PT-2022-7536 · Hdf5+2 · Hdf5+2
Published
2022-08-22
·
Updated
2024-11-08
·
CVE-2024-29162
CVSS v3.1
7.4
High
| Vector | AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
HDF5 versions 1.13.3 and earlier
HDF5 versions 1.14.2 and earlier
Description
The issue is related to a buffer overflow in the H5HG cache heap deserialize() function of the HDF5 library, which can lead to a denial of service or potential code execution, affecting the confidentiality, integrity, and availability of protected information. The vulnerability is also present in the H5HG read function, where a stack buffer overflow can occur.
Recommendations
For HDF5 versions 1.13.3 and earlier, consider updating to a version later than 1.13.3 to resolve the issue.
For HDF5 versions 1.14.2 and earlier, consider updating to a version later than 1.14.2 to resolve the issue.
As a temporary workaround, consider restricting access to the H5HG read function and the H5HG cache heap deserialize() function until a patch is available.
Fix
DoS
Heap Based Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Hdf5
Red Os