{"id":"CVE-2018-11202","aliases":["DEBIAN-CVE-2018-11202","EUVD-2018-3242","GHSA-hmfw-p4xx-rfx7","SUSE-SU-2022:1903-1","SUSE-SU-2022:1910-1","SUSE-SU-2022:1911-1","SUSE-SU-2022:1933-1","SUSE-SU-2024:0538-1","SUSE-SU-2024:0882-1","SUSE-SU-2024:3144-1","UBUNTU-CVE-2018-11202"],"status":"published","title":"A NULL pointer dereference was discovered in H5S_hyper_make_spans in H5Shyper.c in the HDF HDF5 1...","description":"A NULL pointer dereference was discovered in H5S_hyper_make_spans in H5Shyper.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service attack.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01885,"percentile":0.79632,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2018-05-16T15:00:00Z","modified":"2026-10-24T10:30:53Z","fixes":[{"ecosystem":"Debian:12","package":"hdf5","fixed_in":["1.10.4+repack-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"hdf5","fixed_in":["1.10.4+repack-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"hdf5","fixed_in":["1.10.4+repack-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"hdf5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4+repack-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"hdf5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4+repack-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"hdf5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4+repack-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"hdf5_1_10_8-gnu-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150100.7.4.3"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"hdf5_1_10_8-gnu-mpich-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150100.7.4.3"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"hdf5_1_10_8-gnu-mvapich2-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150100.7.4.3"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"hdf5_1_10_8-gnu-openmpi2-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150100.7.4.3"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"hdf5_1_10_8-gnu-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150100.7.4.3"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"hdf5_1_10_8-gnu-mpich-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150100.7.4.3"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"hdf5_1_10_8-gnu-mvapich2-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150100.7.4.3"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"hdf5_1_10_8-gnu-openmpi2-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150100.7.4.3"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"hdf5_1_10_8-gnu-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150200.8.4.2"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"hdf5_1_10_8-gnu-mpich-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150200.8.4.3"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"hdf5_1_10_8-gnu-mvapich2-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150200.8.4.2"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"hdf5_1_10_8-gnu-openmpi2-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150200.8.4.2"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"hdf5_1_10_8-gnu-openmpi3-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150200.8.4.2"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"hdf5_1_10_8-gnu-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150200.8.4.2"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"hdf5_1_10_8-gnu-mpich-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150200.8.4.3"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"hdf5_1_10_8-gnu-mvapich2-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150200.8.4.2"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"hdf5_1_10_8-gnu-openmpi2-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150200.8.4.2"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"hdf5_1_10_8-gnu-openmpi3-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150200.8.4.2"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"hdf5_1_10_8-gnu-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150000.8.4.3"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"hdf5_1_10_8-gnu-mpich-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150000.8.4.3"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"hdf5_1_10_8-gnu-mvapich2-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150000.8.4.3"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"hdf5_1_10_8-gnu-openmpi2-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150000.8.4.3"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"suse-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.20220206.0c6b168-150000.11.3.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"hdf5_1_10_8-gnu-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150000.8.4.3"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"hdf5_1_10_8-gnu-mpich-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150000.8.4.3"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"hdf5_1_10_8-gnu-mvapich2-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150000.8.4.3"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"hdf5_1_10_8-gnu-openmpi2-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150000.8.4.3"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"suse-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.20220206.0c6b168-150000.11.3.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 12","package":"hdf5_1_10_8-gnu-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-3.12.2"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 12","package":"hdf5_1_10_8-gnu-mvapich2-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-3.12.2"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 12","package":"hdf5_1_10_8-gnu-openmpi1-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-3.12.2"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 12","package":"suse-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.20220206.0c6b168-5.2"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 15 SP5","package":"hdf5_1_10_11-gnu-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.11-150400.3.