{"id":"CVE-2018-13869","aliases":["DEBIAN-CVE-2018-13869","EUVD-2018-5803","GHSA-837v-w7pw-f87j","SUSE-SU-2022:1903-1","SUSE-SU-2022:1910-1","SUSE-SU-2022:1911-1","SUSE-SU-2022:1933-1","UBUNTU-CVE-2018-13869"],"status":"published","title":"An issue was discovered in the HDF HDF5 1.8.20 library. There is a memcpy parameter overlap in...","description":"An issue was discovered in the HDF HDF5 1.8.20 library. There is a memcpy parameter overlap in the function H5O_link_decode in H5Olink.c.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01997,"percentile":0.8086,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2018-07-10T21:00:00Z","modified":"2026-10-24T10:31:01Z","fixes":[{"ecosystem":"Debian:12","package":"hdf5","fixed_in":["1.10.7+repack-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"hdf5","fixed_in":["1.10.7+repack-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"hdf5","fixed_in":["1.10.7+repack-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"hdf5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.7+repack-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"hdf5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.7+repack-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"hdf5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.7+repack-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"hdf5_1_10_8-gnu-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150100.7.4.3"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"hdf5_1_10_8-gnu-mpich-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150100.7.4.3"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"hdf5_1_10_8-gnu-mvapich2-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150100.7.4.3"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"hdf5_1_10_8-gnu-openmpi2-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150100.7.4.3"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"hdf5_1_10_8-gnu-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150100.7.4.3"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"hdf5_1_10_8-gnu-mpich-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150100.7.4.3"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"hdf5_1_10_8-gnu-mvapich2-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150100.7.4.3"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"hdf5_1_10_8-gnu-openmpi2-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150100.7.4.3"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"hdf5_1_10_8-gnu-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150200.8.4.2"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"hdf5_1_10_8-gnu-mpich-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150200.8.4.3"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"hdf5_1_10_8-gnu-mvapich2-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150200.8.4.2"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"hdf5_1_10_8-gnu-openmpi2-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150200.8.4.2"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"hdf5_1_10_8-gnu-openmpi3-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150200.8.4.2"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"hdf5_1_10_8-gnu-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150200.8.4.2"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"hdf5_1_10_8-gnu-mpich-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150200.8.4.3"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"hdf5_1_10_8-gnu-mvapich2-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150200.8.4.2"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"hdf5_1_10_8-gnu-openmpi2-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150200.8.4.2"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"hdf5_1_10_8-gnu-openmpi3-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150200.8.4.2"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"hdf5_1_10_8-gnu-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150000.8.4.3"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"hdf5_1_10_8-gnu-mpich-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150000.8.4.3"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"hdf5_1_10_8-gnu-mvapich2-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150000.8.4.3"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"hdf5_1_10_8-gnu-openmpi2-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150000.8.4.3"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"suse-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.20220206.0c6b168-150000.11.3.