Vulnerability-Lookup

SUSE-SU-2020:0495-1

Vulnerability from csaf_suse - Published: 2020-02-26 14:17 - Updated: 2020-02-26 14:17

Summary

Security update for ovmf

Severity

Moderate

Notes

Title of the patch: Security update for ovmf

Description of the patch: This update for ovmf fixes the following issues: Security issues fixed: - CVE-2018-0739: Update openssl to 1.0.2o to limit ASN.1 constructed types recursive definition depth (bsc#1094291). - CVE-2019-14563: Fixed a memory corruption caused by insufficient numeric truncation (bsc#1163959). - CVE-2019-14559: Fixed a remotely exploitable memory leak in the ARP handling code (bsc#1163927). - CVE-2019-14575: Fixed an insufficient signature check in the DxeImageVerificationHandler (bsc#1163969). Bug fixes: - Only use SLES-UEFI-CA-Certificate-2048.crt for the SUSE flavor to provide the better compatibility. (bsc#1077330)

Patchnames: SUSE-2020-495,SUSE-OpenStack-Cloud-7-2020-495,SUSE-SLE-SAP-12-SP2-2020-495,SUSE-SLE-SERVER-12-SP2-2020-495,SUSE-SLE-SERVER-12-SP2-BCL-2020-495

CVE-2018-0739

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 12 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 12 SP2-BCL:ovmf-2015+git1462940744.321151f-19.10.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP2-BCL:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP2-BCL:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP2-LTSS:ovmf-2015+git1462940744.321151f-19.10.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP2-LTSS:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP2-LTSS:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP2:ovmf-2015+git1462940744.321151f-19.10.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP2:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP2:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch	—	Vendor Fix
Unresolved product id: SUSE OpenStack Cloud 7:ovmf-2015+git1462940744.321151f-19.10.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE OpenStack Cloud 7:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE OpenStack Cloud 7:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch	—	Vendor Fix

Threats

Impact important

CVE-2019-14559

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 12 products, the same list as for CVE-2018-0739

Threats

Impact moderate

CVE-2019-14563

5.3 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L

Affected products

Recommended 12 products, the same list as for CVE-2018-0739

Threats

Impact moderate

CVE-2019-14575

7.1 (High)


                
                  CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 12 products, the same list as for CVE-2018-0739

