Red Hat Security Advisory: RHEL AI 1.5 hdf5 security update

Fixed packages 13

Vulnerabilities 30

• Critical 9.8
  CVE-2024-29157

  HDF5 through 1.14.3 contains a heap buffer overflow in H5HG_read, resulting in the corruption of the instruction pointe…

  hdf5 hdf5 hdf5 Debian Ubuntu Azure Linux
  May 9, 2024
• Critical 9.8
  CVE-2024-29159

  HDF5 through 1.14.3 contains a buffer overflow in H5Z__filter_scaleoffset, resulting in the corruption of the instructi…

  hdf5 hdf5 hdf5 Debian Ubuntu Azure Linux
  May 9, 2024
• Critical 9.8
  CVE-2024-29164

  HDF5 through 1.14.3 contains a stack buffer overflow in H5R__decode_heap, resulting in the corruption of the instructio…

  hdf5 hdf5 hdf5 Debian Ubuntu Azure Linux
  May 9, 2024
• Critical 9.8
  CVE-2024-32608

  HDF5 library through 1.14.3 has memory corruption in H5A__close resulting in the corruption of the instruction pointer …

  hdf5 hdf5 Debian Ubuntu
  Oct 9, 2024
• Critical 9.8
  CVE-2024-32611

  HDF5 Library through 1.14.3 may use an uninitialized value in H5A__attr_release_table in H5Aint.c.

  hdf5 hdf5 hdf5 Debian Ubuntu Azure Linux
  May 9, 2024
• Critical 9.8
  CVE-2024-32615

  HDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5Z__nbit_decompress_one_byte in H5Znbit.c, caused…

  hdf5 hdf5 hdf5 Debian Ubuntu Azure Linux
  May 9, 2024
• Critical 9.8
  CVE-2024-32621

  HDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5HG_read in H5HG.c (called from H5VL__native_blob…

  hdf5 hdf5 hdf5 Debian Ubuntu Azure Linux
  May 9, 2024
• Critical 9.8
  CVE-2024-33874

  HDF5 Library through 1.14.3 has a heap buffer overflow in H5O__mtime_new_encode in H5Omtime.c.

  hdf5 hdf5 hdf5 Debian Ubuntu Azure Linux
  May 9, 2024
• Critical 9.1
  CVE-2024-32622

  HDF5 Library through 1.14.3 contains a out-of-bounds read operation in H5FL_arr_malloc in H5FL.c (called from H5S_set_e…

  hdf5 hdf5 hdf5 Debian Ubuntu Azure Linux
  May 9, 2024
• High 8.8
  CVE-2024-29161

  HDF5 through 1.14.3 contains a heap buffer overflow in H5A__attr_release_table, resulting in the corruption of the inst…

  hdf5 hdf5 hdf5 Debian Ubuntu Azure Linux
  May 9, 2024
• High 8.8
  CVE-2024-32605

  HDF5 Library through 1.14.3 has a heap-based buffer over-read in H5VM_memcpyvv in H5VM.c (called from H5D__compact_read…

  hdf5 hdf5 hdf5 Debian Ubuntu Azure Linux
  May 9, 2024
• High 8.8
  CVE-2024-32614

  HDF5 Library through 1.14.3 has a SEGV in H5VM_memcpyvv in H5VM.c.

  hdf5 hdf5 hdf5 Debian Ubuntu Azure Linux
  May 9, 2024
• High 8.8
  CVE-2024-32617

  HDF5 Library through 1.14.3 contains a heap-based buffer over-read caused by the unsafe use of strdup in H5MM_xstrdup i…

  hdf5 hdf5 hdf5 Debian Ubuntu Azure Linux
  May 9, 2024
• High 8.8
  CVE-2024-32623

  HDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5VM_array_fill in H5VM.c (called from H5S_select_…

  hdf5 hdf5 hdf5 Debian Ubuntu Azure Linux
  May 9, 2024
• High 8.8
  CVE-2024-33873

  HDF5 Library through 1.14.3 has a heap-based buffer overflow in H5D__scatter_mem in H5Dscatgath.c.

  hdf5 hdf5 hdf5 Debian Ubuntu Azure Linux
  May 9, 2024
• High 8.8
  CVE-2024-33877

  HDF5 Library through 1.14.3 has a heap-based buffer overflow in H5T__conv_struct_opt in H5Tconv.c.

  hdf5 hdf5 hdf5 Debian Ubuntu Azure Linux
  May 9, 2024
• High 7.5
  CVE-2021-37501

  Buffer Overflow vulnerability in HDFGroup hdf5-h5dump 1.12.0 through 1.13.0 allows attackers to cause a denial of servi…

  hdf5 hdf5 hdf5 Debian Ubuntu Azure Linux
  Feb 3, 2023
• High 7.5
  CVE-2024-32609