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 15 SP5","package":"hdf5_1_10_11-gnu-mpich-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.11-150400.3.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 15 SP5","package":"hdf5_1_10_11-gnu-mvapich2-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.11-150400.3.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 15 SP5","package":"hdf5_1_10_11-gnu-openmpi3-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.11-150400.3.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 15 SP5","package":"hdf5_1_10_11-gnu-openmpi4-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.11-150400.3.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"hdf5_1_10_11-gnu-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.11-150400.3.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"hdf5_1_10_11-gnu-mpich-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.11-150400.3.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"hdf5_1_10_11-gnu-mvapich2-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.11-150400.3.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"hdf5_1_10_11-gnu-openmpi3-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.11-150400.3.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"hdf5_1_10_11-gnu-openmpi4-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.11-150400.3.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"hdf5_1_10_11-gnu-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.11-150400.3.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"hdf5_1_10_11-gnu-mpich-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.11-150400.3.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"hdf5_1_10_11-gnu-mvapich2-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.11-150400.3.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"hdf5_1_10_11-gnu-openmpi3-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.11-150400.3.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"hdf5_1_10_11-gnu-openmpi4-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.11-150400.3.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 12","package":"hdf5_1_10_11-gnu-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.11-3.21.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 12","package":"hdf5_1_10_11-gnu-mvapich2-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.11-3.21.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 12","package":"hdf5_1_10_11-gnu-openmpi1-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.11-3.21.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"adios_1_13_1-gnu-mpich-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-150300.12.4.2"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"adios_1_13_1-gnu-mvapich2-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-150300.12.4.2"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"adios_1_13_1-gnu-openmpi3-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-150300.12.4.2"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"adios_1_13_1-gnu-openmpi4-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-150300.12.4.2"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"hdf5_1_10_11-gnu-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.11-150300.4.16.15"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"hdf5_1_10_11-gnu-mpich-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.11-150300.4.16.15"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"hdf5_1_10_11-gnu-mvapich2-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.11-150300.4.16.15"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"hdf5_1_10_11-gnu-openmpi3-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.11-150300.4.16.15"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"hdf5_1_10_11-gnu-openmpi4-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.11-150300.4.16.15"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"netcdf_4_7_4-gnu-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.4-150300.4.7.19"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"netcdf_4_7_4-gnu-mpich-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.4-150300.4.7.19"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"netcdf_4_7_4-gnu-mvapich2-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.4-150300.4.7.20"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"netcdf_4_7_4-gnu-openmpi3-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.4-150300.4.7.17"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"netcdf_4_7_4-gnu-openmpi4-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.4-150300.4.7.21"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"petsc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.5-150300.3.4.3"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"petsc_3_14_5-gnu-mpich-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.5-150300.3.4.4"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"petsc_3_14_5-gnu-mvapich2-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.5-150300.3.4.4"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"petsc_3_14_5-gnu-openmpi3-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.5-150300.3.4.4"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"petsc_3_14_5-gnu-openmpi4-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.5-150300.3.4.4"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"trilinos_13_2_0-gnu-mpich-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.2.0-150300.3.12.18"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"trilinos_13_2_0-gnu-mvapich2-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.2.0-150300.3.12.18"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"trilinos_13_2_0-gnu-openmpi3-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.2.0-150300.3.12.16"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"trilinos_13_2_0-gnu-openmpi4-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.2.0-150300.3.12.18"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"trilinos_13_2_0-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.2.0-150300.3.12.9"}]}],"bundled":18},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"hdf5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.11-3ubuntu1","1.8.11-5ubuntu1","1.8.11-5ubuntu2","1.8.11-5ubuntu6","1.8.11-5ubuntu7","1.8.11-5ubuntu7.1","1.8.11-5ubuntu7.1+esm1","1.8.11-5ubuntu7.