SUSE Security Update: Security update for hdf5
______________________________________________________________________________

Announcement ID:    SUSE-SU-2022:3828-1
Rating:             important
References:         #1093663 #1101475 #1101906 #1107069 #1111598 
                    #1125882 #1167400 #1194366 #1194375 #1195212 
                    #1195215 
Cross-References:   CVE-2018-11205 CVE-2018-13867 CVE-2018-14031
                    CVE-2018-16438 CVE-2018-17439 CVE-2019-8396
                    CVE-2020-10812 CVE-2021-45830 CVE-2021-45833
                    CVE-2021-46242 CVE-2021-46244
CVSS scores:
                    CVE-2018-11205 (NVD) : 8.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
                    CVE-2018-11205 (SUSE): 5.1 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
                    CVE-2018-13867 (NVD) : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
                    CVE-2018-13867 (SUSE): 5.3 CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L
                    CVE-2018-14031 (NVD) : 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
                    CVE-2018-14031 (SUSE): 4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2018-16438 (NVD) : 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
                    CVE-2018-16438 (SUSE): 2.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
                    CVE-2018-17439 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
                    CVE-2018-17439 (SUSE): 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
                    CVE-2019-8396 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
                    CVE-2019-8396 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
                    CVE-2020-10812 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
                    CVE-2020-10812 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
                    CVE-2021-45830 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
                    CVE-2021-45830 (SUSE): 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
                    CVE-2021-45833 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
                    CVE-2021-45833 (SUSE): 4.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
                    CVE-2021-46242 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
                    CVE-2021-46242 (SUSE): 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
                    CVE-2021-46244 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
                    CVE-2021-46244 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected Products:
                    SUSE Linux Enterprise High Performance Computing 15-ESPOS
                    SUSE Linux Enterprise High Performance Computing 15-LTSS
______________________________________________________________________________

   An update that fixes 11 vulnerabilities is now available.

Description:

   This update for hdf5 fixes the following issues:

     - CVE-2021-46244: Fixed division by zero leading to DoS (bsc#1195215).
     - CVE-2018-13867: Fixed out of bounds read in the function
       H5F__accum_read in H5Faccum.c (bsc#1101906).
     - CVE-2018-16438: Fixed out of bounds read in H5L_extern_query at
       H5Lexternal.c (bsc#1107069).
     - CVE-2020-10812: Fixed NULL pointer dereference (bsc#1167400).
     - CVE-2021-45830: Fixed heap buffer overflow vulnerability in
       H5F_addr_decode_len in /hdf5/src/H5Fint.c (bsc#1194375).
     - CVE-2019-8396:  Fixed buffer overflow in function H5O__layout_encode
       in H5Olayout.c (bsc#1125882).
     - CVE-2018-11205: Fixed out of bounds read was discovered in
       H5VM_memcpyvv in H5VM.c (bsc#1093663).
     - CVE-2021-46242: Fixed heap-use-after free via the component
       H5AC_unpin_entry (bsc#1195212).
     - CVE-2021-45833: Fixed stack buffer overflow vulnerability
       (bsc#1194366).
     - CVE-2018-14031: Fixed heap-based buffer over-read in the function
       H5T_copy in H5T.c (bsc#1101475).
     - CVE-2018-17439: Fixed out of bounds read in the function
       H5F__accum_read in H5Faccum.c (bsc#1111598).


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise High Performance Computing 15-LTSS:

      zypper in -t patch SUSE-SLE-Product-HPC-15-2022-3828=1

   - SUSE Linux Enterprise High Performance Computing 15-ESPOS:

      zypper in -t patch SUSE-SLE-Product-HPC-15-2022-3828=1



Package List:

   - SUSE Linux Enterprise High Performance Computing 15-LTSS (aarch64 x86_64):

