Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
7905ccb6 by Moritz Muehlenhoff at 2026-01-21T15:11:58+01:00
final batch of hdf5 updates
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -197964,55 +197964,45 @@ CVE-2024-2290 (The Advanced Ads plugin for
WordPress is vulnerable to PHP Object
CVE-2024-29800 (Deserialization of Untrusted Data vulnerability in Timber Team
& Contr ...)
NOT-FOR-US: Timber
CVE-2024-29166 (HDF5 through 1.14.3 contains a buffer overflow in
H5O__linfo_decode, r ...)
- - hdf5 1.14.5+repack-1 (bug #1070861)
- [bookworm] - hdf5 <no-dsa> (Minor issue)
- [bullseye] - hdf5 <no-dsa> (Minor issue)
+ - hdf5 1.14.5+repack-1 (bug #1070861; unimportant)
NOTE:
https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
+ NOTE: HDF not covered by security support, see
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1117722
CVE-2024-29165 (HDF5 through 1.14.3 contains a buffer overflow in
H5Z__filter_fletcher ...)
- - hdf5 1.14.5+repack-1 (bug #1070861)
- [bookworm] - hdf5 <no-dsa> (Minor issue)
- [bullseye] - hdf5 <no-dsa> (Minor issue)
+ - hdf5 1.14.5+repack-1 (bug #1070861; unimportant)
NOTE:
https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
+ NOTE: HDF not covered by security support, see
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1117722
CVE-2024-29164 (HDF5 through 1.14.3 contains a stack buffer overflow in
H5R__decode_he ...)
- - hdf5 1.14.5+repack-1 (bug #1070861)
- [bookworm] - hdf5 <no-dsa> (Minor issue)
- [bullseye] - hdf5 <no-dsa> (Minor issue)
+ - hdf5 1.14.5+repack-1 (bug #1070861; unimportant)
NOTE:
https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
+ NOTE: HDF not covered by security support, see
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1117722
CVE-2024-29163 (HDF5 through 1.14.3 contains a heap buffer overflow in
H5T__bit_find, ...)
- - hdf5 1.14.5+repack-1 (bug #1070861)
- [bookworm] - hdf5 <no-dsa> (Minor issue)
- [bullseye] - hdf5 <no-dsa> (Minor issue)
+ - hdf5 1.14.5+repack-1 (bug #1070861; unimportant)
NOTE:
https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
+ NOTE: HDF not covered by security support, see
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1117722
CVE-2024-29162 (HDF5 through 1.13.3 and/or 1.14.2 contains a stack buffer
overflow in ...)
- - hdf5 1.14.5+repack-1 (bug #1070861)
- [bookworm] - hdf5 <no-dsa> (Minor issue)
- [bullseye] - hdf5 <no-dsa> (Minor issue)
+ - hdf5 1.14.5+repack-1 (bug #1070861; unimportant)
NOTE:
https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
+ NOTE: HDF not covered by security support, see
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1117722
CVE-2024-29161 (HDF5 through 1.14.3 contains a heap buffer overflow in
H5A__attr_relea ...)
- - hdf5 1.14.5+repack-1 (bug #1070861)
- [bookworm] - hdf5 <no-dsa> (Minor issue)
- [bullseye] - hdf5 <no-dsa> (Minor issue)
+ - hdf5 1.14.5+repack-1 (bug #1070861; unimportant)
NOTE:
https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
+ NOTE: HDF not covered by security support, see
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1117722
CVE-2024-29160 (HDF5 through 1.14.3 contains a heap buffer overflow in
H5HG__cache_hea ...)
- - hdf5 1.14.5+repack-1 (bug #1070861)
- [bookworm] - hdf5 <no-dsa> (Minor issue)
- [bullseye] - hdf5 <no-dsa> (Minor issue)
+ - hdf5 1.14.5+repack-1 (bug #1070861; unimportant)
NOTE:
https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
+ NOTE: HDF not covered by security support, see
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1117722
CVE-2024-29159 (HDF5 through 1.14.3 contains a buffer overflow in
H5Z__filter_scaleoff ...)
- - hdf5 1.14.5+repack-1 (bug #1070861)
- [bookworm] - hdf5 <no-dsa> (Minor issue)
- [bullseye] - hdf5 <no-dsa> (Minor issue)
+ - hdf5 1.14.5+repack-1 (bug #1070861; unimportant)
NOTE:
https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
+ NOTE: HDF not covered by security support, see
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1117722
CVE-2024-29158 (HDF5 through 1.14.3 contains a stack buffer overflow in
H5FL_arr_mallo ...)
- - hdf5 1.14.5+repack-1 (bug #1070861)
- [bookworm] - hdf5 <no-dsa> (Minor issue)
- [bullseye] - hdf5 <no-dsa> (Minor issue)
+ - hdf5 1.14.5+repack-1 (bug #1070861; unimportant)
NOTE:
https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
+ NOTE: HDF not covered by security support, see
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1117722
CVE-2024-29157 (HDF5 through 1.14.3 contains a heap buffer overflow in
H5HG_read, resu ...)
- - hdf5 1.14.5+repack-1 (bug #1070861)
- [bookworm] - hdf5 <no-dsa> (Minor issue)
- [bullseye] - hdf5 <no-dsa> (Minor issue)
+ - hdf5 1.14.5+repack-1 (bug #1070861; unimportant)
NOTE:
https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
+ NOTE: HDF not covered by security support, see
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1117722
CVE-2024-28075 (The SolarWinds Access Rights Manager was susceptible to Remote
Code Ex ...)