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"hdf5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.15-patch1+docs-4","1.8.15-patch1+docs-5","1.8.16+docs-1","1.8.16+docs-2","1.8.16+docs-3","1.8.16+docs-3ubuntu1","1.8.16+docs-4","1.8.16+docs-4ubuntu1","1.8.16+docs-4ubuntu1.1","1.8.16+docs-4ubuntu1.1+esm1","1.8.16+docs-4ubuntu1.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"hdf5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.0-patch1+docs-4","1.10.0-patch1+docs-4ubuntu0.1~esm1","1.10.0-patch1+docs-4ubuntu0.1~esm2"]}],"products":[{"vendor":"hdfgroup","product":"hdf5"}],"references":[{"url":"https://github.com/Twi1ight/fuzzing-pocs/tree/master/hdf5","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-11202"},{"url":"https://github.com/advisories/GHSA-hmfw-p4xx-rfx7"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-11202","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221903-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1072087","tags":["report"]},{"url":"https://bugzilla.suse.com/1072090","tags":["report"]},{"url":"https://bugzilla.suse.com/1072108","tags":["report"]},{"url":"https://bugzilla.suse.com/1072111","tags":["report"]},{"url":"https://bugzilla.suse.com/1093641","tags":["report"]},{"url":"https://bugzilla.suse.com/1093649","tags":["report"]},{"url":"https://bugzilla.suse.com/1093653","tags":["report"]},{"url":"https://bugzilla.suse.com/1093655","tags":["report"]},{"url":"https://bugzilla.suse.com/1093657","tags":["report"]},{"url":"https://bugzilla.suse.com/1101471","tags":["report"]},{"url":"https://bugzilla.suse.com/1101474","tags":["report"]},{"url":"https://bugzilla.suse.com/1101493","tags":["report"]},{"url":"https://bugzilla.suse.com/1101495","tags":["report"]},{"url":"https://bugzilla.suse.com/1102175","tags":["report"]},{"url":"https://bugzilla.suse.com/1109166","tags":["report"]},{"url":"https://bugzilla.suse.com/1109167","tags":["report"]},{"url":"https://bugzilla.suse.com/1109168","tags":["report"]},{"url":"https://bugzilla.suse.com/1109564","tags":["report"]},{"url":"https://bugzilla.suse.com/1109565","tags":["report"]},{"url":"https://bugzilla.suse.com/1109566","tags":["report"]},{"url":"https://bugzilla.suse.com/1109567","tags":["report"]},{"url":"https://bugzilla.suse.com/1109568","tags":["report"]},{"url":"https://bugzilla.suse.com/1109569","tags":["report"]},{"url":"https://bugzilla.suse.com/1109570","tags":["report"]},{"url":"https://bugzilla.suse.com/1134298","tags":["report"]},{"url":"https://bugzilla.suse.com/1167401","tags":["report"]},{"url":"https://bugzilla.suse.com/1167404","tags":["report"]},{"url":"https://bugzilla.suse.com/1167405","tags":["report"]},{"url":"https://bugzilla.suse.com/1169793","tags":["report"]},{"url":"https://bugzilla.suse.com/1174439","tags":["report"]},{"url":"https://bugzilla.suse.com/1179521","tags":["report"]},{"url":"https://bugzilla.suse.com/1196682","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11202","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-13869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-13870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10811","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221910-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221911-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1116458","tags":["report"]},{"url":"https://bugzilla.suse.com/1124509","tags":["report"]},{"url":"https://bugzilla.suse.com/1133222","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221933-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1058563","tags":["report"]},{"url":"https://bugzilla.suse.com/1080022","tags":["report"]},{"url":"https://bugzilla.suse.com/1080259","tags":["report"]},{"url":"https://bugzilla.suse.com/1080426","tags":["report"]},{"url":"https://bugzilla.suse.com/1080442","tags":["report"]},{"url":"https://bugzilla.suse.com/1082209","tags":["report"]},{"url":"https://bugzilla.suse.com/1084951","tags":["report"]},{"url":"https://bugzilla.suse.com/1088547","tags":["report"]},{"url":"https://bugzilla.suse.com/1091237","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240538-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1011205","tags":["report"]},{"url":"https://bugzilla.suse.com/1125882","tags":["report"]},{"url":"https://bugzilla.suse.com/1167400","tags":["report"]},{"url":"https://bugzilla.suse.com/1207973","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8396","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-37501","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240882-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1209548","tags":["report"]},{"url":"https://bugzilla.suse.com/133222","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243144-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1210049","tags":["report"]},{"url":"https://bugzilla.suse.com/1224158","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-29158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-29161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-29166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-32608","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-32610","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-32614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-32619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-32620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-33873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-33874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-33875","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-11202","tags":["report"]},{"url":"https://jira.hdfgroup.org/browse/HDFFV-10476","tags":["report"]},{"url":"https://bitbucket.hdfgroup.org/projects/HDFFV/repos/hdf5/commits/992a199f90fec31e0ad72ed76ed279a3ccea59e4","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-11202","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-11202","description":"A NULL pointer dereference was discovered in H5S_hyper_make_spans in H5Shyper.