      hdf5_1_10_8-gnu-hpc-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-hpc-debuginfo-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-hpc-debugsource-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-hpc-devel-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-hpc-devel-static-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-hpc-module-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-mpich-hpc-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-mpich-hpc-debuginfo-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-mpich-hpc-debugsource-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-mpich-hpc-devel-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-mpich-hpc-devel-static-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-mpich-hpc-module-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-mvapich2-hpc-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-mvapich2-hpc-debuginfo-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-mvapich2-hpc-debugsource-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-mvapich2-hpc-devel-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-mvapich2-hpc-devel-static-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-mvapich2-hpc-module-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-openmpi2-hpc-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-openmpi2-hpc-debuginfo-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-openmpi2-hpc-debugsource-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-openmpi2-hpc-devel-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-openmpi2-hpc-devel-static-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-openmpi2-hpc-module-1.10.8-150000.8.7.1
      libhdf5-gnu-hpc-1.10.8-150000.8.7.1
      libhdf5-gnu-mpich-hpc-1.10.8-150000.8.7.1
      libhdf5-gnu-mvapich2-hpc-1.10.8-150000.8.7.1
      libhdf5-gnu-openmpi2-hpc-1.10.8-150000.8.7.1
      libhdf5_1_10_8-gnu-hpc-1.10.8-150000.8.7.1
      libhdf5_1_10_8-gnu-hpc-debuginfo-1.10.8-150000.8.7.1
      libhdf5_1_10_8-gnu-mpich-hpc-1.10.8-150000.8.7.1
      libhdf5_1_10_8-gnu-mpich-hpc-debuginfo-1.10.8-150000.8.7.1
      libhdf5_1_10_8-gnu-mvapich2-hpc-1.10.8-150000.8.7.1
      libhdf5_1_10_8-gnu-mvapich2-hpc-debuginfo-1.10.8-150000.8.7.1
      libhdf5_1_10_8-gnu-openmpi2-hpc-1.10.8-150000.8.7.1
      libhdf5_1_10_8-gnu-openmpi2-hpc-debuginfo-1.10.8-150000.8.7.1
      libhdf5_cpp-gnu-hpc-1.10.8-150000.8.7.1
      libhdf5_cpp_1_10_8-gnu-hpc-1.10.8-150000.8.7.1
      libhdf5_cpp_1_10_8-gnu-hpc-debuginfo-1.10.8-150000.8.7.1
      libhdf5_fortran-gnu-hpc-1.10.8-150000.8.7.1
      libhdf5_fortran-gnu-mpich-hpc-1.10.8-150000.8.7.1
      libhdf5_fortran-gnu-mvapich2-hpc-1.10.8-150000.8.7.1
      libhdf5_fortran-gnu-openmpi2-hpc-1.10.8-150000.8.7.1
      libhdf5_fortran_1_10_8-gnu-hpc-1.10.8-150000.8.7.1
      libhdf5_fortran_1_10_8-gnu-hpc-debuginfo-1.10.8-150000.8.7.1
      libhdf5_fortran_1_10_8-gnu-mpich-hpc-1.10.8-150000.8.7.1
      libhdf5_fortran_1_10_8-gnu-mpich-hpc-debuginfo-1.10.8-150000.8.7.1
      libhdf5_fortran_1_10_8-gnu-mvapich2-hpc-1.10.8-150000.8.7.1
      libhdf5_fortran_1_10_8-gnu-mvapich2-hpc-debuginfo-1.10.8-150000.8.7.1
      libhdf5_fortran_1_10_8-gnu-openmpi2-hpc-1.10.8-150000.8.7.1
      libhdf5_fortran_1_10_8-gnu-openmpi2-hpc-debuginfo-1.10.8-150000.8.7.1
      libhdf5_hl-gnu-hpc-1.10.8-150000.8.7.1
      libhdf5_hl-gnu-mpich-hpc-1.10.8-150000.8.7.1
      libhdf5_hl-gnu-mvapich2-hpc-1.10.8-150000.8.7.1
      libhdf5_hl-gnu-openmpi2-hpc-1.10.8-150000.8.7.1
      libhdf5_hl_1_10_8-gnu-hpc-1.10.8-150000.8.7.1
      libhdf5_hl_1_10_8-gnu-hpc-debuginfo-1.10.8-150000.8.7.1
      libhdf5_hl_1_10_8-gnu-mpich-hpc-1.10.8-150000.8.7.1
      libhdf5_hl_1_10_8-gnu-mpich-hpc-debuginfo-1.10.8-150000.8.7.1
      libhdf5_hl_1_10_8-gnu-mvapich2-hpc-1.10.8-150000.8.7.1
      libhdf5_hl_1_10_8-gnu-mvapich2-hpc-debuginfo-1.10.8-150000.8.7.1
      libhdf5_hl_1_10_8-gnu-openmpi2-hpc-1.10.8-150000.8.7.1
      libhdf5_hl_1_10_8-gnu-openmpi2-hpc-debuginfo-1.10.8-150000.8.7.1
      libhdf5_hl_cpp-gnu-hpc-1.10.8-150000.8.7.1
      libhdf5_hl_cpp_1_10_8-gnu-hpc-1.10.8-150000.8.7.1
      libhdf5_hl_cpp_1_10_8-gnu-hpc-debuginfo-1.10.8-150000.8.7.1
      libhdf5_hl_fortran-gnu-hpc-1.10.8-150000.8.7.1
      libhdf5_hl_fortran-gnu-mpich-hpc-1.10.8-150000.8.7.1
      libhdf5_hl_fortran-gnu-mvapich2-hpc-1.10.8-150000.8.7.1
      libhdf5_hl_fortran-gnu-openmpi2-hpc-1.10.8-150000.8.7.1
      libhdf5hl_fortran_1_10_8-gnu-hpc-1.10.8-150000.8.7.1
      libhdf5hl_fortran_1_10_8-gnu-hpc-debuginfo-1.10.8-150000.8.7.1
      libhdf5hl_fortran_1_10_8-gnu-mpich-hpc-1.10.8-150000.8.7.1
      libhdf5hl_fortran_1_10_8-gnu-mpich-hpc-debuginfo-1.10.8-150000.8.7.1
      libhdf5hl_fortran_1_10_8-gnu-mvapich2-hpc-1.10.8-150000.8.7.1
      libhdf5hl_fortran_1_10_8-gnu-mvapich2-hpc-debuginfo-1.10.8-150000.8.7.1
      libhdf5hl_fortran_1_10_8-gnu-openmpi2-hpc-1.10.8-150000.8.7.1
      libhdf5hl_fortran_1_10_8-gnu-openmpi2-hpc-debuginfo-1.10.8-150000.8.7.1

