SUSE update for hdf5, suse-hpc

Published: 2022-06-15 | Updated: 2023-03-09

Risk	High
Patch available	YES
Number of vulnerabilities	26
CVE-ID	CVE-2017-17505 CVE-2017-17506 CVE-2017-17508 CVE-2017-17509 CVE-2018-11202 CVE-2018-11203 CVE-2018-11204 CVE-2018-11206 CVE-2018-11207 CVE-2018-13869 CVE-2018-13870 CVE-2018-14033 CVE-2018-14460 CVE-2018-17233 CVE-2018-17234 CVE-2018-17237 CVE-2018-17432 CVE-2018-17433 CVE-2018-17434 CVE-2018-17435 CVE-2018-17436 CVE-2018-17437 CVE-2018-17438 CVE-2020-10809 CVE-2020-10810 CVE-2020-10811
CWE-ID	CWE-476 CWE-125 CWE-369 CWE-787 CWE-119 CWE-400 CWE-122
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	SUSE Linux Enterprise High Performance Computing Operating systems & Components / Operating system hdf5-gnu-openmpi2-hpc-devel Operating systems & Components / Operating system package or component hdf5-gnu-mvapich2-hpc-devel Operating systems & Components / Operating system package or component hdf5-gnu-mpich-hpc-devel Operating systems & Components / Operating system package or component hdf5-gnu-hpc-devel Operating systems & Components / Operating system package or component libhdf5hl_fortran_1_10_8-gnu-openmpi2-hpc-debuginfo Operating systems & Components / Operating system package or component libhdf5hl_fortran_1_10_8-gnu-openmpi2-hpc Operating systems & Components / Operating system package or component libhdf5hl_fortran_1_10_8-gnu-mvapich2-hpc-debuginfo Operating systems & Components / Operating system package or component libhdf5hl_fortran_1_10_8-gnu-mvapich2-hpc Operating systems & Components / Operating system package or component libhdf5hl_fortran_1_10_8-gnu-mpich-hpc-debuginfo Operating systems & Components / Operating system package or component libhdf5hl_fortran_1_10_8-gnu-mpich-hpc Operating systems & Components / Operating system package or component libhdf5hl_fortran_1_10_8-gnu-hpc-debuginfo Operating systems & Components / Operating system package or component libhdf5hl_fortran_1_10_8-gnu-hpc Operating systems & Components / Operating system package or component libhdf5_hl_fortran-gnu-openmpi2-hpc Operating systems & Components / Operating system package or component libhdf5_hl_fortran-gnu-mvapich2-hpc Operating systems & Components / Operating system package or component libhdf5_hl_fortran-gnu-mpich-hpc Operating systems & Components / Operating system package or component libhdf5_hl_fortran-gnu-hpc Operating systems & Components / Operating system package or component libhdf5_hl_cpp_1_10_8-gnu-hpc-debuginfo Operating systems & Components / Operating system package or component libhdf5_hl_cpp_1_10_8-gnu-hpc Operating systems & Components / Operating system package or component libhdf5_hl_cpp-gnu-hpc Operating systems & Components / Operating system package or component libhdf5_hl_1_10_8-gnu-openmpi2-hpc-debuginfo Operating systems & Components / Operating system package or component libhdf5_hl_1_10_8-gnu-openmpi2-hpc Operating systems & Components / Operating system package or component libhdf5_hl_1_10_8-gnu-mvapich2-hpc-debuginfo Operating systems & Components / Operating system package or component libhdf5_hl_1_10_8-gnu-mvapich2-hpc Operating systems & Components / Operating system package or component libhdf5_hl_1_10_8-gnu-mpich-hpc-debuginfo Operating systems & Components / Operating system package or component libhdf5_hl_1_10_8-gnu-mpich-hpc Operating systems & Components / Operating system package or component libhdf5_hl_1_10_8-gnu-hpc-debuginfo Operating systems & Components / Operating system package or component libhdf5_hl_1_10_8-gnu-hpc Operating systems & Components / Operating system package or component libhdf5_hl-gnu-openmpi2-hpc Operating systems & Components / Operating system package or component libhdf5_hl-gnu-mvapich2-hpc Operating systems & Components / Operating system package or component libhdf5_hl-gnu-mpich-hpc Operating systems & Components / Operating system package or component libhdf5_hl-gnu-hpc Operating systems & Components / Operating system package or component libhdf5_fortran_1_10_8-gnu-openmpi2-hpc-debuginfo Operating systems & Components / Operating system package or component libhdf5_fortran_1_10_8-gnu-openmpi2-hpc Operating systems & Components / Operating system package or component libhdf5_fortran_1_10_8-gnu-mvapich2-hpc-debuginfo Operating systems & Components / Operating system package or component libhdf5_fortran_1_10_8-gnu-mvapich2-hpc Operating systems & Components / Operating system package or component libhdf5_fortran_1_10_8-gnu-mpich-hpc-debuginfo Operating systems & Components / Operating system package or component libhdf5_fortran_1_10_8-gnu-mpich-hpc Operating systems & Components / Operating