PT-2018-12289 · Hdf+2 · Hdf5+2

Published 2018-07-13 · Updated 2026-03-29 · CVE-2018-14033

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HDF5 version 1.8.20

Description A heap-based buffer over-read issue was discovered in the HDF5 library, specifically in the function H5O layout decode in H5Olayout.c. This issue is related to the HDmemcpy function.

Recommendations For version 1.8.20, consider applying a patch or fix that addresses the heap-based buffer over-read in the H5O layout decode function. As a temporary workaround, consider restricting access to the H5O layout decode function until a patch is available.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2018-14033

ECHO-0707-183D-ABEA

OESA-2023-1325

OESA-2023-1326

OESA-2023-1328

OPENSUSE-SU-2022_1912-1

SUSE-SU-2022:1903-1

SUSE-SU-2022:1910-1

SUSE-SU-2022:1911-1

SUSE-SU-2022:1912-1

SUSE-SU-2022:1933-1

Affected Products

Debian

Hdf5

Suse

References · 101

• 🔥 https://github.com/TeamSeri0us/pocs/blob/master/hdf5/README2.md · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2022:1910-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-14033 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-14033 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10811 · Security Note
• https://cve.org/CVERecord?id=CVE-2018-14033 · Security Note
• https://osv.dev/vulnerability/OESA-2023-1325 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:1903-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-14033 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2022:1933-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1326 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1328 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-14033 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:1911-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-14033 · Vendor Advisory