p PatchFirst

CVE-2016-4332

CVE-2016-4332

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The library's failure to check if certain message types support a particular flag, the HDF5 1.8.16 library will cast the structure to an alternative structure and then assign to fields that aren't supported by the message type and the library will write outside the bounds of the heap buffer. This can lead to code execution under the context of the library.

CVSS 8.6 · High · EPSS 0.8% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • hdf5 Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.10.0-patch1+docs-1

    Update to 1.10.0-patch1+docs-1

  • hdf5 Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.10.0-patch1+docs-1

    Update to 1.10.0-patch1+docs-1

  • hdf5 Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.10.0-patch1+docs-1

    Update to 1.10.0-patch1+docs-1

  • hdf5 Ubuntu:14.04:LTS

    Versions
    • 1.8.11-3ubuntu1
    • 1.8.11-5ubuntu1
    • 1.8.11-5ubuntu2
    • 1.8.11-5ubuntu6
    • 1.8.11-5ubuntu7
    Affected ranges
    • ECOSYSTEM: < 1.8.11-5ubuntu7.1

    Update to 1.8.11-5ubuntu7.1

  • hdf5 Ubuntu:16.04:LTS

    Versions
    • 1.8.15-patch1+docs-4
    • 1.8.15-patch1+docs-5
    • 1.8.16+docs-1
    • 1.8.16+docs-2
    • 1.8.16+docs-3
    • 1.8.16+docs-3ubuntu1
    • 1.8.16+docs-4
    • 1.8.16+docs-4ubuntu1
    Affected ranges
    • ECOSYSTEM: < 1.8.16+docs-4ubuntu1.1

    Update to 1.8.16+docs-4ubuntu1.1

Original sources

Check your server →