Threats

Impact important

References

24 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-security-upd…	self
https://bugzilla.suse.com/1077330	self
https://bugzilla.suse.com/1094291	self
https://bugzilla.suse.com/1163927	self
https://bugzilla.suse.com/1163959	self
https://bugzilla.suse.com/1163969	self
https://www.suse.com/security/cve/CVE-2018-0739/	self
https://www.suse.com/security/cve/CVE-2019-14559/	self
https://www.suse.com/security/cve/CVE-2019-14563/	self
https://www.suse.com/security/cve/CVE-2019-14575/	self
https://www.suse.com/security/cve/CVE-2018-0739	external
https://bugzilla.suse.com/1087102	external
https://bugzilla.suse.com/1089997	external
https://bugzilla.suse.com/1094291	external
https://bugzilla.suse.com/1108542	external
https://www.suse.com/security/cve/CVE-2019-14559	external
https://bugzilla.suse.com/1163927	external
https://www.suse.com/security/cve/CVE-2019-14563	external
https://bugzilla.suse.com/1163959	external
https://www.suse.com/security/cve/CVE-2019-14575	external
https://bugzilla.suse.com/1163969	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for ovmf",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for ovmf fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-0739: Update openssl to 1.0.2o to limit ASN.1 constructed types recursive definition depth (bsc#1094291).\n- CVE-2019-14563: Fixed a memory corruption caused by insufficient numeric truncation (bsc#1163959).\n- CVE-2019-14559: Fixed a remotely exploitable memory leak in the ARP handling code (bsc#1163927).\n- CVE-2019-14575: Fixed an insufficient signature check in the DxeImageVerificationHandler (bsc#1163969).\n\nBug fixes:\n\n- Only use SLES-UEFI-CA-Certificate-2048.crt for the SUSE flavor to provide the better compatibility. (bsc#1077330)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2020-495,SUSE-OpenStack-Cloud-7-2020-495,SUSE-SLE-SAP-12-SP2-2020-495,SUSE-SLE-SERVER-12-SP2-2020-495,SUSE-SLE-SERVER-12-SP2-BCL-2020-495",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2020_0495-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2020:0495-1",
        "url": "https://www.suse.com/support/update/announcement/2020/suse-su-20200495-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2020:0495-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2020-February/006535.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1077330",
        "url": "https://bugzilla.suse.com/1077330"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1094291",
        "url": "https://bugzilla.suse.com/1094291"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1163927",
        "url": "https://bugzilla.suse.com/1163927"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1163959",
        "url": "https://bugzilla.suse.com/1163959"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1163969",
        "url": "https://bugzilla.suse.com/1163969"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-0739 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-0739/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-14559 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-14559/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-14563 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-14563/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-14575 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-14575/"
      }
    ],
    "title": "Security update for ovmf",
    "tracking": {
      "current_release_date": "2020-02-26T14:17:52Z",
      "generator": {
        "date": "2020-02-26T14:17:52Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2020:0495-1",
      "initial_release_date": "2020-02-26T14:17:52Z",
      "revision_history": [
        {
          "date": "2020-02-26T14:17:52Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ovmf-2015+git1462940744.321151f-19.10.3.aarch64",
                "product": {
                  "name": "ovmf-2015+git1462940744.321151f-19.10.3.aarch64",
                  "product_id": "ovmf-2015+git1462940744.321151f-19.10.3.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "ovmf-tools-2015+git1462940744.321151f-19.10.3.aarch64",
                "product": {
                  "name": "ovmf-tools-2015+git1462940744.321151f-19.10.3.aarch64",
                  "product_id": "ovmf-tools-2015+git1462940744.321151f-19.10.3.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ovmf-2015+git1462940744.321151f-19.10.3.i586",
                "product": {
                  "name": "ovmf-2015+git1462940744.321151f-19.10.3.i586",
                  "product_id": "ovmf-2015+git1462940744.321151f-19.10.3.i586"
                }
              },
              {
                "category": "product_version",
                "name": "ovmf-tools-2015+git1462940744.321151f-19.10.3.i586",
                "product": {
                  "name": "ovmf-tools-2015+git1462940744.321151f-19.10.3.i586",
                  "product_id": "ovmf-tools-2015+git1462940744.321151f-19.10.3.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "qemu-ovmf-ia32-2015+git1462940744.321151f-19.10.3.noarch",
                "product": {
                  "name": "qemu-ovmf-ia32-2015+git1462940744.321151f-19.10.3.noarch",
                  "product_id": "qemu-ovmf-ia32-2015+git1462940744.321151f-19.10.3.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
                "product": {
                  "name": "qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
                  "product_id": "qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "qemu-uefi-aarch64-2015+git1462940744.321151f-19.10.3.noarch",
                "product": {
                  "name": "qemu-uefi-aarch64-2015+git1462940744.321151f-19.10.3.noarch",
                  "product_id": "qemu-uefi-aarch64-2015+git1462940744.321151f-19.10.3.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
                "product": {
                  "name": "ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
                  "product_id": "ovmf-2015+git1462940744.321151f-19.10.3.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
                "product": {
                  "name": "ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
                  "product_id": "ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "qemu-ovmf-x86_64-debug-2015+git1462940744.321151f-19.10.3.x86_64",
                "product": {
                  "name": "qemu-ovmf-x86_64-debug-2015+git1462940744.321151f-19.10.3.x86_64",
                  "product_id": "qemu-ovmf-x86_64-debug-2015+git1462940744.321151f-19.10.3.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE OpenStack Cloud 7",
                "product": {
                  "name": "SUSE OpenStack Cloud 7",
                  "product_id": "SUSE OpenStack Cloud 7",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:suse-openstack-cloud:7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP2",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP2",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:12:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12 SP2-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12 SP2-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 12 SP2-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:12:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12 SP2-BCL",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12 SP2-BCL",
                  "product_id": "SUSE Linux Enterprise Server 12 SP2-BCL",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-bcl:12:sp2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovmf-2015+git1462940744.321151f-19.10.3.x86_64 as component of SUSE OpenStack Cloud 7",
