diff options
| author | Dana Robinson <43805+derobins@users.noreply.github.com> | 2023-08-31 02:21:49 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-08-31 02:21:49 (GMT) |
| commit | 5e71d54c8fe9c13e6729a3274e36b61b94ed5822 (patch) | |
| tree | 56828d63fdc04b53a65e7c87a4ec488ad8cc7641 /release_docs | |
| parent | c5a9cd8cf187b501c569490d3297bda1fccd6667 (diff) | |
| download | hdf5-5e71d54c8fe9c13e6729a3274e36b61b94ed5822.zip hdf5-5e71d54c8fe9c13e6729a3274e36b61b94ed5822.tar.gz hdf5-5e71d54c8fe9c13e6729a3274e36b61b94ed5822.tar.bz2 | |
Fix CVE-2016-4332 (#3451)
Diffstat (limited to 'release_docs')
| -rw-r--r-- | release_docs/RELEASE.txt | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/release_docs/RELEASE.txt b/release_docs/RELEASE.txt index 2ec08b2..668c648 100644 --- a/release_docs/RELEASE.txt +++ b/release_docs/RELEASE.txt @@ -135,6 +135,18 @@ Bug Fixes since HDF5-1.10.10 release =================================== Library ------- + - Fixed an assertion in a previous fix for CVE-2016-4332 + + An assert could fail when processing corrupt files that have invalid + shared message flags (as in CVE-2016-4332). + + The assert statement in question has been replaced with pointer checks + that don't raise errors. Since the function is in cleanup code, we do + our best to close and free things, even when presented with partially + initialized structs. + + Fixes CVE-2016-4332 and HDFFV-9950 (confirmed via the cve_hdf5 repo) + - Seg fault on file close h5debug fails at file close with core dump on a file that has an |