Bug 905136 (CVE-2021-37501)

Summary:	sci-libs/hdf5: heap buffer overread
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	CONFIRMED ---
Severity:	minor	CC:	sci
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://github.com/ST4RF4LL/Something_Found/blob/main/HDF5_v1.13.0_h5dump_heap_overflow.md
Whiteboard:	B4 [upstream?]
Package list:		Runtime testing required:	---

Description John Helmert III archtester

2023-04-27 01:22:28 UTC

CVE-2021-37501:

Buffer Overflow vulnerability in HDFGroup hdf5-h5dump 1.12.0 through 1.13.0 allows attackers to cause a denial of service via h5tools_str_sprint in /hdf5/tools/lib/h5tools_str.c.

Surprisingly, $URL does appear to contain an upstream report, but it's
an image of a response from some HDF5 support person who says they
filed a bug, SUPPORT-1508.