          "product_id": "SUSE OpenStack Cloud 7:ovmf-2015+git1462940744.321151f-19.10.3.x86_64"
        },
        "product_reference": "ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
        "relates_to_product_reference": "SUSE OpenStack Cloud 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64 as component of SUSE OpenStack Cloud 7",
          "product_id": "SUSE OpenStack Cloud 7:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64"
        },
        "product_reference": "ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
        "relates_to_product_reference": "SUSE OpenStack Cloud 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch as component of SUSE OpenStack Cloud 7",
          "product_id": "SUSE OpenStack Cloud 7:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch"
        },
        "product_reference": "qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
        "relates_to_product_reference": "SUSE OpenStack Cloud 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovmf-2015+git1462940744.321151f-19.10.3.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:ovmf-2015+git1462940744.321151f-19.10.3.x86_64"
        },
        "product_reference": "ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64"
        },
        "product_reference": "ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch"
        },
        "product_reference": "qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovmf-2015+git1462940744.321151f-19.10.3.x86_64 as component of SUSE Linux Enterprise Server 12 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP2-LTSS:ovmf-2015+git1462940744.321151f-19.10.3.x86_64"
        },
        "product_reference": "ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64 as component of SUSE Linux Enterprise Server 12 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP2-LTSS:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64"
        },
        "product_reference": "ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch as component of SUSE Linux Enterprise Server 12 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP2-LTSS:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch"
        },
        "product_reference": "qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovmf-2015+git1462940744.321151f-19.10.3.x86_64 as component of SUSE Linux Enterprise Server 12 SP2-BCL",
          "product_id": "SUSE Linux Enterprise Server 12 SP2-BCL:ovmf-2015+git1462940744.321151f-19.10.3.x86_64"
        },
        "product_reference": "ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-BCL"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64 as component of SUSE Linux Enterprise Server 12 SP2-BCL",
          "product_id": "SUSE Linux Enterprise Server 12 SP2-BCL:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64"
        },
        "product_reference": "ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-BCL"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch as component of SUSE Linux Enterprise Server 12 SP2-BCL",
          "product_id": "SUSE Linux Enterprise Server 12 SP2-BCL:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch"
        },
        "product_reference": "qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-BCL"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2018-0739",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-0739"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP2-BCL:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
          "SUSE Linux Enterprise Server 12 SP2-BCL:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
          "SUSE Linux Enterprise Server 12 SP2-BCL:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
          "SUSE Linux Enterprise Server 12 SP2-LTSS:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
          "SUSE Linux Enterprise Server 12 SP2-LTSS:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
          "SUSE Linux Enterprise Server 12 SP2-LTSS:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
          "SUSE OpenStack Cloud 7:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
          "SUSE OpenStack Cloud 7:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
          "SUSE OpenStack Cloud 7:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-0739",
          "url": "https://www.suse.com/security/cve/CVE-2018-0739"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1087102 for CVE-2018-0739",
          "url": "https://bugzilla.suse.com/1087102"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1089997 for CVE-2018-0739",
          "url": "https://bugzilla.suse.com/1089997"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1094291 for CVE-2018-0739",
          "url": "https://bugzilla.suse.com/1094291"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1108542 for CVE-2018-0739",
          "url": "https://bugzilla.suse.com/1108542"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP2-BCL:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server 12 SP2-BCL:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server 12 SP2-BCL:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
            "SUSE Linux Enterprise Server 12 SP2-LTSS:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server 12 SP2-LTSS:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server 12 SP2-LTSS:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
            "SUSE OpenStack Cloud 7:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE OpenStack Cloud 7:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE OpenStack Cloud 7:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP2-BCL:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server 12 SP2-BCL:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server 12 SP2-BCL:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
            "SUSE Linux Enterprise Server 12 SP2-LTSS:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server 12 SP2-LTSS:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server 12 SP2-LTSS:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
            "SUSE OpenStack Cloud 7:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE OpenStack Cloud 7:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE OpenStack Cloud 7:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-02-26T14:17:52Z",
          "details": "important"
        }
      ],
      "title": "CVE-2018-0739"
    },
    {
      "cve": "CVE-2019-14559",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-14559"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Uncontrolled resource consumption in EDK II may allow an unauthenticated user to potentially enable denial of service via network access.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP2-BCL:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
          "SUSE Linux Enterprise Server 12 SP2-BCL:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
          "SUSE Linux Enterprise Server 12 SP2-BCL:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
          "SUSE Linux Enterprise Server 12 SP2-LTSS:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
          "SUSE Linux Enterprise Server 12 SP2-LTSS:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
          "SUSE Linux Enterprise Server 12 SP2-LTSS:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
          "SUSE OpenStack Cloud 7:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
          "SUSE OpenStack Cloud 7:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
          "SUSE OpenStack Cloud 7:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-14559",