system package or component libhdf5_fortran_1_10_8-gnu-hpc-debuginfo Operating systems & Components / Operating system package or component libhdf5_fortran_1_10_8-gnu-hpc Operating systems & Components / Operating system package or component libhdf5_fortran-gnu-openmpi2-hpc Operating systems & Components / Operating system package or component libhdf5_fortran-gnu-mvapich2-hpc Operating systems & Components / Operating system package or component libhdf5_fortran-gnu-mpich-hpc Operating systems & Components / Operating system package or component libhdf5_fortran-gnu-hpc Operating systems & Components / Operating system package or component libhdf5_cpp_1_10_8-gnu-hpc-debuginfo Operating systems & Components / Operating system package or component libhdf5_cpp_1_10_8-gnu-hpc Operating systems & Components / Operating system package or component libhdf5_cpp-gnu-hpc Operating systems & Components / Operating system package or component libhdf5_1_10_8-gnu-openmpi2-hpc-debuginfo Operating systems & Components / Operating system package or component libhdf5_1_10_8-gnu-openmpi2-hpc Operating systems & Components / Operating system package or component libhdf5_1_10_8-gnu-mvapich2-hpc-debuginfo Operating systems & Components / Operating system package or component libhdf5_1_10_8-gnu-mvapich2-hpc Operating systems & Components / Operating system package or component libhdf5_1_10_8-gnu-mpich-hpc-debuginfo Operating systems & Components / Operating system package or component libhdf5_1_10_8-gnu-mpich-hpc Operating systems & Components / Operating system package or component libhdf5_1_10_8-gnu-hpc-debuginfo Operating systems & Components / Operating system package or component libhdf5_1_10_8-gnu-hpc Operating systems & Components / Operating system package or component libhdf5-gnu-openmpi2-hpc Operating systems & Components / Operating system package or component libhdf5-gnu-mvapich2-hpc Operating systems & Components / Operating system package or component libhdf5-gnu-mpich-hpc Operating systems & Components / Operating system package or component libhdf5-gnu-hpc Operating systems & Components / Operating system package or component hdf5_1_10_8-gnu-openmpi2-hpc-module Operating systems & Components / Operating system package or component hdf5_1_10_8-gnu-openmpi2-hpc-devel-static Operating systems & Components / Operating system package or component hdf5_1_10_8-gnu-openmpi2-hpc-devel Operating systems & Components / Operating system package or component hdf5_1_10_8-gnu-openmpi2-hpc-debugsource Operating systems & Components / Operating system package or component hdf5_1_10_8-gnu-openmpi2-hpc-debuginfo Operating systems & Components / Operating system package or component hdf5_1_10_8-gnu-openmpi2-hpc Operating systems & Components / Operating system package or component hdf5_1_10_8-gnu-mvapich2-hpc-module Operating systems & Components / Operating system package or component hdf5_1_10_8-gnu-mvapich2-hpc-devel-static Operating systems & Components / Operating system package or component hdf5_1_10_8-gnu-mvapich2-hpc-devel Operating systems & Components / Operating system package or component hdf5_1_10_8-gnu-mvapich2-hpc-debugsource Operating systems & Components / Operating system package or component hdf5_1_10_8-gnu-mvapich2-hpc-debuginfo Operating systems & Components / Operating system package or component hdf5_1_10_8-gnu-mvapich2-hpc Operating systems & Components / Operating system package or component hdf5_1_10_8-gnu-mpich-hpc-module Operating systems & Components / Operating system package or component hdf5_1_10_8-gnu-mpich-hpc-devel-static Operating systems & Components / Operating system package or component hdf5_1_10_8-gnu-mpich-hpc-devel Operating systems & Components / Operating system package or component hdf5_1_10_8-gnu-mpich-hpc-debugsource Operating systems & Components / Operating system package or component hdf5_1_10_8-gnu-mpich-hpc-debuginfo Operating systems & Components / Operating system package or component hdf5_1_10_8-gnu-mpich-hpc Operating systems & Components / Operating system package or component hdf5_1_10_8-gnu-hpc-module Operating systems & Components / Operating system package or component hdf5_1_10_8-gnu-hpc-devel-static Operating systems & Components / Operating system package or component hdf5_1_10_8-gnu-hpc-devel Operating systems & Components / Operating system package or component hdf5_1_10_8-gnu-hpc-debugsource Operating systems & Components / Operating system package or component hdf5_1_10_8-gnu-hpc-debuginfo Operating systems & Components / Operating system package or component hdf5_1_10_8-gnu-hpc Operating systems & Components / Operating system package or component
Vendor	SUSE