   - SUSE Linux Enterprise High Performance Computing 15-LTSS (noarch):

      hdf5-gnu-hpc-devel-1.10.8-150000.8.7.1
      hdf5-gnu-mpich-hpc-devel-1.10.8-150000.8.7.1
      hdf5-gnu-mvapich2-hpc-devel-1.10.8-150000.8.7.1
      hdf5-gnu-openmpi2-hpc-devel-1.10.8-150000.8.7.1

   - SUSE Linux Enterprise High Performance Computing 15-ESPOS (aarch64 x86_64):

      hdf5_1_10_8-gnu-hpc-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-hpc-debuginfo-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-hpc-debugsource-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-hpc-devel-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-hpc-devel-static-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-hpc-module-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-mpich-hpc-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-mpich-hpc-debuginfo-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-mpich-hpc-debugsource-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-mpich-hpc-devel-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-mpich-hpc-devel-static-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-mpich-hpc-module-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-mvapich2-hpc-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-mvapich2-hpc-debuginfo-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-mvapich2-hpc-debugsource-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-mvapich2-hpc-devel-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-mvapich2-hpc-devel-static-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-mvapich2-hpc-module-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-openmpi2-hpc-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-openmpi2-hpc-debuginfo-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-openmpi2-hpc-debugsource-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-openmpi2-hpc-devel-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-openmpi2-hpc-devel-static-1.10.8-150000.8.7.1
      hdf5_1_10_8-gnu-openmpi2-hpc-module-1.10.8-150000.8.7.1
      libhdf5-gnu-hpc-1.10.8-150000.8.7.1
      libhdf5-gnu-mpich-hpc-1.10.8-150000.8.7.1
      libhdf5-gnu-mvapich2-hpc-1.10.8-150000.8.7.1
      libhdf5-gnu-openmpi2-hpc-1.10.8-150000.8.7.1
      libhdf5_1_10_8-gnu-hpc-1.10.8-150000.8.7.1
      libhdf5_1_10_8-gnu-hpc-debuginfo-1.10.8-150000.8.7.1
      libhdf5_1_10_8-gnu-mpich-hpc-1.10.8-150000.8.7.1
      libhdf5_1_10_8-gnu-mpich-hpc-debuginfo-1.10.8-150000.8.7.1
      libhdf5_1_10_8-gnu-mvapich2-hpc-1.10.8-150000.8.7.1
      libhdf5_1_10_8-gnu-mvapich2-hpc-debuginfo-1.10.8-150000.8.7.1
      libhdf5_1_10_8-gnu-openmpi2-hpc-1.10.8-150000.8.7.1
      libhdf5_1_10_8-gnu-openmpi2-hpc-debuginfo-1.10.8-150000.8.7.1
      libhdf5_cpp-gnu-hpc-1.10.8-150000.8.7.1
      libhdf5_cpp_1_10_8-gnu-hpc-1.10.8-150000.8.7.1
      libhdf5_cpp_1_10_8-gnu-hpc-debuginfo-1.10.8-150000.8.7.1
      libhdf5_fortran-gnu-hpc-1.10.8-150000.8.7.1
      libhdf5_fortran-gnu-mpich-hpc-1.10.8-150000.8.7.1
      libhdf5_fortran-gnu-mvapich2-hpc-1.10.8-150000.8.7.1
      libhdf5_fortran-gnu-openmpi2-hpc-1.10.8-150000.8.7.1
      libhdf5_fortran_1_10_8-gnu-hpc-1.10.8-150000.8.7.1
      libhdf5_fortran_1_10_8-gnu-hpc-debuginfo-1.10.8-150000.8.7.1
      libhdf5_fortran_1_10_8-gnu-mpich-hpc-1.10.8-150000.8.7.1
