Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2019-13103 (GCVE-0-2019-13103)
Vulnerability from cvelistv5 – Published: 2019-07-29 14:52 – Updated: 2024-08-04 23:41
VLAI?
EPSS
Summary
A crafted self-referential DOS partition table will cause all Das U-Boot versions through 2019.07-rc4 to infinitely recurse, causing the stack to grow infinitely and eventually either crash or overwrite other data.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T23:41:10.417Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/u-boot/u-boot/commits/master"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://lists.denx.de/pipermail/u-boot/2019-July/375512.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://gist.github.com/deephooloovoo/d91b81a1674b4750e662dfae93804d75"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-618620.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A crafted self-referential DOS partition table will cause all Das U-Boot versions through 2019.07-rc4 to infinitely recurse, causing the stack to grow infinitely and eventually either crash or overwrite other data."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-12-10T13:06:03.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/u-boot/u-boot/commits/master"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://lists.denx.de/pipermail/u-boot/2019-July/375512.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://gist.github.com/deephooloovoo/d91b81a1674b4750e662dfae93804d75"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-618620.pdf"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-13103",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A crafted self-referential DOS partition table will cause all Das U-Boot versions through 2019.07-rc4 to infinitely recurse, causing the stack to grow infinitely and eventually either crash or overwrite other data."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/u-boot/u-boot/commits/master",
"refsource": "MISC",
"url": "https://github.com/u-boot/u-boot/commits/master"
},
{
"name": "https://lists.denx.de/pipermail/u-boot/2019-July/375512.html",
"refsource": "MISC",
"url": "https://lists.denx.de/pipermail/u-boot/2019-July/375512.html"
},
{
"name": "https://gist.github.com/deephooloovoo/d91b81a1674b4750e662dfae93804d75",
"refsource": "MISC",
"url": "https://gist.github.com/deephooloovoo/d91b81a1674b4750e662dfae93804d75"
},
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-618620.pdf",
"refsource": "CONFIRM",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-618620.pdf"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-13103",
"datePublished": "2019-07-29T14:52:02.000Z",
"dateReserved": "2019-06-30T00:00:00.000Z",
"dateUpdated": "2024-08-04T23:41:10.417Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CERTFR-2019-AVI-615
Vulnerability from certfr_avis - Published: 2019-12-10 - Updated: 2019-12-10
De multiples vulnérabilités ont été découvertes dans les produits Siemens. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Siemens | N/A | SPPA-T3000 MS3000 Migration Server | ||
| Siemens | N/A | SiNVR 3 Central Control Server (CCS) | ||
| Siemens | N/A | SIMATIC S7-1200 CPU | ||
| Siemens | N/A | RUGGEDCOM ROS RSG9xx R/C | ||
| Siemens | N/A | RUGGEDCOM ROS RMC8388 | ||
| Siemens | N/A | EN100 Ethernet module Modbus TCP | ||
| Siemens | N/A | SIMATIC WinCC OA | ||
| Siemens | N/A | SIMATIC CP 1626 | ||
| Siemens | N/A | SCALANCE W700 versions antérieures à V6.4 | ||
| Siemens | N/A | SIMATIC NET PC | ||
| Siemens | N/A | SIMATIC WinCC Runtime Professional | ||
| Siemens | N/A | EN100 Ethernet module IEC 61850 versions antérieures à V4.37 | ||
| Siemens | N/A | SPPA-T3000 Application Server versions antérieures à Service Pack R8.2 SP1 | ||
| Siemens | N/A | SIMATIC WinCC Runtime Advanced | ||
| Siemens | N/A | RUGGEDCOM ROS RSL910 | ||
| Siemens | N/A | SIMATIC WinCC (TIA Portal) versions antérieures à V16 | ||
| Siemens | N/A | Famille de commutateurs SCALANCE X-200IRT et les variantes SIPLUSNET versions antérieures à V5.4.2 | ||
| Siemens | N/A | SIMATIC S7-200 SMART CPU | ||
| Siemens | N/A | SIMATIC WinCC OA versions antérieures à 3.16 patch version 13 | ||
| Siemens | N/A | SiNVR 3 Video Server | ||
| Siemens | N/A | EN100 Ethernet module DNP3 | ||
| Siemens | N/A | SCALANCE W1700 versions antérieures à V1.1 | ||
| Siemens | N/A | RUGGEDCOM ROS RSG2488 | ||
| Siemens | N/A | EN100 Ethernet module PROFINET IO | ||
| Siemens | N/A | EN100 Ethernet module IEC104 | ||
| Siemens | N/A | RUGGEDCOM ROS RSG920P | ||
| Siemens | N/A | TIM 1531 IRC | ||
| Siemens | N/A | XHQ versions antérieures à V6.0.0.2 | ||
| Siemens | N/A | SIMATIC STEP 7 (TIA Portal) versions antérieures à V16 | ||
| Siemens | N/A | RUGGEDCOM ROS RST2228 | ||
| Siemens | N/A | SIMATIC HMI Panel | ||
