SB2022061552 - SUSE update for hdf5, suse-hpc
Published: June 15, 2022 Updated: March 9, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 26 secuirty vulnerabilities.
1) NULL pointer dereference (CVE-ID: CVE-2017-17505)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dreference error in H5Opline.c file in libhdf5.a. For example, h5dump would crash when someone opens a crafted hdf5 file. A remote attacker can perform a denial of service (DoS) attack.
2) Out-of-bounds read (CVE-ID: CVE-2017-17506)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
In HDF5 1.10.1, there is an out of bounds read vulnerability in the function H5Opline_pline_decode in H5Opline.c in libhdf5.a. For example, h5dump would crash when someone opens a crafted hdf5 file.
3) Division by zero (CVE-ID: CVE-2017-17508)
The vulnerability allows a remote attacker to perform denial of service attack.
The vulnerability exists due to division by zero error when processing untrusted input in the H5T.c file in libhdf5.a. For example, h5dump would crash when someone opens a crafted hdf5 file. A remote attacker can perform denial of service attack.
4) Out-of-bounds write (CVE-ID: CVE-2017-17509)
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
In HDF5 1.10.1, there is an out of bounds write vulnerability in the function H5G__ent_decode_vec in H5Gcache.c in libhdf5.a. For example, h5dump would crash or possibly have unspecified other impact someone opens a crafted hdf5 file.
5) NULL pointer dereference (CVE-ID: CVE-2018-11202)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in H5S_hyper_make_spans in H5Shyper.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service attack. A remote attacker can perform a denial of service (DoS) attack.
6) Division by zero (CVE-ID: CVE-2018-11203)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a division by zero error within . A remote attacker can pass specially crafted data to the application and crash it.
7) NULL pointer dereference (CVE-ID: CVE-2018-11204)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in H5O__chunk_deserialize in H5Ocache.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service attack. A remote attacker can perform a denial of service (DoS) attack.
8) Out-of-bounds read (CVE-ID: CVE-2018-11206)
The vulnerability allows a remote non-authenticated attacker to #BASIC_IMPACT#.
An out of bounds read was discovered in H5O_fill_new_decode and H5O_fill_old_decode in H5Ofill.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service or information disclosure attack.
9) Division by zero (CVE-ID: CVE-2018-11207)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a division by zero error within . A remote attacker can pass specially crafted data to the application and crash it.
10) Buffer overflow (CVE-ID: CVE-2018-13869)
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
An issue was discovered in the HDF HDF5 1.8.20 library. There is a memcpy parameter overlap in the function H5O_link_decode in H5Olink.c.
11) Out-of-bounds read (CVE-ID: CVE-2018-13870)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to heap-based buffer over-read in the function H5O_link_decode in H5Olink.c. A remote attacker can perform a denial of service attack.
12) Out-of-bounds read (CVE-ID: CVE-2018-14033)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to heap-based buffer over-read in the function H5O_layout_decode in H5Olayout.c, related to HDmemcpy. A remote attacker can perform a denial of service attack.
13) Out-of-bounds read (CVE-ID: CVE-2018-14460)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to heap-based buffer over-read in the function H5O_sdspace_decode in H5Osdspace.c. A remote attacker can perform a denial of service attack.
14) Division by zero (CVE-ID: CVE-2018-17233)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a division by zero error in the H5D__create_chunk_file_map_hyper() function of H5Dchunk.c in the HDF HDF5 . A remote attacker can trick the victim into opening specially crafted HDF file and perform a denial of service attack.
15) Resource exhaustion (CVE-ID: CVE-2018-17234)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists in the H5O__chunk_deserialize() function in H5Ocache.c in the HDF HDF5. A remote attacker can trick the victim into opening a specially crafted HDF5 file and perform a denial of service attack.
16) Division by zero (CVE-ID: CVE-2018-17237)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a division by zero error in the function H5D__chunk_set_info_real() of H5Dchunk.c in the HDF HDF5. A remote attacker can trick the victim into opening a specially crafted HDF file and perform a denial of service attack.
17) NULL pointer dereference (CVE-ID: CVE-2018-17432)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in H5O_sdspace_encode() in H5Osdspace.c in the HDF HDF5. A remote attacker can trick the victim into opening specially crafted HDF5 file and perform a denial of service attack.
18) Heap-based buffer overflow (CVE-ID: CVE-2018-17433)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a boundary error in ReadGifImageDesc() in gifread.c in the HDF HDF5 when converting a GIF file to an HDF file. A remote attacker can trick the victim into opening a specially crafted HDF5 file and perform a denial of service attack.
19) Division by zero (CVE-ID: CVE-2018-17434)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a division by zero error in the function apply_filters() of h5repack_filters.c in the HDF HDF5. A remote attacker can trick the victim into opening specially crafted HDF file and perform a denial of service attack.
20) Out-of-bounds read (CVE-ID: CVE-2018-17435)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in the H5O_attr_decode() function in H5Oattr.c in the HDF HDF5 when converting an HDF file to GIF file. A remote attacker can trick the victim into opening a specially crafted HDF5 file and perform a denial of service attack.
21) Out-of-bounds write (CVE-ID: CVE-2018-17436)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a boundary error in the ReadCode() function in decompress.c in the HDF HDF5. A remote attacker can trick the victim into opening specially crafted HDF file, trigger out-of-bounds write, and perform a denial of service attack.
22) Resource exhaustion (CVE-ID: CVE-2018-17437)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources in the H5O_dtype_decode_helper() function in H5Odtype.c in the HDF HDF5. A remote attacker can trick the victim into opening a specially crafted HDF5 file and perform a denial of service attack.
23) Division by zero (CVE-ID: CVE-2018-17438)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a division by zero error in the H5D__select_io() function of H5Dselect.c in the HDF HDF5. A remote attacker can trick the victim into opening a specially crafted HDF file and perform a denial of service attack.
24) Heap-based buffer overflow (CVE-ID: CVE-2020-10809)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the Decompress() function in decompress.c. A remote attacker can exploit the vulnerability by sending a crafted file to the gif2h5 binary, trigger a heap-based buffer overflow and perform a denial of service (DoS) attack.
25) NULL pointer dereference (CVE-ID: CVE-2020-10810)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in the H5AC_unpin_entry() function located in H5AC.c. It allows an attacker to cause Denial of Service. A remote attacker can perform a denial of service (DoS) attack.
26) Out-of-bounds read (CVE-ID: CVE-2020-10811)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in the H5O__layout_decode() function in H5Olayout.c. A remote attacker can pass specially crafted data to the application, trigger out-of-bounds read error and read contents of memory on the system or perform a denial of service attack.
Remediation
Install update from vendor's website.