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service attack.","status":"published","published":"2018-05-16T15:00:00Z","modified":"2024-09-16T18:09:16.792Z","updated_at":"2026-11-02T14:35:09.570381Z"}],"euvd":[{"id":"EUVD-2018-3242","description":"A NULL pointer dereference was discovered in H5S_hyper_make_spans in H5Shyper.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service attack.","status":"published","published":"2018-05-16T15:00:00Z","modified":"2024-09-16T18:09:16Z","updated_at":"2026-11-03T00:55:34.828317Z"}],"ghsa":[{"id":"GHSA-hmfw-p4xx-rfx7","title":"A NULL pointer dereference was discovered in H5S_hyper_make_spans in H5Shyper.c in the HDF HDF5 1...","description":"A NULL pointer dereference was discovered in H5S_hyper_make_spans in H5Shyper.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service attack.","status":"published","published":"2022-05-14T03:17:42Z","modified":"2023-02-02T05:07:38Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:52:33.427724Z"}],"nvd":[{"id":"CVE-2018-11202","description":"A NULL pointer dereference was discovered in H5S_hyper_make_spans in H5Shyper.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service attack.","status":"published","published":"2018-05-16T15:29:00.273Z","modified":"2026-06-17T01:35:29.207Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:04:27.507872Z"}],"osv":[{"id":"CVE-2018-11202","description":"A NULL pointer dereference was discovered in H5S_hyper_make_spans in H5Shyper.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service attack.","status":"published","published":"2018-05-16T15:29:00.273Z","modified":"2026-10-24T10:30:53.582767655Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:07.641418Z"},{"id":"DEBIAN-CVE-2018-11202","description":"A NULL pointer dereference was discovered in H5S_hyper_make_spans in H5Shyper.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service attack.","status":"published","published":"2018-05-16T15:29:00.273Z","modified":"2026-10-23T18:03:35.794942192Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"UBUNTU-CVE-2018-11202","description":"A NULL pointer dereference was discovered in H5S_hyper_make_spans in H5Shyper.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service attack.","status":"published","published":"2018-05-16T15:29:00Z","modified":"2026-04-22T11:40:55.778055Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:16.544091Z"},{"id":"SUSE-SU-2022:1903-1","title":"Security update for hdf5","description":"This update for hdf5 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2020-10811: Fixed heap-based buffer over-read in the function H5O__layout_decode() located in H5Olayout.c (bsc#1167405).\n- CVE-2020-10810: Fixed NULL pointer dereference in the function H5AC_unpin_entry() located in H5AC.c (bsc#1167401).\n- CVE-2020-10809: Fixed heap-based buffer overflow in the function Decompress() located in decompress.c (bsc#1167404).\n- CVE-2018-17438: Fixed SIGFPE signal raise in the function H5D__select_io() of H5Dselect.c (bsc#1109570).\n- CVE-2018-17437: Fixed memory leak in the H5O_dtype_decode_helper() function in H5Odtype.c. (bsc#1109569).\n- CVE-2018-17436: Fixed issue in ReadCode() in decompress.c that allowed attackers to cause a denial of service via a crafted HDF5 file (bsc#1109568).\n- CVE-2018-17435: Fixed heap-based buffer over-read in H5O_attr_decode() in H5Oattr.c (bsc#1109567).\n- CVE-2018-17434: Fixed SIGFPE signal raise in function apply_filters() of h5repack_filters.c (bsc#1109566).\n- CVE-2018-17433: Fixed heap-based buffer overflow in ReadGifImageDesc() in gifread.c (bsc#1109565).\n- CVE-2018-17432: Fixed NULL pointer dereference in H5O_sdspace_encode() in H5Osdspace.c (bsc#1109564).\n- CVE-2018-17237: Fixed SIGFPE signal raise in the function H5D__chunk_set_info_real() (bsc#1109168).\n- CVE-2018-17234: Fixed memory leak in the H5O__chunk_deserialize() function in H5Ocache.c (bsc#1109167).\n- CVE-2018-17233: Fixed SIGFPE signal is raise in the function H5D__create_chunk_file_map_hyper (bsc#1109166).\n- CVE-2018-14460: Fixed heap-based buffer over-read in the function H5O_sdspace_decode in H5Osdspace.c (bsc#1102175).\n- CVE-2018-14033: Fixed heap-based buffer over-read in the function H5O_layout_decode in H5Olayout.c (bsc#1101471).\n- CVE-2018-14032: Fixed heap-based buffer over-read in the function H5O_fill_new_decode in H5Ofill.c (bsc#1101474).\n- CVE-2018-13870: Fixed heap-based buffer over-read in the function H5O_link_decode in H5Olink.c (bsc#1101493).\n- CVE-2018-13869: Fixed memcpy parameter overlap in the function H5O_link_decode in H5Olink.c (bsc#1101495).\n- CVE-2018-11207: Fixed division by zero was discovered in H5D__chunk_init in H5Dchunk.c (bsc#1093653).\n- CVE-2018-11206: Fixed out of bounds read in H5O_fill_new_decode and H5O_fill_old_decode in H5Ofill.c (bsc#1093657).\n- CVE-2018-11204: Fixed NULL pointer dereference in H5O__chunk_deserialize in H5Ocache.c (bsc#1093655).\n- CVE-2018-11203: Fixed division by zero in H5D__btree_decode_key in H5Dbtree.c (bsc#1093649).\n- CVE-2018-11202: Fixed NULL pointer dereference in H5S_hyper_make_spans in H5Shyper.c (bsc#1093641).\n- CVE-2017-17509: Fixed out of bounds write vulnerability in function H5G__ent_decode_vec (bsc#1072111).\n- CVE-2017-17508: Fixed divide-by-zero vulnerability in function H5T_set_loc (bsc#1072108).\n- CVE-2017-17506: Fixed out of bounds read in the function H5Opline_pline_decode (bsc#1072090).\n- CVE-2017-17505: Fixed NULL pointer dereference in the function H5O_pline_decode (bsc#1072087).\n\nBugfixes:\n\n- Fix library link flags on pkg-config file for HPC builds (bsc#1134298).\n- Fix .so number in baselibs.conf for libhdf5_fortran libs (bsc#1169793).\n- Fix python-h5py packages built against out-of-date version of HDF5 (bsc#1196682).