          "url": "https://www.suse.com/security/cve/CVE-2019-14559"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1163927 for CVE-2019-14559",
          "url": "https://bugzilla.suse.com/1163927"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP2-BCL:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server 12 SP2-BCL:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server 12 SP2-BCL:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
            "SUSE Linux Enterprise Server 12 SP2-LTSS:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server 12 SP2-LTSS:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server 12 SP2-LTSS:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
            "SUSE OpenStack Cloud 7:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE OpenStack Cloud 7:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE OpenStack Cloud 7:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP2-BCL:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server 12 SP2-BCL:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server 12 SP2-BCL:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
            "SUSE Linux Enterprise Server 12 SP2-LTSS:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server 12 SP2-LTSS:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server 12 SP2-LTSS:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
            "SUSE OpenStack Cloud 7:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE OpenStack Cloud 7:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE OpenStack Cloud 7:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-02-26T14:17:52Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-14559"
    },
    {
      "cve": "CVE-2019-14563",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-14563"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Integer truncation in EDK II may allow an authenticated user to potentially enable escalation of privilege via local access.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP2-BCL:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
          "SUSE Linux Enterprise Server 12 SP2-BCL:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
          "SUSE Linux Enterprise Server 12 SP2-BCL:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
          "SUSE Linux Enterprise Server 12 SP2-LTSS:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
          "SUSE Linux Enterprise Server 12 SP2-LTSS:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
          "SUSE Linux Enterprise Server 12 SP2-LTSS:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
          "SUSE OpenStack Cloud 7:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
          "SUSE OpenStack Cloud 7:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
          "SUSE OpenStack Cloud 7:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-14563",
          "url": "https://www.suse.com/security/cve/CVE-2019-14563"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1163959 for CVE-2019-14563",
          "url": "https://bugzilla.suse.com/1163959"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP2-BCL:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server 12 SP2-BCL:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server 12 SP2-BCL:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
            "SUSE Linux Enterprise Server 12 SP2-LTSS:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server 12 SP2-LTSS:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server 12 SP2-LTSS:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
            "SUSE OpenStack Cloud 7:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE OpenStack Cloud 7:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE OpenStack Cloud 7:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP2-BCL:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server 12 SP2-BCL:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server 12 SP2-BCL:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
            "SUSE Linux Enterprise Server 12 SP2-LTSS:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server 12 SP2-LTSS:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server 12 SP2-LTSS:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
            "SUSE OpenStack Cloud 7:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE OpenStack Cloud 7:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE OpenStack Cloud 7:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-02-26T14:17:52Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-14563"
    },
    {
      "cve": "CVE-2019-14575",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-14575"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Logic issue in DxeImageVerificationHandler() for EDK II may allow an authenticated user to potentially enable escalation of privilege via local access.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP2-BCL:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
          "SUSE Linux Enterprise Server 12 SP2-BCL:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
          "SUSE Linux Enterprise Server 12 SP2-BCL:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
          "SUSE Linux Enterprise Server 12 SP2-LTSS:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
          "SUSE Linux Enterprise Server 12 SP2-LTSS:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
          "SUSE Linux Enterprise Server 12 SP2-LTSS:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP2:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
          "SUSE OpenStack Cloud 7:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
          "SUSE OpenStack Cloud 7:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
          "SUSE OpenStack Cloud 7:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-14575",
          "url": "https://www.suse.com/security/cve/CVE-2019-14575"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1163969 for CVE-2019-14575",
          "url": "https://bugzilla.suse.com/1163969"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP2-BCL:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server 12 SP2-BCL:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server 12 SP2-BCL:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
            "SUSE Linux Enterprise Server 12 SP2-LTSS:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server 12 SP2-LTSS:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server 12 SP2-LTSS:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
            "SUSE OpenStack Cloud 7:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE OpenStack Cloud 7:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE OpenStack Cloud 7:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP2-BCL:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server 12 SP2-BCL:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server 12 SP2-BCL:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
            "SUSE Linux Enterprise Server 12 SP2-LTSS:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server 12 SP2-LTSS:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server 12 SP2-LTSS:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP2:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch",
            "SUSE OpenStack Cloud 7:ovmf-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE OpenStack Cloud 7:ovmf-tools-2015+git1462940744.321151f-19.10.3.x86_64",
            "SUSE OpenStack Cloud 7:qemu-ovmf-x86_64-2015+git1462940744.321151f-19.10.3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-02-26T14:17:52Z",
          "details": "important"
        }
      ],
      "title": "CVE-2019-14575"
    }
  ]
}

