Detections
Analytics

SUSE SLES15 Security Update : hdf5 (SUSE-SU-2022:1912-1)

high Nessus Plugin ID 161827

Language:

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1912-1 advisory.

 - An out of bounds read was discovered in H5O_fill_new_decode and H5O_fill_old_decode in H5Ofill.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service or information disclosure attack.
 (CVE-2018-11206)

 - An issue was discovered in the HDF HDF5 1.8.20 library. There is a heap-based buffer over-read in the function H5O_layout_decode in H5Olayout.c, related to HDmemcpy. (CVE-2018-14033)

 - An issue was discovered in the HDF HDF5 1.8.20 library. There is a heap-based buffer over-read in the function H5O_sdspace_decode in H5Osdspace.c. (CVE-2018-14460)

 - Memory leak in the H5O__chunk_deserialize() function in H5Ocache.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service (memory consumption) via a crafted HDF5 file.
 (CVE-2018-17234)

 - A SIGFPE signal is raised in the function H5D__chunk_set_info_real() of H5Dchunk.c in the HDF HDF5 1.10.3 library during an attempted parse of a crafted HDF file, because of incorrect protection against division by zero. This issue is different from CVE-2018-11207. (CVE-2018-17237)

 - A NULL pointer dereference in H5O_sdspace_encode() in H5Osdspace.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service via a crafted HDF5 file. (CVE-2018-17432)

 - A heap-based buffer overflow in ReadGifImageDesc() in gifread.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service via a crafted HDF5 file. This issue was triggered while converting a GIF file to an HDF file. (CVE-2018-17433)

 - A SIGFPE signal is raised in the function apply_filters() of h5repack_filters.c in the HDF HDF5 through 1.10.3 library during an attempted parse of a crafted HDF file, because of incorrect protection against division by zero. It could allow a remote denial of service attack. (CVE-2018-17434)

 - ReadCode() in decompress.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service (invalid write access) via a crafted HDF5 file. This issue was triggered while converting a GIF file to an HDF file. (CVE-2018-17436)

 - Memory leak in the H5O_dtype_decode_helper() function in H5Odtype.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service (memory consumption) via a crafted HDF5 file.
 (CVE-2018-17437)

 - A SIGFPE signal is raised in the function H5D__select_io() of H5Dselect.c in the HDF HDF5 through 1.10.3 library during an attempted parse of a crafted HDF file, because of incorrect protection against division by zero. It could allow a remote denial of service attack. (CVE-2018-17438)

 - An issue was discovered in HDF5 through 1.12.0. A heap-based buffer overflow exists in the function Decompress() located in decompress.c. It can be triggered by sending a crafted file to the gif2h5 binary.
 It allows an attacker to cause Denial of Service. (CVE-2020-10809)

 - An issue was discovered in HDF5 through 1.12.0. A NULL pointer dereference exists in the function H5AC_unpin_entry() located in H5AC.c. It allows an attacker to cause Denial of Service. (CVE-2020-10810)

 - An issue was discovered in HDF5 through 1.12.0. A heap-based buffer over-read exists in the function H5O__layout_decode() located in H5Olayout.c. It allows an attacker to cause Denial of Service.
 (CVE-2020-10811)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://bugzilla.suse.com/1093657