\n- Fix netcdf-cxx4 packages built against out-of-date version of HDF5 (bsc#1179521).\n- Add build support for gcc10 to HPC build (bsc#1174439).\n- Add HPC support for gcc8 and gcc9 (jsc#SLE-7766 \u0026 jsc#SLE-8604).\n- Enable openmpi3 builds for Leap and SLE \u003e 15.1 (jsc#SLE-7773).\n- HDF5 version Update to 1.10.5 (jsc#SLE-8501).\n","status":"published","published":"2022-06-01T09:04:18Z","modified":"2026-02-04T02:34:42.316951Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1910-1","title":"Security update for hdf5","description":"This update for hdf5 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2020-10811: Fixed heap-based buffer over-read in the function H5O__layout_decode() located in H5Olayout.c (bsc#1167405).\n- CVE-2020-10810: Fixed NULL pointer dereference in the function H5AC_unpin_entry() located in H5AC.c (bsc#1167401).\n- CVE-2020-10809: Fixed heap-based buffer overflow in the function Decompress() located in decompress.c (bsc#1167404).\n- CVE-2018-17438: Fixed SIGFPE signal raise in the function H5D__select_io() of H5Dselect.c (bsc#1109570).\n- CVE-2018-17437: Fixed memory leak in the H5O_dtype_decode_helper() function in H5Odtype.c. (bsc#1109569).\n- CVE-2018-17436: Fixed issue in ReadCode() in decompress.c that allowed attackers to cause a denial of service via a crafted HDF5 file (bsc#1109568).\n- CVE-2018-17435: Fixed heap-based buffer over-read in H5O_attr_decode() in H5Oattr.c (bsc#1109567).\n- CVE-2018-17434: Fixed SIGFPE signal raise in function apply_filters() of h5repack_filters.c (bsc#1109566).\n- CVE-2018-17433: Fixed heap-based buffer overflow in ReadGifImageDesc() in gifread.c (bsc#1109565).\n- CVE-2018-17432: Fixed NULL pointer dereference in H5O_sdspace_encode() in H5Osdspace.c (bsc#1109564).\n- CVE-2018-17237: Fixed SIGFPE signal raise in the function H5D__chunk_set_info_real() (bsc#1109168).\n- CVE-2018-17234: Fixed memory leak in the H5O__chunk_deserialize() function in H5Ocache.c (bsc#1109167).\n- CVE-2018-17233: Fixed SIGFPE signal is raise in the function H5D__create_chunk_file_map_hyper (bsc#1109166).\n- CVE-2018-14460: Fixed heap-based buffer over-read in the function H5O_sdspace_decode in H5Osdspace.c (bsc#1102175).\n- CVE-2018-14033: Fixed heap-based buffer over-read in the function H5O_layout_decode in H5Olayout.c (bsc#1101471).\n- CVE-2018-14032: Fixed heap-based buffer over-read in the function H5O_fill_new_decode in H5Ofill.c (bsc#1101474).\n- CVE-2018-13870: Fixed heap-based buffer over-read in the function H5O_link_decode in H5Olink.c (bsc#1101493).\n- CVE-2018-13869: Fixed memcpy parameter overlap in the function H5O_link_decode in H5Olink.c (bsc#1101495).\n- CVE-2018-11207: Fixed division by zero was discovered in H5D__chunk_init in H5Dchunk.c (bsc#1093653).\n- CVE-2018-11206: Fixed out of bounds read in H5O_fill_new_decode and H5O_fill_old_decode in H5Ofill.c (bsc#1093657).\n- CVE-2018-11204: Fixed NULL pointer dereference in H5O__chunk_deserialize in H5Ocache.c (bsc#1093655).\n- CVE-2018-11203: Fixed division by zero in H5D__btree_decode_key in H5Dbtree.c (bsc#1093649).\n- CVE-2018-11202: Fixed NULL pointer dereference in H5S_hyper_make_spans in H5Shyper.c (bsc#1093641).\n- CVE-2017-17509: Fixed out of bounds write vulnerability in function H5G__ent_decode_vec (bsc#1072111).\n- CVE-2017-17508: Fixed divide-by-zero vulnerability in function H5T_set_loc (bsc#1072108).\n- CVE-2017-17506: Fixed out of bounds read in the function H5Opline_pline_decode (bsc#1072090).\n- CVE-2017-17505: Fixed NULL pointer dereference in the function H5O_pline_decode (bsc#1072087).\n\nBugfixes:\n\n- Fix python-h5py packages built against out-of-date version of HDF5 (bsc#1196682).\n- Fix netcdf-cxx4 packages built against out-of-date version of HDF5 (bsc#1179521).\n- Add build support for gcc10 to HPC build (bsc#1174439).\n","status":"published","published":"2022-06-01T15:24:23Z","modified":"2026-02-04T03:49:17.463493Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1911-1","title":"Security update for hdf5, suse-hpc","description":"This update for hdf5, suse-hpc fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2020-10811: Fixed heap-based buffer over-read in the function H5O__layout_decode() located in H5Olayout.c (bsc#1167405).\n- CVE-2020-10810: Fixed NULL pointer dereference in the function H5AC_unpin_entry() located in H5AC.c (bsc#1167401).\n- CVE-2020-10809: Fixed heap-based buffer overflow in the function Decompress() located in decompress.c (bsc#1167404).\n- CVE-2018-17438: Fixed SIGFPE signal raise in the function H5D__select_io() of H5Dselect.c (bsc#1109570).\n- CVE-2018-17437: Fixed memory leak in the H5O_dtype_decode_helper() function in H5Odtype.c. (bsc#1109569).\n- CVE-2018-17436: Fixed issue in ReadCode() in decompress.c that allowed attackers to cause a denial of service via a crafted HDF5 file (bsc#1109568).\n- CVE-2018-17435: Fixed heap-based buffer over-read in H5O_attr_decode() in H5Oattr.c (bsc#1109567).\n- CVE-2018-17434: Fixed SIGFPE signal raise in function apply_filters() of h5repack_filters.c (bsc#1109566).\n- CVE-2018-17433: Fixed heap-based buffer overflow in ReadGifImageDesc() in gifread.c (bsc#1109565).\n- CVE-2018-17432: Fixed NULL pointer dereference in H5O_sdspace_encode() in H5Osdspace.c (bsc#1109564).\n- CVE-2018-17237: Fixed SIGFPE signal raise in the function H5D__chunk_set_info_real() (bsc#1109168).\n- CVE-2018-17234: Fixed memory leak in the H5O__chunk_deserialize() function in H5Ocache.c (bsc#1109167).\n- CVE-2018-17233: Fixed SIGFPE signal is raise in the function H5D__create_chunk_file_map_hyper (bsc#1109166).\n- CVE-2018-14460: Fixed heap-based buffer over-read in the function H5O_sdspace_decode in H5Osdspace.c (bsc#1102175).\n- CVE-2018-14033: Fixed heap-based buffer over-read in the function H5O_layout_decode in H5Olayout.c (bsc#1101471).\n- CVE-2018-14032: Fixed heap-based buffer over-read in the function H5O_fill_new_decode in H5Ofill.c (bsc#1101474).\n- CVE-2018-13870: Fixed heap-based buffer over-read in the function H5O_link_decode in H5Olink.c (bsc#1101493).