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"hdf5_1_10_8-gnu-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150000.8.4.3"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"hdf5_1_10_8-gnu-mpich-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150000.8.4.3"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"hdf5_1_10_8-gnu-mvapich2-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150000.8.4.3"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"hdf5_1_10_8-gnu-openmpi2-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150000.8.4.3"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"suse-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.20220206.0c6b168-150000.11.3.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 12","package":"hdf5_1_10_8-gnu-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-3.12.2"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 12","package":"hdf5_1_10_8-gnu-mvapich2-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-3.12.2"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 12","package":"hdf5_1_10_8-gnu-openmpi1-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-3.12.2"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 12","package":"suse-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.20220206.0c6b168-5.2"}]}],"bundled":27},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"hdf5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.11-3ubuntu1","1.8.11-5ubuntu1","1.8.11-5ubuntu2","1.8.11-5ubuntu6","1.8.11-5ubuntu7","1.8.11-5ubuntu7.1","1.8.11-5ubuntu7.1+esm1","1.8.11-5ubuntu7.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"hdf5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.15-patch1+docs-4","1.8.15-patch1+docs-5","1.8.16+docs-1","1.8.16+docs-2","1.8.16+docs-3","1.8.16+docs-3ubuntu1","1.8.16+docs-4","1.8.16+docs-4ubuntu1","1.8.16+docs-4ubuntu1.1","1.8.16+docs-4ubuntu1.1+esm1","1.8.16+docs-4ubuntu1.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"hdf5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.0-patch1+docs-4","1.10.0-patch1+docs-4ubuntu0.1~esm1","1.10.0-patch1+docs-4ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"hdf5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.4+repack-10","1.10.4+repack-11","1.10.4+repack-11ubuntu1","1.10.4+repack-11ubuntu1+esm1"]}],"products":[{"vendor":"hdfgroup","product":"hdf5"}],"references":[{"url":"https://github.com/TeamSeri0us/pocs/tree/master/hdf5","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-13869"},{"url":"https://github.com/advisories/GHSA-837v-w7pw-f87j"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-13869","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221903-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1072087","tags":["report"]},{"url":"https://bugzilla.suse.com/1072090","tags":["report"]},{"url":"https://bugzilla.suse.com/1072108","tags":["report"]},{"url":"https://bugzilla.suse.com/1072111","tags":["report"]},{"url":"https://bugzilla.suse.com/1093641","tags":["report"]},{"url":"https://bugzilla.suse.com/1093649","tags":["report"]},{"url":"https://bugzilla.suse.com/1093653","tags":["report"]},{"url":"https://bugzilla.suse.com/1093655","tags":["report"]},{"url":"https://bugzilla.suse.com/1093657","tags":["report"]},{"url":"https://bugzilla.suse.com/1101471","tags":["report"]},{"url":"https://bugzilla.suse.com/1101474","tags":["report"]},{"url":"https://bugzilla.suse.com/1101493","tags":["report"]},{"url":"https://bugzilla.suse.com/1101495","tags":["report"]},{"url":"https://bugzilla.suse.com/1102175","tags":["report"]},{"url":"https://bugzilla.suse.com/1109166","tags":["report"]},{"url":"https://bugzilla.suse.com/1109167","tags":["report"]},{"url":"https://bugzilla.suse.com/1109168","tags":["report"]},{"url":"https://bugzilla.suse