CVE-2024-29162

Name of the Vulnerable Software and Affected Versions HDF5 versions 1.13.3 and earlier HDF5 versions 1.14.2 and earlier

Description The issue is related to a buffer overflow in the H5HG cache heap deserialize() function of the HDF5 library, which can lead to a denial of service or potential code execution, affecting the confidentiality, integrity, and availability of protected information. The vulnerability is also present in the H5HG read function, where a stack buffer overflow can occur.

Recommendations For HDF5 versions 1.13.3 and earlier, consider updating to a version later than 1.13.3 to resolve the issue. For HDF5 versions 1.14.2 and earlier, consider updating to a version later than 1.14.2 to resolve the issue. As a temporary workaround, consider restricting access to the H5HG read function and the H5HG cache heap deserialize() function until a patch is available.