Heap-Based Buffer Overflow in HDF5 1.14.6 Metadata Attribute Decoder
A critical vulnerability exists in HDF5 version 1.14.6, specifically impacting the H5MM_strndup function within the Metadata Attribute Decoder component. The vulnerability can result in a heap-based buffer overflow when locally manipulated. While the exploit has been publicly disclosed, the actual existence of the vulnerability remains uncertain. The vendor was initially contacted about multiple vulnerabilities and responded with a blanket "reject" without providing additional context. Despite polite requests for further explanation, no elaboration was received. At present, it appears the vendor is attempting to dispute the vulnerability findings, and the issue remains flagged pending more detailed information.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
* hdf5 |
Vulmon