Security Bulletin

This security bulletin contains information about 26 vulnerabilities.

1) NULL pointer dereference

EUVDB-ID: #VU37766

Risk: Medium

CVSSv3.1: 5.7 [AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-17505

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dreference error in H5Opline.c file in libhdf5.a. For example, h5dump would crash when someone opens a crafted hdf5 file. A remote attacker can perform a denial of service (DoS) attack.

Mitigation

Update the affected package hdf5, suse-hpc to the latest version.

Vulnerable software versions

SUSE Linux Enterprise High Performance Computing: 15-ESPOS - 15-LTSS

hdf5-gnu-openmpi2-hpc-devel: before 1.10.8-150000.8.4.3

hdf5-gnu-mvapich2-hpc-devel: before 1.10.8-150000.8.4.3

hdf5-gnu-mpich-hpc-devel: before 1.10.8-150000.8.4.3

hdf5-gnu-hpc-devel: before 1.10.8-150000.8.4.3

libhdf5hl_fortran_1_10_8-gnu-openmpi2-hpc-debuginfo: before 1.10.8-150000.8.4.3

libhdf5hl_fortran_1_10_8-gnu-openmpi2-hpc: before 1.10.8-150000.8.4.3

libhdf5hl_fortran_1_10_8-gnu-mvapich2-hpc-debuginfo: before 1.10.8-150000.8.4.3

libhdf5hl_fortran_1_10_8-gnu-mvapich2-hpc: before 1.10.8-150000.8.4.3

libhdf5hl_fortran_1_10_8-gnu-mpich-hpc-debuginfo: before 1.10.8-150000.8.4.3

libhdf5hl_fortran_1_10_8-gnu-mpich-hpc: before 1.10.8-150000.8.4.3

libhdf5hl_fortran_1_10_8-gnu-hpc-debuginfo: before 1.10.8-150000.8.4.3

libhdf5hl_fortran_1_10_8-gnu-hpc: before 1.10.8-150000.8.4.3

libhdf5_hl_fortran-gnu-openmpi2-hpc: before 1.10.8-150000.8.4.3

libhdf5_hl_fortran-gnu-mvapich2-hpc: before 1.10.8-150000.8.4.3

libhdf5_hl_fortran-gnu-mpich-hpc: before 1.10.8-150000.8.4.3

libhdf5_hl_fortran-gnu-hpc: before 1.10.8-150000.8.4.3

libhdf5_hl_cpp_1_10_8-gnu-hpc-debuginfo: before 1.10.8-150000.8.4.3

libhdf5_hl_cpp_1_10_8-gnu-hpc: before 1.10.8-150000.8.4.3

libhdf5_hl_cpp-gnu-hpc: before 1.10.8-150000.8.4.3

libhdf5_hl_1_10_8-gnu-openmpi2-hpc-debuginfo: before 1.10.8-150000.8.4.3

libhdf5_hl_1_10_8-gnu-openmpi2-hpc: before 1.10.8-150000.8.4.3

libhdf5_hl_1_10_8-gnu-mvapich2-hpc-debuginfo: before 1.10.8-150000.8.4.3

