[Git][security-tracker-team/security-tracker][master] new hdf5 issues

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
f1c647a4 by Moritz Muehlenhoff at 2026-11-04T14:02:56+01:00
new hdf5 issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -710,15 +710,31 @@ CVE-2026-120843 (Improper Neutralization of Input During Web Page Generation ('C
 CVE-2026-120775 (Tanium addressed a heap-based buffer overflow vulnerability in Deploy.)
 	NOT-FOR-US: Tanium
 CVE-2026-120758 (HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability i ...)
-	TODO: check
+	- hdf5 <unfixed> (unimportant)
+	NOTE: https://github.com/HDFGroup/hdf5/issues/6403
+	NOTE: https://github.com/HDFGroup/hdf5/pull/6377
+	NOTE: https://github.com/HDFGroup/hdf5/commit/91fc37c3325264e67699408e3a190fe4f329bf85
+	NOTE: HDF not covered by security support, see https://bugs.debian.org/1117722
 CVE-2026-120757 (HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H ...)
-	TODO: check
+	- hdf5 <unfixed> (unimportant)
+	NOTE: https://github.com/HDFGroup/hdf5/pull/6708
+	NOTE: https://github.com/HDFGroup/hdf5/commit/8117f4c75fdfb5e759ad73ce62d7ef4584130acd
+	NOTE: HDF not covered by security support, see https://bugs.debian.org/1117722
 CVE-2026-120756 (HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H ...)
-	TODO: check
+	- hdf5 <unfixed> (unimportant)
+	NOTE: https://github.com/HDFGroup/hdf5/pull/6589
+	NOTE: https://github.com/HDFGroup/hdf5/commit/10f1af5528168c5a71a58eba0b486e0677f3aaa3
+	NOTE: HDF not covered by security support, see https://bugs.debian.org/1117722
 CVE-2026-120755 (HDF5 through 2.2.0 contains an out-of-bounds read vulnerability in H5Z ...)
-	TODO: check
+	- hdf5 <unfixed> (unimportant)
+	NOTE: https://github.com/HDFGroup/hdf5/pull/6585
+	NOTE: https://github.com/HDFGroup/hdf5/commit/cdb13c4de9c7edbbae180f384e2e610a3b3cf185
+	NOTE: HDF not covered by security support, see https://bugs.debian.org/1117722
 CVE-2026-120754 (HDF5 through 2.2.0 contains an uninitialized memory read vulnerability ...)
-	TODO: check
+	- hdf5 <unfixed> (unimportant)
+	NOTE: https://github.com/HDFGroup/hdf5/pull/6585
+	NOTE: https://github.com/HDFGroup/hdf5/commit/cdb13c4de9c7edbbae180f384e2e610a3b3cf185
+	NOTE: HDF not covered by security support, see https://bugs.debian.org/1117722
 CVE-2026-120734 (Cleartext transmission of sensitive information in the email configura ...)
 	NOT-FOR-US: Devolutions
 CVE-2026-120733 (Cleartext storage of sensitive information in the user account data in ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f1c647a4957373aa3b84843f00c688894a39e28a

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f1c647a4957373aa3b84843f00c688894a39e28a
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261104/a73ca183/attachment-0001.htm>