.com/1109564","tags":["report"]},{"url":"https://bugzilla.suse.com/1109565","tags":["report"]},{"url":"https://bugzilla.suse.com/1109566","tags":["report"]},{"url":"https://bugzilla.suse.com/1109567","tags":["report"]},{"url":"https://bugzilla.suse.com/1109568","tags":["report"]},{"url":"https://bugzilla.suse.com/1109569","tags":["report"]},{"url":"https://bugzilla.suse.com/1109570","tags":["report"]},{"url":"https://bugzilla.suse.com/1134298","tags":["report"]},{"url":"https://bugzilla.suse.com/1167401","tags":["report"]},{"url":"https://bugzilla.suse.com/1167404","tags":["report"]},{"url":"https://bugzilla.suse.com/1167405","tags":["report"]},{"url":"https://bugzilla.suse.com/1169793","tags":["report"]},{"url":"https://bugzilla.suse.com/1174439","tags":["report"]},{"url":"https://bugzilla.suse.com/1179521","tags":["report"]},{"url":"https://bugzilla.suse.com/1196682","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11202","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-13869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-13870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10811","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221910-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221911-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1116458","tags":["report"]},{"url":"https://bugzilla.suse.com/1124509","tags":["report"]},{"url":"https://bugzilla.suse.com/1133222","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221933-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1058563","tags":["report"]},{"url":"https://bugzilla.suse.com/1080022","tags":["report"]},{"url":"https://bugzilla.suse.com/1080259","tags":["report"]},{"url":"https://bugzilla.suse.com/1080426","tags":["report"]},{"url":"https://bugzilla.suse.com/1080442","tags":["report"]},{"url":"https://bugzilla.suse.com/1082209","tags":["report"]},{"url":"https://bugzilla.suse.com/1084951","tags":["report"]},{"url":"https://bugzilla.suse.com/1088547","tags":["report"]},{"url":"https://bugzilla.suse.com/1091237","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-13869","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-13869","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-13869","description":"An issue was discovered in the HDF HDF5 1.8.20 library. There is a memcpy parameter overlap in the function H5O_link_decode in H5Olink.c.","status":"published","published":"2018-07-10T21:00:00Z","modified":"2024-09-17T00:41:53.99Z","updated_at":"2026-11-02T14:35:07.01498Z"}],"euvd":[{"id":"EUVD-2018-5803","description":"An issue was discovered in the HDF HDF5 1.8.20 library. There is a memcpy parameter overlap in the function H5O_link_decode in H5Olink.c.","status":"published","published":"2018-07-10T21:00:00Z","modified":"2024-09-17T00:41:53Z","updated_at":"2026-11-03T00:28:56.965297Z"}],"ghsa":[{"id":"GHSA-837v-w7pw-f87j","title":"An issue was discovered in the HDF HDF5 1.8.20 library. There is a memcpy parameter overlap in...","description":"An issue was discovered in the HDF HDF5 1.8.20 library. There is a memcpy parameter overlap in the function H5O_link_decode in H5Olink.c.","status":"published","published":"2022-05-14T03:01:57Z","modified":"2023-02-02T05:07:06Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:52:25.892644Z"}],"nvd":[{"id":"CVE-2018-13869","description":"An issue was discovered in the HDF HDF5 1.8.20 library. There is a memcpy parameter overlap in the function H5O_link_decode in H5Olink.c.","status":"published","published":"2018-07-10T21:29:00.403Z","modified":"2026-06-17T01:40:17.747Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:04:32.929986Z"}],"osv":[{"id":"CVE-2018-13869","description":"An issue was discovered in the HDF HDF5 1.8.20 library. There is a memcpy parameter overlap in the function H5O_link_decode in H5Olink.c.","status":"published","published":"2018-07-10T21:29:00.403Z","modified":"2026-10-24T10:31:01.091436202Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:08.242347Z"},{"id":"DEBIAN-CVE-2018-13869","description":"An issue was discovered in the HDF HDF5 1.8.20 library. There is a memcpy parameter overlap in the function H5O_link_decode in