libhdf5_hl_1_10_8-gnu-mvapich2-hpc: before 1.10.8-150000.8.4.3

libhdf5_hl_1_10_8-gnu-mpich-hpc-debuginfo: before 1.10.8-150000.8.4.3

libhdf5_hl_1_10_8-gnu-mpich-hpc: before 1.10.8-150000.8.4.3

libhdf5_hl_1_10_8-gnu-hpc-debuginfo: before 1.10.8-150000.8.4.3

libhdf5_hl_1_10_8-gnu-hpc: before 1.10.8-150000.8.4.3

libhdf5_hl-gnu-openmpi2-hpc: before 1.10.8-150000.8.4.3

libhdf5_hl-gnu-mvapich2-hpc: before 1.10.8-150000.8.4.3

libhdf5_hl-gnu-mpich-hpc: before 1.10.8-150000.8.4.3

libhdf5_hl-gnu-hpc: before 1.10.8-150000.8.4.3

libhdf5_fortran_1_10_8-gnu-openmpi2-hpc-debuginfo: before 1.10.8-150000.8.4.3

libhdf5_fortran_1_10_8-gnu-openmpi2-hpc: before 1.10.8-150000.8.4.3

libhdf5_fortran_1_10_8-gnu-mvapich2-hpc-debuginfo: before 1.10.8-150000.8.4.3

libhdf5_fortran_1_10_8-gnu-mvapich2-hpc: before 1.10.8-150000.8.4.3

libhdf5_fortran_1_10_8-gnu-mpich-hpc-debuginfo: before 1.10.8-150000.8.4.3

libhdf5_fortran_1_10_8-gnu-mpich-hpc: before 1.10.8-150000.8.4.3

libhdf5_fortran_1_10_8-gnu-hpc-debuginfo: before 1.10.8-150000.8.4.3

libhdf5_fortran_1_10_8-gnu-hpc: before 1.10.8-150000.8.4.3

libhdf5_fortran-gnu-openmpi2-hpc: before 1.10.8-150000.8.4.3

libhdf5_fortran-gnu-mvapich2-hpc: before 1.10.8-150000.8.4.3

libhdf5_fortran-gnu-mpich-hpc: before 1.10.8-150000.8.4.3

libhdf5_fortran-gnu-hpc: before 1.10.8-150000.8.4.3

libhdf5_cpp_1_10_8-gnu-hpc-debuginfo: before 1.10.8-150000.8.4.3

libhdf5_cpp_1_10_8-gnu-hpc: before 1.10.8-150000.8.4.3

libhdf5_cpp-gnu-hpc: before 1.10.8-150000.8.4.3

libhdf5_1_10_8-gnu-openmpi2-hpc-debuginfo: before 1.10.8-150000.8.4.3

libhdf5_1_10_8-gnu-openmpi2-hpc: before 1.10.8-150000.8.4.3

libhdf5_1_10_8-gnu-mvapich2-hpc-debuginfo: before 1.10.8-150000.8.4.3

libhdf5_1_10_8-gnu-mvapich2-hpc: before 1.10.8-150000.8.4.3

libhdf5_1_10_8-gnu-mpich-hpc-debuginfo: before 1.10.8-150000.8.4.3

libhdf5_1_10_8-gnu-mpich-hpc: before 1.10.8-150000.8.4.3

libhdf5_1_10_8-gnu-hpc-debuginfo: before 1.10.8-150000.8.4.3

libhdf5_1_10_8-gnu-hpc: before 1.10.8-150000.8.4.3

libhdf5-gnu-openmpi2-hpc: before 1.10.8-150000.8.4.3

libhdf5-gnu-mvapich2-hpc: before 1.10.8-150000.8.4.3

