Bug 866091 (CVE-2022-25942, CVE-2022-25972, CVE-2022-26061)

Summary:	sci-libs/hdf5: multiple vulnerabilities
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	CONFIRMED ---
Severity:	normal	CC:	sci
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	B2 [upstream]
Package list:		Runtime testing required:	---

Description John Helmert III archtester

2022-08-23 02:04:02 UTC

CVE-2022-25942 (https://talosintelligence.com/vulnerability_reports/TALOS-2022-1486):

An out-of-bounds read vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. A specially-crafted GIF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.

CVE-2022-25972 (https://talosintelligence.com/vulnerability_reports/TALOS-2022-1485):

An out-of-bounds write vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. A specially-crafted GIF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.

CVE-2022-26061 (https://talosintelligence.com/vulnerability_reports/TALOS-2022-1487):

A heap-based buffer overflow vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. A specially-crafted GIF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.