DEBIAN-CVE-2025-2309

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2025-2309

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-2309.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2025-2309

Upstream

CVE-2025-2309

Published

2025-03-14T21:15:37Z

Modified

2026-09-01T20:05:44Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

A vulnerability has been found in HDF5 1.14.6 and classified as critical. This vulnerability affects the function H5T__bit_copy of the component Type Conversion Logic. The manipulation leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor plans to fix this issue in an upcoming release.

References

https://security-tracker.debian.org/tracker/CVE-2025-2309

Affected packages

Debian:12 / hdf5

Package

Name: hdf5
Purl: pkg:deb/debian/hdf5?arch=source&distro=bookworm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.10.8+repack1-1

1.10.10+repack-1

1.10.10+repack-2

1.10.10+repack-3

1.10.10+repack-3.1

1.10.10+repack-3.2

1.10.10+repack-3.2+ports

1.10.10+repack-3.3

1.10.10+repack-4

1.10.10+repack-5

1.12.0+repack-1~exp1

1.12.0+repack-1~exp2

1.12.2+repack-1~exp1

1.14.3+repack-1~exp1

1.14.3+repack1-1~exp2

1.14.3+repack1-1~exp3

1.14.4.3+repack-1~exp1

1.14.4.3+repack-1~exp2

1.14.4.3+repack-1~exp3

1.14.5+repack-1~exp1

1.14.5+repack-1~exp2

1.14.5+repack-1~exp3

1.14.5+repack-1~exp4

1.14.5+repack-1~exp5

1.14.5+repack-1~exp6

1.14.5+repack-1

1.14.5+repack-2

1.14.5+repack-3~exp1

1.14.5+repack-3~exp2

1.14.5+repack-3~exp3

1.14.5+repack-3~exp4

1.14.5+repack-3

1.14.5+repack-3.1

1.14.5+repack-4~exp1

1.14.5+repack-4~exp2

1.14.5+repack-4

1.14.5+repack-5~exp2

1.14.5+repack-5~exp3

1.14.6+repack-1~exp1

1.14.6+repack-1~exp2

1.14.6+repack-1~exp3

1.14.6+repack-1~exp4

1.14.6+repack-1~exp5

1.14.6+repack-1~exp6

1.14.6+repack-1~exp7

1.14.6+repack-1~exp8

1.14.6+repack-1~exp9

1.14.6+repack-1~exp10

1.14.6+repack-1~exp11

1.14.6+repack-1~exp12

1.14.6+repack-1~exp13

1.14.6+repack-1~exp14

1.14.6+repack-1~exp15

1.14.6+repack-1~exp16

1.14.6+repack-1~exp17

1.14.6+repack-1~exp18

1.14.6+repack-1~exp19

1.14.6+repack-1~exp20

1.14.6+repack-1~exp21

1.14.6+repack-1

1.14.6+repack-2

1.14.6+repack-3~exp1

2.*

2.1.0+repack-1~exp3

2.1.0+repack-1~exp4

2.1.0+repack-1~exp5

2.1.0+repack-1~exp6

2.1.0+repack-1~exp7

2.1.0+repack-1~exp8

2.1.0+repack-1~exp9

2.1.0+repack-1~exp10

2.1.0+repack-1~exp11

2.1.0+repack-1

2.2.0+repack-1

2.2.0+repack-2

2.2.0+repack-3

2.2.0+repack-4

Ecosystem specific

{
    "urgency": "unimportant"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-2309.json"

Debian:13 / hdf5

Package

Name: hdf5
Purl: pkg:deb/debian/hdf5?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.14.5+repack-3

1.14.5+repack-3.1

1.14.5+repack-4~exp1

1.14.5+repack-4~exp2

1.14.5+repack-4

1.14.5+repack-5~exp2

1.14.5+repack-5~exp3

1.14.6+repack-1~exp1

1.14.6+repack-1~exp2

1.14.6+repack-1~exp3

1.14.6+repack-1~exp4

1.14.6+repack-1~exp5

1.14.6+repack-1~exp6

1.14.6+repack-1~exp7

1.14.6+repack-1~exp8

1.14.6+repack-1~exp9

1.14.6+repack-1~exp10

1.14.6+repack-1~exp11

1.14.6+repack-1~exp12

1.14.6+repack-1~exp13

1.14.6+repack-1~exp14

1.14.6+repack-1~exp15

1.14.6+repack-1~exp16

1.14.6+repack-1~exp17

1.14.6+repack-1~exp18

1.14.6+repack-1~exp19

1.14.6+repack-1~exp20

1.14.6+repack-1~exp21

1.14.6+repack-1

1.14.6+repack-2

1.14.6+repack-3~exp1

2.*

2.1.0+repack-1~exp3

2.1.0+repack-1~exp4

2.1.0+repack-1~exp5

2.1.0+repack-1~exp6

2.1.0+repack-1~exp7

2.1.0+repack-1~exp8

2.1.0+repack-1~exp9

2.1.0+repack-1~exp10

2.1.0+repack-1~exp11

2.1.0+repack-1

2.2.0+repack-1

2.2.0+repack-2

2.2.0+repack-3

2.2.0+repack-4

Ecosystem specific

{
    "urgency": "unimportant"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-2309.json"

Debian:14 / hdf5

Package

Name: hdf5
Purl: pkg:deb/debian/hdf5?arch=source&distro=forky

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.14.5+repack-3

1.14.5+repack-3.1

1.14.5+repack-4~exp1

1.14.5+repack-4~exp2

1.14.5+repack-4

1.14.5+repack-5~exp2

1.14.5+repack-5~exp3

1.14.6+repack-1~exp1

1.14.6+repack-1~exp2

1.14.6+repack-1~exp3

1.14.6+repack-1~exp4

1.14.6+repack-1~exp5

1.14.6+repack-1~exp6

1.14.6+repack-1~exp7

1.14.6+repack-1~exp8

1.14.6+repack-1~exp9

1.14.6+repack-1~exp10

1.14.6+repack-1~exp11

1.14.6+repack-1~exp12

1.14.6+repack-1~exp13

1.14.6+repack-1~exp14

1.14.6+repack-1~exp15

1.14.6+repack-1~exp16

1.14.6+repack-1~exp17

1.14.6+repack-1~exp18

1.14.6+repack-1~exp19

1.14.6+repack-1~exp20

1.14.6+repack-1~exp21

1.14.6+repack-1

1.14.6+repack-2

1.14.6+repack-3~exp1

2.*

2.1.0+repack-1~exp3

2.1.0+repack-1~exp4

2.1.0+repack-1~exp5

2.1.0+repack-1~exp6

2.1.0+repack-1~exp7

2.1.0+repack-1~exp8

2.1.0+repack-1~exp9

2.1.0+repack-1~exp10

2.1.0+repack-1~exp11

2.1.0+repack-1

2.2.0+repack-1

2.2.0+repack-2

2.2.0+repack-3

2.2.0+repack-4

Ecosystem specific

{
    "urgency": "unimportant"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-2309.json"