7.8 HIGH
- CVSS version: 3.1
- Attack vector (AV): LOCAL
- Attack complexity (AC): LOW
- Privileges required (PR): NONE
- User interaction (UI): REQUIRED
- Scope (S): UNCHANGED
- Confidentiality impact (C): HIGH
- Integrity impact (I): HIGH
- Availability impact (A): HIGH
by @LeSuisse Activity log
- Created automatic suggestion
-
@LeSuisse
removed
4 packages
- haskellPackages.hdf5-lite
- python312Packages.hdf5plugin
- python313Packages.hdf5plugin
- python314Packages.hdf5plugin
- @LeSuisse dismissed
HDF5 Affected by H5T__conv_struct_opt Heap Buffer Overflow
HDF5 is software for managing data. Prior to version 1.14.4-2, an attacker who can control an `h5` file parsed by HDF5 can trigger a write-based heap buffer overflow condition. This can lead to a denial-of-service condition, and potentially further issues such as remote code execution depending on the practical exploitability of the heap overflow against modern operating systems. Real-world exploitability of this issue in terms of remote-code execution is currently unknown. Version 1.14.4-2 fixes the issue.
References
- https://github.com/HDFGroup/hdf5/security/advisories/GHSA-5p2m-j456-9mr2 x_refsource_CONFIRM
Affected products
- ==< 1.14.4-2
Matching in nixpkgs
pkgs.hdf5
Data model, library, and file format for storing and managing data
pkgs.hdf5-cpp
Data model, library, and file format for storing and managing data
pkgs.hdf5-mpi
Data model, library, and file format for storing and managing data
pkgs.hdf5_1_10
Data model, library, and file format for storing and managing data
pkgs.hdf5-blosc
Filter for HDF5 that uses the Blosc compressor
pkgs.hdf5-fortran
Data model, library, and file format for storing and managing data
pkgs.hdf5-threadsafe
Data model, library, and file format for storing and managing data
pkgs.hdf5-fortran-mpi
Data model, library, and file format for storing and managing data
pkgs.pkgsRocm.hdf5-mpi
Data model, library, and file format for storing and managing data
pkgs.haskellPackages.hdf5
Haskell interface to the HDF5 scientific data storage library
Ignored packages (4)
pkgs.haskellPackages.hdf5-lite
High-level bindings to the HDF5 "lite" interface
pkgs.python312Packages.hdf5plugin
Additional compression filters for h5py
-
nixos-25.11 hdf5plugin-5.1.0
- nixos-25.11-small hdf5plugin-5.1.0
- nixpkgs-25.11-darwin hdf5plugin-5.1.0
pkgs.python313Packages.hdf5plugin
Additional compression filters for h5py
-
nixos-unstable hdf5plugin-5.1.0
- nixpkgs-unstable hdf5plugin-5.1.0
- nixos-unstable-small hdf5plugin-5.1.0
-
nixos-25.11 hdf5plugin-5.1.0
- nixos-25.11-small hdf5plugin-5.1.0
- nixpkgs-25.11-darwin hdf5plugin-5.1.0
pkgs.python314Packages.hdf5plugin
Additional compression filters for h5py
-
nixos-unstable hdf5plugin-5.1.0
- nixpkgs-unstable hdf5plugin-5.1.0
- nixos-unstable-small hdf5plugin-5.1.0
Package maintainers
-
@markuskowa Markus Kowalewski <markus.kowalewski@gmail.com>
-
@stephen-huan Stephen Huan <stephen.huan@cgdct.moe>
-
@bhipple Benjamin Hipple <bhipple@protonmail.com>