SB2023060336 - openEuler 22.03 LTS SP1 update for hdf5

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Buffer overflow (CVE-ID: CVE-2019-8396)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the H5O__layout_encode function in H5Olayout.c. A remote attacker can pass specially crafted data to the application, trigger a buffer buffer overflow and perform a denial of service (DoS) attack.

2) Out-of-bounds read (CVE-ID: CVE-2018-13867)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

An issue was discovered in the HDF HDF5 1.8.20 library. There is an out of bounds read in the function H5F__accum_read in H5Faccum.c.

3) Out-of-bounds write (CVE-ID: CVE-2021-37501)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the h5tools_str_sprint() function in /hdf5/tools/lib/h5tools_str.c. A remote attacker can trigger an out-of-bounds write and perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1327