CVSS: 7.6EPSS: 0%CPEs: 20EXPL: 0CVE-2020-25647 – grub2: Out-of-bounds write in grub_usb_device_initialize()
https://notcve.org/view.php?id=CVE-2020-25647
A flaw was found in grub2 in versions prior to 2.06. During USB device initialization, descriptors are read with very little bounds checking and assumes the USB device is providing sane values. If properly exploited, an attacker could trigger memory corruption leading to arbitrary code execution allowing a bypass of the Secure Boot mechanism. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Se encontró un fallo en grub2 en versiones anteriores a 2.06. • https://bugzilla.redhat.com/show_bug.cgi?id=1886936 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZWZ36QK4IKU6MWDWNOOWKPH3WXZBHT2R https://security.gentoo.org/glsa/202104-05 https://security.netapp.com/advisory/ntap-20220325-0001 https://access.redhat.com/security/cve/CVE-2020-25647 • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 20EXPL: 0CVE-2020-27749 – grub2: Stack buffer overflow in grub_parser_split_cmdline()
https://notcve.org/view.php?id=CVE-2020-27749
A flaw was found in grub2 in versions prior to 2.06. Variable names present are expanded in the supplied command line into their corresponding variable contents, using a 1kB stack buffer for temporary storage, without sufficient bounds checking. If the function is called with a command line that references a variable with a sufficiently large payload, it is possible to overflow the stack buffer, corrupt the stack frame and control execution which could also circumvent Secure Boot protections. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Se encontró un fallo en grub2 en versiones anteriores a 2.06. • https://bugzilla.redhat.com/show_bug.cgi?id=1899966 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZWZ36QK4IKU6MWDWNOOWKPH3WXZBHT2R https://security.gentoo.org/glsa/202104-05 https://security.netapp.com/advisory/ntap-20220325-0001 https://access.redhat.com/security/cve/CVE-2020-27749 • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 20EXPL: 0CVE-2020-27779 – grub2: cutmem command allows privileged user to remove memory regions when Secure Boot is enabled
https://notcve.org/view.php?id=CVE-2020-27779
A flaw was found in grub2 in versions prior to 2.06. The cutmem command does not honor secure boot locking allowing an privileged attacker to remove address ranges from memory creating an opportunity to circumvent SecureBoot protections after proper triage about grub's memory layout. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Se encontró un fallo en grub2 en versiones anteriores a 2.06. El comando cutmem no respeta el bloqueo de secure boot, permitiendo a un atacante privilegiado eliminar rangos de direcciones de la memoria, creando una oportunidad para omitir unas protecciones de SecureBoot después de una clasificación apropiada sobre el diseño de la memoria de grub. • https://bugzilla.redhat.com/show_bug.cgi?id=1900698 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZWZ36QK4IKU6MWDWNOOWKPH3WXZBHT2R https://security.gentoo.org/glsa/202104-05 https://security.netapp.com/advisory/ntap-20220325-0001 https://access.redhat.com/security/cve/CVE-2020-27779 • CWE-285: Improper Authorization •
CVSS: 7.5EPSS: 0%CPEs: 21EXPL: 1CVE-2020-14372 – grub2: acpi command allows privileged user to load crafted ACPI tables when Secure Boot is enabled
https://notcve.org/view.php?id=CVE-2020-14372
A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled. This flaw allows an attacker with privileged access to craft a Secondary System Description Table (SSDT) containing code to overwrite the Linux kernel lockdown variable content directly into memory. The table is further loaded and executed by the kernel, defeating its Secure Boot lockdown and allowing the attacker to load unsigned code. The highest threat from this vulnerability is to data confidentiality and integrity, as well as system availability. Se encontró un fallo en grub2 en versiones anteriores a 2.06, donde habilita incorrectamente el uso del comando ACPI cuando Secure Boot está habilitado. • https://github.com/kukrimate/CVE-2020-14372 https://access.redhat.com/security/vulnerabilities/RHSB-2021-003 https://bugzilla.redhat.com/show_bug.cgi?id=1873150 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZWZ36QK4IKU6MWDWNOOWKPH3WXZBHT2R https://security.gentoo.org/glsa/202104-05 https://security.netapp.com/advisory/ntap-20210416-0004 https://access.redhat.com/security/cve/CVE-2020-14372 • CWE-184: Incomplete List of Disallowed Inputs •
CVSS: 7.8EPSS: 0%CPEs: 7EXPL: 0CVE-2020-35523 – libtiff: Integer overflow in tif_getimage.c
https://notcve.org/view.php?id=CVE-2020-35523
An integer overflow flaw was found in libtiff that exists in the tif_getimage.c file. This flaw allows an attacker to inject and execute arbitrary code when a user opens a crafted TIFF file. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Se encontró un fallo de desbordamiento de enteros en libtiff que existe en el archivo tif_getimage.c. Este fallo permite a un atacante inyectar y ejecutar código arbitrario cuando un usuario abre un archivo TIFF diseñado. • https://bugzilla.redhat.com/show_bug.cgi?id=1932040 https://gitlab.com/libtiff/libtiff/-/commit/c8d613ef497058fe653c467fc84c70a62a4a71b2 https://gitlab.com/libtiff/libtiff/-/merge_requests/160 https://lists.debian.org/debian-lts-announce/2021/06/msg00023.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BMHBYFMX3D5VGR6Y3RXTTH3Q4NF4E6IG https://security.gentoo.org/glsa/202104-06 https://security.netapp.com/advisory/ntap-20210521-0009 https://www.debian.org/ • CWE-190: Integer Overflow or Wraparound •