CVE-2024-32606

HDF5 Library through 1.14.3 may attempt to dereference uninitialized values in h5tools_str_sprint in tools/lib/h5tools_str.c (called from h5tools_dump_simple_data in tools/lib/h5tools_dump.c).
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.7 MEDIUM
LOCAL
HIGH
NONE
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
mitreCNA
---
---
CVEADP
---
---
CISA-ADPADP
5.7 MEDIUM
LOCAL
HIGH
NONE
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 5%
VendorProductVersion
hdfgrouphdf5
𝑥
< 1.14.4
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
hdf5
bullseye
no-dsa
bookworm
no-dsa
sid
1.14.5+repack-3
fixed
trixie
1.14.5+repack-3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
hdf5
plucky
needs-triage
oracular
needs-triage
noble
needs-triage
mantic
ignored
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
trusty
needs-triage
Common Weakness Enumeration
References
https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/