  HDF5 Library through 1.14.3 allows stack consumption in the function H5E_printf_stack in H5Eint.c.

  hdf5 hdf5 hdf5 Debian Ubuntu Azure Linux
  May 9, 2024
• High 7.4
  CVE-2024-29158

  HDF5 through 1.14.3 contains a stack buffer overflow in H5FL_arr_malloc, resulting in the corruption of the instruction…

  hdf5 hdf5 hdf5 Debian Ubuntu Azure Linux
  May 9, 2024
• High 7.4
  CVE-2024-29160

  HDF5 through 1.14.3 contains a heap buffer overflow in H5HG__cache_heap_deserialize, resulting in the corruption of the…

  hdf5 hdf5 hdf5 Debian Ubuntu Azure Linux
  May 9, 2024
• High 7.4
  CVE-2024-29162

  HDF5 through 1.13.3 and/or 1.14.2 contains a stack buffer overflow in H5HG_read, resulting in denial of service or pote…

  hdf5 hdf5 hdf5 Debian Ubuntu Azure Linux
  May 9, 2024
• High 7.4
  CVE-2024-29163

  HDF5 through 1.14.3 contains a heap buffer overflow in H5T__bit_find, resulting in the corruption of the instruction po…

  hdf5 hdf5 hdf5 Debian Ubuntu Azure Linux
  May 9, 2024
• High 7.4
  CVE-2024-29165

  HDF5 through 1.14.3 contains a buffer overflow in H5Z__filter_fletcher32, resulting in the corruption of the instructio…

  hdf5 hdf5 hdf5 Debian Ubuntu Azure Linux
  May 9, 2024
• High 7.4
  CVE-2024-32612

  HDF5 Library through 1.14.3 contains a heap-based buffer over-read in H5HL__fl_deserialize in H5HLcache.c, resulting in…

  hdf5 hdf5 hdf5 Debian Ubuntu Azure Linux
  May 9, 2024
• High 7.4
  CVE-2024-32613

  HDF5 Library through 1.14.3 contains a heap-based buffer over-read in the function H5HL__fl_deserialize in H5HLcache.c,…

  hdf5 hdf5 hdf5 Debian Ubuntu Azure Linux
  May 9, 2024
• High 7.4
  CVE-2024-32616

  HDF5 Library through 1.14.3 contains a heap-based buffer over-read in H5O__dtype_encode_helper in H5Odtype.c.

  hdf5 hdf5 hdf5 Debian Ubuntu Azure Linux
  May 9, 2024
• High 7.4
  CVE-2024-32618

  HDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5T__get_native_type in H5Tnative.c, resulting in …

  hdf5 hdf5 hdf5 Debian Ubuntu Azure Linux
  May 9, 2024
• High 7.4
  CVE-2024-32619

  HDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5T_copy_reopen in H5T.c, resulting in the corrupt…

  hdf5 hdf5 hdf5 Debian Ubuntu Azure Linux
  May 9, 2024
• High 7.4
  CVE-2024-32620

  HDF5 Library through 1.14.3 contains a heap-based buffer over-read in H5F_addr_decode_len in H5Fint.c, resulting in the…

  hdf5 hdf5 hdf5 Debian Ubuntu Azure Linux
  May 9, 2024
• High 7.4
  CVE-2024-32624

  HDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5T__ref_mem_setnull in H5Tref.c (called from H5T_…

  hdf5 hdf5 hdf5 Debian Ubuntu Azure Linux
  May 9, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3801.json
• report
  https://access.redhat.com/security/cve/CVE-2021-37501
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2230281
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-37501
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-37501
• advisory
  https://github.com/advisories/GHSA-rfgw-5vq3-wrjf
• report
  https://access.redhat.com/security/cve/CVE-2024-29157
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2280037
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-29157
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-29157
• article
  https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
• report
  https://access.redhat.com/security/cve/CVE-2024-29158
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-29158
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-29158
• report
  https://access.redhat.com/security/cve/CVE-2024-29159
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-29159
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-29159
• report
  https://access.redhat.com/security/cve/CVE-2024-29160
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-29160
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-29160
• report
  https://access.redhat.com/security/cve/CVE-2024-29161
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-29161
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-29161
• report
  https://access.redhat.com/security/cve/CVE-2024-29162
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-29162
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-29162
• report
  https://access.redhat.com/security/cve/CVE-2024-29163
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-29163
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-29163
• report
  https://access.redhat.com/security/cve/CVE-2024-29164
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-29164
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-29164
• report
  https://access.redhat.com/security/cve/CVE-2024-29165
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-29165
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-29165
• report
  https://access.redhat.com/security/cve/CVE-2024-32605
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-32605
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-32605