H5Olink.c.","status":"published","published":"2018-07-10T21:29:00.403Z","modified":"2026-10-23T18:02:58.817287233Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:30.290351Z"},{"id":"UBUNTU-CVE-2018-13869","description":"An issue was discovered in the HDF HDF5 1.8.20 library. There is a memcpy parameter overlap in the function H5O_link_decode in H5Olink.c.","status":"published","published":"2018-07-10T21:29:00Z","modified":"2026-04-22T11:44:51.473821Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:17.014176Z"},{"id":"SUSE-SU-2022:1903-1","title":"Security update for hdf5","description":"This update for hdf5 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2020-10811: Fixed heap-based buffer over-read in the function H5O__layout_decode() located in H5Olayout.c (bsc#1167405).\n- CVE-2020-10810: Fixed NULL pointer dereference in the function H5AC_unpin_entry() located in H5AC.c (bsc#1167401).\n- CVE-2020-10809: Fixed heap-based buffer overflow in the function Decompress() located in decompress.c (bsc#1167404).\n- CVE-2018-17438: Fixed SIGFPE signal raise in the function H5D__select_io() of H5Dselect.c (bsc#1109570).\n- CVE-2018-17437: Fixed memory leak in the H5O_dtype_decode_helper() function in H5Odtype.c. (bsc#1109569).\n- CVE-2018-17436: Fixed issue in ReadCode() in decompress.c that allowed attackers to cause a denial of service via a crafted HDF5 file (bsc#1109568).\n- CVE-2018-17435: Fixed heap-based buffer over-read in H5O_attr_decode() in H5Oattr.c (bsc#1109567).\n- CVE-2018-17434: Fixed SIGFPE signal raise in function apply_filters() of h5repack_filters.c (bsc#1109566).\n- CVE-2018-17433: Fixed heap-based buffer overflow in ReadGifImageDesc() in gifread.c (bsc#1109565).\n- CVE-2018-17432: Fixed NULL pointer dereference in H5O_sdspace_encode() in H5Osdspace.c (bsc#1109564).\n- CVE-2018-17237: Fixed SIGFPE signal raise in the function H5D__chunk_set_info_real() (bsc#1109168).\n- CVE-2018-17234: Fixed memory leak in the H5O__chunk_deserialize() function in H5Ocache.c (bsc#1109167).\n- CVE-2018-17233: Fixed SIGFPE signal is raise in the function H5D__create_chunk_file_map_hyper (bsc#1109166).\n- CVE-2018-14460: Fixed heap-based buffer over-read in the function H5O_sdspace_decode in H5Osdspace.c (bsc#1102175).\n- CVE-2018-14033: Fixed heap-based buffer over-read in the function H5O_layout_decode in H5Olayout.c (bsc#1101471).\n- CVE-2018-14032: Fixed heap-based buffer over-read in the function H5O_fill_new_decode in H5Ofill.c (bsc#1101474).\n- CVE-2018-13870: Fixed heap-based buffer over-read in the function H5O_link_decode in H5Olink.c (bsc#1101493).\n- CVE-2018-13869: Fixed memcpy parameter overlap in the function H5O_link_decode in H5Olink.c (bsc#1101495).\n- CVE-2018-11207: Fixed division by zero was discovered in H5D__chunk_init in H5Dchunk.c (bsc#1093653).\n- CVE-2018-11206: Fixed out of bounds read in H5O_fill_new_decode and H5O_fill_old_decode in H5Ofill.c (bsc#1093657).\n- CVE-2018-11204: Fixed NULL pointer dereference in H5O__chunk_deserialize in H5Ocache.c (bsc#1093655).\n- CVE-2018-11203: Fixed division by zero in H5D__btree_decode_key in H5Dbtree.c (bsc#1093649).\n- CVE-2018-11202: Fixed NULL pointer dereference in H5S_hyper_make_spans in H5Shyper.c (bsc#1093641).\n- CVE-2017-17509: Fixed out of bounds write vulnerability in function H5G__ent_decode_vec (bsc#1072111).\n- CVE-2017-17508: Fixed divide-by-zero vulnerability in function H5T_set_loc (bsc#1072108).\n- CVE-2017-17506: Fixed out of bounds read in the function H5Opline_pline_decode (bsc#1072090).\n- CVE-2017-17505: Fixed NULL pointer dereference in the function H5O_pline_decode (bsc#1072087).\n\nBugfixes:\n\n- Fix library link flags on pkg-config file for HPC builds (bsc#1134298).\n- Fix .so number in baselibs.conf for libhdf5_fortran libs (bsc#1169793).\n- Fix python-h5py packages built against out-of-date version of HDF5 (bsc#1196682).\n- Fix netcdf-cxx4 packages built against out-of-date version of HDF5 (bsc#1179521).\n- Add build support for gcc10 to HPC build (bsc#1174439).\n- Add HPC support for gcc8 and gcc9 (jsc#SLE-7766 \u0026 jsc#SLE-8604).\n- Enable openmpi3 builds for Leap and SLE \u003e 15.1 (jsc#SLE-7773).