CVE-2018-0739 (GCVE-0-2018-0739)

Vulnerability from cvelistv5 – Published: 2018-03-27 21:00 – Updated: 2024-09-16 22:35

Title

Constructed ASN.1 types with a recursive definition could exceed the stack

Summary

Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n).

Severity

No CVSS data available.

CWE

Stack overflow

Assigner

openssl mitre root

References

34 references

URL	Tags
https://usn.ubuntu.com/3611-2/	vendor-advisoryx_refsource_UBUNTU
https://www.debian.org/security/2018/dsa-4158	vendor-advisoryx_refsource_DEBIAN
https://security.gentoo.org/glsa/201811-21	vendor-advisoryx_refsource_GENTOO
https://access.redhat.com/errata/RHSA-2019:0367	vendor-advisoryx_refsource_REDHAT
https://www.debian.org/security/2018/dsa-4157	vendor-advisoryx_refsource_DEBIAN
https://access.redhat.com/errata/RHSA-2018:3505	vendor-advisoryx_refsource_REDHAT
http://www.securityfocus.com/bid/103518	vdb-entryx_refsource_BID
http://www.securitytracker.com/id/1040576	vdb-entryx_refsource_SECTRACK
https://access.redhat.com/errata/RHSA-2018:3221	vendor-advisoryx_refsource_REDHAT
http://www.securityfocus.com/bid/105609	vdb-entryx_refsource_BID
https://usn.ubuntu.com/3611-1/	vendor-advisoryx_refsource_UBUNTU
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://access.redhat.com/errata/RHSA-2019:0366	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:3090	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:1711	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:1712	vendor-advisoryx_refsource_REDHAT
http://www.oracle.com/technetwork/security-adviso…	x_refsource_CONFIRM
http://www.oracle.com/technetwork/security-adviso…	x_refsource_CONFIRM
http://www.oracle.com/technetwork/security-adviso…	x_refsource_CONFIRM
https://www.oracle.com/technetwork/security-advis…	x_refsource_CONFIRM
https://www.oracle.com/technetwork/security-advis…	x_refsource_MISC
https://www.oracle.com/technetwork/security-advis…	x_refsource_MISC
https://security.netapp.com/advisory/ntap-2018072…	x_refsource_CONFIRM
https://security.gentoo.org/glsa/202007-53	vendor-advisoryx_refsource_GENTOO
https://securityadvisories.paloaltonetworks.com/H…	x_refsource_CONFIRM
https://www.oracle.com//security-alerts/cpujul2021.html	x_refsource_MISC
https://www.tenable.com/security/tns-2018-07	x_refsource_CONFIRM
https://www.tenable.com/security/tns-2018-04	x_refsource_CONFIRM
https://nodejs.org/en/blog/vulnerability/march-20…	x_refsource_CONFIRM
https://git.openssl.org/gitweb/?p=openssl.git%3Ba…	x_refsource_CONFIRM
https://git.openssl.org/gitweb/?p=openssl.git%3Ba…	x_refsource_CONFIRM
https://www.tenable.com/security/tns-2018-06	x_refsource_CONFIRM
https://security.netapp.com/advisory/ntap-2018033…	x_refsource_CONFIRM
https://www.openssl.org/news/secadv/20180327.txt	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
OpenSSL	OpenSSL	Affected: Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g) Affected: Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n)

