Stack-Based Buffer Over-Read in HDF5 Library by HDF Group
CVE-2018-13866

9.8CRITICAL

Key Information:

Vendor

Hdfgroup

Status
Hdf5
Vendor
CVE Published:
10 July 2018

What is CVE-2018-13866?

A stack-based buffer over-read has been identified in the HDF5 1.8.20 library, specifically in the function H5F_addr_decode_len located in H5Fint.c. This vulnerability can lead to data exposure, potentially allowing an attacker to retrieve sensitive information from the stack. Developers and system administrators using this version of HDF5 are advised to review their systems for exposure and apply necessary updates or mitigations.

References

https://github.com/TeamSeri0us/pocs/tree/master/hdf5
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.