\n- CVE-2018-13869: Fixed memcpy parameter overlap in the function H5O_link_decode in H5Olink.c (bsc#1101495).\n- CVE-2018-11207: Fixed division by zero was discovered in H5D__chunk_init in H5Dchunk.c (bsc#1093653).\n- CVE-2018-11206: Fixed out of bounds read in H5O_fill_new_decode and H5O_fill_old_decode in H5Ofill.c (bsc#1093657).\n- CVE-2018-11204: Fixed NULL pointer dereference in H5O__chunk_deserialize in H5Ocache.c (bsc#1093655).\n- CVE-2018-11203: Fixed division by zero in H5D__btree_decode_key in H5Dbtree.c (bsc#1093649).\n- CVE-2018-11202: Fixed NULL pointer dereference in H5S_hyper_make_spans in H5Shyper.c (bsc#1093641).\n- CVE-2017-17509: Fixed out of bounds write vulnerability in function H5G__ent_decode_vec (bsc#1072111).\n- CVE-2017-17508: Fixed divide-by-zero vulnerability in function H5T_set_loc (bsc#1072108).\n- CVE-2017-17506: Fixed out of bounds read in the function H5Opline_pline_decode (bsc#1072090).\n- CVE-2017-17505: Fixed NULL pointer dereference in the function H5O_pline_decode (bsc#1072087).\n\nBugfixes:\n\n- Expand modules handling (bsc#1116458).\n- Fix default moduleversion link generation and deletion (bsc#1124509).\n- Set higher constraints for succesfull mpich tests (bsc#1133222).\n- Fix library link flags on pkg-config file for HPC builds (bsc#1134298).\n- Fix .so number in baselibs.conf for libhdf5_fortran libs (bsc#1169793).\n- Fix python-h5py packages built against out-of-date version of HDF5 (bsc#1196682).\n- Fix netcdf-cxx4 packages built against out-of-date version of HDF5 (bsc#1179521).\n- Add build support for gcc10 to HPC build (bsc#1174439).\n- Add HPC support for gcc8 and gcc9 (jsc#SLE-7766 \u0026 jsc#SLE-8604).\n- Enable openmpi3 builds for Leap and SLE \u003e 15.1 (jsc#SLE-7773).\n- HDF5 version Update to 1.10.5 (jsc#SLE-8501).\n","status":"published","published":"2022-06-02T07:54:26Z","modified":"2026-02-04T03:01:25.980159Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1933-1","title":"Security update for hdf5, suse-hpc","description":"This update for hdf5, suse-hpc fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2020-10811: Fixed heap-based buffer over-read in the function H5O__layout_decode() located in H5Olayout.c (bsc#1167405).\n- CVE-2020-10810: Fixed NULL pointer dereference in the function H5AC_unpin_entry() located in H5AC.c (bsc#1167401).\n- CVE-2020-10809: Fixed heap-based buffer overflow in the function Decompress() located in decompress.c (bsc#1167404).\n- CVE-2018-17438: Fixed SIGFPE signal raise in the function H5D__select_io() of H5Dselect.c (bsc#1109570).\n- CVE-2018-17437: Fixed memory leak in the H5O_dtype_decode_helper() function in H5Odtype.c. (bsc#1109569).\n- CVE-2018-17436: Fixed issue in ReadCode() in decompress.c that allowed attackers to cause a denial of service via a crafted HDF5 file (bsc#1109568).\n- CVE-2018-17435: Fixed heap-based buffer over-read in H5O_attr_decode() in H5Oattr.c (bsc#1109567).\n- CVE-2018-17434: Fixed SIGFPE signal raise in function apply_filters() of h5repack_filters.c (bsc#1109566).\n- CVE-2018-17433: Fixed heap-based buffer overflow in ReadGifImageDesc() in gifread.c (bsc#1109565).\n- CVE-2018-17432: Fixed NULL pointer dereference in H5O_sdspace_encode() in H5Osdspace.c (bsc#1109564).\n- CVE-2018-17237: Fixed SIGFPE signal raise in the function H5D__chunk_set_info_real() (bsc#1109168).\n- CVE-2018-17234: Fixed memory leak in the H5O__chunk_deserialize() function in H5Ocache.c (bsc#1109167).\n- CVE-2018-17233: Fixed SIGFPE signal is raise in the function H5D__create_chunk_file_map_hyper (bsc#1109166).\n- CVE-2018-14460: Fixed heap-based buffer over-read in the function H5O_sdspace_decode in H5Osdspace.c (bsc#1102175).\n- CVE-2018-14033: Fixed heap-based buffer over-read in the function H5O_layout_decode in H5Olayout.c (bsc#1101471).\n- CVE-2018-14032: Fixed heap-based buffer over-read in the function H5O_fill_new_decode in H5Ofill.c (bsc#1101474).\n- CVE-2018-13870: Fixed heap-based buffer over-read in the function H5O_link_decode in H5Olink.c (bsc#1101493).\n- CVE-2018-13869: Fixed memcpy parameter overlap in the function H5O_link_decode in H5Olink.c (bsc#1101495).\n- CVE-2018-11207: Fixed division by zero was discovered in H5D__chunk_init in H5Dchunk.c (bsc#1093653).\n- CVE-2018-11206: Fixed out of bounds read in H5O_fill_new_decode and H5O_fill_old_decode in H5Ofill.c (bsc#1093657).\n- CVE-2018-11204: Fixed NULL pointer dereference in H5O__chunk_deserialize in H5Ocache.c (bsc#1093655).\n- CVE-2018-11203: Fixed division by zero in H5D__btree_decode_key in H5Dbtree.c (bsc#1093649).\n- CVE-2018-11202: Fixed NULL pointer dereference in H5S_hyper_make_spans in H5Shyper.c (bsc#1093641).\n- CVE-2017-17509: Fixed out of bounds write vulnerability in function H5G__ent_decode_vec (bsc#1072111).\n- CVE-2017-17508: Fixed divide-by-zero vulnerability in function H5T_set_loc (bsc#1072108).\n- CVE-2017-17506: Fixed out of bounds read in the function H5Opline_pline_decode (bsc#1072090).\n- CVE-2017-17505: Fixed NULL pointer dereference in the function H5O_pline_decode (bsc#1072087).\n\nBugfixes:\n\n- Expand modules handling (bsc#1116458).\n- Fix default moduleversion link generation and deletion (bsc#1124509).\n- Set higher constraints for succesfull mpich tests (bsc#1133222).\n- Only build one examples package for all flavors, do not include dependencies as these would be flavor specific (bsc#1088547).\n- Prepend PKG_CONFIG_PATH in modules file (bsc#1080426).\n- Validate Python 3 code (bsc#1082209).\n- Fix library link flags on pkg-config file for HPC builds (bsc#1134298).\n- Fix .so number in baselibs.conf for libhdf5_fortran libs (bsc#1169793).\n- Fix python-h5py packages built against out-of-date version of HDF5 (bsc#1196682).\n- Fix netcdf-cxx4 packages built against out-of-date version of HDF5 (bsc#1179521).\n- Make module files package arch dependent: it contains arch-dependent paths (bsc#1080442).\n- Disable %check stage for mpich builds on s390(x) (bsc#1080022).\n- Add build support for gcc10 to HPC build (bsc#1174439). \n- Fix summary in module files (bsc#1080259).