Skip to content
Heist/ feed
Back to feed
Unrated

Heap-buffer-overflow in H5L__extern_traverse

Type: advisorySources: OSV

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56501 ``` Crash type: Heap-buffer-overflow READ {*} Crash state: H5L__extern_traverse H5G__traverse_special H5G__traverse_real ```

Products
hdf5
Affected versions
1.14.1, 2.0.0, 2.1.0, 2.1.1, final_autotools_develop, hdf5-1.14.5, hdf5-1.14.6, hdf5-1_10_10, hdf5-1_10_11, hdf5-1_12_3, hdf5-1_14_1, hdf5-1_14_1-2, hdf5-1_14_2, hdf5-1_14_3, hdf5-1_14_3-rc1, hdf5_1.14.4, hdf5_1.14.4.1, hdf5_1.14.4.2, hdf5_1.14.4.3, hdf5_1.14.5, hdf5_1.14.6, hdf5_2.0.0, hdf5_2.1.0, hdff5-1_14-_0, hdff5-1_14_0, snapshot, snapshot-1.10, snapshot-1.12, snapshot-1.14
Fixed versions
Not specified
CVEs
Not specified
Confirmed fixed CVEs
Not specified
Updated in this feed
28 Oct 2026, 12:38 UTC · Revision 1

Source evidence

Heap-buffer-overflow in H5L__extern_traverse

core-osv · Original source

Published 2 Mar 2023, 13:02 UTC

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56501 ``` Crash type: Heap-buffer-overflow READ {*} Crash state: H5L__extern_traverse H5G__traverse_special H5G__traverse_real ```

osv:OSV-2023-133

hdf5

Fixed versions: Not specified

Complete source record
{
  "id": "dedd21e99688128426926842d777faaa671525870b4c5fe4dcccdb51f5afe5ff",
  "url": "https://osv.dev/vulnerability/OSV-2023-133",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Heap-buffer-overflow in H5L__extern_traverse",
    "summary": "OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56501 ``` Crash type: Heap-buffer-overflow READ {*} Crash state: H5L__extern_traverse H5G__traverse_special H5G__traverse_real ```",
    "evidence": "osv:OSV-2023-133",
    "products": [
      {
        "name": {
          "value": "hdf5",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "1.14.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.0.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.1.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.1.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "final_autotools_develop",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "hdf5-1.14.5",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "hdf5-1.14.6",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "hdf5-1_10_10",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "hdf5-1_10_11",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "hdf5-1_12_3",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "hdf5-1_14_1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "hdf5-1_14_1-2",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "hdf5-1_14_2",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "hdf5-1_14_3",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "hdf5-1_14_3-rc1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "hdf5_1.14.4",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "hdf5_1.14.4.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "hdf5_1.14.4.2",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "hdf5_1.14.4.3",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "hdf5_1.14.5",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "hdf5_1.14.6",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "hdf5_2.0.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "hdf5_2.1.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "hdff5-1_14-_0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "hdff5-1_14_0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "snapshot",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "snapshot-1.10",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "snapshot-1.12",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "snapshot-1.14",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "OSV-2023-133",
      "aliases": [
        "OSV-2023-133"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/HDFGroup/hdf5",
              "type": "GIT",
              "events": [
                {
                  "introduced": "966454aac1231da7209ef81c11055d3312181f99"
                },
                {
                  "introduced": "04f0647727677d716a3c1c772d35a660a8ea0dc5"
                },
                {
                  "introduced": "5a0ec52099cf02224a4066b158bcf1a34829db20"
                },
                {
                  "introduced": "f527239564fc27a6e666ce734b88e4ab18765efc"
                },
                {
                  "fixed": "5933130b610c7bd6e66fe93c2798b97e3f3188c8"
                }
              ]
            }
          ],
          "package": {
            "name": "hdf5",
            "purl": "pkg:generic/hdf5",
            "ecosystem": "OSS-Fuzz"
          },
          "versions": [
            "1.14.1",
            "2.0.0",
            "2.1.0",
            "2.1.1",
            "final_autotools_develop",
            "hdf5-1.14.5",
            "hdf5-1.14.6",
            "hdf5-1_10_10",
            "hdf5-1_10_11",
            "hdf5-1_12_3",
            "hdf5-1_14_1",
            "hdf5-1_14_1-2",
            "hdf5-1_14_2",
            "hdf5-1_14_3",
            "hdf5-1_14_3-rc1",
            "hdf5_1.14.4",
            "hdf5_1.14.4.1",
            "hdf5_1.14.4.2",
            "hdf5_1.14.4.3",
            "hdf5_1.14.5",
            "hdf5_1.14.6",
            "hdf5_2.0.0",
            "hdf5_2.1.0",
            "hdff5-1_14-_0",
            "hdff5-1_14_0",
            "snapshot",
            "snapshot-1.10",
            "snapshot-1.12",
            "snapshot-1.14"
          ],
          "database_specific": {
            "source": "https://github.com/google/oss-fuzz-vulns/blob/main/vulns/hdf5/OSV-2023-133.yaml",
            "fixed_range": "856fc07e7aafc4fcd65dce60f0a905a7f3b83a36:5933130b610c7bd6e66fe93c2798b97e3f3188c8"
          },
          "ecosystem_specific": {
            "severity": "MEDIUM"
          }
        }
      ],
      "modified": "2026-10-09T16:08:39.744181Z",
      "provider": "osv",
      "references": [
        "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56501"
      ]
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 121325,
  "published_at": "2023-03-02T13:02:08.499+00:00"
}