High severity · published Nov 18, 2016
CVE-2016-4330
In the HDF5 1.8.16 library's failure to check if the number of dimensions for an array read from the file is within the bounds of the space allocated for it, a heap-based buffer…
8.6
CVSS
0.8%
EPSS
No
On KEV
Description
In the HDF5 1.8.16 library's failure to check if the number of dimensions for an array read from the file is within the bounds of the space allocated for it, a heap-based buffer overflow will occur, potentially leading to arbitrary code execution.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HD
Hdf5 · Hdfgroup
1.8.16 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-4330
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-4330
www.debian.org
http://www.debian.org/security/2016/dsa-3727
www.securityfocus.com
http://www.securityfocus.com/bid/94414
Exploit
http://www.talosintelligence.com/reports/TALOS-2016-0176/
security.gentoo.org
https://security.gentoo.org/glsa/201701-13
More from Hdf5
9.8
CVE-2024-32608
HDF5 library through 1.14.3 has memory corruption in H5A__close resulting in the corruption of the instruction pointer and causing denial of service or potential code execution
9.8
CVE-2024-33874
HDF5 Library through 1.14.3 has a heap buffer overflow in H5O__mtime_new_encode in H5Omtime.c
9.8
CVE-2024-32621
HDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5HG_read in H5HG.c (called from H5VL__native_blob_get in H5VLnative_blob.c), resulting in the corruption of…
9.8
CVE-2024-32615
HDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5Z__nbit_decompress_one_byte in H5Znbit.c, caused by the earlier use of an initialized pointer
9.8
CVE-2024-32611
HDF5 Library through 1.14.3 may use an uninitialized value in H5A__attr_release_table in H5Aint.c