CVSS: 6.5EPSS: 0%CPEs: 758EXPL: 0CVE-2018-3629
https://notcve.org/view.php?id=CVE-2018-3629
Buffer overflow in event handler in Intel Active Management Technology in Intel Converged Security Manageability Engine Firmware 3.x, 4.x, 5.x, 6.x, 7.x, 8.x, 9.x, 10.x, and 11.x may allow an attacker to cause a denial of service via the same subnet. Desbordamiento de búfer en el manipulador de eventos en Intel Active Management Technology en Intel Converged Security Manageability Engine con versiones de firmware 3.x, 4.x, 5.x, 6.x, 7.x, 8.x, 9.x, 10.x y 11.x podría permitir que un atacante provoque una denegación de servicio (DoS) mediante la misma subred. • http://www.securitytracker.com/id/1041362 https://security.netapp.com/advisory/ntap-20190327-0001 https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03868en_us https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00112.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.2EPSS: 0%CPEs: 182EXPL: 0CVE-2018-3627
https://notcve.org/view.php?id=CVE-2018-3627
Logic bug in Intel Converged Security Management Engine 11.x may allow an attacker to execute arbitrary code via local privileged access. Un error de lógica en Intel Converged Security Management Engine 11.x podría permitir que un atacante ejecute código arbitrario mediante el acceso local privilegiado. • https://security.netapp.com/advisory/ntap-20190327-0006 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00118.html •
CVSS: 7.2EPSS: 0%CPEs: 758EXPL: 0CVE-2018-3632
https://notcve.org/view.php?id=CVE-2018-3632
Memory corruption in Intel Active Management Technology in Intel Converged Security Manageability Engine Firmware 6.x / 7.x / 8.x / 9.x / 10.x / 11.0 / 11.5 / 11.6 / 11.7 / 11.10 / 11.20 could be triggered by an attacker with local administrator permission on the system. Corrupción de memoria en Intel Active Management Technology en Intel Converged Security Manageability Engine con versiones de firmware 6.x, 7.x, 8.x, 9.x, 10.x, 11.0, 11.5, 11.6, 11.7, 11.10 y 11.20 podría ser provocada por un atacante con permisos de administrador locales en el sistema. • http://www.securitytracker.com/id/1041362 https://security.netapp.com/advisory/ntap-20190327-0001 https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03868en_us https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00112.html • CWE-787: Out-of-bounds Write •
CVSS: 5.6EPSS: 0%CPEs: 481EXPL: 0CVE-2018-3665 – Kernel: FPU state information leakage via lazy FPU restore
https://notcve.org/view.php?id=CVE-2018-3665
System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially allow a local process to infer data from another process through a speculative execution side channel. El software de sistema que emplea la técnica de restauración de estado Lazy FP en los sistemas que emplean microprocesadores de Intel Core podrían permitir que un proceso local infiera datos de otro proceso mediante un canal lateral de ejecución especulativa. A Floating Point Unit (FPU) state information leakage flaw was found in the way the Linux kernel saved and restored the FPU state during task switch. Linux kernels that follow the "Lazy FPU Restore" scheme are vulnerable to the FPU state information leakage issue. An unprivileged local attacker could use this flaw to read FPU state bits by conducting targeted cache side-channel attacks, similar to the Meltdown vulnerability disclosed earlier this year. • http://www.securityfocus.com/bid/104460 http://www.securitytracker.com/id/1041124 http://www.securitytracker.com/id/1041125 https://access.redhat.com/errata/RHSA-2018:1852 https://access.redhat.com/errata/RHSA-2018:1944 https://access.redhat.com/errata/RHSA-2018:2164 https://access.redhat.com/errata/RHSA-2018:2165 https://access.redhat.com/errata/RHSA-2019:1170 https://access.redhat.com/errata/RHSA-2019:1190 https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes& • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.6EPSS: 0%CPEs: 500EXPL: 0CVE-2018-3640
https://notcve.org/view.php?id=CVE-2018-3640
Systems with microprocessors utilizing speculative execution and that perform speculative reads of system registers may allow unauthorized disclosure of system parameters to an attacker with local user access via a side-channel analysis, aka Rogue System Register Read (RSRE), Variant 3a. Los sistemas con microprocesadores que emplean la ejecución especulativa y que realizan lecturas especulativas de registros del sistema podrían permitir la divulgación no autorizada de parámetros del sistema a un atacante con acceso de usuario local mediante un análisis de canal lateral. Esto también se conoce como Rogue System Register Read (RSRE), Variant 3a. • http://support.lenovo.com/us/en/solutions/LEN-22133 http://www.fujitsu.com/global/support/products/software/security/products-f/cve-2018-3639e.html http://www.securityfocus.com/bid/104228 http://www.securitytracker.com/id/1040949 http://www.securitytracker.com/id/1042004 https://cert-portal.siemens.com/productcert/pdf/ssa-268644.pdf https://cert-portal.siemens.com/productcert/pdf/ssa-608355.pdf https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability https:&#x • CWE-203: Observable Discrepancy •