Rulkallos

Name of the Vulnerable Software and Affected Versions: HDF5 versions up to 1.14.6 Description: A critical vulnerability has been found in HDF5, affecting the function `H5F addr decode len` of the file /hdf5/src/H5Fint.c. The manipulation leads to a heap-based buffer overflow. An attack must be approached locally. The exploit has been disclosed to the public and may be used. Recommendations: For HDF5 versions up to 1.14.6, as a temporary workaround, consider disabling the `H5F addr decode len` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HDF5 versions up to 1.14.6 **Description** A critical vulnerability was found in HDF5, affecting the function `H5C reconstruct cache entry` of the file `H5Cimage.c`. This issue leads to a heap-based buffer overflow. The exploitation of this vulnerability requires local access. **Recommendations** For HDF5 versions up to 1.14.6, update to a version later than 1.14.6 to resolve the issue. As a temporary workaround, consider restricting access to the `H5C reconstruct cache entry` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** HDF5 versions up to 1.14.6 **Description** A critical issue has been found, affecting the `H5FS sect find node` function of the file H5FSsection.c, leading to a heap-based buffer overflow. The attack can be launched on the local host. **Recommendations** For HDF5 versions up to 1.14.6, as a temporary workaround, consider disabling the `H5FS sect find node` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Open Asset Import Library Assimp versions up to 5.4.3 **Description** A critical vulnerability has been found in the Open Asset Import Library Assimp. The issue affects the function `Assimp::BVHLoader::ReadNodeChannels` in the library `assimp/code/AssetLib/BVH/BVHLoader.cpp`. The manipulation of the argument `pNode` leads to use after free. Local attacks are required to exploit this issue. The exploit has been disclosed to the public and may be used. **Recommendations** For versions up to 5.4.3, as a temporary workaround, consider disabling the `Assimp::BVHLoader::ReadNodeChannels` function until a patch is available. Restrict access to the `assimp/code/AssetLib/BVH/BVHLoader.cpp` library to minimize the risk of exploitation. Avoid using the argument `pNode` in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Open Asset Import Library Assimp versions up to 5.4.3 **Description** A critical issue was found in the Open Asset Import Library Assimp. The `read meshes` function in the library is affected, leading to a heap-based buffer overflow. This issue can be exploited on the local host. **Recommendations** For versions up to 5.4.3, as a temporary workaround, consider disabling the `read meshes` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.