      libhdf5_fortran_1_10_8-gnu-mpich-hpc-debuginfo-1.10.8-150000.8.7.1
      libhdf5_fortran_1_10_8-gnu-mvapich2-hpc-1.10.8-150000.8.7.1
      libhdf5_fortran_1_10_8-gnu-mvapich2-hpc-debuginfo-1.10.8-150000.8.7.1
      libhdf5_fortran_1_10_8-gnu-openmpi2-hpc-1.10.8-150000.8.7.1
      libhdf5_fortran_1_10_8-gnu-openmpi2-hpc-debuginfo-1.10.8-150000.8.7.1
      libhdf5_hl-gnu-hpc-1.10.8-150000.8.7.1
      libhdf5_hl-gnu-mpich-hpc-1.10.8-150000.8.7.1
      libhdf5_hl-gnu-mvapich2-hpc-1.10.8-150000.8.7.1
      libhdf5_hl-gnu-openmpi2-hpc-1.10.8-150000.8.7.1
      libhdf5_hl_1_10_8-gnu-hpc-1.10.8-150000.8.7.1
      libhdf5_hl_1_10_8-gnu-hpc-debuginfo-1.10.8-150000.8.7.1
      libhdf5_hl_1_10_8-gnu-mpich-hpc-1.10.8-150000.8.7.1
      libhdf5_hl_1_10_8-gnu-mpich-hpc-debuginfo-1.10.8-150000.8.7.1
      libhdf5_hl_1_10_8-gnu-mvapich2-hpc-1.10.8-150000.8.7.1
      libhdf5_hl_1_10_8-gnu-mvapich2-hpc-debuginfo-1.10.8-150000.8.7.1
      libhdf5_hl_1_10_8-gnu-openmpi2-hpc-1.10.8-150000.8.7.1
      libhdf5_hl_1_10_8-gnu-openmpi2-hpc-debuginfo-1.10.8-150000.8.7.1
      libhdf5_hl_cpp-gnu-hpc-1.10.8-150000.8.7.1
      libhdf5_hl_cpp_1_10_8-gnu-hpc-1.10.8-150000.8.7.1
      libhdf5_hl_cpp_1_10_8-gnu-hpc-debuginfo-1.10.8-150000.8.7.1
      libhdf5_hl_fortran-gnu-hpc-1.10.8-150000.8.7.1
      libhdf5_hl_fortran-gnu-mpich-hpc-1.10.8-150000.8.7.1
      libhdf5_hl_fortran-gnu-mvapich2-hpc-1.10.8-150000.8.7.1
      libhdf5_hl_fortran-gnu-openmpi2-hpc-1.10.8-150000.8.7.1
      libhdf5hl_fortran_1_10_8-gnu-hpc-1.10.8-150000.8.7.1
      libhdf5hl_fortran_1_10_8-gnu-hpc-debuginfo-1.10.8-150000.8.7.1
      libhdf5hl_fortran_1_10_8-gnu-mpich-hpc-1.10.8-150000.8.7.1
      libhdf5hl_fortran_1_10_8-gnu-mpich-hpc-debuginfo-1.10.8-150000.8.7.1
      libhdf5hl_fortran_1_10_8-gnu-mvapich2-hpc-1.10.8-150000.8.7.1
      libhdf5hl_fortran_1_10_8-gnu-mvapich2-hpc-debuginfo-1.10.8-150000.8.7.1
      libhdf5hl_fortran_1_10_8-gnu-openmpi2-hpc-1.10.8-150000.8.7.1
      libhdf5hl_fortran_1_10_8-gnu-openmpi2-hpc-debuginfo-1.10.8-150000.8.7.1

   - SUSE Linux Enterprise High Performance Computing 15-ESPOS (noarch):

      hdf5-gnu-hpc-devel-1.10.8-150000.8.7.1
      hdf5-gnu-mpich-hpc-devel-1.10.8-150000.8.7.1
      hdf5-gnu-mvapich2-hpc-devel-1.10.8-150000.8.7.1
      hdf5-gnu-openmpi2-hpc-devel-1.10.8-150000.8.7.1


References:

   https://www.suse.com/security/cve/CVE-2018-11205.html
   https://www.suse.com/security/cve/CVE-2018-13867.html
   https://www.suse.com/security/cve/CVE-2018-14031.html
   https://www.suse.com/security/cve/CVE-2018-16438.html
   https://www.suse.com/security/cve/CVE-2018-17439.html
   https://www.suse.com/security/cve/CVE-2019-8396.html
   https://www.suse.com/security/cve/CVE-2020-10812.html
   https://www.suse.com/security/cve/CVE-2021-45830.html
   https://www.suse.com/security/cve/CVE-2021-45833.html
   https://www.suse.com/security/cve/CVE-2021-46242.html
   https://www.suse.com/security/cve/CVE-2021-46244.html
   https://bugzilla.suse.com/1093663
   https://bugzilla.suse.com/1101475
   https://bugzilla.suse.com/1101906
   https://bugzilla.suse.com/1107069
   https://bugzilla.suse.com/1111598
   https://bugzilla.suse.com/1125882
   https://bugzilla.suse.com/1167400
   https://bugzilla.suse.com/1194366
   https://bugzilla.suse.com/1194375
   https://bugzilla.suse.com/1195212
   https://bugzilla.suse.com/1195215

