DEBIAN-CVE-2025-2308

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2025-2308

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-2308.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2025-2308

Upstream

CVE-2025-2308

Published

2025-03-14T21:15:37Z

Modified

2026-09-01T20:05:44Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

A vulnerability, which was classified as critical, was found in HDF5 1.14.6. This affects the function H5Z__scaleoffset_decompress_one_byte of the component Scale-Offset Filter. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The vendor plans to fix this issue in an upcoming release.

References

https://security-tracker.debian.org/tracker/CVE-2025-2308

Affected packages

Debian:12 / hdf5

Package

Name: hdf5
Purl: pkg:deb/debian/hdf5?arch=source&distro=bookworm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.10.8+repack1-1

1.10.10+repack-1

1.10.10+repack-2

1.10.10+repack-3

1.10.10+repack-3.1

1.10.10+repack-3.2

1.10.10+repack-3.2+ports

1.10.10+repack-3.3

1.10.10+repack-4

1.10.10+repack-5

1.12.0+repack-1~exp1

1.12.0+repack-1~exp2

1.12.2+repack-1~exp1

1.14.3+repack-1~exp1

1.14.3+repack1-1~exp2

1.14.3+repack1-1~exp3

1.14.4.3+repack-1~exp1

1.14.4.3+repack-1~exp2

1.14.4.3+repack-1~exp3

1.14.5+repack-1~exp1

1.14.5+repack-1~exp2

1.14.5+repack-1~exp3

1.14.5+repack-1~exp4

1.14.5+repack-1~exp5

1.14.5+repack-1~exp6

1.14.5+repack-1

1.14.5+repack-2

1.14.5+repack-3~exp1

1.14.5+repack-3~exp2

1.14.5+repack-3~exp3

1.14.5+repack-3~exp4

1.14.5+repack-3

1.14.5+repack-3.1

1.14.5+repack-4~exp1

1.14.5+repack-4~exp2

1.14.5+repack-4

1.14.5+repack-5~exp2

1.14.5+repack-5~exp3

1.14.6+repack-1~exp1

1.14.6+repack-1~exp2

1.14.6+repack-1~exp3

1.14.6+repack-1~exp4

1.14.6+repack-1~exp5

1.14.6+repack-1~exp6

1.14.6+repack-1~exp7

1.14.6+repack-1~exp8

1.14.6+repack-1~exp9

1.14.6+repack-1~exp10

1.14.6+repack-1~exp11

1.14.6+repack-1~exp12

1.14.6+repack-1~exp13

1.14.6+repack-1~exp14

1.14.6+repack-1~exp15

1.14.6+repack-1~exp16

1.14.6+repack-1~exp17

1.14.6+repack-1~exp18

1.14.6+repack-1~exp19

1.14.6+repack-1~exp20

1.14.6+repack-1~exp21

1.14.6+repack-1

1.14.6+repack-2

1.14.6+repack-3~exp1

2.*

2.1.0+repack-1~exp3

2.1.0+repack-1~exp4

2.1.0+repack-1~exp5

2.1.0+repack-1~exp6

2.1.0+repack-1~exp7

2.1.0+repack-1~exp8

2.1.0+repack-1~exp9

2.1.0+repack-1~exp10

2.1.0+repack-1~exp11

2.1.0+repack-1

2.2.0+repack-1

2.2.0+repack-2

2.2.0+repack-3

2.2.0+repack-4

Ecosystem specific

{
    "urgency": "unimportant"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-2308.json"

Debian:13 / hdf5

Package

Name: hdf5
Purl: pkg:deb/debian/hdf5?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.14.5+repack-3

1.14.5+repack-3.1

1.14.5+repack-4~exp1

1.14.5+repack-4~exp2

1.14.5+repack-4

1.14.5+repack-5~exp2

1.14.5+repack-5~exp3

1.14.6+repack-1~exp1

1.14.6+repack-1~exp2

1.14.6+repack-1~exp3

1.14.6+repack-1~exp4

1.14.6+repack-1~exp5

1.14.6+repack-1~exp6

1.14.6+repack-1~exp7

1.14.6+repack-1~exp8

1.14.6+repack-1~exp9

1.14.6+repack-1~exp10

1.14.6+repack-1~exp11

1.14.6+repack-1~exp12

1.14.6+repack-1~exp13

1.14.6+repack-1~exp14

1.14.6+repack-1~exp15

1.14.6+repack-1~exp16

1.14.6+repack-1~exp17

1.14.6+repack-1~exp18

1.14.6+repack-1~exp19

1.14.6+repack-1~exp20

1.14.6+repack-1~exp21

1.14.6+repack-1

1.14.6+repack-2

1.14.6+repack-3~exp1

2.*

2.1.0+repack-1~exp3

2.1.0+repack-1~exp4

2.1.0+repack-1~exp5

2.1.0+repack-1~exp6

2.1.0+repack-1~exp7

2.1.0+repack-1~exp8

2.1.0+repack-1~exp9

2.1.0+repack-1~exp10

2.1.0+repack-1~exp11

2.1.0+repack-1

2.2.0+repack-1

2.2.0+repack-2

2.2.0+repack-3

2.2.0+repack-4

Ecosystem specific

{
    "urgency": "unimportant"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-2308.json"

Debian:14 / hdf5

Package

Name: hdf5
Purl: pkg:deb/debian/hdf5?arch=source&distro=forky

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.14.5+repack-3

1.14.5+repack-3.1

1.14.5+repack-4~exp1

1.14.5+repack-4~exp2

1.14.5+repack-4

1.14.5+repack-5~exp2

1.14.5+repack-5~exp3

1.14.6+repack-1~exp1

1.14.6+repack-1~exp2

1.14.6+repack-1~exp3

1.14.6+repack-1~exp4

1.14.6+repack-1~exp5

1.14.6+repack-1~exp6

1.14.6+repack-1~exp7

1.14.6+repack-1~exp8

1.14.6+repack-1~exp9

1.14.6+repack-1~exp10

1.14.6+repack-1~exp11

1.14.6+repack-1~exp12

1.14.6+repack-1~exp13

1.14.6+repack-1~exp14

1.14.6+repack-1~exp15

1.14.6+repack-1~exp16

1.14.6+repack-1~exp17

1.14.6+repack-1~exp18

1.14.6+repack-1~exp19

1.14.6+repack-1~exp20

1.14.6+repack-1~exp21

1.14.6+repack-1

1.14.6+repack-2

1.14.6+repack-3~exp1

2.*

2.1.0+repack-1~exp3

2.1.0+repack-1~exp4

2.1.0+repack-1~exp5

2.1.0+repack-1~exp6

2.1.0+repack-1~exp7

2.1.0+repack-1~exp8

2.1.0+repack-1~exp9

2.1.0+repack-1~exp10

2.1.0+repack-1~exp11

2.1.0+repack-1

2.2.0+repack-1

2.2.0+repack-2

2.2.0+repack-3

2.2.0+repack-4

Ecosystem specific

{
    "urgency": "unimportant"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-2308.json"