An update for hdf5 is now available for openEuler-22.03-LTS-SP3 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2024-2407 Final 1.0 1.0 2024-11-15 Initial 2024-11-15 2024-11-15 openEuler SA Tool V1.0 2024-11-15 hdf5 security update An update for hdf5 is now available for openEuler-22.03-LTS-SP3 HDF5 is a data model, library, and file format for storing and managing data. It supports an unlimited variety of datatypes, and is designed for flexible and efficient I/O and for high volume and complex data. HDF5 is portable and is extensible, allowing applications to evolve in their use of HDF5. The HDF5 Technology suite includes tools and applications for managing, manipulating, viewing, and analyzing data in the HDF5 format. Security Fix(es): HDF5 through 1.14.3 contains a buffer overflow in H5O__linfo_decode, resulting in the corruption of the instruction pointer and causing denial of service or potential code execution.(CVE-2024-29166) HDF5 Library through 1.14.3 may attempt to dereference uninitialized values in h5tools_str_sprint in tools/lib/h5tools_str.c (called from h5tools_dump_simple_data in tools/lib/h5tools_dump.c).(CVE-2024-32606) An update for hdf5 is now available for master/openEuler-20.03-LTS-SP4/openEuler-22.03-LTS-SP1/openEuler-22.03-LTS-SP3/openEuler-22.03-LTS-SP4/openEuler-24.03-LTS/openEuler-24.03-LTS-Next. openEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Medium hdf5 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2407 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-29166 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-32606 https://nvd.nist.gov/vuln/detail/CVE-2024-29166 https://nvd.nist.gov/vuln/detail/CVE-2024-32606 openEuler-22.03-LTS-SP3 hdf5-1.14.5-1.oe2203sp3.aarch64.rpm hdf5-debuginfo-1.14.5-1.oe2203sp3.aarch64.rpm hdf5-debugsource-1.14.5-1.oe2203sp3.aarch64.rpm hdf5-devel-1.14.5-1.oe2203sp3.aarch64.rpm hdf5-mpich-1.14.5-1.oe2203sp3.aarch64.rpm hdf5-mpich-devel-1.14.5-1.oe2203sp3.aarch64.rpm hdf5-mpich-static-1.14.5-1.oe2203sp3.aarch64.rpm hdf5-openmpi-1.14.5-1.oe2203sp3.aarch64.rpm hdf5-openmpi-devel-1.14.5-1.oe2203sp3.aarch64.rpm hdf5-openmpi-static-1.14.5-1.oe2203sp3.aarch64.rpm hdf5-1.14.5-1.oe2203sp3.src.rpm hdf5-1.14.5-1.oe2203sp3.x86_64.rpm hdf5-debuginfo-1.14.5-1.oe2203sp3.x86_64.rpm hdf5-debugsource-1.14.5-1.oe2203sp3.x86_64.rpm hdf5-devel-1.14.5-1.oe2203sp3.x86_64.rpm hdf5-mpich-1.14.5-1.oe2203sp3.x86_64.rpm hdf5-mpich-devel-1.14.5-1.oe2203sp3.x86_64.rpm hdf5-mpich-static-1.14.5-1.oe2203sp3.x86_64.rpm hdf5-openmpi-1.14.5-1.oe2203sp3.x86_64.rpm hdf5-openmpi-devel-1.14.5-1.oe2203sp3.x86_64.rpm hdf5-openmpi-static-1.14.5-1.oe2203sp3.x86_64.rpm HDF5 through 1.14.3 contains a buffer overflow in H5O__linfo_decode, resulting in the corruption of the instruction pointer and causing denial of service or potential code execution. 2024-11-15 CVE-2024-29166 openEuler-22.03-LTS-SP3 Medium 5.7 AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H hdf5 security update 2024-11-15 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2407 HDF5 Library through 1.14.3 may attempt to dereference uninitialized values in h5tools_str_sprint in tools/lib/h5tools_str.c (called from h5tools_dump_simple_data in tools/lib/h5tools_dump.c). 2024-11-15 CVE-2024-32606 openEuler-22.03-LTS-SP3 Medium 5.7 AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H hdf5 security update 2024-11-15 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2407