DescriptionA buffer overflow in H5O__layout_encode in H5Olayout.c in the HDF HDF5 through 1.10.4 library allows attackers to cause a denial of service via a crafted HDF5 file. This issue was triggered while repacking an HDF5 file, aka "Invalid write of size 2."
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1034838

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
hdf5 (PTS)buster1.10.4+repack-10vulnerable
buster (security)1.10.4+repack-10+deb10u1vulnerable
sid, trixie1.10.10+repack-3.3vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs


[bookworm] - hdf5 <no-dsa> (Minor issue)
[bullseye] - hdf5 <no-dsa> (Minor issue)
[buster] - hdf5 <no-dsa> (Minor issue)
HDFFV-10712 is marked to be closed in a future 1.10.8 upstream release.
Upstream fix was made in May 2021 after the 1.12.0 release (Mar 2020)

Search for package or bug name: Reporting problems