CVE-2020-10759-poc

Summary Exploits CVE-2020-10759 - fwupd PGP signature verification bypass. See https://github.com/justinsteven/advisories/blob/master/2020fwupddanglings3bucketandCVE-2020-10759signatureverificationbypass.md for more details. Requirements Note: You need to install python3-gpg from your OS vendor...

Rocky Linux 8 [CIQ] Security Update: appstream-data / libxmlb / libxmlb-debuginfo / libxmlb-debugsource (crlsa-2020_4436)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20204436 advisory. fwupd: Possible bypass in signature verification CVE-2020-10759 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note...

Rocky Linux 8.8 [CIQ] Security Update: fwupd / fwupd-debuginfo / fwupd-debugsource (ciqsa-2026_0284)

The Rocky Linux 8.8 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20260284 advisory. This advisory aggregates security fixes for the fwupd SRPM in CIQ LTS 8.8. It addresses 1 CVE: CVE-2022-3287. Tenable has extracted the preceding description bloc...

Rocky Linux 8 [CIQ] Security Update: fwupd / fwupd-debuginfo / fwupd-debugsource / fwupd-devel (crlsa-2023_7189)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20237189 advisory. fwupd: world readable password in /etc/fwupd/redfish.conf CVE-2022-3287 Tenable has extracted the preceding description block directly from the CIQ security advisor...

fwupd:protobuf_fuzzer: Stack-buffer-overflow in g_atomic_ref_count_inc

Project: https://github.com/fwupd/fwupd.git Detailed Report: https://oss-fuzz.com/testcase?key=5318619387723776 Project: fwupd Fuzzing Engine: libFuzzer Fuzz Target: protobuffuzzer Job Type: libfuzzerasanfwupd Platform Id: linux Crash Type: Stack-buffer-overflow READ 4 Crash Address: 0x7ac79ecd01...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: fwupd (UTSA-2026-054034)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054034 advisory. A PGP signature bypass flaw was found in fwupd all versions, which could lead to the installation of unsigned firmware. As per upstream, a signature bypass is...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099973)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099973 advisory. In the Linux kernel, the following vulnerability has been resolved: nouveau/dpcd: return EBUSY for aux xfer if the device is asleep If we have runtime suspended, and...

fwupd:uswid_fuzzer: Crash in g_byte_array_append

Project: https://github.com/fwupd/fwupd.git Detailed Report: https://oss-fuzz.com/testcase?key=5430594256044032 Project: fwupd Fuzzing Engine: libFuzzer Fuzz Target: uswidfuzzer Job Type: libfuzzerasanfwupd Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x7a619a501520 Crash State:...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: Platform/x86: hp-bioscfg: Fixed kernel panic in the GETINSTANCEID macro. The GETINSTANCEID macro caused a kernel panic when accessing sysfs attributes. 1. Off-by-one error: The loop condition used name without checking whether...

CVE-2026-43381

In the Linux kernel, the following vulnerability has been resolved: nouveau/dpcd: return EBUSY for aux xfer if the device is asleep If we have runtime suspended, and userspace wants to use /dev/drmdp then just tell it the device is busy instead of crashing in the GSP code. WARNING: CPU: 2 PID:...

CVE-2026-43381

In the Linux kernel, the following vulnerability has been resolved: nouveau/dpcd: return EBUSY for aux xfer if the device is asleep If we have runtime suspended, and userspace wants to use /dev/drmdp then just tell it the device is busy instead of crashing in the GSP code. WARNING: CPU: 2 PID:...

Linux Distros Unpatched Vulnerability : CVE-2026-43381

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nouveau/dpcd: return EBUSY for aux xfer if the device is asleep If we have runtime suspended, and userspace wants to use /dev/drmdp then just tell it the device...

MiracleLinux 9 : fwupd-1.8.10-2.el9.ML.1 (AXSA:2023-5696:02)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-5696:02 advisory. fwupd: world readable password in /etc/fwupd/redfish.conf CVE-2022-3287 shim: 3rd party shim allow secure boot bypass CVE-2022-34301 shim: 3rd party...

MiracleLinux 8 : fwupd-1.7.8-2.el8.ML.1 (AXSA:2023-7312:04)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-7312:04 advisory. fwupd: world readable password in /etc/fwupd/redfish.conf CVE-2022-3287 Tenable has extracted the preceding description block directly from the MiracleLinux...

MiracleLinux 8 : appstream-data-8-20200724.el8, fwupd-1.4.2-4.0.2.el8, gnome-software-3.36.1-4.el8, libxmlb-0.1.15-1.el8 (AXSA:2021-1476:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2021-1476:01 advisory. fwupd: Possible bypass in signature verification CVE-2020-10759 Tenable has extracted the preceding description block directly from the MiracleLinux security...

MiracleLinux 8 : fwupd-1.1.4-7.0.1.el8, grub2-2.02-87.0.1.el8, shim-15-15.0.1, shim-unsigned-x64-15-8.0.1.el8 (AXSA:2020-773:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-773:01 advisory. grub2: Crafted grub.cfg file can lead to arbitrary code execution during boot process CVE-2020-10713 grub2: grubmalloc does not validate allocation...

EUVD-2020-3175

Malware in sbrugna...

fwupd:efi-volume_fuzzer: Heap-buffer-overflow in fu_byte_array_set_size

Project: https://github.com/fwupd/fwupd.git Detailed Report: https://oss-fuzz.com/testcase?key=6697581892927488 Project: fwupd Fuzzing Engine: libFuzzer Fuzz Target: efi-volumefuzzer Job Type: libfuzzerasanfwupd Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Crash Address: 0x7ac3ebbe20...

Alibaba Cloud Linux 3 : 0048: fwupd (ALINUX3-SA-2021:0048)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2021:0048 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2020-10713: A flaw was found in grub2,...

Alibaba Cloud Linux 3 : 0065: fwupd (ALINUX3-SA-2024:0065)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2024:0065 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2022-3287: When creating an OPERATOR user accou...