PT-2016-5890 · Hdf+1 · Hdf5+1

Publicado 2016-11-18 · Atualizado 2018-04-24 · CVE-2016-4330

Positive Technologies (AI Summary)

CVSS v3.1

8.6

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HDF5 version 1.8.16

Description The issue arises from the failure to check if the number of dimensions for an array read from a file is within the allocated space bounds, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution.

Recommendations For HDF5 version 1.8.16, update to a version that includes a fix for this issue to prevent potential arbitrary code execution.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2016-4330

DLA-771-1

DSA-3727-1

MGASA-2016-0425

OPENSUSE-SU-2018:1051-1

OPENSUSE-SU-2018:1056-1

OPENSUSE-SU-2018_1056-1

Produtos afetados

Hdf5

Suse

Referências · 43

• 🔥 http://talosintelligence.com/reports/TALOS-2016-0176 · Exploit
• https://suse.com/security/cve/CVE-2016-4330.html · Nota
• http://talosintelligence.com/reports/TALOS-2016-0177 · Nota
• https://bugs.mageia.org/show_bug.cgi?id=19874 · Nota
• https://security.gentoo.org/glsa/201701-13 · Aviso do Fabricante
• https://lists.opensuse.org/archives/list/[e-mail]/thread/Q6WDDNJ3NEYHLHLN6YSKTURIF42SBRMI · Nota
• https://cve.org/CVERecord?id=CVE-2016-4330 · Nota de Segurança
• https://osv.dev/vulnerability/MGASA-2016-0425 · Aviso do Fabricante
• http://talosintelligence.com/reports/TALOS-2016-0179 · Nota
• https://bugzilla.suse.com/1011201 · Nota
• https://packages.debian.org/src:hdf5 · Nota
• https://osv.dev/vulnerability/DSA-3727-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2018:1051-1 · Aviso do Fabricante
• https://bugzilla.suse.com/1011198 · Nota
• https://suse.com/security/cve/CVE-2016-4332.html · Nota