The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1912-1 advisory.

  - An out of bounds read was discovered in H5O_fill_new_decode and H5O_fill_old_decode in H5Ofill.c in the     HDF HDF5 1.10.2 library. It could allow a remote denial of service or information disclosure attack.
    (CVE-2018-11206)

  - An issue was discovered in the HDF HDF5 1.8.20 library. There is a heap-based buffer over-read in the     function H5O_layout_decode in H5Olayout.c, related to HDmemcpy. (CVE-2018-14033)

  - An issue was discovered in the HDF HDF5 1.8.20 library. There is a heap-based buffer over-read in the     function H5O_sdspace_decode in H5Osdspace.c. (CVE-2018-14460)

  - Memory leak in the H5O__chunk_deserialize() function in H5Ocache.c in the HDF HDF5 through 1.10.3 library     allows attackers to cause a denial of service (memory consumption) via a crafted HDF5 file.
    (CVE-2018-17234)

  - A SIGFPE signal is raised in the function H5D__chunk_set_info_real() of H5Dchunk.c in the HDF HDF5 1.10.3     library during an attempted parse of a crafted HDF file, because of incorrect protection against division     by zero. This issue is different from CVE-2018-11207. (CVE-2018-17237)

  - A NULL pointer dereference in H5O_sdspace_encode() in H5Osdspace.c in the HDF HDF5 through 1.10.3 library     allows attackers to cause a denial of service via a crafted HDF5 file. (CVE-2018-17432)

  - A heap-based buffer overflow in ReadGifImageDesc() in gifread.c in the HDF HDF5 through 1.10.3 library     allows attackers to cause a denial of service via a crafted HDF5 file. This issue was triggered while     converting a GIF file to an HDF file. (CVE-2018-17433)

  - A SIGFPE signal is raised in the function apply_filters() of h5repack_filters.c in the HDF HDF5 through     1.10.3 library during an attempted parse of a crafted HDF file, because of incorrect protection against     division by zero. It could allow a remote denial of service attack. (CVE-2018-17434)

  - ReadCode() in decompress.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of     service (invalid write access) via a crafted HDF5 file. This issue was triggered while converting a GIF     file to an HDF file. (CVE-2018-17436)

  - Memory leak in the H5O_dtype_decode_helper() function in H5Odtype.c in the HDF HDF5 through 1.10.3 library     allows attackers to cause a denial of service (memory consumption) via a crafted HDF5 file.
    (CVE-2018-17437)

  - A SIGFPE signal is raised in the function H5D__select_io() of H5Dselect.c in the HDF HDF5 through 1.10.3     library during an attempted parse of a crafted HDF file, because of incorrect protection against division     by zero. It could allow a remote denial of service attack. (CVE-2018-17438)

  - An issue was discovered in HDF5 through 1.12.0. A heap-based buffer overflow exists in the function     Decompress() located in decompress.c. It can be triggered by sending a crafted file to the gif2h5 binary.
    It allows an attacker to cause Denial of Service. (CVE-2020-10809)

  - An issue was discovered in HDF5 through 1.12.0. A NULL pointer dereference exists in the function     H5AC_unpin_entry() located in H5AC.c. It allows an attacker to cause Denial of Service. (CVE-2020-10810)

  - An issue was discovered in HDF5 through 1.12.0. A heap-based buffer over-read exists in the function     H5O__layout_decode() located in H5Olayout.c. It allows an attacker to cause Denial of Service.
    (CVE-2020-10811)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

SUSE SLES15 Security Update : hdf5 (SUSE-SU-2022:1912-1)

high Nessus Plugin ID 161827

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.6 Jul 14, 2023, 8:58 AM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") Plugin metadata Plugin Feed: 202307140858
Version 1.5 Jul 12, 2023, 5:37 PM Detection Plugin Feed: 202307121737
Version 1.4 Feb 8, 2023, 11:19 PM Logic Changes (Updated openSUSE package checks in SUSE plugins) Plugin Feed: 202302082319
Version 1.3 Jan 21, 2023, 5:26 AM Logic Changes (Added package checks for openSuSE) Plugin Feed: 202301210526