\n- Append a newline to the shebang line prepended by the %hpc_shebang_prepend_list macro (bsc#1084951).\n- Temporarily disable make check for PowerPC (bsc#1058563).\n- Fix HPC library master packages dependency: make it require the correct flavor (bsc#1091237).\n- Add HPC support for gcc8 and gcc9 (jsc#SLE-7766 \u0026 jsc#SLE-8604).\n- Enable openmpi3 builds for Leap and SLE \u003e 15.1 (jsc#SLE-7773).\n- HDF5 version Update to 1.10.5 (jsc#SLE-8501).\n- Add support for openmpi2 for HPC (FATE#325089).\n- Initial version (FATE#320596).\n","status":"published","published":"2022-06-03T09:51:34Z","modified":"2026-02-04T03:57:33.435913Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2024:0538-1","title":"Security update for hdf5","description":"This update for hdf5 fixes the following issues:\n\nUpdated to version 1.10.11\n\n  * Changed the error handling for a not found path in the find\n    plugin process.\n  * Fixed CVE-2018-11202, a malformed file could result in chunk\n    index memory leaks.\n  * Fixed a file space allocation bug in the parallel library for\n    chunked datasets.\n  * Fixed an assertion failure in Parallel HDF5 when a file can't\n    be created due to an invalid library version bounds setting.\n  * Fixed an assertion in a previous fix for CVE-2016-4332.\n  * Fixed segfault on file close in h5debug which fails with a core\n    dump on a file that has an illegal file size in its cache image.\n    Fixes HDFFV-11052, CVE-2020-10812.\n  * Fixed memory leaks that could occur when reading a dataset from\n    a malformed file.\n  * Fixed a bug in H5Ocopy that could generate invalid HDF5 files\n  * Fixed potential heap buffer overflow in decoding of link info\n    message.\n  * Fixed potential buffer overrun issues in some object header\n    decode routines.\n  * Fixed a heap buffer overflow that occurs when reading from\n    a dataset with a compact layout within a malformed HDF5 file.\n  * Fixed CVE-2019-8396, malformed HDF5 files where content does\n    not match expected size.\n  * Fixed memory leak when running h5dump with proof of\n    vulnerability file.\n  * Added option --no-compact-subset to h5diff.\n\nFixes since 1.10.10:\n\n  * Fixed a memory corruption when reading from dataset using a\n    hyperslab selection in file dataspace and a point selection\n    memory dataspace.\n  * Fix CVE-2021-37501\n  * Fixed an issue with variable length attributes.\n  * Fixed an issue with hyperslab selections where an incorrect\n    combined selection was produced.\n  * Fixed an issue with attribute type conversion with compound\n    datatypes.\n  * Modified H5Fstart_swmr_write() to preserve DAPL properties.\n  * Converted an assertion on (possibly corrupt) file contents to\n    a normal error check.\n  * Fixed memory leak with variable-length fill value in\n    H5O_fill_convert().\n  * Fix h5repack to only print output when verbose option is\n    selected.\n\nFixes since 1.10.9:\n\n  * Several improvements to parallel compression feature,\n    including:\n    + Improved support for collective I/O (for both writes and\n      reads).\n    + Reduction of copying of application data buffers passed to\n      H5Dwrite.\n    + Addition of support for incremental file space allocation\n      for filtered datasets created in parallel.\n    + Addition of support for HDF5's 'don't filter partial edge\n      chunks' flag\n    + Addition of proper support for HDF5 fill values with the\n      feature.\n    + Addition of 'H5_HAVE_PARALLEL_FILTERED_WRITES' macro to\n      H5pubconf.h\n      so HDF5 applications can determine at compile-time whether\n      the feature is available.\n    + Addition of simple examples\n  * h5repack added an optional verbose value for reporting R/W\n    timing.\n  * Fixed a metadata cache bug when resizing a pinned/protected\n    cache entry.\n  * Fixed a problem with the H5_VERS_RELEASE check in the\n    H5check_version function.\n  * Unified handling of collective metadata reads to correctly fix\n    old bugs.\n  * Fixed several potential MPI deadlocks in library failure\n    conditions.\n  * Fixed an issue with collective metadata reads being permanently\n    disabled after a dataset chunk lookup operation.\n","status":"published","published":"2024-02-20T13:43:58Z","modified":"2026-02-04T04:16:19.128147Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0882-1","title":"Security update for hdf5","description":"This update for hdf5 fixes the following issues:\n\nUpdated to version 1.10.11\n\n  * Changed the error handling for a not found path in the find\n    plugin process.\n  * Fixed CVE-2018-11202, a malformed file could result in chunk\n    index memory leaks.\n  * Fixed a file space allocation bug in the parallel library for\n    chunked datasets.\n  * Fixed an assertion failure in Parallel HDF5 when a file can't\n    be created due to an invalid library version bounds setting.\n  * Fixed an assertion in a previous fix for CVE-2016-4332.\n  * Fixed segfault on file close in h5debug which fails with a core\n    dump on a file that has an illegal file size in its cache image.\n    Fixes HDFFV-11052, CVE-2020-10812.\n  * Fixed memory leaks that could occur when reading a dataset from\n    a malformed file.\n  * Fixed a bug in H5Ocopy that could generate invalid HDF5 files\n  * Fixed potential heap buffer overflow in decoding of link info\n    message.\n  * Fixed potential buffer overrun issues in some object header\n    decode routines.\n  * Fixed a heap buffer overflow that occurs when reading from\n    a dataset with a compact layout within a malformed HDF5 file.\n  * Fixed CVE-2019-8396, malformed HDF5 files where content does\n    not match expected size.\n  * Fixed memory leak when running h5dump with proof of\n    vulnerability file.\n  * Added option --no-compact-subset to h5diff.\n\nFixes since 1.10.10:\n\n  * Fixed a memory corruption when reading from dataset using a\n    hyperslab selection in file dataspace and a point selection\n    memory dataspace.\n  * Fix CVE-2021-37501\n  * Fixed an issue with variable length attributes.