Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
a94b33fb by Salvatore Bonaccorso at 2026-07-28T07:52:07+02:00
Add new hdf5 issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -356,11 +356,18 @@ CVE-2026-24252 (NVIDIA NeMo for Linux contains a
vulnerability where an attacker
CVE-2026-17612 (Honeywell S35 Series 3M/5M/8M/PinHole Cameras, all versions
prior to a ...)
NOT-FOR-US: Honeywell
CVE-2026-17574 (HDF5 contains a NULL pointer dereference vulnerability.
Processing a c ...)
- TODO: check
+ - hdf5 <unfixed>
+ NOTE: Fixed by:
https://github.com/HDFGroup/hdf5/commit/3fa6ed6e9dfeebbc784e21d8c48e31e35a8042bc
(2.2.0-rc1)
CVE-2026-17573 (A double free vulnerability was discovered in the HDF5
library. Proces ...)
- TODO: check
+ - hdf5 <unfixed>
+ NOTE: https://github.com/HDFGroup/hdf5/issues/6124
+ NOTE: https://github.com/HDFGroup/hdf5/pull/6160
+ NOTE: Fixed by:
https://github.com/HDFGroup/hdf5/commit/dd3080a58cc6bb86f3b34284399915da9e513262
(2.1.0)
CVE-2026-17572 (Heap-based buffer overflow in the SOHM list-index
deserialization code ...)
- TODO: check
+ - hdf5 <unfixed>
+ NOTE: https://github.com/HDFGroup/hdf5/issues/6501
+ NOTE: https://github.com/HDFGroup/hdf5/pull/6499
+ NOTE: Fixed by:
https://github.com/HDFGroup/hdf5/commit/20f0b9564bc46154e60f8d35578720a599d41552
(2.2.0-rc1)
CVE-2026-17570 (Improper access control in the PAM password history endpoints
in Devol ...)
NOT-FOR-US: Devolutions
CVE-2026-17569 (Improper access control in the NetBox synchronizer in
Devolutions Serv ...)
@@ -7853,7 +7860,6 @@ CVE-2026-26197 (HDF5 is a high-performance library and a
file format specificati
[bullseye] - hdf5 <postponed> (Minor issue; OOB read only via a
maliciously altered file whose array datatype size, element count and element
size disagree; hdf5 is limited-support, trusted content only)
NOTE:
https://github.com/HDFGroup/hdf5/security/advisories/GHSA-gh44-7wpq-622f
NOTE: Fixed by:
https://github.com/HDFGroup/hdf5/commit/8cd9f7a7ba6757fbb72e36bbe23e127f8507c8a6
(2.1.0)
- NOTE: Unchecked H5T_ARRAY decode in src/H5Odtype.c predates 1.8.0, not
2.0.0-specific; fix is only on develop/2.1.0, not backported to the 1.14 branch
CVE-2026-25039 (Parsec is a cloud-based application for simple and
cryptographically s ...)
NOT-FOR-US: Parsec
CVE-2026-21824 (HCL Commerce contains an privilege escalation vulnerability
that could ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a94b33fb879e1c3fc3456a5fcde58ac3b3dbb7e7
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a94b33fb879e1c3fc3456a5fcde58ac3b3dbb7e7
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
