The HDF Group HDF5.

NULL Pointer Dereference in H5HL_unprotect via Corrupted File

• The HDF Group HDF5
• Memory corruption

Heap Buffer Over-read via Non-Terminated Link Data in H5L__extern_traverse

• The HDF Group HDF5
• Memory corruption

Heap Buffer Over-read via Malformed Message Size in HDF5's H5O__chunk_deserialize

• The HDF Group HDF5
• Memory corruption

Uncontrolled Recursion in HDF5 H5B__iterate_helper() via Crafted File

• The HDF Group HDF5
• Denial of service

HDF5 heap buffer overflow in H5VM_array_fill via crafted fill-value metadata

• The HDF Group HDF5
• Memory corruption

HDF5 scale-offset filter heap buffer over-read via crafted chunk

• The HDF Group HDF5
• Memory corruption

Heap Use-After-Free in H5T__conv_f_f

• The HDF Group HDF5
• Memory corruption

HDF5 integer underflow in Fletcher32 filter leads to massive out-of-bounds read

• The HDF Group HDF5
• Memory corruption
• CWE-1284

HDF5 out-of-bounds heap read in N-Bit filter decompression

• The HDF Group HDF5
• Memory corruption

Nbit filter NULL/short parameter-array dereference

• The HDF Group HDF5
• Memory corruption
• CWE-1284

HDF5 divide-by-zero (SIGFPE) via mismatched chunk-layout dimensionality and dataspace rank on dataset open

• The HDF Group HDF5
• Denial of service

HDF5 H5Pget_fill_value NULL Pointer Dereference via Malformed Fill Value Message

• The HDF Group HDF5
• Memory corruption

HDF5 h5dump Untrusted Pointer Dereference in Binary Output of Variable-Length String Datasets

• The HDF Group HDF5
• Memory corruption

NULL Pointer Dereference in HDF5 via Invalid Variable-Length Datatype Type Tag

• The HDF Group HDF5
• Memory corruption
• Denial of service

Double Free in H5D__chunk_copy() in HDF5 via a Crafted Chunk-Index Size Field

• The HDF Group HDF5
• Memory corruption

HDF5 SOHM List Index Heap Buffer Overflow

• The HDF Group HDF5
• Memory corruption