NOT-FOR-US: SolarWinds
CVE-2024-24157 (Gnuboard g6 / https://github.com/gnuboard/g6 commit
c2cc1f5069e00491ea ...)
@@ -362618,26 +362608,23 @@ CVE-2022-26892
CVE-2022-26891 (Microsoft Edge (Chromium-based) Elevation of Privilege
Vulnerability)
NOT-FOR-US: Microsoft
CVE-2022-26061 (A heap-based buffer overflow vulnerability exists in the
gif2h5 functi ...)
- - hdf5 1.10.10+repack-1 (bug #1031726)
- [bookworm] - hdf5 <postponed> (Minor issue, revisit when fixed upstream)
- [bullseye] - hdf5 <postponed> (Minor issue, revisit when fixed upstream)
+ - hdf5 1.10.10+repack-1 (bug #1031726; unimportant)
[buster] - hdf5 <postponed> (Minor issue, revisit when fixed upstream)
NOTE:
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1487
NOTE: Starting with 1.10.10+repack-1 gif2h5 and h52gif are no longer
installed
+ NOTE: HDF not covered by security support, see
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1117722
CVE-2022-25972 (An out-of-bounds write vulnerability exists in the gif2h5
functionalit ...)
- - hdf5 1.10.10+repack-1 (bug #1031726)
- [bookworm] - hdf5 <postponed> (Minor issue, revisit when fixed upstream)
- [bullseye] - hdf5 <postponed> (Minor issue, revisit when fixed upstream)
+ - hdf5 1.10.10+repack-1 (bug #1031726; unimportant)
[buster] - hdf5 <postponed> (Minor issue, revisit when fixed upstream)
NOTE:
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1485
NOTE: Starting with 1.10.10+repack-1 gif2h5 and h52gif are no longer
installed
+ NOTE: HDF not covered by security support, see
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1117722
CVE-2022-25942 (An out-of-bounds read vulnerability exists in the gif2h5
functionality ...)
- - hdf5 1.10.10+repack-1 (bug #1031726)
- [bookworm] - hdf5 <postponed> (Minor issue, revisit when fixed upstream)
- [bullseye] - hdf5 <postponed> (Minor issue, revisit when fixed upstream)
+ - hdf5 1.10.10+repack-1 (bug #1031726; unimportant)
[buster] - hdf5 <postponed> (Minor issue, revisit when fixed upstream)
NOTE:
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1486
NOTE: Starting with 1.10.10+repack-1 gif2h5 and h52gif are no longer
installed
+ NOTE: HDF not covered by security support, see
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1117722
CVE-2022-0935 (Host Header injection in password Reset in GitHub repository
livehelpe ...)
NOT-FOR-US: livehelperchat
CVE-2022-26886
@@ -567439,12 +567426,11 @@ CVE-2019-8400 (ORY Hydra before v1.0.0-rc.3+oryOS.9
has Reflected XSS via the oa
CVE-2019-8399
RESERVED
CVE-2019-8398 (An issue was discovered in the HDF HDF5 1.10.4 library. There
is an ou ...)
- - hdf5 1.14.5+repack-1 (bug #1034838)
- [bookworm] - hdf5 <no-dsa> (Minor issue)
- [bullseye] - hdf5 <no-dsa> (Minor issue)
+ - hdf5 1.14.5+repack-1 (bug #1034838; unimportant)
[buster] - hdf5 <no-dsa> (Minor issue)
NOTE: https://github.com/magicSwordsMan/PAAFS/tree/master/vul6
NOTE: https://jira.hdfgroup.org/browse/HDFFV-10710
+ NOTE: HDF not covered by security support, see
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1117722
CVE-2019-8397 (An issue was discovered in the HDF HDF5 1.10.4 library. There
is an ou ...)
- hdf5 <unfixed> (unimportant)
[buster] - hdf5 <no-dsa> (Minor issue)
@@ -567454,14 +567440,13 @@ CVE-2019-8397 (An issue was discovered in the HDF
HDF5 1.10.4 library. There is
NOTE: issue in upstream bug tracker:
https://jira.hdfgroup.org/browse/HDFFV-10711
NOTE: Negligible security impact, malicous scientific data has more
issues than a crash
CVE-2019-8396 (A buffer overflow in H5O__layout_encode in H5Olayout.c in the
HDF HDF5 ...)
- - hdf5 1.14.5+repack-1 (bug #1034838)
- [bookworm] - hdf5 <no-dsa> (Minor issue)
- [bullseye] - hdf5 <no-dsa> (Minor issue)
+ - hdf5 1.14.5+repack-1 (bug #1034838; unimportant)
[buster] - hdf5 <no-dsa> (Minor issue)
NOTE: https://github.com/magicSwordsMan/PAAFS/tree/master/vul4
NOTE: https://jira.hdfgroup.org/browse/HDFFV-10712
NOTE: HDFFV-10712 is marked to be closed in a future 1.10.8 upstream
release.
NOTE: Upstream fix was made in May 2021 after the 1.12.0 release (Mar
2020)
+ NOTE: HDF not covered by security support, see
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1117722
CVE-2019-8395 (An Insecure Direct Object Reference (IDOR) vulnerability exists
in Zoh ...)
NOT-FOR-US: Zoho ManageEngine ServiceDesk Plus
CVE-2019-8394 (Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build
10012 allow ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7905ccb60a38a3d5fe29b8a79a030f43347acfb2
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7905ccb60a38a3d5fe29b8a79a030f43347acfb2
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