https://bugzilla.suse.com/1101471

https://bugzilla.suse.com/1101474

https://bugzilla.suse.com/1102175

https://bugzilla.suse.com/1109167

https://bugzilla.suse.com/1109168

https://bugzilla.suse.com/1109564

https://bugzilla.suse.com/1109565

https://bugzilla.suse.com/1109566

https://bugzilla.suse.com/1109568

https://bugzilla.suse.com/1109569

https://bugzilla.suse.com/1109570

https://bugzilla.suse.com/1167401

https://bugzilla.suse.com/1167404

https://bugzilla.suse.com/1167405

https://bugzilla.suse.com/1179521

https://bugzilla.suse.com/1196682

https://www.suse.com/security/cve/CVE-2018-11206

https://www.suse.com/security/cve/CVE-2018-14032

https://www.suse.com/security/cve/CVE-2018-14033

https://www.suse.com/security/cve/CVE-2018-14460

https://www.suse.com/security/cve/CVE-2018-17234

https://www.suse.com/security/cve/CVE-2018-17237

https://www.suse.com/security/cve/CVE-2018-17432

https://www.suse.com/security/cve/CVE-2018-17433

https://www.suse.com/security/cve/CVE-2018-17434

https://www.suse.com/security/cve/CVE-2018-17436

https://www.suse.com/security/cve/CVE-2018-17437

https://www.suse.com/security/cve/CVE-2018-17438

https://www.suse.com/security/cve/CVE-2020-10809

https://www.suse.com/security/cve/CVE-2020-10810

https://www.suse.com/security/cve/CVE-2020-10811

http://www.nessus.org/u?c3a50ab1

Plugin Details

Severity: High

ID: 161827

File Name: suse_SU-2022-1912-1.nasl

Version: 1.6

Type: local

Agent: unix

Published: 6/3/2022

Updated: 7/14/2023

Supported Sensors: Agentless Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.0

