CVE-2016-4332

HIGH

HDF5 1.8.16 - Heap-Based Buffer Overflow via Unsupported Message Flag

Title source: llm

Description

The library's failure to check if certain message types support a particular flag, the HDF5 1.8.16 library will cast the structure to an alternative structure and then assign to fields that aren't supported by the message type and the library will write outside the bounds of the heap buffer. This can lead to code execution under the context of the library.

References (4)

Core 4

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/94417

Third Party Advisory vendor-advisory x_refsource_gentoo

https://security.gentoo.org/glsa/201701-13

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2016/dsa-3727

Exploit, Technical Description, Third Party Advisory x_refsource_misc

http://www.talosintelligence.com/reports/TALOS-2016-0178/

Scores

CVSS v3 8.6

EPSS 0.0081

EPSS Percentile 52.6%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Details

CWE

CWE-20

Status published

Products (1)

hdfgroup/hdf5 1.8.16

Published Nov 18, 2016

Tracked Since Feb 18, 2026