Date Public

2018-03-27 00:00

Credits

OSS-fuzz

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T03:35:49.367Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-3611-2",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3611-2/"
          },
          {
            "name": "DSA-4158",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4158"
          },
          {
            "name": "GLSA-201811-21",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201811-21"
          },
          {
            "name": "RHSA-2019:0367",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:0367"
          },
          {
            "name": "DSA-4157",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4157"
          },
          {
            "name": "RHSA-2018:3505",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3505"
          },
          {
            "name": "103518",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/103518"
          },
          {
            "name": "1040576",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1040576"
          },
          {
            "name": "RHSA-2018:3221",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3221"
          },
          {
            "name": "105609",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/105609"
          },
          {
            "name": "USN-3611-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3611-1/"
          },
          {
            "name": "[debian-lts-announce] 20180330 [SECURITY] [DLA 1330-1] openssl security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/03/msg00033.html"
          },
          {
            "name": "RHSA-2019:0366",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:0366"
          },
          {
            "name": "RHSA-2018:3090",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3090"
          },
          {
            "name": "RHSA-2019:1711",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:1711"
          },
          {
            "name": "RHSA-2019:1712",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:1712"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20180726-0002/"
          },
          {
            "name": "GLSA-202007-53",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202007-53"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://securityadvisories.paloaltonetworks.com/Home/Detail/133"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/tns-2018-07"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/tns-2018-04"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2ac4c6f7b2b2af20c0e2b0ba05367e454cd11b33"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9310d45087ae546e27e61ddf8f6367f29848220d"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/tns-2018-06"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20180330-0002/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.openssl.org/news/secadv/20180327.txt"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g)"
            },
            {
              "status": "affected",
              "version": "Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n)"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "OSS-fuzz"
        }
      ],
      "datePublic": "2018-03-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n)."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "lang": "eng",
              "url": "https://www.openssl.org/policies/secpolicy.html#Moderate",
              "value": "Moderate"
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Stack overflow",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-07-20T22:53:11.000Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "name": "USN-3611-2",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3611-2/"
        },
        {
          "name": "DSA-4158",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4158"
        },
        {
          "name": "GLSA-201811-21",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201811-21"
        },
        {
          "name": "RHSA-2019:0367",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:0367"
        },
        {
          "name": "DSA-4157",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4157"
        },
        {
          "name": "RHSA-2018:3505",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3505"
        },
        {
          "name": "103518",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/103518"
        },
        {
          "name": "1040576",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1040576"
        },
        {
          "name": "RHSA-2018:3221",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3221"
        },
        {
          "name": "105609",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/105609"
        },
        {
          "name": "USN-3611-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3611-1/"
        },
        {
          "name": "[debian-lts-announce] 20180330 [SECURITY] [DLA 1330-1] openssl security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/03/msg00033.html"
        },
        {
          "name": "RHSA-2019:0366",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:0366"
        },
        {
          "name": "RHSA-2018:3090",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3090"
        },
        {
          "name": "RHSA-2019:1711",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:1711"
        },
        {
          "name": "RHSA-2019:1712",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:1712"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20180726-0002/"
        },
        {
          "name": "GLSA-202007-53",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202007-53"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://securityadvisories.paloaltonetworks.com/Home/Detail/133"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.tenable.com/security/tns-2018-07"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.tenable.com/security/tns-2018-04"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2ac4c6f7b2b2af20c0e2b0ba05367e454cd11b33"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9310d45087ae546e27e61ddf8f6367f29848220d"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.tenable.com/security/tns-2018-06"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20180330-0002/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.openssl.org/news/secadv/20180327.txt"
