Skip to content
OpenAdvisories
Medium WID-SEC-2023-3068 4 CVEs

UEFI BIOS: Mehrere Schwachstellen

Published Dec 6, 2023 · Updated Dec 16, 2024 · Revision 3 · de-DE

Vendor: Dell Vendor: HP Vendor: Insyde Software Vendor: Lenovo Product: BIOS Product: Computer Product: PowerScale OneFS Product: UEFI Firmware

Summary

Ein lokaler Angreifer kann mehrere Schwachstellen im UEFI BIOS verschiedener Hersteller ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen oder einen Denial of Service Zustand herbeizuführen.

Product

Das BIOS ist die Firmware bei IBM PC kompatiblen Computern.
InsydeH2O UEFI BIOS ist eine proprietäre, lizenzierte UEFI-BIOS-Firmware, die Intel und AMD basierte Computer unterstützt.

Vulnerabilities 4

  • High 7.5
    CVE-2023-39538

    Failure when uploading a Logo image file

    AMI AptioV contains a vulnerability in BIOS where a User may cause an unrestricted upload of a BMP Logo file with dangerous type by Local access. A successful exploit of this vulnerability may lead to a loss of Confidentiality, Integrity, and/or Availability. 

    AMI AptioV
  • High 7.5
    CVE-2023-39539 Public exploit

    Failure when uploading a Logo image file

    AMI AptioV contains a vulnerability in BIOS where a User may cause an unrestricted upload of a PNG Logo file with dangerous type by Local access. A successful exploit of this vulnerability may lead to a loss of Confidentiality, Integrity, and/or Availability. 

    AMI AptioV
  • Medium 5.5
    CVE-2023-40238

    A LogoFAIL issue was discovered in BmpDecoderDxe in Insyde InsydeH2O with kernel 5.2 before 05.28.47, 5.3 before 05.37.…

  • Unscored —
    CVE-2023-5058

    Improper Input Validation in the processing of user-supplied splash screen during system boot in Phoenix SecureCore™ Te…

    Phoenix SecureCore Technology 4

Revision history

  1. #3

    Neue Updates von Dell aufgenommen

  2. #2

    Neue Updates von HP aufgenommen

  3. #1

    Initiale Fassung

References