Skip to content
OpenAdvisories
Medium WID-SEC-2024-0053 7 CVEs

Dell BIOS: Mehrere Schwachstellen

Published Jan 9, 2024 · Updated Jan 9, 2024 · de-DE

Vendor: Dell Product: BIOS Product: BIOS Alienware m15 R6 < 1.27.0 Product: BIOS Dell G15 5511 < 1.26.0 Product: BIOS XPS 8960 < 2.3.0

Summary

Ein Angreifer kann mehrere Schwachstellen im Dell BIOS ausnutzen, um vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder einen Denial-of-Service-Zustand auszulösen.

Product

Das BIOS ist die Firmware bei IBM PC kompatiblen Computern.

Vulnerabilities 7

  • High 7.8
    CVE-2023-4807

    POLY1305 MAC implementation corrupts XMM registers on Windows

    Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications on the Windows 64 platform when running on newer X86_64 processors supporting the AVX512-IFMA instructions. Impac…

    OpenSSL OpenSSL kata-containers openssl-fips-provider Azure Linux
  • High 7.5
    CVE-2023-0464 Public exploit

    Excessive Resource Usage Verifying X.509 Policy Constraints

    A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate …

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 6.5
    CVE-2023-2650 EPSS 75%

    Possible DoS translating ASN.1 object identifiers

    Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with …

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.3
    CVE-2023-0465

    Invalid certificate policies in leaf certificates are silently ignored

    Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate pol…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.3
    CVE-2023-0466

    Certificate policy check not enabled

    The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or in…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine
  • Medium 5.3
    CVE-2023-3446

    Excessive time spent checking DH keys and parameters

    Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the k…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.3
    CVE-2023-3817

    Excessive time spent checking DH q parameter value

    Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the k…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Revision history

  1. #1

    Initiale Fassung

References