        }
      ],
      "title": "Constructed ASN.1 types with a recursive definition could exceed the stack",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "openssl-security@openssl.org",
          "DATE_PUBLIC": "2018-03-27",
          "ID": "CVE-2018-0739",
          "STATE": "PUBLIC",
          "TITLE": "Constructed ASN.1 types with a recursive definition could exceed the stack"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "OpenSSL",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g)"
                          },
                          {
                            "version_value": "Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "OpenSSL"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "OSS-fuzz"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n)."
            }
          ]
        },
        "impact": [
          {
            "lang": "eng",
            "url": "https://www.openssl.org/policies/secpolicy.html#Moderate",
            "value": "Moderate"
          }
        ],
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Stack overflow"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "USN-3611-2",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3611-2/"
            },
            {
              "name": "DSA-4158",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4158"
            },
            {
              "name": "GLSA-201811-21",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201811-21"
            },
            {
              "name": "RHSA-2019:0367",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:0367"
            },
            {
              "name": "DSA-4157",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4157"
            },
            {
              "name": "RHSA-2018:3505",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3505"
            },
            {
              "name": "103518",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/103518"
            },
            {
              "name": "1040576",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1040576"
            },
            {
              "name": "RHSA-2018:3221",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3221"
            },
            {
              "name": "105609",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/105609"
            },
            {
              "name": "USN-3611-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3611-1/"
            },
            {
              "name": "[debian-lts-announce] 20180330 [SECURITY] [DLA 1330-1] openssl security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/03/msg00033.html"
            },
            {
              "name": "RHSA-2019:0366",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:0366"
            },
            {
              "name": "RHSA-2018:3090",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3090"
            },
            {
              "name": "RHSA-2019:1711",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:1711"
            },
            {
              "name": "RHSA-2019:1712",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:1712"
            },
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"
            },
            {
              "name": "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html",
              "refsource": "CONFIRM",
              "url": "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
            },
            {
              "name": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
            },
            {
              "name": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20180726-0002/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20180726-0002/"
            },
            {
              "name": "GLSA-202007-53",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202007-53"
            },
            {
              "name": "https://securityadvisories.paloaltonetworks.com/Home/Detail/133",
              "refsource": "CONFIRM",
              "url": "https://securityadvisories.paloaltonetworks.com/Home/Detail/133"
            },
            {
              "name": "https://www.oracle.com//security-alerts/cpujul2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
            },
            {
              "name": "https://www.tenable.com/security/tns-2018-07",
              "refsource": "CONFIRM",
              "url": "https://www.tenable.com/security/tns-2018-07"
            },
            {
              "name": "https://www.tenable.com/security/tns-2018-04",
              "refsource": "CONFIRM",
              "url": "https://www.tenable.com/security/tns-2018-04"
            },
            {
              "name": "https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/",
              "refsource": "CONFIRM",
              "url": "https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/"
            },
            {
              "name": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2ac4c6f7b2b2af20c0e2b0ba05367e454cd11b33",
              "refsource": "CONFIRM",
              "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2ac4c6f7b2b2af20c0e2b0ba05367e454cd11b33"
            },
            {
              "name": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9310d45087ae546e27e61ddf8f6367f29848220d",
              "refsource": "CONFIRM",
              "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9310d45087ae546e27e61ddf8f6367f29848220d"
            },
            {
              "name": "https://www.tenable.com/security/tns-2018-06",
              "refsource": "CONFIRM",
              "url": "https://www.tenable.com/security/tns-2018-06"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20180330-0002/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20180330-0002/"
            },
            {
              "name": "https://www.openssl.org/news/secadv/20180327.txt",
              "refsource": "CONFIRM",
              "url": "https://www.openssl.org/news/secadv/20180327.txt"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2018-0739",
    "datePublished": "2018-03-27T21:00:00.000Z",
    "dateReserved": "2017-11-30T00:00:00.000Z",
    "dateUpdated": "2024-09-16T22:35:29.998Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-14559 (GCVE-0-2019-14559)

