Lenovo Patches Intel Firmware Flaws in Multiple Product Lines

Lenovo has patched several several high-severity vulnerabilities tied to Intel flaws that could enable escalation of privilege, information disclosure, or even denial of service. Overall the device maker patched flaws tied to 16 high-severity CVEs on Thursday. Those include five related to Intel...

CVE-2018-12196

Insufficient input validation in IntelR AMT in IntelR CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20 may allow a privileged user to potentially execute arbitrary code via local access...

CVE-2018-12185

Insufficient input validation in IntelR AMT in IntelR CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20 may allow an unauthenticated user to potentially execute arbitrary code via physical access...

Brocade Fabric OS Advisory - US

Lenovo Security Advisory: LEN-24765 Potential Impact: Privilege escalation, information disclosure, denial of service Severity: High Scope of Impact: Industry-wide CVE Identifier: CVE-2018-6433, CVE-2018-6434, CVE-2018-6435, CVE-2018-6436, CVE-2018-6437, CVE-2018-6438, CVE-2018-6439, CVE-2018-644...

HPESBHF03899 rev.1 - HPE Converged System 700 Virtual Services Router (VSR) using NTP

Potential Security Impact: Remote: Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HP ConvergedSystem 700 Virtualization 2.0 VMware Kit - Nov 2017 Recipe or Aug 2018 Recipe HP ConvergedSystem 700x for VMware Solution Kit - Nov 2017 Recipe or Aug 2018 Recipe H...

The vulnerability of Microprogramming Software, including Intel Converged Security and Manageability Engine (CSME), Intel Server Platform Services (SPS), and Intel Trusted Execution Engine (TXE), arises due to privilege management errors, allowing attackers to disclose or modify protected information.

The vulnerabilities of Intel CSME, Intel SPS, and Intel TXE are caused by privilege management errors. Exploiting these vulnerabilities can allow attackers to disclose or modify protected information...

The vulnerability relates to the implementation of the TLS protocol by the Intel Active Management Technology (AMT) subsystem of the Intel Converged Security and Manageability Engine and the Intel Management Engine. This vulnerability allows a attacker to obtain the TLS session key.

The vulnerability of the TLS protocol implementation of the Intel Active Management Technology AMT microprogramming system, Intel Converged Security and Manageability Engine, and Intel Management Engine is due to the lack of security measures in accordance with TLS standards. Exploiting this...

The vulnerability of the implementation of Intel Active Management Technology for microprogramming software, Intel Converged Security and Manageability Engine, and Intel Management Engine, which allows a perpetrator to trigger a service failure.

The vulnerability of the Intel Active Management Technology AMT implementation of the Intel Converged Security and Manageability Engine CSME and Intel Management Engine ME arises due to errors in processing memory objects. Exploiting this vulnerability can allow a malicious actor to cause service...

Power Management Controller (PMC) Security Vulnerability in Systems using specific Intel® CSME or SPS firmware versions - Lenovo Support US

No description provided...

Intel CSME AMT Buffer Overflow Vulnerability

Intel CSME is a converged security management engine from Intel Corporation, U.S.A. Intel AMT is one of the active management technology modules. A buffer overflow vulnerability exists in Intel AMT in Intel CSME firmware versions prior to 12.0.5. A local attacker can exploit this vulnerability wi...

Intel CSME and Intel TXE PTT Module Privilege Permission and Access Control Issues Vulnerability

Intel CSME and Intel TXE are both products of Intel Corporation, USA. Intel CSME is a converged security management engine. Intel TXE is a trust execution engine with hardware authentication used in CPUs central processing units. Intel PTT module is one of the trusted platform modules. A...

Intel CSME Resource Management Error Vulnerability

Intel CSME is a converged security management engine from Intel Corporation, U.S.A. Intel AMT is one of the active management technology modules. A resource management error vulnerability exists in Intel CSME. An attacker could exploit this vulnerability to cause a denial of service memory leak...

CVE-2018-3659

A vulnerability in Intel PTT module in Intel CSME firmware before version 12.0.5 and Intel TXE firmware before version 4.0 may allow an unauthenticated user to potentially disclose information via physical access...

CVE-2018-3643

A vulnerability in Power Management Controller firmware in systems using specific IntelR Converged Security and Management Engine CSME before version 11.8.55, 11.11.55, 11.21.55, 12.0.6 or IntelR Server Platform Services firmware before version 4.x.04 may allow an attacker with administrative...

CVE-2018-3643

A vulnerability in Power Management Controller firmware in systems using specific IntelR Converged Security and Management Engine CSME before version 11.8.55, 11.11.55, 11.21.55, 12.0.6 or IntelR Server Platform Services firmware before version 4.x.04 may allow an attacker with administrative...

HPESBHF03873 rev.1 - Certain HPE Gen10 Servers with Intel-based Processors using Converged Security and Management Engine (CSME), and Power Management Controller (PMC) Vulnerabilities

Potential Security Impact: Local: Denial of Service DoS, Disclosure of Information, Elevation of Privilege SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE ProLiant DL380 Gen10 Server - Prior to 04.00.04.39312 Sep 2018 HPE Cloudline CL2100 Gen10 Server - Prior to 04.00.04.39312...

HPESBST03884 rev.2 - HPE ConvergedSystem 700 Solutions Using HPE 3PAR Service Processor, Multiple Vulnerabilities

Potential Security Impact: Local: Directory Traversal, Disclosure of Privileged Information; Remote: Access Restriction Bypass, Code Execution, Cross-Site Request Forgery CSRF SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE 3PAR Service Processors - Prior to SP-4.4.0.GA-110MU7...

Intel Converged Security Manageability Engine Active Management Technology Elevation of Privilege Vulnerability

The Intel Converged Security Manageability Engine is a security management engine for use in CPUs Central Processing Units from Intel Corporation in the U.S. Active Management Technology AMT is one of the active management components. An elevation of privilege vulnerability exists in AMT in the...

Intel Converged Security Manageability Engine Active Management Technology Buffer Overflow Vulnerability

The Intel Converged Security Manageability Engine is a security management engine for use in CPUs Central Processing Units from Intel Corporation in the U.S. Active Management Technology AMT is one of the active management components. A buffer overflow vulnerability exists in the event handler of...

Intel Converged Security Management Engine Arbitrary Code Execution Vulnerability

Intel Converged Security Management Engine is a security management engine for use in CPUs central processing units from Intel Corporation. A security vulnerability exists in Intel Converged Security Management Engine version 11.x. An attacker could exploit this vulnerability to execute arbitrary...