PT-2018-12242 · Hdf · Hdf5

Published 2018-07-10 · Updated 2020-08-24 · CVE-2018-13874

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HDF5 version 1.8.20

Description A stack-based buffer overflow issue was found in the HDF5 library, specifically in the H5FD sec2 read function located in H5FDsec2.c. This issue is related to the HDmemset function.

Recommendations For HDF5 version 1.8.20, consider applying a patch or fix that addresses the buffer overflow in the H5FD sec2 read function. As a temporary workaround, restrict access to the H5FD sec2 read function to minimize the risk of exploitation.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2018-13874

Affected Products

Hdf5

References · 6

• 🔥 https://github.com/TeamSeri0us/pocs/tree/master/hdf5 · Exploit
• https://cve.org/CVERecord?id=CVE-2018-13874 · Security Note
• https://ubuntu.com/security/CVE-2018-13874 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-13874 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-13874 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-13874 · Vendor Advisory