Heap-based Buffer Over-read in HDF5 Library
CVE-2024-32617

8.8HIGH

Key Information:

Vendor

HDF Group

Status
Hdf5
Vendor
CVE Published:
14 May 2024

What is CVE-2024-32617?

A vulnerability exists in the HDF5 Library that leads to heap-based buffer over-reads. This issue is caused by the unsafe use of 'strdup' within the 'H5MM_xstrdup' function, which is invoked from 'H5G__ent_to_link' in the H5Glink.c file. Affected users of HDF5 Library versions 1.14.3 and earlier are urged to upgrade to version 1.14.4 or later to mitigate the associated security risks.

References

https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixe...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

.