146 matches found
Lenovo Patches Intel Firmware Flaws in Multiple Product Lines
Lenovo has patched several several high-severity vulnerabilities tied to Intel flaws that could enable escalation of privilege, information disclosure, or even denial of service. Overall the device maker patched flaws tied to 16 high-severity CVEs on Thursday. Those include five related to Intel...
CVE-2018-12192
Logic bug in Kernel subsystem in Intel CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20, or IntelR Server Platform Services before version SPSE504.00.04.393.0 may allow an unauthenticated user to potentially bypass MEBx authentication via physical access...
CVE-2018-12198
Insufficient input validation in IntelR Server Platform Services HECI subsystem before version SPSE504.00.04.393.0 may allow privileged user to potentially cause a denial of service via local access...
CVE-2018-12208
Buffer overflow in HECI subsystem in IntelR CSME before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 and IntelR TXE version before 3.1.60 or 4.0.10, or IntelR Server Platform Services before version 5.00.04.012 may allow an unauthenticated user to potentially execute arbitrary code via physica...
Buffer overflow
Buffer overflow in HECI subsystem in IntelR CSME before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 and IntelR TXE version before 3.1.60 or 4.0.10, or IntelR Server Platform Services before version 5.00.04.012 may allow an unauthenticated user to potentially execute arbitrary code via physica...
Design/Logic Flaw
Bounds check in Kernel subsystem in Intel CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20, or IntelR Server Platform Services before versions 4.00.04.383 or SPS 4.01.02.174, or IntelR TXE before versions 3.1.60 or 4.0.10 may allow an unauthenticated user to potentially execute arbitrar...
CVE-2018-12198
Insufficient input validation in IntelR Server Platform Services HECI subsystem before version SPSE504.00.04.393.0 may allow privileged user to potentially cause a denial of service via local access...
CVE-2018-12192
Logic bug in Kernel subsystem in Intel CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20, or IntelR Server Platform Services before version SPSE504.00.04.393.0 may allow an unauthenticated user to potentially bypass MEBx authentication via physical access...
Input validation
Insufficient input validation in IntelR Server Platform Services HECI subsystem before version SPSE504.00.04.393.0 may allow privileged user to potentially cause a denial of service via local access...
Authentication flaw
Logic bug in Kernel subsystem in Intel CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20, or IntelR Server Platform Services before version SPSE504.00.04.393.0 may allow an unauthenticated user to potentially bypass MEBx authentication via physical access...
CVE-2018-12191
Bounds check in Kernel subsystem in Intel CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20, or IntelR Server Platform Services before versions 4.00.04.383 or SPS 4.01.02.174, or IntelR TXE before versions 3.1.60 or 4.0.10 may allow an unauthenticated user to potentially execute arbitrar...
CVE-2018-12192
The CVE-2018-12192 issue is a logic bug in the Kernel subsystem of Intel CSME and related components (SPS, TXE, AMT) that may allow an unauthenticated user to bypass MEBx authentication via physical access. Affected products include Intel CSME, SPS, TXE, and AMT with affected firmware ranges cite...
CVE-2018-12191
The CVE-2018-12191 issue affects Intel CSME, Intel Server Platform Services (SPS), and Intel TXE/AMT. It is a bounds-check vulnerability in the Kernel subsystem that could allow an unauthenticated user with physical access to potentially execute arbitrary code. Affected versions are: Intel CSME b...
CVE-2018-12198
CVE-2018-12198 involves Intel CSME ecosystem (CSME, SPS, TXE, AMT) where Insufficient input validation in the Intel Server Platform Services HECI subsystem before SPS_E5_04.00.04.393.0 may allow a privileged local user to cause a denial of service. Connected Intel advisories/Lenovo HP references ...
CVE-2018-12208
Intel CVE-2018-12208 is a buffer overflow in the HECI subsystem affecting Intel CSME, TXE, and SPS prior to specified fixed versions. The Intel advisory INTEL-SA-00185 documents the issue, listing affected products and firmware families (CSME before 11.8.60/11.11.60/11.22.60 or 12.0.20; TXE befor...
Intel CSME, Server Platform Services, Trusted Execution Engine and Intel Active Management Technology Vulnerabilities - Lenovo Support US
No description provided...
Power Management Controller (PMC) Security Advisory
Summary: A potential security vulnerability in power management controller firmware may allow escalation of privilege and/ or information disclosure. Intel is releasing firmware updates to mitigate this potential vulnerability. Vulnerability Details CVEID: CVE-2018-3643 Description: A vulnerabili...
Missing System x Flash Memory Write Protection Lock Bit
A write protection lock bit was left unset after boot on an older generation of Lenovo and IBM System x servers, potentially allowing an attacker with administrator access to modify the subset of flash memory containing Intel Server Platform Services SPS and the system Flash Descriptors...
CVE-2018-9085 Missing System x Flash Memory Write Protection Lock Bit
A write protection lock bit was left unset after boot on an older generation of Lenovo and IBM System x servers, potentially allowing an attacker with administrator access to modify the subset of flash memory containing Intel Server Platform Services SPS and the system Flash Descriptors...