\n- HDF5 version Update to 1.10.5 (jsc#SLE-8501).\n","status":"published","published":"2022-06-01T09:04:18Z","modified":"2026-02-04T02:34:42.316951Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1910-1","title":"Security update for hdf5","description":"This update for hdf5 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2020-10811: Fixed heap-based buffer over-read in the function H5O__layout_decode() located in H5Olayout.c (bsc#1167405).\n- CVE-2020-10810: Fixed NULL pointer dereference in the function H5AC_unpin_entry() located in H5AC.c (bsc#1167401).\n- CVE-2020-10809: Fixed heap-based buffer overflow in the function Decompress() located in decompress.c (bsc#1167404).\n- CVE-2018-17438: Fixed SIGFPE signal raise in the function H5D__select_io() of H5Dselect.c (bsc#1109570).\n- CVE-2018-17437: Fixed memory leak in the H5O_dtype_decode_helper() function in H5Odtype.c. (bsc#1109569).\n- CVE-2018-17436: Fixed issue in ReadCode() in decompress.c that allowed attackers to cause a denial of service via a crafted HDF5 file (bsc#1109568).\n- CVE-2018-17435: Fixed heap-based buffer over-read in H5O_attr_decode() in H5Oattr.c (bsc#1109567).\n- CVE-2018-17434: Fixed SIGFPE signal raise in function apply_filters() of h5repack_filters.c (bsc#1109566).\n- CVE-2018-17433: Fixed heap-based buffer overflow in ReadGifImageDesc() in gifread.c (bsc#1109565).\n- CVE-2018-17432: Fixed NULL pointer dereference in H5O_sdspace_encode() in H5Osdspace.c (bsc#1109564).\n- CVE-2018-17237: Fixed SIGFPE signal raise in the function H5D__chunk_set_info_real() (bsc#1109168).\n- CVE-2018-17234: Fixed memory leak in the H5O__chunk_deserialize() function in H5Ocache.c (bsc#1109167).\n- CVE-2018-17233: Fixed SIGFPE signal is raise in the function H5D__create_chunk_file_map_hyper (bsc#1109166).\n- CVE-2018-14460: Fixed heap-based buffer over-read in the function H5O_sdspace_decode in H5Osdspace.c (bsc#1102175).\n- CVE-2018-14033: Fixed heap-based buffer over-read in the function H5O_layout_decode in H5Olayout.c (bsc#1101471).\n- CVE-2018-14032: Fixed heap-based buffer over-read in the function H5O_fill_new_decode in H5Ofill.c (bsc#1101474).\n- CVE-2018-13870: Fixed heap-based buffer over-read in the function H5O_link_decode in H5Olink.c (bsc#1101493).\n- CVE-2018-13869: Fixed memcpy parameter overlap in the function H5O_link_decode in H5Olink.c (bsc#1101495).\n- CVE-2018-11207: Fixed division by zero was discovered in H5D__chunk_init in H5Dchunk.c (bsc#1093653).\n- CVE-2018-11206: Fixed out of bounds read in H5O_fill_new_decode and H5O_fill_old_decode in H5Ofill.c (bsc#1093657).\n- CVE-2018-11204: Fixed NULL pointer dereference in H5O__chunk_deserialize in H5Ocache.c (bsc#1093655).\n- CVE-2018-11203: Fixed division by zero in H5D__btree_decode_key in H5Dbtree.c (bsc#1093649).\n- CVE-2018-11202: Fixed NULL pointer dereference in H5S_hyper_make_spans in H5Shyper.c (bsc#1093641).\n- CVE-2017-17509: Fixed out of bounds write vulnerability in function H5G__ent_decode_vec (bsc#1072111).\n- CVE-2017-17508: Fixed divide-by-zero vulnerability in function H5T_set_loc (bsc#1072108).\n- CVE-2017-17506: Fixed out of bounds read in the function H5Opline_pline_decode (bsc#1072090).\n- CVE-2017-17505: Fixed NULL pointer dereference in the function H5O_pline_decode (bsc#1072087).\n\nBugfixes:\n\n- Fix python-h5py packages built against out-of-date version of HDF5 (bsc#1196682).\n- Fix netcdf-cxx4 packages built against out-of-date version of HDF5 (bsc#1179521).\n- Add build support for gcc10 to HPC build (bsc#1174439).\n","status":"published","published":"2022-06-01T15:24:23Z","modified":"2026-02-04T03:49:17.463493Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1911-1","title":"Security update for hdf5, suse-hpc","description":"This update for hdf5, suse-hpc fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2020-10811: Fixed heap-based buffer over-read in the function H5O__layout_decode() located in H5Olayout.c (bsc#1167405).\n- CVE-2020-10810: Fixed NULL pointer dereference in the function H5AC_unpin_entry() located in H5AC.c (bsc#1167401).\n- CVE-2020-10809: Fixed heap-based buffer overflow in the function Decompress() located in decompress.c (bsc#1167404).