CVE-2024-32615 - Vulnerability Details - OpenCVE

HDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5Z__nbit_decompress_one_byte in H5Znbit.c, caused by the earlier use of an initialized pointer.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Hdfgroup	Hdf5
Redhat	Enterprise Linux Ai

Configuration 1 [-]

cpe:2.3:a:hdfgroup:hdf5:*:*:*:*:*:*:*:*

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux AI 1.5 for RHEL 9.4
hdf5-0:1.14.6-3.1.el9ai	cpe:/a:redhat:enterprise_linux_ai:1.5::el9	RHSA-2025:3801	2025-04-10T00:00:00Z
libaec-0:1.1.3-1.el9ai	cpe:/a:redhat:enterprise_linux_ai:1.5::el9	RHSA-2025:3801	2025-04-10T00:00:00Z

References

Link	Providers
https://github.com/HDFGroup/cve_hdf5/blob/main/CVE_list.md
https://nvd.nist.gov/vuln/detail/CVE-2024-32615
https://www.cve.org/CVERecord?id=CVE-2024-32615
https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/

History

Fri, 11 Apr 2025 03:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Redhat Redhat enterprise Linux Ai
CPEs		cpe:/a:redhat:enterprise_linux_ai:1.5::el9
Vendors & Products		Redhat Redhat enterprise Linux Ai

Tue, 29 Oct 2024 16:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-122

Tue, 29 Oct 2024 15:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-05-09T16:43:08.948Z

Updated: 2025-02-13T15:52:23.977Z

Reserved: 2024-04-16T00:00:00.000Z

Link: CVE-2024-32615

Vulnrichment

Updated: 2024-08-02T02:13:40.164Z

NVD

Status : Analyzed

Published: 2024-05-14T15:36:46.620

Modified: 2025-04-18T14:33:56.717

Link: CVE-2024-32615

Redhat

Severity : Moderate

Publid Date: 2024-05-10T00:00:00Z

Links: CVE-2024-32615 - Bugzilla

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-32615", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2025-02-13T15:52:23.977Z", "datePublished": "2024-05-09T16:43:08.948Z", "dateReserved": "2024-04-16T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-05-09T16:43:09.305Z"}, "descriptions": [{"lang": "en", "value": "HDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5Z__nbit_decompress_one_byte in H5Znbit.c, caused by the earlier use of an initialized pointer."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-787", "lang": "en", "description": "CWE-787 Out-of-bounds Write"}]}], "references": [{"url": "https://github.com/HDFGroup/cve_hdf5/blob/main/CVE_list.md"}], "affected": [{"vendor": "hdfgroup", "product": "hdf5", "cpes": ["cpe:2.3:a:hdfgroup:hdf5:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.14.3", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-06-11T14:23:03.766035Z", "id": "CVE-2024-32615", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-29T14:29:01.379Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:13:40.164Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:13:40.164Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-32615", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-06-11T14:23:03.766035Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:hdfgroup:hdf5:*:*:*:*:*:*:*:*"], "vendor": "hdfgroup", "product": "hdf5", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.14.3"}], "defaultStatus": "unknown"}], "references": [{"url": "https://github.com/HDFGroup/cve_hdf5/blob/main/CVE_list.md"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-09T18:38:23.162Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/"}], "descriptions": [{"lang": "en", "value": "HDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5Z__nbit_decompress_one_byte in H5Znbit.c, caused by the earlier use of an initialized pointer."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-05-09T16:43:09.305Z"}}}, "cveMetadata": {"cveId": "CVE-2024-32615", "state": "PUBLISHED", "dateUpdated": "2025-02-13T15:52:23.977Z", "dateReserved": "2024-04-16T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2024-05-09T16:43:08.948Z", "assignerShortName": "mitre"}, "dataVersion": "5.1"}