SB2022061542 - SUSE update for hdf5
Published: June 15, 2022 Updated: March 9, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 14 secuirty vulnerabilities.
1) Out-of-bounds read (CVE-ID: CVE-2018-11206)
The vulnerability allows a remote non-authenticated attacker to #BASIC_IMPACT#.
An out of bounds read was discovered in H5O_fill_new_decode and H5O_fill_old_decode in H5Ofill.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service or information disclosure attack.
2) Out-of-bounds read (CVE-ID: CVE-2018-14033)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to heap-based buffer over-read in the function H5O_layout_decode in H5Olayout.c, related to HDmemcpy. A remote attacker can perform a denial of service attack.
3) Out-of-bounds read (CVE-ID: CVE-2018-14460)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to heap-based buffer over-read in the function H5O_sdspace_decode in H5Osdspace.c. A remote attacker can perform a denial of service attack.
4) Resource exhaustion (CVE-ID: CVE-2018-17234)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists in the H5O__chunk_deserialize() function in H5Ocache.c in the HDF HDF5. A remote attacker can trick the victim into opening a specially crafted HDF5 file and perform a denial of service attack.
5) Division by zero (CVE-ID: CVE-2018-17237)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a division by zero error in the function H5D__chunk_set_info_real() of H5Dchunk.c in the HDF HDF5. A remote attacker can trick the victim into opening a specially crafted HDF file and perform a denial of service attack.
6) NULL pointer dereference (CVE-ID: CVE-2018-17432)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in H5O_sdspace_encode() in H5Osdspace.c in the HDF HDF5. A remote attacker can trick the victim into opening specially crafted HDF5 file and perform a denial of service attack.
7) Heap-based buffer overflow (CVE-ID: CVE-2018-17433)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a boundary error in ReadGifImageDesc() in gifread.c in the HDF HDF5 when converting a GIF file to an HDF file. A remote attacker can trick the victim into opening a specially crafted HDF5 file and perform a denial of service attack.
8) Division by zero (CVE-ID: CVE-2018-17434)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a division by zero error in the function apply_filters() of h5repack_filters.c in the HDF HDF5. A remote attacker can trick the victim into opening specially crafted HDF file and perform a denial of service attack.
9) Out-of-bounds write (CVE-ID: CVE-2018-17436)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a boundary error in the ReadCode() function in decompress.c in the HDF HDF5. A remote attacker can trick the victim into opening specially crafted HDF file, trigger out-of-bounds write, and perform a denial of service attack.
10) Resource exhaustion (CVE-ID: CVE-2018-17437)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources in the H5O_dtype_decode_helper() function in H5Odtype.c in the HDF HDF5. A remote attacker can trick the victim into opening a specially crafted HDF5 file and perform a denial of service attack.
11) Division by zero (CVE-ID: CVE-2018-17438)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a division by zero error in the H5D__select_io() function of H5Dselect.c in the HDF HDF5. A remote attacker can trick the victim into opening a specially crafted HDF file and perform a denial of service attack.
12) Heap-based buffer overflow (CVE-ID: CVE-2020-10809)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the Decompress() function in decompress.c. A remote attacker can exploit the vulnerability by sending a crafted file to the gif2h5 binary, trigger a heap-based buffer overflow and perform a denial of service (DoS) attack.
13) NULL pointer dereference (CVE-ID: CVE-2020-10810)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in the H5AC_unpin_entry() function located in H5AC.c. It allows an attacker to cause Denial of Service. A remote attacker can perform a denial of service (DoS) attack.
14) Out-of-bounds read (CVE-ID: CVE-2020-10811)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in the H5O__layout_decode() function in H5Olayout.c. A remote attacker can pass specially crafted data to the application, trigger out-of-bounds read error and read contents of memory on the system or perform a denial of service attack.
Remediation
Install update from vendor's website.