Vulnerability from cvelistv5 – Published: 2020-11-23 15:50 – Updated: 2024-08-05 00:19

Summary

Uncontrolled resource consumption in EDK II may allow an unauthenticated user to potentially enable denial of service via network access.

Severity

No CVSS data available.

CWE

Denial of Service

Assigner

intel mitre root

References

2 references

URL	Tags
https://bugzilla.tianocore.org/show_bug.cgi?id=2031	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2021…	mailing-listx_refsource_MLIST

Impacted products

1 product

Vendor	Product	Version
n/a	Extensible Firmware Interface Development Kit (EDK II)	Affected: EDK II

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:19:41.363Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=2031"
          },
          {
            "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Extensible Firmware Interface Development Kit (EDK II)",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "EDK II"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Uncontrolled resource consumption in EDK II may allow an unauthenticated user to potentially enable denial of service via network access."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Denial of Service",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-04-29T21:06:27.000Z",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=2031"
        },
        {
          "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@intel.com",
          "ID": "CVE-2019-14559",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Extensible Firmware Interface Development Kit (EDK II)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "EDK II"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Uncontrolled resource consumption in EDK II may allow an unauthenticated user to potentially enable denial of service via network access."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Denial of Service"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.tianocore.org/show_bug.cgi?id=2031",
              "refsource": "MISC",
              "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=2031"
            },
            {
              "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2019-14559",
    "datePublished": "2020-11-23T15:50:32.000Z",
    "dateReserved": "2019-08-03T00:00:00.000Z",
    "dateUpdated": "2024-08-05T00:19:41.363Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-14563 (GCVE-0-2019-14563)

Vulnerability from cvelistv5 – Published: 2020-11-23 16:11 – Updated: 2024-08-05 00:19

Summary

Integer truncation in EDK II may allow an authenticated user to potentially enable escalation of privilege via local access.

Severity

No CVSS data available.

CWE

Escalation of Privilege

Assigner

intel mitre root

References

2 references

URL	Tags
https://bugzilla.tianocore.org/show_bug.cgi?id=2001	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2021…	mailing-listx_refsource_MLIST

Impacted products

1 product

Vendor	Product	Version
n/a	Extensible Firmware Interface Development Kit (EDK II)	Affected: EDK II

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:19:41.365Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=2001"
          },
          {
            "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Extensible Firmware Interface Development Kit (EDK II)",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "EDK II"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Integer truncation in EDK II may allow an authenticated user to potentially enable escalation of privilege via local access."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Escalation of Privilege",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-04-29T21:06:23.000Z",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=2001"
        },
        {
          "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@intel.com",
          "ID": "CVE-2019-14563",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Extensible Firmware Interface Development Kit (EDK II)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "EDK II"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Integer truncation in EDK II may allow an authenticated user to potentially enable escalation of privilege via local access."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Escalation of Privilege"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.tianocore.org/show_bug.cgi?id=2001",
              "refsource": "MISC",
              "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=2001"
            },
            {
              "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2019-14563",
    "datePublished": "2020-11-23T16:11:10.000Z",
    "dateReserved": "2019-08-03T00:00:00.000Z",
    "dateUpdated": "2024-08-05T00:19:41.365Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-14575 (GCVE-0-2019-14575)

Vulnerability from cvelistv5 – Published: 2020-11-23 16:11 – Updated: 2024-08-05 00:19

Summary

Logic issue in DxeImageVerificationHandler() for EDK II may allow an authenticated user to potentially enable escalation of privilege via local access.

Severity

No CVSS data available.

CWE

escalation of privilege

Assigner

intel mitre root

References

2 references

URL	Tags
https://bugzilla.tianocore.org/show_bug.cgi?id=1608	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2021…	mailing-listx_refsource_MLIST

Impacted products

1 product

Vendor	Product	Version
n/a	Extensible Firmware Interface Development Kit (EDK II)	Affected: EDK II

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:19:41.254Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=1608"
          },
          {
            "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Extensible Firmware Interface Development Kit (EDK II)",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "EDK II"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Logic issue in DxeImageVerificationHandler() for EDK II may allow an authenticated user to potentially enable escalation of privilege via local access."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "escalation of privilege",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-04-29T21:06:24.000Z",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=1608"
        },
        {
          "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@intel.com",
          "ID": "CVE-2019-14575",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Extensible Firmware Interface Development Kit (EDK II)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "EDK II"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Logic issue in DxeImageVerificationHandler() for EDK II may allow an authenticated user to potentially enable escalation of privilege via local access."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "escalation of privilege"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.tianocore.org/show_bug.cgi?id=1608",
              "refsource": "MISC",
              "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=1608"
            },
            {
              "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2019-14575",
    "datePublished": "2020-11-23T16:11:19.000Z",
    "dateReserved": "2019-08-03T00:00:00.000Z",
    "dateUpdated": "2024-08-05T00:19:41.254Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

SUSE-SU-2020:0495-1

CVE-2018-0739 (GCVE-0-2018-0739)

CVE-2019-14559 (GCVE-0-2019-14559)

CVE-2019-14563 (GCVE-0-2019-14563)

CVE-2019-14575 (GCVE-0-2019-14575)

Tags

Sightings

Nomenclature

Related by attack behaviour