SUSE: 2022:3828-1 important: hdf5

November 1, 2022
An update that fixes 11 vulnerabilities is now available

Summary

This update for hdf5 fixes the following issues: - CVE-2021-46244: Fixed division by zero leading to DoS (bsc#1195215). - CVE-2018-13867: Fixed out of bounds read in the function H5F__accum_read in H5Faccum.c (bsc#1101906). - CVE-2018-16438: Fixed out of bounds read in H5L_extern_query at H5Lexternal.c (bsc#1107069). - CVE-2020-10812: Fixed NULL pointer dereference (bsc#1167400). - CVE-2021-45830: Fixed heap buffer overflow vulnerability in H5F_addr_decode_len in /hdf5/src/H5Fint.c (bsc#1194375). - CVE-2019-8396: Fixed buffer overflow in function H5O__layout_encode in H5Olayout.c (bsc#1125882). - CVE-2018-11205: Fixed out of bounds read was discovered in H5VM_memcpyvv in H5VM.c (bsc#1093663). - CVE-2021-46242: Fixed heap-use-after free via the component H5AC_unpin_entry (bsc#1195212). - CVE-2021-45833: Fixed stack buffer overflow vulnerability (bsc#1194366). - CVE-2018-14031: Fixed heap-based buffer over-read in the function H5T_copy in H5T.c (bsc#1101475). - CVE-2018-17439: Fixed out of bounds read in the function H5F__accum_read in H5Faccum.c (bsc#1111598). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise High Performance Computing 15-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-2022-3828=1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-2022-3828=1 Package List: - SUSE Linux Enterprise High Performance Computing 15-LTSS (aarch64 x86_64): hdf5_1_10_8-gnu-hpc-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-hpc-debuginfo-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-hpc-debugsource-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-hpc-devel-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-hpc-devel-static-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-hpc-module-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-mpich-hpc-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-mpich-hpc-debuginfo-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-mpich-hpc-debugsource-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-mpich-hpc-devel-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-mpich-hpc-devel-static-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-mpich-hpc-module-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-mvapich2-hpc-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-mvapich2-hpc-debuginfo-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-mvapich2-hpc-debugsource-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-mvapich2-hpc-devel-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-mvapich2-hpc-devel-static-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-mvapich2-hpc-module-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-openmpi2-hpc-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-openmpi2-hpc-debuginfo-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-openmpi2-hpc-debugsource-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-openmpi2-hpc-devel-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-openmpi2-hpc-devel-static-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-openmpi2-hpc-module-1.10.8-150000.8.7.1 libhdf5-gnu-hpc-1.10.8-150000.8.7.1 libhdf5-gnu-mpich-hpc-1.10.8-150000.8.7.1 libhdf5-gnu-mvapich2-hpc-1.10.8-150000.8.7.1 libhdf5-gnu-openmpi2-hpc-1.10.8-150000.8.7.1 libhdf5_1_10_8-gnu-hpc-1.10.8-150000.8.7.1 libhdf5_1_10_8-gnu-hpc-debuginfo-1.10.8-150000.8.7.1 libhdf5_1_10_8-gnu-mpich-hpc-1.10.8-150000.8.7.1 libhdf5_1_10_8-gnu-mpich-hpc-debuginfo-1.10.8-150000.8.7.1 libhdf5_1_10_8-gnu-mvapich2-hpc-1.10.8-150000.8.7.1 libhdf5_1_10_8-gnu-mvapich2-hpc-debuginfo-1.10.8-150000.8.7.1 libhdf5_1_10_8-gnu-openmpi2-hpc-1.10.8-150000.8.7.1 libhdf5_1_10_8-gnu-openmpi2-hpc-debuginfo-1.10.8-150000.8.7.1 