CVE-2016-4333
Multiple heap overflows were found in HDF5. These issues could be used to gain code execution in any program that exposes the affected functions to untrusted input. While HDF5 is shipped as a dependency, no Red Hat products are known to expose these issues in any supported use case at this time.
Find out more about CVE-2016-4333 from the MITRE CVE dictionary dictionary and NIST NVD.
CVSS v2 metrics
NOTE: The following CVSS v2 metrics and score provided are preliminary and subject to review.
| Base Score | 6.8 |
|---|---|
| Base Metrics | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| Access Vector | Network |
| Access Complexity | Medium |
| Authentication | None |
| Confidentiality Impact | Partial |
| Integrity Impact | Partial |
| Availability Impact | Partial |
CVSS v3 metrics
NOTE: The following CVSS v3 metrics and score provided are preliminary and subject to review.
| CVSS3 Base Score | 8.6 |
|---|---|
| CVSS3 Base Metrics | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
| Attack Vector | Local |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | Required |
| Scope | Changed |
| Confidentiality | High |
| Integrity Impact | High |
| Availability Impact | High |
Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).
Affected Packages State
| Platform | Package | State |
|---|---|---|
| Red Hat OpenStack Platform 9.0 | hdf5 | Will not fix |
| Red Hat OpenStack Platform 8.0 (Liberty) | hdf5 | Will not fix |
| Red Hat OpenStack Platform 11.0 (Ocata) | hdf5 | Not affected |
| Red Hat OpenStack Platform 10 | hdf5 | Will not fix |
| Red Hat OpenShift Enterprise 2 | hdf5 | Will not fix |
| Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 | hdf5 | Will not fix |