WID-SEC-W-2024-2112

DeutschShown in its original language — a full translation is planned for a future version.

Insyde UEFI Firmware: Mehrere Schwachstellen ermöglichen Denial of Service

view advisory published 2024-09-10

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Insyde UEFI Firmware ausnutzen, um einen Denial of Service Angriff durchzuführen.

describes (6)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-4741US	—	2.93% (87th)	—	2024-11-13
Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause memory to be accessed that was previously freed in some situations Impact summary: A use after free can…
CVE-2024-5535US	—	5.58% (93rd)	Exploit	2024-06-27
Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer.…
CVE-2024-4603US	—	1.13% (66th)	—	2024-05-16
Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the functions EVP_PKEY_param_check() or EVP_PKEY_public_che…
CVE-2024-2511US	—	52.4% (99th)	—	2024-04-08
Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server…
CVE-2024-0727US	medium5.5	3.19% (88th)	—	2024-01-26
Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files…
CVE-2023-5678US	medium5.3	4.46% (91st)	—	2023-11-06
Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the funct…

External citations — patches, advisories, analysis.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.