| Siemens | N/A | Famille de commutateurs SCALANCE X-200 et les variantes SIPLUSNET versions antérieures à V5.2.4 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SPPA-T3000 MS3000 Migration Server",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SiNVR 3 Central Control Server (CCS)",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC S7-1200 CPU",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "RUGGEDCOM ROS RSG9xx R/C",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "RUGGEDCOM ROS RMC8388",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "EN100 Ethernet module Modbus TCP",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC WinCC OA",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC CP 1626",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE W700 versions ant\u00e9rieures \u00e0 V6.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC NET PC",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC WinCC Runtime Professional",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "EN100 Ethernet module IEC 61850 versions ant\u00e9rieures \u00e0 V4.37",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SPPA-T3000 Application Server versions ant\u00e9rieures \u00e0 Service Pack R8.2 SP1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC WinCC Runtime Advanced",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "RUGGEDCOM ROS RSL910",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC WinCC (TIA Portal) versions ant\u00e9rieures \u00e0 V16",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Famille de commutateurs SCALANCE X-200IRT et les variantes SIPLUSNET versions ant\u00e9rieures \u00e0 V5.4.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC S7-200 SMART CPU",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC WinCC OA versions ant\u00e9rieures \u00e0 3.16 patch version 13",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SiNVR 3 Video Server",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "EN100 Ethernet module DNP3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE W1700 versions ant\u00e9rieures \u00e0 V1.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "RUGGEDCOM ROS RSG2488",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "EN100 Ethernet module PROFINET IO",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "EN100 Ethernet module IEC104",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "RUGGEDCOM ROS RSG920P",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "TIM 1531 IRC",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "XHQ versions ant\u00e9rieures \u00e0 V6.0.0.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC STEP 7 (TIA Portal) versions ant\u00e9rieures \u00e0 V16",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "RUGGEDCOM ROS RST2228",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC HMI Panel",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Famille de commutateurs SCALANCE X-200 et les variantes SIPLUSNET versions ant\u00e9rieures \u00e0 V5.2.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2019-13944",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-13944"
},
{
"name": "CVE-2019-18339",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18339"
},
{
"name": "CVE-2019-18341",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18341"
},
{
"name": "CVE-2019-18332",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18332"
},
{
"name": "CVE-2019-18335",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18335"
},
{
"name": "CVE-2019-18338",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18338"
},
{
"name": "CVE-2018-14526",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-14526"
},
{
"name": "CVE-2019-18319",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18319"
},
{
"name": "CVE-2019-18331",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18331"
},
{
"name": "CVE-2019-18312",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18312"
},
{
"name": "CVE-2019-18320",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18320"
},
{
"name": "CVE-2019-18322",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18322"
},
{
"name": "CVE-2019-18283",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18283"
},
{
"name": "CVE-2019-18303",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18303"
},
{
"name": "CVE-2019-18302",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18302"
},
{
"name": "CVE-2019-18311",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18311"
},
{
"name": "CVE-2019-18290",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18290"
},
{
"name": "CVE-2019-18292",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18292"
},
{
"name": "CVE-2019-18309",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18309"
},
{
"name": "CVE-2019-18291",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18291"
},
{
"name": "CVE-2019-18304",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18304"
},
{
"name": "CVE-2019-18326",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18326"
},
{
"name": "CVE-2019-18305",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18305"
},
{
"name": "CVE-2019-18318",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18318"
},
{
"name": "CVE-2013-3634",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-3634"
},
{
"name": "CVE-2019-18334",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18334"
},
{
"name": "CVE-2019-18299",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18299"
},
{
"name": "CVE-2019-13932",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-13932"
},
{
"name": "CVE-2019-18316",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18316"
},
{
