Data Handling Flaw in HDF5 Library Impacting Multiple Versions
CVE-2024-32606

5.7MEDIUM

Key Information:

Vendor

The HDF Group

Status
Hdf5
Vendor
CVE Published:
14 May 2024

What is CVE-2024-32606?

The HDF5 Library, which is widely used for managing and manipulating scientific data files, has a vulnerability where it may attempt to dereference uninitialized values in the function h5tools_str_sprint. This occurs within the context of h5tools_dump_simple_data, which impacts how data is processed and displayed to users. Such behavior can lead to exploitation that compromises data integrity and security, making it essential for users to upgrade to HDF5 Library version 1.14.4 or later to mitigate associated risks.

References

https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixe...

CVSS V3.1

Score:
5.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.