libhdf5-gnu-mpich-hpc: before 1.10.8-150000.8.4.3

libhdf5-gnu-hpc: before 1.10.8-150000.8.4.3

hdf5_1_10_8-gnu-openmpi2-hpc-module: before 1.10.8-150000.8.4.3

hdf5_1_10_8-gnu-openmpi2-hpc-devel-static: before 1.10.8-150000.8.4.3

hdf5_1_10_8-gnu-openmpi2-hpc-devel: before 1.10.8-150000.8.4.3

hdf5_1_10_8-gnu-openmpi2-hpc-debugsource: before 1.10.8-150000.8.4.3

hdf5_1_10_8-gnu-openmpi2-hpc-debuginfo: before 1.10.8-150000.8.4.3

hdf5_1_10_8-gnu-openmpi2-hpc: before 1.10.8-150000.8.4.3

hdf5_1_10_8-gnu-mvapich2-hpc-module: before 1.10.8-150000.8.4.3

hdf5_1_10_8-gnu-mvapich2-hpc-devel-static: before 1.10.8-150000.8.4.3

hdf5_1_10_8-gnu-mvapich2-hpc-devel: before 1.10.8-150000.8.4.3

hdf5_1_10_8-gnu-mvapich2-hpc-debugsource: before 1.10.8-150000.8.4.3

hdf5_1_10_8-gnu-mvapich2-hpc-debuginfo: before 1.10.8-150000.8.4.3

hdf5_1_10_8-gnu-mvapich2-hpc: before 1.10.8-150000.8.4.3

hdf5_1_10_8-gnu-mpich-hpc-module: before 1.10.8-150000.8.4.3

hdf5_1_10_8-gnu-mpich-hpc-devel-static: before 1.10.8-150000.8.4.3

hdf5_1_10_8-gnu-mpich-hpc-devel: before 1.10.8-150000.8.4.3

hdf5_1_10_8-gnu-mpich-hpc-debugsource: before 1.10.8-150000.8.4.3

hdf5_1_10_8-gnu-mpich-hpc-debuginfo: before 1.10.8-150000.8.4.3

hdf5_1_10_8-gnu-mpich-hpc: before 1.10.8-150000.8.4.3

hdf5_1_10_8-gnu-hpc-module: before 1.10.8-150000.8.4.3

hdf5_1_10_8-gnu-hpc-devel-static: before 1.10.8-150000.8.4.3

hdf5_1_10_8-gnu-hpc-devel: before 1.10.8-150000.8.4.3

hdf5_1_10_8-gnu-hpc-debugsource: before 1.10.8-150000.8.4.3

hdf5_1_10_8-gnu-hpc-debuginfo: before 1.10.8-150000.8.4.3

hdf5_1_10_8-gnu-hpc: before 1.10.8-150000.8.4.3

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20221911-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Out-of-bounds read

EUVDB-ID: #VU37767

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-17506

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

In HDF5 1.10.1, there is an out of bounds read vulnerability in the function H5Opline_pline_decode in H5Opline.c in libhdf5.a. For example, h5dump would crash when someone opens a crafted hdf5 file.