"name": "CVE-2019-18329",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18329"
},
{
"name": "CVE-2019-10929",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10929"
},
{
"name": "CVE-2019-13931",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-13931"
},
{
"name": "CVE-2019-18333",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18333"
},
{
"name": "CVE-2019-18300",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18300"
},
{
"name": "CVE-2019-18301",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18301"
},
{
"name": "CVE-2019-18328",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18328"
},
{
"name": "CVE-2019-18321",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18321"
},
{
"name": "CVE-2019-13947",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-13947"
},
{
"name": "CVE-2019-18317",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18317"
},
{
"name": "CVE-2019-18294",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18294"
},
{
"name": "CVE-2019-13943",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-13943"
},
{
"name": "CVE-2019-18330",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18330"
},
{
"name": "CVE-2019-18314",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18314"
},
{
"name": "CVE-2019-18307",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18307"
},
{
"name": "CVE-2019-13945",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-13945"
},
{
"name": "CVE-2019-18308",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18308"
},
{
"name": "CVE-2013-3633",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-3633"
},
{
"name": "CVE-2019-18306",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18306"
},
{
"name": "CVE-2019-18340",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18340"
},
{
"name": "CVE-2019-18342",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18342"
},
{
"name": "CVE-2019-18325",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18325"
},
{
"name": "CVE-2018-4832",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-4832"
},
{
"name": "CVE-2019-18310",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18310"
},
{
"name": "CVE-2019-13103",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-13103"
},
{
"name": "CVE-2019-13930",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-13930"
},
{
"name": "CVE-2019-18337",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18337"
},
{
"name": "CVE-2019-18323",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18323"
},
{
"name": "CVE-2019-18327",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18327"
},
{
"name": "CVE-2018-18440",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-18440"
},
{
"name": "CVE-2019-18315",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18315"
},
{
"name": "CVE-2019-18298",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18298"
},
{
"name": "CVE-2019-13942",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-13942"
},
{
"name": "CVE-2019-18313",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18313"
},
{
"name": "CVE-2019-18324",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18324"
}
],
"initial_release_date": "2019-12-10T00:00:00",
"last_revision_date": "2019-12-10T00:00:00",
"links": [],
"reference": "CERTFR-2019-AVI-615",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2019-12-10T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSiemens. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0\ndistance et un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Siemens",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-451445 du 10 d\u00e9cembre 2019",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-451445.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-418979 du 10 d\u00e9cembre 2019",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-418979.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-170686 du 10 d\u00e9cembre 2019",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-170686.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-344983 du 10 d\u00e9cembre 2019",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-344983.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-761617 du 10 d\u00e9cembre 2019",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-761617.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-618620 du 10 d\u00e9cembre 2019",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-618620.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-525454 du 10 d\u00e9cembre 2019",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-525454.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-686531 du 10 d\u00e9cembre 2019",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-686531.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-273799 du 10 d\u00e9cembre 2019",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-273799.pdf"
}
]
}
FKIE_CVE-2019-13103
Vulnerability from fkie_nvd - Published: 2019-07-29 15:15 - Updated: 2024-11-21 04:24
Severity ?
Summary
A crafted self-referential DOS partition table will cause all Das U-Boot versions through 2019.07-rc4 to infinitely recurse, causing the stack to grow infinitely and eventually either crash or overwrite other data.
