摘要:
hdf5 security update
安全等级: Medium
公告ID: KylinSec-SA-2024-6674
发布日期: 2025年9月4日
关联CVE: CVE-2024-29166 CVE-2024-32606
HDF5 is a data model, library, and file format for storing and managing data. It supports an unlimited variety of datatypes, and is designed for flexible and efficient I/O and for high volume and complex data. HDF5 is portable and is extensible, allowing applications to evolve in their use of HDF5. The HDF5 Technology suite includes tools and applications for managing, manipulating, viewing, and analyzing data in the HDF5 format.
Security Fix(es):
HDF5 through 1.14.3 contains a buffer overflow in H5O__linfo_decode, resulting in the corruption of the instruction pointer and causing denial of service or potential code execution.(CVE-2024-29166)
HDF5 Library through 1.14.3 may attempt to dereference uninitialized values in h5tools_str_sprint in tools/lib/h5tools_str.c (called from h5tools_dump_simple_data in tools/lib/h5tools_dump.c).(CVE-2024-32606)
| cve名称 | 产品 | 组件 | 是否受影响 |
|---|---|---|---|
| CVE-2024-29166 | KY3.5.3 | hdf5 | Fixed |
| CVE-2024-32606 | KY3.5.3 | hdf5 | Fixed |
| 软件名称 | 架构 | 版本号 |
|---|---|---|
| hdf5 | x86_64 | 1.14.5-1.ky3_5 |
| hdf5-devel | x86_64 | 1.14.5-1.ky3_5 |
| hdf5-mpich | x86_64 | 1.14.5-1.ky3_5 |
| hdf5-mpich-devel | x86_64 | 1.14.5-1.ky3_5 |
| hdf5-mpich-static | x86_64 | 1.14.5-1.ky3_5 |
| hdf5-openmpi | x86_64 | 1.14.5-1.ky3_5 |
| hdf5-openmpi-devel | x86_64 | 1.14.5-1.ky3_5 |
| hdf5-openmpi-static | x86_64 | 1.14.5-1.ky3_5 |
| hdf5 | aarch64 | 1.14.5-1.ky3_5 |
| hdf5-devel | aarch64 | 1.14.5-1.ky3_5 |
| hdf5-mpich | aarch64 | 1.14.5-1.ky3_5 |
| hdf5-mpich-devel | aarch64 | 1.14.5-1.ky3_5 |
| hdf5-mpich-static | aarch64 | 1.14.5-1.ky3_5 |
| hdf5-openmpi | aarch64 | 1.14.5-1.ky3_5 |
| hdf5-openmpi-devel | aarch64 | 1.14.5-1.ky3_5 |
| hdf5-openmpi-static | aarch64 | 1.14.5-1.ky3_5 |
方法一：下载安装包进行升级安装
1、通过下载链接下载需要升级的升级包保存，如 xxx.rpm
2、通过rpm命令升级，如 rpm -Uvh xxx.rpm
方法二：通过软件源进行升级安装
1、保持能够连接上互联网
2、通过yum命令升级指定的包，如 yum install 包名