\n  * Fixed an issue with hyperslab selections where an incorrect\n    combined selection was produced.\n  * Fixed an issue with attribute type conversion with compound\n    datatypes.\n  * Modified H5Fstart_swmr_write() to preserve DAPL properties.\n  * Converted an assertion on (possibly corrupt) file contents to\n    a normal error check.\n  * Fixed memory leak with variable-length fill value in\n    H5O_fill_convert().\n  * Fix h5repack to only print output when verbose option is\n    selected.\n\nFixes since 1.10.9:\n\n  * Several improvements to parallel compression feature,\n    including:\n    + Improved support for collective I/O (for both writes and\n      reads).\n    + Reduction of copying of application data buffers passed to\n      H5Dwrite.\n    + Addition of support for incremental file space allocation\n      for filtered datasets created in parallel.\n    + Addition of support for HDF5's 'don't filter partial edge\n      chunks' flag\n    + Addition of proper support for HDF5 fill values with the\n      feature.\n    + Addition of 'H5_HAVE_PARALLEL_FILTERED_WRITES' macro to\n      H5pubconf.h\n      so HDF5 applications can determine at compile-time whether\n      the feature is available.\n    + Addition of simple examples\n  * h5repack added an optional verbose value for reporting R/W\n    timing.\n  * Fixed a metadata cache bug when resizing a pinned/protected\n    cache entry.\n  * Fixed a problem with the H5_VERS_RELEASE check in the\n    H5check_version function.\n  * Unified handling of collective metadata reads to correctly fix\n    old bugs.\n  * Fixed several potential MPI deadlocks in library failure\n    conditions.\n  * Fixed an issue with collective metadata reads being permanently\n    disabled after a dataset chunk lookup operation.\n\n- Remove timestamp/buildhost/kernel version from libhdf5.settings (bsc#1209548).\n\n- set higher constraints for succesfull mpich tests (bsc#133222)","status":"published","published":"2024-03-14T10:33:28Z","modified":"2026-02-04T02:36:13.577796Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:3144-1","title":"Security update for hdf5, netcdf, trilinos ","description":"This update for hdf5, netcdf, trilinos fixes the following issues:\n\nhdf5 was updated from version 1.10.8 to 1.10.11:\n\n- Security issues fixed:\n\n  * CVE-2019-8396: Fixed problems with malformed HDF5 files where content does not match expected size. (bsc#1125882)\n  * CVE-2018-11202: Fixed that a malformed file could result in chunk index memory leaks. (bsc#1093641)\n  * CVE-2016-4332: Fixed an assertion in a previous fix for this issue (bsc#1011205).\n  * CVE-2020-10812: Fixed a segfault on file close in h5debug which fails with a core dump on a file that has an illegal\n    file size in its cache image.Fixes HDFFV-11052, (bsc#1167400).\n  * CVE-2021-37501: Fixed buffer overflow in hdf5-h5dump (bsc#1207973)\n  * Other security issues fixed (bsc#1224158):\n\n    +  CVE-2024-29158, CVE-2024-29161, CVE-2024-29166, CVE-2024-32608,\n    +  CVE-2024-32610, CVE-2024-32614, CVE-2024-32619, CVE-2024-32620,\n    +  CVE-2024-33873, CVE-2024-33874, CVE-2024-33875\n    +  Additionally, these fixes resolve crashes triggered by the\n       reproducers for CVE-2017-17507, CVE-2018-11205. These crashes\n       appear to be unrelated to the original problems\n\n- Other issues fixed:\n\n  * Remove timestamp/buildhost/kernel version from libhdf5.settings (bsc#1209548)\n  * Changed the error handling for a not found path in the find plugin process.\n  * Fixed a file space allocation bug in the parallel library for chunked datasets.\n  * Fixed an assertion failure in Parallel HDF5 when a file can't be created due to an invalid library version bounds\n    setting.\n  * Fixed memory leaks that could occur when reading a dataset from a malformed file.\n  * Fixed a bug in H5Ocopy that could generate invalid HDF5 files\n  * Fixed potential heap buffer overflow in decoding of link info message.\n  * Fixed potential buffer overrun issues in some object header decode routines.\n  * Fixed a heap buffer overflow that occurs when reading from a dataset with a compact layout within a malformed HDF5\n    file.\n  * Fixed memory leak when running h5dump with proof of vulnerability file.\n  * Added option --no-compact-subset to h5diff\n  * Several improvements to parallel compression feature, including:\n\n    + Improved support for collective I/O (for both writes and reads).\n    + Reduction of copying of application data buffers passed to H5Dwrite.\n    + Addition of support for incremental file space allocation for filtered datasets created in parallel.\n    + Addition of support for HDF5's 'don't filter partial edge chunks' flag\n    + Addition of proper support for HDF5 fill values with the feature.\n    + Addition of 'H5_HAVE_PARALLEL_FILTERED_WRITES' macro toH5pubconf.h so HDF5 applications can determine at\n      compile-time whether the feature is available.\n    + Addition of simple examples\n\n  * h5repack added an optional verbose value for reporting R/W timing.\n  * Fixed a metadata cache bug when resizing a pinned/protected cache entry.\n  * Fixed a problem with the H5_VERS_RELEASE check in the H5check_version function.\n  * Unified handling of collective metadata reads to correctly fix old bugs.\n  * Fixed several potential MPI deadlocks in library failure conditions.\n  * Fixed an issue with collective metadata reads being permanently disabled after a dataset chunk lookup operation.\n\nnetcdf was updated to fix:\n\n- rebuild against new hdf5 library version.\n\ntrilinos was updated to fix:\n\n- Rebuild against new hdf5 library version.\n- Fix dependency in module file for MPI version of Trilinos to depend on the correct version of netcdf (bsc#1210049).\n  This prevents the error message:\n  'Lmod has detected the following error: These module(s) or\n   extension(s) exist but cannot be loaded as requested: 'trilinos'\n","status":"published","published":"2024-09-05T06:31:59Z","modified":"2026-02-04T03:54:00.430805Z","updated_at":"2026-11-02T15:53:55.136363Z"}]}}