Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2022-25942: rootio-hdf5 Allows Arbitrary File Access on Debian 12

CVE-2022-25942 · published 4 years ago

Summary

The rootio-hdf5 package on Debian 12 has a security issue that could allow an attacker to read or modify files they shouldn't be able to access. This could be exploited if an attacker gains access to the system or has a malicious file uploaded to it. Update to the latest version of rootio-hdf5 to fix this issue.

What to do

Update debian hdf5 to version 1.10.6+repack-4+deb11u1.aikido.12.
Update debian rootio-hdf5 to version 1.10.6+repack-4+deb11u1.aikido.12.
Update debian rootio-hdf5 to version 1.10.8+repack1-1.root.io.30.
Update debian rootio-hdf5 to version 1.10.8+repack1-1.root.io.31.
Update debian rootio-hdf5 to version 1.10.8+repack1-1.root.io.32.
Update debian hdf5 to version 1.10.10+repack-1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Root:Debian:11	debian	hdf5	< 1.10.6+repack-4+deb11u1.aikido.12 Fix: upgrade to 1.10.6+repack-4+deb11u1.aikido.12
Root:Debian:11	debian	rootio-hdf5	< 1.10.6+repack-4+deb11u1.aikido.12 Fix: upgrade to 1.10.6+repack-4+deb11u1.aikido.12
Root:Debian:12	debian	rootio-hdf5	< 1.10.8+repack1-1.root.io.30 < 1.10.8+repack1-1.root.io.31 < 1.10.8+repack1-1.root.io.32 Fix: upgrade to 1.10.8+repack1-1.root.io.30
–	hdfgroup	hdf5	1.10.4 `cpe:2.3:a:hdfgroup:hdf5:1.10.4:::::::*`
Debian:12	debian	hdf5	All versions
Debian:13	debian	hdf5	< 1.10.10+repack-1 Fix: upgrade to 1.10.10+repack-1

Original advisory text

CVE-2022-25942 in rootio-hdf5 - Patched by Root

An out-of-bounds read vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. A specially-crafted GIF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.

References

https://security-tracker.debian.org/tracker/CVE-2022-25942 Vendor Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1486 URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/25xxx/CVE-2022-25942... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-25942 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-125Out-of-bounds Read

Timeline

Published22 Aug 2022

Updated4 Nov 2026

First seen26 Mar 2026

Sources

ROOT-OS-DEBIAN-12-CVE-2022-25942 · OSV

ROOT-OS-DEBIAN-11-CVE-2022-25942 · OSV

CVE-2022-25942 · NVD

CVE-2022-25942 · OSV

DEBIAN-CVE-2022-25942 · OSV

Track software like this

Free during beta