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2018-14460

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:libhdf5_cpp_1_10_8-gnu-mpich-hpc, p-cpe:/a:novell:suse_linux:libhdf5_cpp_1_10_8-gnu-mvapich2-hpc, p-cpe:/a:novell:suse_linux:libhdf5_cpp_1_10_8-gnu-openmpi3-hpc, p-cpe:/a:novell:suse_linux:libhdf5_cpp_1_10_8-gnu-openmpi4-hpc, p-cpe:/a:novell:suse_linux:libhdf5_fortran-gnu-hpc, p-cpe:/a:novell:suse_linux:libhdf5_fortran-gnu-mpich-hpc, p-cpe:/a:novell:suse_linux:libhdf5_fortran-gnu-mvapich2-hpc, p-cpe:/a:novell:suse_linux:hdf5-gnu-hpc, p-cpe:/a:novell:suse_linux:hdf5-gnu-hpc-devel, p-cpe:/a:novell:suse_linux:hdf5-gnu-mpich-hpc, p-cpe:/a:novell:suse_linux:hdf5-gnu-mpich-hpc-devel, p-cpe:/a:novell:suse_linux:hdf5-gnu-mvapich2-hpc, p-cpe:/a:novell:suse_linux:hdf5-gnu-mvapich2-hpc-devel, p-cpe:/a:novell:suse_linux:hdf5-gnu-openmpi3-hpc, p-cpe:/a:novell:suse_linux:hdf5-gnu-openmpi3-hpc-devel, p-cpe:/a:novell:suse_linux:hdf5-gnu-openmpi4-hpc, p-cpe:/a:novell:suse_linux:hdf5-gnu-openmpi4-hpc-devel, p-cpe:/a:novell:suse_linux:hdf5-hpc-examples, p-cpe:/a:novell:suse_linux:hdf5_1_10_8-gnu-hpc, p-cpe:/a:novell:suse_linux:hdf5_1_10_8-gnu-hpc-devel, p-cpe:/a:novell:suse_linux:hdf5_1_10_8-gnu-hpc-devel-static, p-cpe:/a:novell:suse_linux:hdf5_1_10_8-gnu-hpc-module, p-cpe:/a:novell:suse_linux:hdf5_1_10_8-gnu-mpich-hpc, p-cpe:/a:novell:suse_linux:hdf5_1_10_8-gnu-mpich-hpc-devel, p-cpe:/a:novell:suse_linux:hdf5_1_10_8-gnu-mpich-hpc-devel-static, p-cpe:/a:novell:suse_linux:hdf5_1_10_8-gnu-mpich-hpc-module, p-cpe:/a:novell:suse_linux:hdf5_1_10_8-gnu-mvapich2-hpc, p-cpe:/a:novell:suse_linux:hdf5_1_10_8-gnu-mvapich2-hpc-devel, p-cpe:/a:novell:suse_linux:hdf5_1_10_8-gnu-mvapich2-hpc-devel-static, p-cpe:/a:novell:suse_linux:hdf5_1_10_8-gnu-mvapich2-hpc-module, p-cpe:/a:novell:suse_linux:hdf5_1_10_8-gnu-openmpi3-hpc, p-cpe:/a:novell:suse_linux:hdf5_1_10_8-gnu-openmpi3-hpc-devel, p-cpe:/a:novell:suse_linux:hdf5_1_10_8-gnu-openmpi3-hpc-devel-static, p-cpe:/a:novell:suse_linux:hdf5_1_10_8-gnu-openmpi3-hpc-module, p-cpe:/a:novell:suse_linux:hdf5_1_10_8-gnu-openmpi4-hpc, p-cpe:/a:novell:suse_linux:hdf5_1_10_8-gnu-openmpi4-hpc-devel, p-cpe:/a:novell:suse_linux:hdf5_1_10_8-gnu-openmpi4-hpc-devel-static, p-cpe:/a:novell:suse_linux:hdf5_1_10_8-gnu-openmpi4-hpc-module, p-cpe:/a:novell:suse_linux:hdf5_1_10_8-hpc-examples, p-cpe:/a:novell:suse_linux:libhdf5-gnu-hpc, p-cpe:/a:novell:suse_linux:libhdf5-gnu-mpich-hpc, p-cpe:/a:novell:suse_linux:libhdf5-gnu-mvapich2-hpc, p-cpe:/a:novell:suse_linux:libhdf5-gnu-openmpi3-hpc, p-cpe:/a:novell:suse_linux:libhdf5-gnu-openmpi4-hpc, p-cpe:/a:novell:suse_linux:libhdf5_1_10_8-gnu-hpc, p-cpe:/a:novell:suse_linux:libhdf5_1_10_8-gnu-mpich-hpc, p-cpe:/a:novell:suse_linux:libhdf5_1_10_8-gnu-mvapich2-hpc, p-cpe:/a:novell:suse_linux:libhdf5_1_10_8-gnu-openmpi3-hpc, p-cpe:/a:novell:suse_linux:libhdf5_1_10_8-gnu-openmpi4-hpc, p-cpe:/a:novell:suse_linux:libhdf5_cpp-gnu-hpc, p-cpe:/a:novell:suse_linux