libhdf5_cpp-gnu-hpc-1.10.8-150000.8.7.1 libhdf5_cpp_1_10_8-gnu-hpc-1.10.8-150000.8.7.1 libhdf5_cpp_1_10_8-gnu-hpc-debuginfo-1.10.8-150000.8.7.1 libhdf5_fortran-gnu-hpc-1.10.8-150000.8.7.1 libhdf5_fortran-gnu-mpich-hpc-1.10.8-150000.8.7.1 libhdf5_fortran-gnu-mvapich2-hpc-1.10.8-150000.8.7.1 libhdf5_fortran-gnu-openmpi2-hpc-1.10.8-150000.8.7.1 libhdf5_fortran_1_10_8-gnu-hpc-1.10.8-150000.8.7.1 libhdf5_fortran_1_10_8-gnu-hpc-debuginfo-1.10.8-150000.8.7.1 libhdf5_fortran_1_10_8-gnu-mpich-hpc-1.10.8-150000.8.7.1 libhdf5_fortran_1_10_8-gnu-mpich-hpc-debuginfo-1.10.8-150000.8.7.1 libhdf5_fortran_1_10_8-gnu-mvapich2-hpc-1.10.8-150000.8.7.1 libhdf5_fortran_1_10_8-gnu-mvapich2-hpc-debuginfo-1.10.8-150000.8.7.1 libhdf5_fortran_1_10_8-gnu-openmpi2-hpc-1.10.8-150000.8.7.1 libhdf5_fortran_1_10_8-gnu-openmpi2-hpc-debuginfo-1.10.8-150000.8.7.1 libhdf5_hl-gnu-hpc-1.10.8-150000.8.7.1 libhdf5_hl-gnu-mpich-hpc-1.10.8-150000.8.7.1 libhdf5_hl-gnu-mvapich2-hpc-1.10.8-150000.8.7.1 libhdf5_hl-gnu-openmpi2-hpc-1.10.8-150000.8.7.1 libhdf5_hl_1_10_8-gnu-hpc-1.10.8-150000.8.7.1 libhdf5_hl_1_10_8-gnu-hpc-debuginfo-1.10.8-150000.8.7.1 libhdf5_hl_1_10_8-gnu-mpich-hpc-1.10.8-150000.8.7.1 libhdf5_hl_1_10_8-gnu-mpich-hpc-debuginfo-1.10.8-150000.8.7.1 libhdf5_hl_1_10_8-gnu-mvapich2-hpc-1.10.8-150000.8.7.1 libhdf5_hl_1_10_8-gnu-mvapich2-hpc-debuginfo-1.10.8-150000.8.7.1 libhdf5_hl_1_10_8-gnu-openmpi2-hpc-1.10.8-150000.8.7.1 libhdf5_hl_1_10_8-gnu-openmpi2-hpc-debuginfo-1.10.8-150000.8.7.1 libhdf5_hl_cpp-gnu-hpc-1.10.8-150000.8.7.1 libhdf5_hl_cpp_1_10_8-gnu-hpc-1.10.8-150000.8.7.1 libhdf5_hl_cpp_1_10_8-gnu-hpc-debuginfo-1.10.8-150000.8.7.1 libhdf5_hl_fortran-gnu-hpc-1.10.8-150000.8.7.1 libhdf5_hl_fortran-gnu-mpich-hpc-1.10.8-150000.8.7.1 libhdf5_hl_fortran-gnu-mvapich2-hpc-1.10.8-150000.8.7.1 libhdf5_hl_fortran-gnu-openmpi2-hpc-1.10.8-150000.8.7.1 libhdf5hl_fortran_1_10_8-gnu-hpc-1.10.8-150000.8.7.1 libhdf5hl_fortran_1_10_8-gnu-hpc-debuginfo-1.10.8-150000.8.7.1 libhdf5hl_fortran_1_10_8-gnu-mpich-hpc-1.10.8-150000.8.7.1 libhdf5hl_fortran_1_10_8-gnu-mpich-hpc-debuginfo-1.10.8-150000.8.7.1 libhdf5hl_fortran_1_10_8-gnu-mvapich2-hpc-1.10.8-150000.8.7.1 libhdf5hl_fortran_1_10_8-gnu-mvapich2-hpc-debuginfo-1.10.8-150000.8.7.1 libhdf5hl_fortran_1_10_8-gnu-openmpi2-hpc-1.10.8-150000.8.7.1 libhdf5hl_fortran_1_10_8-gnu-openmpi2-hpc-debuginfo-1.10.8-150000.8.7.1 - SUSE Linux Enterprise High Performance Computing 15-LTSS (noarch): hdf5-gnu-hpc-devel-1.10.8-150000.8.7.1 hdf5-gnu-mpich-hpc-devel-1.10.8-150000.8.7.1 hdf5-gnu-mvapich2-hpc-devel-1.10.8-150000.8.7.1 hdf5-gnu-openmpi2-hpc-devel-1.10.8-150000.8.7.1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS (aarch64 x86_64): hdf5_1_10_8-gnu-hpc-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-hpc-debuginfo-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-hpc-debugsource-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-hpc-devel-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-hpc-devel-static-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-hpc-module-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-mpich-hpc-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-mpich-hpc-debuginfo-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-mpich-hpc-debugsource-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-mpich-hpc-devel-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-mpich-hpc-devel-static-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-mpich-hpc-module-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-mvapich2-hpc-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-mvapich2-hpc-debuginfo-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-mvapich2-hpc-debugsource-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-mvapich2-hpc-devel-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-mvapich2-hpc-devel-static-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-mvapich2-hpc-module-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-openmpi2-hpc-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-openmpi2-hpc-debuginfo-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-openmpi2-hpc-debugsource-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-openmpi2-hpc-devel-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-openmpi2-hpc-devel-static-1.10.8-150000.8.7.1 