PT-2024-6194 · Unknown+2 · Hdf5 Library+2
Published
2024-05-09
·
Updated
2026-03-29
·
CVE-2024-32623
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
HDF5 Library versions through 1.14.3
Description
The issue is related to a heap-based buffer overflow in the
H5VM array fill() function in the H5VM.c file of the HDF5 Library. This overflow can be triggered when the H5S select elements function in H5Spoint.c calls H5VM array fill(). Exploitation of this issue may allow a remote attacker to impact the confidentiality, integrity, and availability of protected information, potentially leading to a denial of service.Recommendations
For HDF5 Library versions through 1.14.3, as a temporary workaround, consider disabling the
H5VM array fill() function until a patch is available. Restrict access to the H5VM.c file and related functions to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Heap Based Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Hdf5 Library
Red Os