Bug#845301: hdf5: CVE-2016-4330 CVE-2016-4331 CVE-2016-4332 CVE-2016-4333

[Salvatore Bonaccorso]

Source: hdf5
Version: 1.8.16+docs-8
Severity: grave
Tags: security upstream
Justification: user security hole

Hi,

the following vulnerabilities were published for hdf5.

CVE-2016-4330[0]:
| In the HDF5 1.8.16 library's failure to check if the number of
| dimensions for an array read from the file is within the bounds of the
| space allocated for it, a heap-based buffer overflow will occur,
| potentially leading to arbitrary code execution.

CVE-2016-4331[1]:
| When decoding data out of a dataset encoded with the H5Z_NBIT
| decoding, the HDF5 1.8.16 library will fail to ensure that the
| precision is within the bounds of the size leading to arbitrary code
| execution.

CVE-2016-4332[2]:
| The library's failure to check if certain message types support a
| particular flag, the HDF5 1.8.16 library will cast the structure to an
| alternative structure and then assign to fields that aren't supported
| by the message type and the library will write outside the bounds of
| the heap buffer. This can lead to code execution under the context of
| the library.

CVE-2016-4333[3]:
| The HDF5 1.8.16 library allocating space for the array using a value
| from the file has an impact within the loop for initializing said
| array allowing a value within the file to modify the loop's
| terminator. Due to this, an aggressor can cause the loop's index to
| point outside the bounds of the array when initializing it.

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2016-4330
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4330
[1] https://security-tracker.debian.org/tracker/CVE-2016-4331
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4331
[2] https://security-tracker.debian.org/tracker/CVE-2016-4332
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4332
[3] https://security-tracker.debian.org/tracker/CVE-2016-4333
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4333

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore