Summary
Multiple vulnerabilities have been identified in the BIOS of the SIMATIC S7-1500 TM MFP before V1.3.0.
Siemens has released a new version for SIMATIC S7-1500 TM MFP - BIOS and recommends to update to the latest version.
Vulnerabilities 72
-
High 7.8
Glibc: buffer overflow in ld.so leading to privilege escalation
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binar…
KEV Nov 21, 2023 -
Critical 9.8
The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34…
-
Critical 9.8
The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 co…
-
Critical 9.1
The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (i…
-
High 8.8
BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's…
-
High 7.8
A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when t…
-
High 7.8
A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing …
-
High 7.8
A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain kernel parameters …
-
High 7.8
Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability
Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()` failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace
-
High 7.8CVE-2023-3390 Public exploit
Use-after-free in Linux kernel's netfilter subsystem
A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vu…
-
High 7.8CVE-2023-35001 Public exploit
Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability
Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace
-
High 7.8
Use-after-free in Linux kernel's netfilter: nf_tables component
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. Flaw in the error handling of bound chains causes a use-after-free in the abort path of NFT_MSG_NEWRULE. The vulnerabil…
-
High 7.8
Out-of-bounds write in Linux kernel's net/sched: sch_qfq component
An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated accordin…
-
High 7.8CVE-2023-3776 Public exploit
Use-after-free in Linux kernel's net/sched: cls_fw component
A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an error after incrementing or decrementing the refere…
-
High 7.8
Kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove()
A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their pr…
-
High 7.8
Use-after-free in Linux kernel's netfilter: nf_tables component
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. On an error when building a nftables rule, deactivating immediate expressions in nft_immediate_deactivate() can lead un…
-
High 7.8CVE-2023-4147 Public exploit
Kernel: netfilter: nf_tables_newrule when adding a rule with nfta_rule_chain_id leads to use-after-free
A use-after-free flaw was found in the Linux kernel’s Netfilter functionality when adding a rule with NFTA_RULE_CHAIN_ID. This flaw allows a local user to crash or escalate their privileges on the system.
-
High 7.5
decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resulta…
-
High 7.5
The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences …
-
High 7.5
In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_R…
-
High 7.5
A flaw was found in glibc. The realpath() function can mistakenly return an unexpected value, potentially leading to in…
-
High 7.5
Glibc: dos due to memory leak in getaddrinfo.c
A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash.
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.0
A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was c…
-
High 7.0
mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is not held dur…
-
Medium 6.6
A memory corruption flaw was found in the Linux kernel’s human interface device (HID) subsystem in how a user inserts a…
-
Medium 6.5
Glibc: stack read overflow in getaddrinfo in no-aaaa mode
A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents thr…
-
Medium 6.0
Kernel: exfat: stack overflow in exfat_get_uniname_from_ext_entry
A flaw was found in the exFAT driver of the Linux kernel. The vulnerability exists in the implementation of the file name reconstruction function, which is responsible for reading file name entries from a directory index and merging file name parts belonging …
-
Medium 5.9
The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequ…
-
Medium 5.9
Glibc: potential use-after-free in getaddrinfo()
A flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the _nss_*_gethostbyname2_…
-
Medium 5.5
The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input…
-
Medium 5.5
An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted…
-
Medium 5.5
Improper isolation of shared resources in some Intel(R) Processors may allow a privileged user to potentially enable in…
-
Medium 5.5
A flaw was found in the Linux kernel’s networking code. A use-after-free was found in the way the sch_sfb enqueue funct…
-
Medium 5.5
A flaw incorrect access control in the Linux kernel USB core subsystem was found in the way user attaches usb device. A…
-
Medium 5.5
A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network subcomponent in…
-
Medium 5.3
An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA…
-
Medium 5.3
It was discovered that when exec'ing from a non-leader thread, armed POSIX CPU timers would be left on a list but freed…
-
Medium 5.3CVE-2022-2588 Public exploit
It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the …
-
Medium 4.8
The iconv function in the GNU C Library (aka glibc or libc6) 2.30 to 2.32, when converting UCS4 text containing an irre…
-
Medium 4.3
Linux Kernel IPv4 fib_semantics.c fib_nh_match out-of-bounds
A vulnerability classified as problematic has been found in Linux Kernel. This affects the function fib_nh_match of the file net/ipv4/fib_semantics.c of the component IPv4 Handler. The manipulation leads to out-of-bounds read. It is possible to initiate the a…
-
Low 2.5
The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a req…
-
Unscored —
The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in th…
-
Unscored —
The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input…
-
Unscored —
A flaw was found in the permissions of a log file created by kexec-tools. This flaw allows a local unprivileged user to…
-
Unscored —
The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the not…
-
Unscored —
A NULL pointer dereference in Busybox's man applet leads to denial of service when a section name is supplied but no pa…
-
Unscored —
A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command,…
-
Unscored —
An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution whe…
-
Unscored —
In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered, leading to a mo…
-
Unscored —CVE-2022-1015 Public exploit
A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem. This flaw allow…
-
Unscored —
A use-after-free flaw was found in the Linux kernel’s pipes functionality in how a user performs manipulations with the…
-
Unscored —CVE-2022-20421 Public exploit
In binder_inc_ref_for_node of binder.c, there is a possible way to corrupt memory due to a use after free. This could l…
-
Unscored —
In emulation_proc_handler of armv8_deprecated.c, there is a possible way to corrupt memory due to a race condition. Thi…
-
Unscored —
An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the bpf_tail_call f…
-
Unscored —
A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple c…
-
Unscored —
An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race condition (unma…
-
Unscored —
An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6. A denial of service can occ…
-
Unscored —
An issue was discovered in the Linux kernel through 5.19.8. drivers/firmware/efi/capsule-loader.c has a race condition …
-
Unscored —CVE-2022-42703 Public exploit
mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse.
-
Unscored —CVE-2023-0179 Public exploit
A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the le…
-
Unscored —
There is a null-pointer-dereference flaw found in f2fs_write_end_io in fs/f2fs/data.c in the Linux kernel. This flaw al…
-
Unscored —
** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-4206, CVE-2023-4207, CVE-2023-4208. Reason: This record i…
-
Unscored —
An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker can trigger a …
Revision history
-
#5
Added fix for SIMATIC S7-1500 TM MFP - BIOS
-
#4
Added CVE-2021-44879, CVE-2023-45863
-
#3
Added CVE-2023-4527, CVE-2023-4806, CVE-2023-4911, CVE-2023-5156
-
#2
Added CVE-2022-1015, CVE-2023-2898, CVE-2023-31248, CVE-2023-3390, CVE-2023-35001, CVE-2023-3610, CVE-2023-3611, CVE-2023-3776, CVE-2023-4004, CVE-2023-4015, CVE-2023-4128, CVE-2023-4147, CVE-2023-4273
-
#1
Publication Date
References
-
SSA-831302: Vulnerabilities in the BIOS of the SIMATIC S7-1500 TM MFP before V1.3.0 - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-831302.html
-
SSA-831302: Vulnerabilities in the BIOS of the SIMATIC S7-1500 TM MFP before V1.3.0 - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-831302.pdf
-
SSA-831302: Vulnerabilities in the BIOS of the SIMATIC S7-1500 TM MFP before V1.3.0 - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-831302.txt