Uninitialized Value Vulnerability in HDF5 Library
CVE-2024-32611

9.8CRITICAL

Key Information:

Vendor

The HDF Group

Status
Hdf5
Vendor
CVE Published:
14 May 2024

What is CVE-2024-32611?

The HDF5 Library, up to version 1.14.3, is susceptible to a vulnerability stemming from the use of an uninitialized value in the H5A__attr_release_table function within the H5Aint.c implementation. This flaw could potentially lead to unexpected behavior or security issues during attribute releases, emphasizing the importance of updating to the latest version. The issue has been addressed in HDF5 version 1.14.4 and users are strongly encouraged to upgrade to mitigate risks associated with this vulnerability.

References

https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixe...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.