hdf5_1_10_8-gnu-openmpi2-hpc-module-1.10.8-150000.8.7.1 libhdf5-gnu-hpc-1.10.8-150000.8.7.1 libhdf5-gnu-mpich-hpc-1.10.8-150000.8.7.1 libhdf5-gnu-mvapich2-hpc-1.10.8-150000.8.7.1 libhdf5-gnu-openmpi2-hpc-1.10.8-150000.8.7.1 libhdf5_1_10_8-gnu-hpc-1.10.8-150000.8.7.1 libhdf5_1_10_8-gnu-hpc-debuginfo-1.10.8-150000.8.7.1 libhdf5_1_10_8-gnu-mpich-hpc-1.10.8-150000.8.7.1 libhdf5_1_10_8-gnu-mpich-hpc-debuginfo-1.10.8-150000.8.7.1 libhdf5_1_10_8-gnu-mvapich2-hpc-1.10.8-150000.8.7.1 libhdf5_1_10_8-gnu-mvapich2-hpc-debuginfo-1.10.8-150000.8.7.1 libhdf5_1_10_8-gnu-openmpi2-hpc-1.10.8-150000.8.7.1 libhdf5_1_10_8-gnu-openmpi2-hpc-debuginfo-1.10.8-150000.8.7.1 libhdf5_cpp-gnu-hpc-1.10.8-150000.8.7.1 libhdf5_cpp_1_10_8-gnu-hpc-1.10.8-150000.8.7.1 libhdf5_cpp_1_10_8-gnu-hpc-debuginfo-1.10.8-150000.8.7.1 libhdf5_fortran-gnu-hpc-1.10.8-150000.8.7.1 libhdf5_fortran-gnu-mpich-hpc-1.10.8-150000.8.7.1 libhdf5_fortran-gnu-mvapich2-hpc-1.10.8-150000.8.7.1 libhdf5_fortran-gnu-openmpi2-hpc-1.10.8-150000.8.7.1 libhdf5_fortran_1_10_8-gnu-hpc-1.10.8-150000.8.7.1 libhdf5_fortran_1_10_8-gnu-hpc-debuginfo-1.10.8-150000.8.7.1 libhdf5_fortran_1_10_8-gnu-mpich-hpc-1.10.8-150000.8.7.1 libhdf5_fortran_1_10_8-gnu-mpich-hpc-debuginfo-1.10.8-150000.8.7.1 libhdf5_fortran_1_10_8-gnu-mvapich2-hpc-1.10.8-150000.8.7.1 libhdf5_fortran_1_10_8-gnu-mvapich2-hpc-debuginfo-1.10.8-150000.8.7.1 libhdf5_fortran_1_10_8-gnu-openmpi2-hpc-1.10.8-150000.8.7.1 libhdf5_fortran_1_10_8-gnu-openmpi2-hpc-debuginfo-1.10.8-150000.8.7.1 libhdf5_hl-gnu-hpc-1.10.8-150000.8.7.1 libhdf5_hl-gnu-mpich-hpc-1.10.8-150000.8.7.1 libhdf5_hl-gnu-mvapich2-hpc-1.10.8-150000.8.7.1 libhdf5_hl-gnu-openmpi2-hpc-1.10.8-150000.8.7.1 libhdf5_hl_1_10_8-gnu-hpc-1.10.8-150000.8.7.1 libhdf5_hl_1_10_8-gnu-hpc-debuginfo-1.10.8-150000.8.7.1 libhdf5_hl_1_10_8-gnu-mpich-hpc-1.10.8-150000.8.7.1 libhdf5_hl_1_10_8-gnu-mpich-hpc-debuginfo-1.10.8-150000.8.7.1 libhdf5_hl_1_10_8-gnu-mvapich2-hpc-1.10.8-150000.8.7.1 libhdf5_hl_1_10_8-gnu-mvapich2-hpc-debuginfo-1.10.8-150000.8.7.1 libhdf5_hl_1_10_8-gnu-openmpi2-hpc-1.10.8-150000.8.7.1 libhdf5_hl_1_10_8-gnu-openmpi2-hpc-debuginfo-1.10.8-150000.8.7.1 libhdf5_hl_cpp-gnu-hpc-1.10.8-150000.8.7.1 libhdf5_hl_cpp_1_10_8-gnu-hpc-1.10.8-150000.8.7.1 libhdf5_hl_cpp_1_10_8-gnu-hpc-debuginfo-1.10.8-150000.8.7.1 libhdf5_hl_fortran-gnu-hpc-1.10.8-150000.8.7.1 libhdf5_hl_fortran-gnu-mpich-hpc-1.10.8-150000.8.7.1 libhdf5_hl_fortran-gnu-mvapich2-hpc-1.10.8-150000.8.7.1 libhdf5_hl_fortran-gnu-openmpi2-hpc-1.10.8-150000.8.7.1 libhdf5hl_fortran_1_10_8-gnu-hpc-1.10.8-150000.8.7.1 libhdf5hl_fortran_1_10_8-gnu-hpc-debuginfo-1.10.8-150000.8.7.1 libhdf5hl_fortran_1_10_8-gnu-mpich-hpc-1.10.8-150000.8.7.1 libhdf5hl_fortran_1_10_8-gnu-mpich-hpc-debuginfo-1.10.8-150000.8.7.1 libhdf5hl_fortran_1_10_8-gnu-mvapich2-hpc-1.10.8-150000.8.7.1 libhdf5hl_fortran_1_10_8-gnu-mvapich2-hpc-debuginfo-1.10.8-150000.8.7.1 libhdf5hl_fortran_1_10_8-gnu-openmpi2-hpc-1.10.8-150000.8.7.1 libhdf5hl_fortran_1_10_8-gnu-openmpi2-hpc-debuginfo-1.10.8-150000.8.7.1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS (noarch): hdf5-gnu-hpc-devel-1.10.8-150000.8.7.1 hdf5-gnu-mpich-hpc-devel-1.10.8-150000.8.7.1 hdf5-gnu-mvapich2-hpc-devel-1.10.8-150000.8.7.1 hdf5-gnu-openmpi2-hpc-devel-1.10.8-150000.8.7.1

