CVE-2023-39010 Code injection in BoofCV
Attackers can execute arbitrary code by tricking users into loading a malicious camera calibration file in BoofCV.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-39010?
CVE-2023-39010 is a critical code injection vulnerability in n/a, published on 28 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
BoofCV 0.42 was discovered to contain a code injection vulnerability via the component boofcv.io.calibration.CalibrationIO.load. This vulnerability is exploited by loading a crafted camera calibration file.
Weakness: CWE-94
Which versions are affected by CVE-2023-39010?
2 open source packages ship an affected version, including org.boofcv:boofcv-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.boofcv:boofcv-core Maven | All versions | 0.43.1 |
org.boofcv:boofcv-core Maven | All versions | 0.43.1 |
Products include Boofcv Boofcv.
How do I fix CVE-2023-39010?
Upgrade org.boofcv:boofcv-core to 0.43.1 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-39010 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-39010 exists.
Sources
Also known as GHSA-99p5-qpqx-mhwc.