\n- CVE-2018-17438: Fixed SIGFPE signal raise in the function H5D__select_io() of H5Dselect.c (bsc#1109570).\n- CVE-2018-17437: Fixed memory leak in the H5O_dtype_decode_helper() function in H5Odtype.c. (bsc#1109569).\n- CVE-2018-17436: Fixed issue in ReadCode() in decompress.c that allowed attackers to cause a denial of service via a crafted HDF5 file (bsc#1109568).\n- CVE-2018-17435: Fixed heap-based buffer over-read in H5O_attr_decode() in H5Oattr.c (bsc#1109567).\n- CVE-2018-17434: Fixed SIGFPE signal raise in function apply_filters() of h5repack_filters.c (bsc#1109566).\n- CVE-2018-17433: Fixed heap-based buffer overflow in ReadGifImageDesc() in gifread.c (bsc#1109565).\n- CVE-2018-17432: Fixed NULL pointer dereference in H5O_sdspace_encode() in H5Osdspace.c (bsc#1109564).\n- CVE-2018-17237: Fixed SIGFPE signal raise in the function H5D__chunk_set_info_real() (bsc#1109168).\n- CVE-2018-17234: Fixed memory leak in the H5O__chunk_deserialize() function in H5Ocache.c (bsc#1109167).\n- CVE-2018-17233: Fixed SIGFPE signal is raise in the function H5D__create_chunk_file_map_hyper (bsc#1109166).\n- CVE-2018-14460: Fixed heap-based buffer over-read in the function H5O_sdspace_decode in H5Osdspace.c (bsc#1102175).\n- CVE-2018-14033: Fixed heap-based buffer over-read in the function H5O_layout_decode in H5Olayout.c (bsc#1101471).\n- CVE-2018-14032: Fixed heap-based buffer over-read in the function H5O_fill_new_decode in H5Ofill.c (bsc#1101474).\n- CVE-2018-13870: Fixed heap-based buffer over-read in the function H5O_link_decode in H5Olink.c (bsc#1101493).\n- CVE-2018-13869: Fixed memcpy parameter overlap in the function H5O_link_decode in H5Olink.c (bsc#1101495).\n- CVE-2018-11207: Fixed division by zero was discovered in H5D__chunk_init in H5Dchunk.c (bsc#1093653).\n- CVE-2018-11206: Fixed out of bounds read in H5O_fill_new_decode and H5O_fill_old_decode in H5Ofill.c (bsc#1093657).\n- CVE-2018-11204: Fixed NULL pointer dereference in H5O__chunk_deserialize in H5Ocache.c (bsc#1093655).\n- CVE-2018-11203: Fixed division by zero in H5D__btree_decode_key in H5Dbtree.c (bsc#1093649).\n- CVE-2018-11202: Fixed NULL pointer dereference in H5S_hyper_make_spans in H5Shyper.c (bsc#1093641).\n- CVE-2017-17509: Fixed out of bounds write vulnerability in function H5G__ent_decode_vec (bsc#1072111).\n- CVE-2017-17508: Fixed divide-by-zero vulnerability in function H5T_set_loc (bsc#1072108).\n- CVE-2017-17506: Fixed out of bounds read in the function H5Opline_pline_decode (bsc#1072090).\n- CVE-2017-17505: Fixed NULL pointer dereference in the function H5O_pline_decode (bsc#1072087).\n\nBugfixes:\n\n- Expand modules handling (bsc#1116458).\n- Fix default moduleversion link generation and deletion (bsc#1124509).\n- Set higher constraints for succesfull mpich tests (bsc#1133222).\n- Fix library link flags on pkg-config file for HPC builds (bsc#1134298).\n- Fix .so number in baselibs.conf for libhdf5_fortran libs (bsc#1169793).\n- Fix python-h5py packages built against out-of-date version of HDF5 (bsc#1196682).\n- Fix netcdf-cxx4 packages built against out-of-date version of HDF5 (bsc#1179521).\n- Add build support for gcc10 to HPC build (bsc#1174439).\n- Add HPC support for gcc8 and gcc9 (jsc#SLE-7766 \u0026 jsc#SLE-8604).\n- Enable openmpi3 builds for Leap and SLE \u003e 15.1 (jsc#SLE-7773).\n- HDF5 version Update to 1.10.5 (jsc#SLE-8501).\n","status":"published","published":"2022-06-02T07:54:26Z","modified":"2026-02-04T03:01:25.980159Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1933-1","title":"Security update for hdf5, suse-hpc","description":"This update for hdf5, suse-hpc fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2020-10811: Fixed heap-based buffer over-read in the function H5O__layout_decode() located in H5Olayout.c (bsc#1167405).\n- CVE-2020-10810: Fixed NULL pointer dereference in the function H5AC_unpin_entry() located in H5AC.c (bsc#1167401).\n- CVE-2020-10809: Fixed heap-based buffer overflow in the function Decompress() located in decompress.c (bsc#1167404).\n- CVE-2018-17438: Fixed SIGFPE signal raise in the function H5D__select_io() of H5Dselect.c (bsc#1109570).