Intel® NUC Firmware Advisory

Summary: A potential security vulnerability in system firmware for some Intel® NUC may allow escalation of privilege. Intel is releasing a firmware update to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2020-0600 Description: Improper buffer restrictions in firmware fo...

CVE-2019-14284

A vulnerability was found in the Linux kernel’s floppy disk driver implementation. A local attacker with access to the floppy disk device file /dev/fd0 through to /dev/fdN can create a situation that causes the kernel to divide by zero. This requires two consecutive ioctl calls to be issued. The...

Dell Latitude 7202 Rugged Tablet BIOS Resource Management Error Vulnerability

Dell Latitude 7202 Rugged Tablet BIOS is a basic input/output system BIOS for the Dell Latitude 7202 Tablet PC from Dell USA. A resource management error vulnerability exists in EFIBOOTSERVICES in System Management mode in Dell Latitude 7202 Rugged Tablet BIOS versions prior to A28. An attacker...

CVE-2020-5348

Dell Latitude 7202 Rugged Tablet BIOS versions prior to A28 contain a UAF vulnerability in EFIBOOTSERVICES in system management mode. A local unauthenticated attacker may exploit this vulnerability by overwriting the EFIBOOTSERVICES structure to execute arbitrary code in system management mode...

CVE-2020-5348

Dell Latitude 7202 Rugged Tablet BIOS versions prior to A28 contain a UAF vulnerability in EFIBOOTSERVICES in system management mode. A local unauthenticated attacker may exploit this vulnerability by overwriting the EFIBOOTSERVICES structure to execute arbitrary code in system management mode...

CVE-2020-5348

CVE-2020-5348 affects Dell Latitude 7202 Rugged Tablet BIOS versions prior to A28. The vulnerability is a use-after-free in EFI_BOOT_SERVICES when operating in System Management Mode, enabling a local unauthenticated attacker to overwrite EFI_BOOT_SERVICES and execute arbitrary code in SMM. Suppo...

CVE-2020-5348

Dell Latitude 7202 Rugged Tablet BIOS versions prior to A28 contain a UAF vulnerability in EFIBOOTSERVICES in system management mode. A local unauthenticated attacker may exploit this vulnerability by overwriting the EFIBOOTSERVICES structure to execute arbitrary code in system management mode...

CVE-2019-3459

A flaw was found in the Linux kernel's implementation of Logical Link Control and Adaptation Protocol L2CAP, part of the Bluetooth stack. An attacker, within the range of standard Bluetooth transmissions, can create and send a specially crafted packet. The response to this specially crafted packe...

Buffer overflow

MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A buffer overflow vulnerability was reported, fixed and publicly disclosed in 2015 in the Lenovo Service Engine LSE, affecting various versions of BIOS for Lenovo Notebooks, that could allow a remote user to execu...

CVE-2015-5684

CVE-2015-5684 describes a buffer overflow in Lenovo Service Engine (LSE) components embedded in BIOS on certain Lenovo notebooks (e.g., Flex 2 Pro-15/Edge 15 Broadwell/Haswell variants). The vulnerability could allow a remote attacker to execute arbitrary code with system privileges. Affected BIO...

CVE-2015-5684

MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A buffer overflow vulnerability was reported, fixed and publicly disclosed in 2015 in the Lenovo Service Engine LSE, affecting various versions of BIOS for Lenovo Notebooks, that could allow a remote user to execu...

The vulnerability of the Cisco UCS Series C microprogramming software’s BIOS update tool allows a hacker to load a malicious software image onto a vulnerable device.

The vulnerability of the Cisco UCS Series C microprogramming software’s BIOS update tool is related to improper verification of the cryptographic signature. Exploiting this vulnerability could allow a hacker to load the malicious software onto a vulnerable device...

CVE-2019-14283

A vulnerability was found in the Linux kernel’s floppy disk driver implementation. A local attacker with access to the floppy device could call setgeometry in drivers/block/floppy.c, which does not validate the sect and head fields, causing an integer overflow and out-of-bounds read. This flaw ma...

CVE-2020-5326

Affected Dell Client platforms contain a BIOS Setup configuration authentication bypass vulnerability in the pre-boot Intel Rapid Storage Response Technology iRST Manager menu. An attacker with physical access to the system could perform unauthorized changes to the BIOS Setup configuration settin...

CVE-2020-5326

Affected Dell Client platforms contain a BIOS Setup configuration authentication bypass vulnerability in the pre-boot Intel Rapid Storage Response Technology iRST Manager menu. An attacker with physical access to the system could perform unauthorized changes to the BIOS Setup configuration settin...

Authentication flaw

Affected Dell Client platforms contain a BIOS Setup configuration authentication bypass vulnerability in the pre-boot Intel Rapid Storage Response Technology iRST Manager menu. An attacker with physical access to the system could perform unauthorized changes to the BIOS Setup configuration settin...

CVE-2020-5326

Dell Client platforms are affected by a BIOS Setup authentication bypass in the pre-boot iRST Manager menu. The issue allows an attacker with physical access to change BIOS Setup configuration by selecting Optimized Defaults without entering the BIOS Admin password. Root cause and affected compon...

CVE-2020-5326

Affected Dell Client platforms contain a BIOS Setup configuration authentication bypass vulnerability in the pre-boot Intel Rapid Storage Response Technology iRST Manager menu. An attacker with physical access to the system could perform unauthorized changes to the BIOS Setup configuration settin...

CVE-2020-5326

Affected Dell Client platforms contain a BIOS Setup configuration authentication bypass vulnerability in the pre-boot Intel Rapid Storage Response Technology iRST Manager menu. An attacker with physical access to the system could perform unauthorized changes to the BIOS Setup configuration settin...

CVE-2019-6190

Lenovo was notified of a potential denial of service vulnerability, affecting various versions of BIOS for Lenovo Desktop, Desktop - All in One, and ThinkStation, that could cause PCRs to be cleared intermittently after resuming from sleep S3 on systems with Intel TXT enabled...