Vendor
HDF5 versions 2.2.0 and earlier contain a heap buffer over-read vulnerability in the external link traversal callback that can be triggered by a crafted file, potentially leading to denial of service or information disclosure.