microcode_ctl: Improper input validation in UEFI firmware

An improper input validation flaw was found in UEFI firmware. Some IntelR Processors may allow a privileged user to enable privilege escalation via local access...

CVE-2025-25728

CVE-2025-25728 involves Bosscomm IF740 firmware (versions 11001.7078 and v11001.0000) and System versions 6.25 and 6.00 where the device’s update API traffic is sent in plaintext, enabling MITM access to sensitive information. Related Red Hat advisories describe additional issues in the same prod...

CVE-2025-23421

CVE-2025-23421 affects Qardio iOS and Android applications. Multiple connected sources describe that an attacker could obtain firmware files and reverse engineer their intended use, leading to loss of confidentiality and integrity of the hardware devices enabled by these apps. Red Hat and NVD ent...

OPENSUSE-SU-2025:14794-1 kernel-firmware-qlogic-20250206-1.1 on GA media

These are all security issues fixed in the kernel-firmware-qlogic-20250206-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2025:14793-1 kernel-firmware-qcom-20250206-1.1 on GA media

These are all security issues fixed in the kernel-firmware-qcom-20250206-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2025:14771-1 kernel-firmware-ath11k-20250206-1.1 on GA media

These are all security issues fixed in the kernel-firmware-ath11k-20250206-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2025:14797-1 kernel-firmware-serial-20250206-1.1 on GA media

These are all security issues fixed in the kernel-firmware-serial-20250206-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2025:14791-1 kernel-firmware-platform-20250206-1.1 on GA media

These are all security issues fixed in the kernel-firmware-platform-20250206-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2025:14795-1 kernel-firmware-radeon-20250206-1.1 on GA media

These are all security issues fixed in the kernel-firmware-radeon-20250206-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2024-10239

A security issue in the firmware image verification implementation at Supermicro MBD-X12DPG-OA6 . An attacker with administrator privileges can upload a specially crafted image, which can cause a stack overflow due to the unchecked fat-fsd.maxfld...

New UEFI Secure Boot Vulnerability Could Allow Attackers to Load Malicious Bootkits

Details have emerged about a now-patched security vulnerability that could allow a bypass of the Secure Boot mechanism in Unified Extensible Firmware Interface UEFI systems. The vulnerability, assigned the CVE identifier CVE-2024-7344 CVSS score: 6.7, resides in a UEFI application signed by...

CVE-2024-46601

CVE-2024-46601 affects Elspec G5 Digital Fault Recorder firmware. A buffer overflow in Firmware v1.2.1.12 (and earlier per sources) could allow code execution on the device. CVSSv3.1 base score 7.5 (HIGH) with network access, no user interaction required, and no confidentiality/integrity impact r...

CVE-2024-53688

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in AE1021 firmware versions 2.0.10 and earlier and AE1021PE firmware versions 2.0.10 and earlier, which may allow a logged-in user to execute an arbitrary OS command using a crafted HTTP request...

Firmware Security: Identifying Risks to Implement Best Cybersecurity Practices

Find out the key security risks of firmware security: Identify threats, and learn best practices and protection methods…...

The vulnerability of the Resume Extensible Firmware Interface in Microsoft Windows operating systems allows a hacker to bypass the UEFI Secure Boot security mechanism.

The vulnerability of the Resume Extensible Firmware Interface in Microsoft Windows operating systems is related to the use of an unreliable pointer. Exploiting this vulnerability could allow an attacker to bypass the UEFI Secure Boot security mechanism...

Moderate: Red Hat Security Advisory: linux-firmware security update

An update for linux-firmware is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.6 Telecommunications Update Service. Red Hat Product Security has rated this upda...

edk2: Use of a Weak PseudoRandom Number Generator

A security flaw has been identified in the cryptographic system of EDK2, the open-source reference implementation of the UEFI specification. This vulnerability enables an unauthorized remote attacker to potentially expose sensitive information...

OESA-2024-1752 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: EDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division-By-Zero due to a UNIT32 overflow via local access. A successful...

Important: linux-firmware security update

The linux-firmware packages contain all of the firmware files that are required by various devices to operate. Security Fixes: hw: intel: Protection mechanism failure for some IntelR PROSet/Wireless WiFi CVE-2022-46329 hw: amd: INVD instruction may lead to a loss of SEV-ES guest machine memory...

Insyde InsydeH2O 安全漏洞

Insyde InsydeH2O is a C source from Insyde Corporation, Taiwan, which implements the new technology "EFI/UEFI" specification designed to replace the traditional BIOS Basic Input/Output System. A security vulnerability exists in Insyde InsydeH2O, which stems from a memory corruption vulnerability...