Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 661156 (CVE-2018-14031, CVE-2018-14032, CVE-2018-14033, CVE-2018-14034, CVE-2018-14035) - sci-libs/hdf: Multiple vulnerabilities
Summary: sci-libs/hdf: Multiple vulnerabilities
Status: IN_PROGRESS
Alias: CVE-2018-14031, CVE-2018-14032, CVE-2018-14033, CVE-2018-14034, CVE-2018-14035
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor
Assignee: Gentoo Security
URL:
Whiteboard: B3 [??]
Keywords:
Depends on:
Blocks:
 
Reported: 2018-07-14 16:28 UTC by GLSAMaker/CVETool Bot
Modified: 2022-08-11 01:59 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description GLSAMaker/CVETool Bot gentoo-dev 2018-07-14 16:28:42 UTC 
CVE-2018-14035 (https://nvd.nist.gov/vuln/detail/CVE-2018-14035):
  An issue was discovered in the HDF HDF5 1.8.20 library. There is a
  heap-based buffer over-read in the function H5VM_memcpyvv in H5VM.c.

CVE-2018-14034 (https://nvd.nist.gov/vuln/detail/CVE-2018-14034):
  An issue was discovered in the HDF HDF5 1.8.20 library. There is an out of
  bounds read in the function H5O_pline_reset in H5Opline.c.

CVE-2018-14033 (https://nvd.nist.gov/vuln/detail/CVE-2018-14033):
  An issue was discovered in the HDF HDF5 1.8.20 library. There is a
  heap-based buffer over-read in the function H5O_layout_decode in
  H5Olayout.c, related to HDmemcpy.

CVE-2018-14032 (https://nvd.nist.gov/vuln/detail/CVE-2018-14032):
  An issue was discovered in the HDF HDF5 1.8.20 library. There is a
  heap-based buffer over-read in the function H5O_fill_new_decode in
  H5Ofill.c, related to HDmemcpy.

CVE-2018-14031 (https://nvd.nist.gov/vuln/detail/CVE-2018-14031):
  An issue was discovered in the HDF HDF5 1.8.20 library. There is a
  heap-based buffer over-read in the function H5T_copy in H5T.c.
Comment 1 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-08-11 01:59:06 UTC 
Seems like PoCs are public, but need to comb through them to see if any were ever fixed. https://github.com/TeamSeri0us/pocs/tree/master/hdf5