References
| URL | Tags | ||
|---|---|---|---|
| cve@mitre.org | https://cert-portal.siemens.com/productcert/pdf/ssa-618620.pdf | Third Party Advisory | |
| cve@mitre.org | https://gist.github.com/deephooloovoo/d91b81a1674b4750e662dfae93804d75 | Third Party Advisory | |
| cve@mitre.org | https://github.com/u-boot/u-boot/commits/master | Patch, Third Party Advisory | |
| cve@mitre.org | https://lists.denx.de/pipermail/u-boot/2019-July/375512.html | Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://cert-portal.siemens.com/productcert/pdf/ssa-618620.pdf | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://gist.github.com/deephooloovoo/d91b81a1674b4750e662dfae93804d75 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/u-boot/u-boot/commits/master | Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.denx.de/pipermail/u-boot/2019-July/375512.html | Patch, Third Party Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:denx:u-boot:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3CE34963-D56A-47B2-B806-13932FF2279D",
"versionEndExcluding": "2019.04",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:denx:u-boot:2019.04:-:*:*:*:*:*:*",
"matchCriteriaId": "66CA6618-F036-445D-A72D-E0A974545C82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:denx:u-boot:2019.04:rc1:*:*:*:*:*:*",
"matchCriteriaId": "80AA22EE-9DCB-4E79-B848-10A9C33A17E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:denx:u-boot:2019.04:rc2:*:*:*:*:*:*",
"matchCriteriaId": "23BF77D6-82EB-42F4-81EB-BF97A9FCDC21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:denx:u-boot:2019.04:rc3:*:*:*:*:*:*",
"matchCriteriaId": "275FA806-F592-4EE9-8AD7-D29A93443003",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:denx:u-boot:2019.04:rc4:*:*:*:*:*:*",
"matchCriteriaId": "ED14D8C5-6253-4176-A251-9051C70E7F63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:denx:u-boot:2019.07:rc1:*:*:*:*:*:*",
"matchCriteriaId": "75689E3C-FBB6-46B5-B59C-41D244702158",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:denx:u-boot:2019.07:rc2:*:*:*:*:*:*",
"matchCriteriaId": "9358D79B-256E-4AEA-BE6B-A182AA4AE861",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:denx:u-boot:2019.07:rc3:*:*:*:*:*:*",
"matchCriteriaId": "6AAFACF6-606C-4429-B680-01D3C4A98BC1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:denx:u-boot:2019.07:rc4:*:*:*:*:*:*",
"matchCriteriaId": "27B38F3B-75C0-4067-857F-C78160493D17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A crafted self-referential DOS partition table will cause all Das U-Boot versions through 2019.07-rc4 to infinitely recurse, causing the stack to grow infinitely and eventually either crash or overwrite other data."
},
{
"lang": "es",
"value": "Una tabla de partici\u00f3n autorreferencial DOS especialmente dise\u00f1ada, causar\u00e1 que todas las versiones hasta 2019.07-rc4 de Das U-Boot se repitan infinitamente, haciendo que la pila crezca infinitamente y eventualmente se bloquee o sobrescriba otros datos."
}
],
"id": "CVE-2019-13103",
"lastModified": "2024-11-21T04:24:11.540",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 3.6,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.2,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-07-29T15:15:12.390",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-618620.pdf"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://gist.github.com/deephooloovoo/d91b81a1674b4750e662dfae93804d75"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/u-boot/u-boot/commits/master"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://lists.denx.de/pipermail/u-boot/2019-July/375512.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-618620.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://gist.github.com/deephooloovoo/d91b81a1674b4750e662dfae93804d75"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/u-boot/u-boot/commits/master"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://lists.denx.de/pipermail/u-boot/2019-July/375512.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-674"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CVE-2019-13103
Vulnerability from fstec - Published: 09.04.2019
VLAI Severity ?
Title
Уязвимость загрузчика U-Boot, связанная с неконтролируемой рекурсией, позволяющая нарушителю нарушить целостность данных, а также вызвать отказ в обслуживании
Description
Уязвимость загрузчика U-Boot связана с неконтролируемой рекурсией. Эксплуатация уязвимости позволяет нарушителю нарушить целостность данных, а также вызвать отказ в обслуживании
Severity ?
Vendor
Сообщество свободного программного обеспечения, ООО «РусБИТех-Астра»
Software Name
Debian GNU/Linux, Astra Linux Special Edition (запись в едином реестре российских программ №369), U-Boot
Software Version
11 (Debian GNU/Linux), 12 (Debian GNU/Linux), 4.7 (Astra Linux Special Edition), 13 (Debian GNU/Linux), до 2019.04 (U-Boot)
Possible Mitigations
В условиях отсутствия обновлений безопасности от производителя рекомендуется придерживаться "Рекомендаций по безопасной настройке операционных систем LINUX", изложенных в методическом документе ФСТЭК России, утверждённом 25 декабря 2022 года.
