CVE-2019-0093

CVE-2019-0093 is an information-disclosure vulnerability in Intel® CSME/HECI and Intel® SPS. The issue is caused by insufficient data sanitization in the HECI subsystem and affects Intel® CSME before 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Intel® SPS before SPS_E3_05.00.04.027.0, potentially all...

CVE-2019-0098

CVE-2019-0098 is a logic bug in Intel CSME (before 12.0.35) and TXE (before 3.1.65, 4.0.15) that may allow an unauthenticated user to escalate privileges via physical access. Connected docs corroborate affected Intel subsystems (CSME, SPS, TXE, DAL, AMT) and note mitigation paths: Intel’s advisor...

CVE-2019-0153

CVE-2019-0153 is an Intel CSME buffer overflow vulnerability affecting CSME 12.0.0–12.0.34. An unauthenticated, remote attacker could potentially escalate privileges via network access. The strongest documented impact is privilege escalation with high/critical impact in CVSS terms (CVSSv3 base sc...

CVE-2019-0091

CVE-2019-0091 is a code-injection vulnerability in the installer component of Intel CSME (CSME) and TXE, allowing a locally logged-in unprivileged user to escalate privileges. Affected: Intel CSME before 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Intel TXE 3.1.65, 4.0.15. Exploitation context is lo...

CVE-2019-0086: Improper Link Resolution Before File Access

Insufficient access control vulnerability in Dynamic Application Loader software for IntelR CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and IntelR TXE 3.1.65, 4.0.15 may allow an unprivileged user to potentially enable escalation of privilege via local access...

CVE-2019-0153: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in subsystem in IntelR CSME 12.0.0 through 12.0.34 may allow an unauthenticated user to potentially enable escalation of privilege via network access...

CVE-2019-0093: Undefined Security Weakness

Insufficient data sanitization vulnerability in HECI subsystem for IntelR CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and IntelR SPS before version SPSE305.00.04.027.0 may allow a privileged user to potentially enable information disclosure via local access...

CVE-2019-0098: Undefined Security Weakness

Logic bug vulnerability in subsystem for IntelR CSME before version 12.0.35, IntelR TXE before 3.1.65, 4.0.15 may allow an unauthenticated user to potentially enable escalation of privilege via physical access...

CVE-2019-0091: Improper Control of Generation of Code

Code injection vulnerability in installer for IntelR CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and IntelR TXE 3.1.65, 4.0.15 may allow an unprivileged user to potentially enable escalation of privilege via local access...

CVE-2019-0090: Undefined Security Weakness

Insufficient access control vulnerability in subsystem for IntelR CSME before versions 11.x, 12.0.35 IntelR TXE 3.x, 4.x, IntelR Server Platform Services 3.x, 4.x, IntelR SPS before version SPSE305.00.04.027.0 may allow an unauthenticated user to potentially enable escalation of privilege via...

Intel CSME, Server Platform Services, Trusted Execution Engine and Intel Active Management Technology Vulnerabilities - Lenovo Support US

Lenovo Security Advisory: LEN-26293 Potential Impact: Privilege escalation, denial of service, information disclosure Severity: High Scope of Impact: Industry-wide CVE Identifier: CVE-2019-0086 , CVE-2019-0089 , CVE-2019-0090 , CVE-2019-0091 , CVE-2019-0092 , CVE-2019-0093 , CVE-2019-0094 ,...

Intel CSME, Server Platform Services, Trusted Execution Engine and Intel Active Management Technology Vulnerabilities - Lenovo Support US

No description provided...

PT-2019-2207

Name of the Vulnerable Software and Affected Versions IntelR CSME versions prior to 12.0.35 IntelR TXE versions prior to 3.1.65 IntelR TXE version 4.0.15 Description The issue is related to a logic bug in the subsystem, which may allow an unauthenticated user to potentially enable escalation of...

PT-2019-2110

Name of the Vulnerable Software and Affected Versions Intel Converged Security and Manageability Engine CSME versions 12.0.0 through 12.0.34 Description The issue is related to a buffer overflow in the Intel Converged Security and Manageability Engine CSME subsystem. This could allow a remote...

PT-2019-2116

Name of the Vulnerable Software and Affected Versions IntelR CSME versions prior to 11.x IntelR TXE versions 3.x, 4.x IntelR Server Platform Services versions 3.x, 4.x IntelR SPS versions prior to SPS E3 05.00.04.027.0 Description The issue is related to insufficient access control in the Intel...

Intel® CSME, Server Platform Services, Trusted Execution Engine and Intel® Active Management Technology 2018.4 QSR Advisory

Summary: Multiple potential security vulnerabilities in Intel® CSME, Server Platform Services, Trusted Execution Engine and Intel® Active Management Technology may allow users to potentially escalate privileges, disclose information or cause a denial of service. Intel is releasing Intel® CSME,...

Lenovo Patches Intel Firmware Flaws in Multiple Product Lines

Lenovo has patched several several high-severity vulnerabilities tied to Intel flaws that could enable escalation of privilege, information disclosure, or even denial of service. Overall the device maker patched flaws tied to 16 high-severity CVEs on Thursday. Those include five related to Intel...

CVE-2018-12191

Bounds check in Kernel subsystem in Intel CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20, or IntelR Server Platform Services before versions 4.00.04.383 or SPS 4.01.02.174, or IntelR TXE before versions 3.1.60 or 4.0.10 may allow an unauthenticated user to potentially execute arbitrar...

CVE-2018-12190

Insufficient input validation in Intelr CSME subsystem before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 or Intelr TXE before 3.1.60 or 4.0.10 may allow a privileged user to potentially enable an escalation of privilege via local access...

Authentication flaw

Logic bug in Kernel subsystem in Intel CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20, or IntelR Server Platform Services before version SPSE504.00.04.393.0 may allow an unauthenticated user to potentially bypass MEBx authentication via physical access...