CVE-2016-4332
Description
The library's failure to check if certain message types support a particular flag, the HDF5 1.8.16 library will cast the structure to an alternative structure and then assign to fields that aren't supported by the message type and the library will write outside the bounds of the heap buffer. This can lead to code execution under the context of the library.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
OS impact
Debian Fixed 5 releases
| Version | Status | Fixed in |
|---|---|---|
| trixie | Fixed | 1.10.0-patch1+docs-1 |
| sid | Fixed | 1.10.0-patch1+docs-1 |
| forky | Fixed | 1.10.0-patch1+docs-1 |
| bullseye | Fixed | 1.10.0-patch1+docs-1 |
| bookworm | Fixed | 1.10.0-patch1+docs-1 |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| hdfgroup | hdf5 | 1.8.16 | |
References
CWEs
CWE-20
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.