From 3d55f0d55d06b4358c795b82192b5c14629a1e31 Mon Sep 17 00:00:00 2001
From: "LI, WENJIE" <liwenjie@kylinos.cn>
Date: Thu, 9 Nov 2023 09:52:40 +0800
Subject: [PATCH] add CVE-2018-13870.

---
 .../H5O_link_decode-heap-buffer-overflow      | Bin 0 -> 896 bytes
 cve/hdf5/2018/CVE-2018-13870/README.md        |   3 +++
 cve/hdf5/2018/yaml/CVE-2018-13870.yaml        |  19 ++++++++++++++++++
 openkylin_list.yaml                           |   1 +
 4 files changed, 23 insertions(+)
 create mode 100755 cve/hdf5/2018/CVE-2018-13870/H5O_link_decode-heap-buffer-overflow
 create mode 100644 cve/hdf5/2018/CVE-2018-13870/README.md
 create mode 100644 cve/hdf5/2018/yaml/CVE-2018-13870.yaml

diff --git a/cve/hdf5/2018/CVE-2018-13870/H5O_link_decode-heap-buffer-overflow b/cve/hdf5/2018/CVE-2018-13870/H5O_link_decode-heap-buffer-overflow
new file mode 100755
index 0000000000000000000000000000000000000000..a8718e39f795b4c76c0f5d74e26614affdd0e7ec
GIT binary patch
literal 896
zcmeD5aB<`1lHy_j0S*oZ76t(@6Gr@pf(B-Y2#gPtPk=FS(2PJ68G&*VP<a8U`3g|;
z5}@KCL9VVKCd_;o4V50HMtBH#xH<-af*=AK4jfSW1QV12r9f#71i*?ROo~V*c*=#P
zNEi(<mWzP{oW5a}urX+WnT%Wx9H|v0@j01!*<uU~NvZKb9*AS4mto3~UX)*209FS8
DD|13=

literal 0
HcmV?d00001

diff --git a/cve/hdf5/2018/CVE-2018-13870/README.md b/cve/hdf5/2018/CVE-2018-13870/README.md
new file mode 100644
index 00000000..384fa462
--- /dev/null
+++ b/cve/hdf5/2018/CVE-2018-13870/README.md
@@ -0,0 +1,3 @@
+h5dump H5O_link_decode-heap-buffer-overflow
+
+段错误 (核心已转储)
diff --git a/cve/hdf5/2018/yaml/CVE-2018-13870.yaml b/cve/hdf5/2018/yaml/CVE-2018-13870.yaml
new file mode 100644
index 00000000..88128e1c
--- /dev/null
+++ b/cve/hdf5/2018/yaml/CVE-2018-13870.yaml
@@ -0,0 +1,19 @@
+id: CVE-2018-13870
+source: https://github.com/TeamSeri0us/pocs/tree/master/hdf5
+info:
+  name: HDF5是一套免费的用于管理存储不同类型数据的工具套件，它能够管理、操作、查看、分析数据，并生成可移植格式的文件。
+  severity: high
+  description: |
+    HDF5 1.8.20版本中的H5Olink.c文件的‘H5O_link_decode’函数存在安全漏洞。攻击者可通过诱使用户打开特制的文件利用该漏洞造成应用程序崩溃（越界读取）。
+  scope-of-influence:
+    hdf5:1.8.20
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-13870
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2018-13870
+    cwe-id: CWE-125
+    cnvd-id: None
+    kve-id: None
+  tags: CVE2018, hdf5
\ No newline at end of file
diff --git a/openkylin_list.yaml b/openkylin_list.yaml
index 6faa9354..9f241768 100644
--- a/openkylin_list.yaml
+++ b/openkylin_list.yaml
@@ -91,6 +91,7 @@ cve:
     - CVE-2023-1355
   hdf5:
     - CVE-2018-13867
+    - CVE-2018-13870
 cnvd:
   
 kve:
-- 
Gitee