libopencv413]Unknown
Source package: [opencv]
Details (1)
- 4.13.0-1.8 · x86_64 · tumbleweed
  Unknown · Fixed: 4.5.2-2.2
  Version impact unknown
  dsa · opencv · opensuse · tumbleweed
[libopencv_aruco413]Unknown
Source package: [opencv]
Details (1)
- 4.13.0-1.8 · x86_64 · tumbleweed
  Unknown · Fixed: 4.5.2-2.2
  Version impact unknown
  dsa · opencv · opensuse · tumbleweed
[libopencv_face413]Unknown
Source package: [opencv]
Details (1)
- 4.13.0-1.8 · x86_64 · tumbleweed
  Unknown · Fixed: 4.5.2-2.2
  Version impact unknown
  dsa · opencv · opensuse · tumbleweed
[libopencv_gapi413]Unknown
Source package: [opencv]
Details (1)
- 4.13.0-1.8 · x86_64 · tumbleweed
  Unknown · Fixed: 4.5.2-2.2
  Version impact unknown
  dsa · opencv · opensuse · tumbleweed
[libopencv_highgui413]Unknown
Source package: [opencv]
Details (1)
- 4.13.0-1.8 · x86_64 · tumbleweed
  Unknown · Fixed: 4.5.2-2.2
  Version impact unknown
  dsa · opencv · opensuse · tumbleweed
[libopencv_imgcodecs413]Unknown
Source package: [opencv]
Details (1)
- 4.13.0-1.8 · x86_64 · tumbleweed
  Unknown · Fixed: 4.5.2-2.2
  Version impact unknown
  dsa · opencv · opensuse · tumbleweed
[libopencv_objdetect413]Unknown
Source package: [opencv]
Details (1)
- 4.13.0-1.8 · x86_64 · tumbleweed
  Unknown · Fixed: 4.5.2-2.2
  Version impact unknown
  dsa · opencv · opensuse · tumbleweed
[libopencv_optflow413]Unknown
Source package: [opencv]
Details (1)
- 4.13.0-1.8 · x86_64 · tumbleweed
  Unknown · Fixed: 4.5.2-2.2
  Version impact unknown
  dsa · opencv · opensuse · tumbleweed
[libopencv_superres413]Unknown
Source package: [opencv]
Details (1)
- 4.13.0-1.8 · x86_64 · tumbleweed
  Unknown · Fixed: 4.5.2-2.2
  Version impact unknown
  dsa · opencv · opensuse · tumbleweed
[libopencv_videoio413]Unknown
Source package: [opencv]
Details (1)
- 4.13.0-1.8 · x86_64 · tumbleweed
  Unknown · Fixed: 4.5.2-2.2
  Version impact unknown
  dsa · opencv · opensuse · tumbleweed
[libopencv_videostab413]Unknown
Source package: [opencv]
Details (1)
- 4.13.0-1.8 · x86_64 · tumbleweed
  Unknown · Fixed: 4.5.2-2.2
  Version impact unknown
  dsa · opencv · opensuse · tumbleweed
[libopencv_ximgproc413]Unknown
Source package: [opencv]
Details (1)
- 4.13.0-1.8 · x86_64 · tumbleweed
  Unknown · Fixed: 4.5.2-2.2
  Version impact unknown
  dsa · opencv · opensuse · tumbleweed
[opencv4-cascades-data]Unknown
Source package: [opencv]
Details (1)
- 4.13.0-1.8 · noarch · tumbleweed
  Unknown · Fixed: 4.5.2-2.2
  Version impact unknown
  dsa · opencv · opensuse · tumbleweed
[opencv-devel]Unknown
Source package: [opencv]
Details (1)
- 4.13.0-1.8 · x86_64 · tumbleweed
  Unknown · Fixed: 4.5.2-2.2
  Version impact unknown
  dsa · opencv · opensuse · tumbleweed
[opencv-doc]Unknown
Source package: [opencv]
Details (1)
- 4.13.0-1.8 · noarch · tumbleweed
  Unknown · Fixed: 4.5.2-2.2
  Version impact unknown
  dsa · opencv · opensuse · tumbleweed
[python313-opencv]Unknown
Source package: [opencv]
Details (1)
- 4.13.0-1.8 · x86_64 · tumbleweed
  Unknown · Fixed: 4.5.2-2.2
  Version impact unknown
  dsa · opencv · opensuse · tumbleweed
[python314-opencv]Unknown
Source package: [opencv]
Details (1)
- 4.13.0-1.8 · x86_64 · tumbleweed
  Unknown · Fixed: 4.5.2-2.2
  Version impact unknown
  dsa · opencv · opensuse · tumbleweed

[Debian 12 (Bookworm)]

[libopencv406-jni]Fixed
Source package: [opencv]
Details (2)
- 4.6.0+dfsg-12 · amd64 · bookworm
  Fixed · Fixed: 4.1.2+dfsg-3
  dsa · opencv · debian · bookworm; dsa · opencv · debian · 12
- 4.6.0+dfsg-12 · arm64 · bookworm
  Fixed · Fixed: 4.1.2+dfsg-3
  dsa · opencv · debian · bookworm; dsa · opencv · debian · 12
[libopencv-calib3d406]Fixed
Source package: [opencv]
Details (2)
- 4.6.0+dfsg-12 · amd64 · bookworm
  Fixed · Fixed: 4.1.2+dfsg-3
  dsa · opencv · debian · bookworm; dsa · opencv · debian · 12
- 4.6.0+dfsg-12 · arm64 · bookworm
  Fixed · Fixed: 4.1.2+dfsg-3
  dsa · opencv · debian · bookworm; dsa · opencv · debian · 12
[libopencv-calib3d-dev]Fixed
Source package: [opencv]
Details (2)
- 4.6.0+dfsg-12 · amd64 · bookworm
  Fixed · Fixed: 4.1.2+dfsg-3
  dsa · opencv · debian · bookworm; dsa · opencv · debian · 12
- 4.6.0+dfsg-12 · arm64 · bookworm
  Fixed · Fixed: 4.1.2+dfsg-3
  dsa · opencv · debian · bookworm; dsa · opencv · debian · 12

Next results

Observed: Oct 23, 2026, 5:40:07 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]