:libhdf5_cpp-gnu-mpich-hpc, p-cpe:/a:novell:suse_linux:libhdf5_cpp-gnu-mvapich2-hpc, p-cpe:/a:novell:suse_linux:libhdf5_cpp-gnu-openmpi3-hpc, p-cpe:/a:novell:suse_linux:libhdf5_fortran-gnu-openmpi3-hpc, p-cpe:/a:novell:suse_linux:libhdf5_fortran-gnu-openmpi4-hpc, p-cpe:/a:novell:suse_linux:libhdf5_fortran_1_10_8-gnu-hpc, p-cpe:/a:novell:suse_linux:libhdf5_fortran_1_10_8-gnu-mpich-hpc, p-cpe:/a:novell:suse_linux:libhdf5_fortran_1_10_8-gnu-mvapich2-hpc, p-cpe:/a:novell:suse_linux:libhdf5_fortran_1_10_8-gnu-openmpi3-hpc, p-cpe:/a:novell:suse_linux:libhdf5_fortran_1_10_8-gnu-openmpi4-hpc, p-cpe:/a:novell:suse_linux:libhdf5_hl-gnu-hpc, p-cpe:/a:novell:suse_linux:libhdf5_hl-gnu-mpich-hpc, p-cpe:/a:novell:suse_linux:libhdf5_hl-gnu-mvapich2-hpc, p-cpe:/a:novell:suse_linux:libhdf5_hl-gnu-openmpi3-hpc, p-cpe:/a:novell:suse_linux:libhdf5_hl-gnu-openmpi4-hpc, p-cpe:/a:novell:suse_linux:libhdf5_cpp-gnu-openmpi4-hpc, p-cpe:/a:novell:suse_linux:libhdf5_cpp_1_10_8-gnu-hpc, p-cpe:/a:novell:suse_linux:libhdf5_hl_1_10_8-gnu-hpc, p-cpe:/a:novell:suse_linux:libhdf5_hl_1_10_8-gnu-mpich-hpc, p-cpe:/a:novell:suse_linux:libhdf5_hl_1_10_8-gnu-mvapich2-hpc, p-cpe:/a:novell:suse_linux:libhdf5_hl_1_10_8-gnu-openmpi3-hpc, p-cpe:/a:novell:suse_linux:libhdf5_hl_1_10_8-gnu-openmpi4-hpc, p-cpe:/a:novell:suse_linux:libhdf5_hl_cpp-gnu-hpc, p-cpe:/a:novell:suse_linux:libhdf5_hl_cpp-gnu-mpich-hpc, p-cpe:/a:novell:suse_linux:libhdf5_hl_cpp-gnu-mvapich2-hpc, p-cpe:/a:novell:suse_linux:libhdf5_hl_cpp-gnu-openmpi3-hpc, p-cpe:/a:novell:suse_linux:libhdf5_hl_cpp-gnu-openmpi4-hpc, p-cpe:/a:novell:suse_linux:libhdf5_hl_cpp_1_10_8-gnu-hpc, p-cpe:/a:novell:suse_linux:libhdf5_hl_cpp_1_10_8-gnu-mpich-hpc, p-cpe:/a:novell:suse_linux:libhdf5_hl_cpp_1_10_8-gnu-mvapich2-hpc, p-cpe:/a:novell:suse_linux:libhdf5_hl_cpp_1_10_8-gnu-openmpi3-hpc, p-cpe:/a:novell:suse_linux:libhdf5_hl_cpp_1_10_8-gnu-openmpi4-hpc, p-cpe:/a:novell:suse_linux:libhdf5_hl_fortran-gnu-hpc, p-cpe:/a:novell:suse_linux:libhdf5_hl_fortran-gnu-mpich-hpc, p-cpe:/a:novell:suse_linux:libhdf5_hl_fortran-gnu-mvapich2-hpc, p-cpe:/a:novell:suse_linux:libhdf5_hl_fortran-gnu-openmpi3-hpc, p-cpe:/a:novell:suse_linux:libhdf5_hl_fortran-gnu-openmpi4-hpc, p-cpe:/a:novell:suse_linux:libhdf5hl_fortran_1_10_8-gnu-hpc, p-cpe:/a:novell:suse_linux:libhdf5hl_fortran_1_10_8-gnu-mpich-hpc, p-cpe:/a:novell:suse_linux:libhdf5hl_fortran_1_10_8-gnu-mvapich2-hpc, p-cpe:/a:novell:suse_linux:libhdf5hl_fortran_1_10_8-gnu-openmpi3-hpc, p-cpe:/a:novell:suse_linux:libhdf5hl_fortran_1_10_8-gnu-openmpi4-hpc, cpe:/o:novell:suse_linux:15

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/8/2022

Vulnerability Publication Date: 5/16/2018

Reference Information

CVE: CVE-2018-11206, CVE-2018-14032, CVE-2018-14033, CVE-2018-14460, CVE-2018-17234, CVE-2018-17237, CVE-2018-17432, CVE-2018-17433, CVE-2018-17434, CVE-2018-17436, CVE-2018-17437, CVE-2018-17438, CVE-2020-10809, CVE-2020-10810, CVE-2020-10811

SuSE: SUSE-SU-2022:1912-1