References

#1093663 #1101475 #1101906 #1107069 #1111598

#1125882 #1167400 #1194366 #1194375 #1195212

#1195215

Cross- CVE-2018-11205 CVE-2018-13867 CVE-2018-14031

CVE-2018-16438 CVE-2018-17439 CVE-2019-8396

CVE-2020-10812 CVE-2021-45830 CVE-2021-45833

CVE-2021-46242 CVE-2021-46244

CVSS scores:

CVE-2018-11205 (NVD) : 8.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

CVE-2018-11205 (SUSE): 5.1 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

CVE-2018-13867 (NVD) : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2018-13867 (SUSE): 5.3 CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L

CVE-2018-14031 (NVD) : 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2018-14031 (SUSE): 4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVE-2018-16438 (NVD) : 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2018-16438 (SUSE): 2.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

CVE-2018-17439 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVE-2018-17439 (SUSE): 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CVE-2019-8396 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVE-2019-8396 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

CVE-2020-10812 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVE-2020-10812 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

CVE-2021-45830 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVE-2021-45830 (SUSE): 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

CVE-2021-45833 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVE-2021-45833 (SUSE): 4.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

CVE-2021-46242 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2021-46242 (SUSE): 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

CVE-2021-46244 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVE-2021-46244 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected Products:

SUSE Linux Enterprise High Performance Computing 15-ESPOS

SUSE Linux Enterprise High Performance Computing 15-LTSS

https://www.suse.com/security/cve/CVE-2018-11205.html

https://www.suse.com/security/cve/CVE-2018-13867.html

https://www.suse.com/security/cve/CVE-2018-14031.html

https://www.suse.com/security/cve/CVE-2018-16438.html

https://www.suse.com/security/cve/CVE-2018-17439.html

https://www.suse.com/security/cve/CVE-2019-8396.html

https://www.suse.com/security/cve/CVE-2020-10812.html

https://www.suse.com/security/cve/CVE-2021-45830.html

https://www.suse.com/security/cve/CVE-2021-45833.html

https://www.suse.com/security/cve/CVE-2021-46242.html

https://www.suse.com/security/cve/CVE-2021-46244.html

https://bugzilla.suse.com/1093663

https://bugzilla.suse.com/1101475

https://bugzilla.suse.com/1101906

https://bugzilla.suse.com/1107069

https://bugzilla.suse.com/1111598

https://bugzilla.suse.com/1125882

https://bugzilla.suse.com/1167400

https://bugzilla.suse.com/1194366

https://bugzilla.suse.com/1194375

https://bugzilla.suse.com/1195212

https://bugzilla.suse.com/1195215

Severity
Announcement ID: SUSE-SU-2022:3828-1
Rating: important

Related News