PT-2016-5893 · Hdf+1 · Hdf5+1

Published 2016-11-18 · Updated 2018-04-24 · CVE-2016-4333

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HDF5 version 1.8.16

Description The issue allows an aggressor to cause the loop's index to point outside the bounds of the array when initializing it, due to the library allocating space for the array using a value from the file. This can have an impact within the loop for initializing the array, allowing a value within the file to modify the loop's terminator.

Recommendations For HDF5 version 1.8.16, consider updating to a newer version that contains a fix for this issue, as using a value from the file to allocate space for the array can lead to out-of-bounds access.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2016-4333

DLA-771-1

DSA-3727-1

MGASA-2016-0425

OPENSUSE-SU-2018:1051-1

OPENSUSE-SU-2018:1056-1

OPENSUSE-SU-2018_1056-1

Affected Products

Hdf5

Suse

References · 43

• 🔥 http://talosintelligence.com/reports/TALOS-2016-0179 · Exploit
• https://ubuntu.com/security/CVE-2016-4333 · Vendor Advisory
• https://security.gentoo.org/glsa/201701-13 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-4333 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2016-0425 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3727-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2018:1051-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4331 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2016-4333 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2018:1056-1 · Vendor Advisory
• http://debian.org/security/2016/dsa-3727 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4333 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-4333 · Vendor Advisory
• https://debian.org/security/2016/dsa-3727 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3727-1 · Vendor Advisory