\n- CVE-2018-17437: Fixed memory leak in the H5O_dtype_decode_helper() function in H5Odtype.c. (bsc#1109569).\n- CVE-2018-17436: Fixed issue in ReadCode() in decompress.c that allowed attackers to cause a denial of service via a crafted HDF5 file (bsc#1109568).\n- CVE-2018-17435: Fixed heap-based buffer over-read in H5O_attr_decode() in H5Oattr.c (bsc#1109567).\n- CVE-2018-17434: Fixed SIGFPE signal raise in function apply_filters() of h5repack_filters.c (bsc#1109566).\n- CVE-2018-17433: Fixed heap-based buffer overflow in ReadGifImageDesc() in gifread.c (bsc#1109565).\n- CVE-2018-17432: Fixed NULL pointer dereference in H5O_sdspace_encode() in H5Osdspace.c (bsc#1109564).\n- CVE-2018-17237: Fixed SIGFPE signal raise in the function H5D__chunk_set_info_real() (bsc#1109168).\n- CVE-2018-17234: Fixed memory leak in the H5O__chunk_deserialize() function in H5Ocache.c (bsc#1109167).\n- CVE-2018-17233: Fixed SIGFPE signal is raise in the function H5D__create_chunk_file_map_hyper (bsc#1109166).\n- CVE-2018-14460: Fixed heap-based buffer over-read in the function H5O_sdspace_decode in H5Osdspace.c (bsc#1102175).\n- CVE-2018-14033: Fixed heap-based buffer over-read in the function H5O_layout_decode in H5Olayout.c (bsc#1101471).\n- CVE-2018-14032: Fixed heap-based buffer over-read in the function H5O_fill_new_decode in H5Ofill.c (bsc#1101474).\n- CVE-2018-13870: Fixed heap-based buffer over-read in the function H5O_link_decode in H5Olink.c (bsc#1101493).\n- CVE-2018-13869: Fixed memcpy parameter overlap in the function H5O_link_decode in H5Olink.c (bsc#1101495).\n- CVE-2018-11207: Fixed division by zero was discovered in H5D__chunk_init in H5Dchunk.c (bsc#1093653).\n- CVE-2018-11206: Fixed out of bounds read in H5O_fill_new_decode and H5O_fill_old_decode in H5Ofill.c (bsc#1093657).\n- CVE-2018-11204: Fixed NULL pointer dereference in H5O__chunk_deserialize in H5Ocache.c (bsc#1093655).\n- CVE-2018-11203: Fixed division by zero in H5D__btree_decode_key in H5Dbtree.c (bsc#1093649).\n- CVE-2018-11202: Fixed NULL pointer dereference in H5S_hyper_make_spans in H5Shyper.c (bsc#1093641).\n- CVE-2017-17509: Fixed out of bounds write vulnerability in function H5G__ent_decode_vec (bsc#1072111).\n- CVE-2017-17508: Fixed divide-by-zero vulnerability in function H5T_set_loc (bsc#1072108).\n- CVE-2017-17506: Fixed out of bounds read in the function H5Opline_pline_decode (bsc#1072090).\n- CVE-2017-17505: Fixed NULL pointer dereference in the function H5O_pline_decode (bsc#1072087).\n\nBugfixes:\n\n- Expand modules handling (bsc#1116458).\n- Fix default moduleversion link generation and deletion (bsc#1124509).\n- Set higher constraints for succesfull mpich tests (bsc#1133222).\n- Only build one examples package for all flavors, do not include dependencies as these would be flavor specific (bsc#1088547).\n- Prepend PKG_CONFIG_PATH in modules file (bsc#1080426).\n- Validate Python 3 code (bsc#1082209).\n- Fix library link flags on pkg-config file for HPC builds (bsc#1134298).\n- Fix .so number in baselibs.conf for libhdf5_fortran libs (bsc#1169793).\n- Fix python-h5py packages built against out-of-date version of HDF5 (bsc#1196682).\n- Fix netcdf-cxx4 packages built against out-of-date version of HDF5 (bsc#1179521).\n- Make module files package arch dependent: it contains arch-dependent paths (bsc#1080442).\n- Disable %check stage for mpich builds on s390(x) (bsc#1080022).\n- Add build support for gcc10 to HPC build (bsc#1174439). \n- Fix summary in module files (bsc#1080259).\n- Append a newline to the shebang line prepended by the %hpc_shebang_prepend_list macro (bsc#1084951).\n- Temporarily disable make check for PowerPC (bsc#1058563).\n- Fix HPC library master packages dependency: make it require the correct flavor (bsc#1091237).\n- Add HPC support for gcc8 and gcc9 (jsc#SLE-7766 \u0026 jsc#SLE-8604).\n- Enable openmpi3 builds for Leap and SLE \u003e 15.1 (jsc#SLE-7773).\n- HDF5 version Update to 1.10.5 (jsc#SLE-8501).\n- Add support for openmpi2 for HPC (FATE#325089).\n- Initial version (FATE#320596).\n","status":"published","published":"2022-06-03T09:51:34Z","modified":"2026-02-04T03:57:33.435913Z","updated_at":"2026-11-02T15:53:50.513981Z"}]}}