Использование рекомендаций:
Для Debian:
https://security-tracker.debian.org/tracker/CVE-2019-13103
Для U-Boot:
https://lists.denx.de/pipermail/u-boot/2019-July/375512.html
Для ОС Astra Linux:
обновить пакет u-boot до 2019.01+dfsg-7.astra2+ci1 или более высокой версии, используя рекомендации производителя: https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1020SE47
Reference
https://cert-portal.siemens.com/productcert/pdf/ssa-618620.pdf
https://gist.github.com/deephooloovoo/d91b81a1674b4750e662dfae93804d75
https://github.com/u-boot/u-boot/commits/master
https://gitlab.denx.de/u-boot/u-boot/commit/232e2f4fd9a24bf08215ddc8c53ccadffc841fb5
https://lists.denx.de/pipermail/u-boot/2019-July/375512.html
https://nvd.nist.gov/vuln/detail/CVE-2019-13103
https://security-tracker.debian.org/tracker/CVE-2019-13103
https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1020SE47
CWE
CWE-674
{
"CVSS 2.0": "AV:L/AC:L/Au:N/C:N/I:P/A:P",
"CVSS 3.0": "AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"CVSS 4.0": null,
"remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
"remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
"\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "\u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f, \u041e\u041e\u041e \u00ab\u0420\u0443\u0441\u0411\u0418\u0422\u0435\u0445-\u0410\u0441\u0442\u0440\u0430\u00bb",
"\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "11 (Debian GNU/Linux), 12 (Debian GNU/Linux), 4.7 (Astra Linux Special Edition), 13 (Debian GNU/Linux), \u0434\u043e 2019.04 (U-Boot)",
"\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0412 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0442\u044c\u0441\u044f \"\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c LINUX\", \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0445 \u0432 \u043c\u0435\u0442\u043e\u0434\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0435 \u0424\u0421\u0422\u042d\u041a \u0420\u043e\u0441\u0441\u0438\u0438, \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0451\u043d\u043d\u043e\u043c 25 \u0434\u0435\u043a\u0430\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430.\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\u0414\u043b\u044f Debian:\nhttps://security-tracker.debian.org/tracker/CVE-2019-13103\n\n\u0414\u043b\u044f U-Boot:\nhttps://lists.denx.de/pipermail/u-boot/2019-July/375512.html\n\n\u0414\u043b\u044f \u041e\u0421 Astra Linux:\n\u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u0430\u043a\u0435\u0442 u-boot \u0434\u043e 2019.01+dfsg-7.astra2+ci1 \u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f: https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1020SE47",
"\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "09.04.2019",
"\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "10.11.2025",
"\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "31.10.2025",
"\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2025-13581",
"\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2019-13103",
"\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
"\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
"\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Debian GNU/Linux, Astra Linux Special Edition (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u2116369), U-Boot",
"\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "\u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 11 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 12 , \u041e\u041e\u041e \u00ab\u0420\u0443\u0441\u0411\u0418\u0422\u0435\u0445-\u0410\u0441\u0442\u0440\u0430\u00bb Astra Linux Special Edition 4.7 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u2116369), \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 13 ",
"\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 U-Boot, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043d\u0435\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u043e\u0439 \u0440\u0435\u043a\u0443\u0440\u0441\u0438\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u044c \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0445, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
"\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
"\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0440\u0435\u043a\u0443\u0440\u0441\u0438\u044f (CWE-674)",
"\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 U-Boot \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u043e\u0439 \u0440\u0435\u043a\u0443\u0440\u0441\u0438\u0435\u0439. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u044c \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0445, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
"\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
"\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
"\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
"\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
"\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
"\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u0418\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432",
"\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://cert-portal.siemens.com/productcert/pdf/ssa-618620.pdf\nhttps://gist.github.com/deephooloovoo/d91b81a1674b4750e662dfae93804d75\nhttps://github.com/u-boot/u-boot/commits/master\nhttps://gitlab.denx.de/u-boot/u-boot/commit/232e2f4fd9a24bf08215ddc8c53ccadffc841fb5\nhttps://lists.denx.de/pipermail/u-boot/2019-July/375512.html\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-13103\nhttps://security-tracker.debian.org/tracker/CVE-2019-13103\nhttps://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1020SE47",
"\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
"\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u041c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0439 \u043a\u043e\u0434",
"\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-674",
"\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041d\u0438\u0437\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 3,6)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,1)"
}
GSD-2019-13103
Vulnerability from gsd - Updated: 2023-12-13 01:23Details
A crafted self-referential DOS partition table will cause all Das U-Boot versions through 2019.07-rc4 to infinitely recurse, causing the stack to grow infinitely and eventually either crash or overwrite other data.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2019-13103",
"description": "A crafted self-referential DOS partition table will cause all Das U-Boot versions through 2019.07-rc4 to infinitely recurse, causing the stack to grow infinitely and eventually either crash or overwrite other data.",
"id": "GSD-2019-13103",
"references": [
"https://www.suse.com/security/cve/CVE-2019-13103.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2019-13103"
],
"details": "A crafted self-referential DOS partition table will cause all Das U-Boot versions through 2019.07-rc4 to infinitely recurse, causing the stack to grow infinitely and eventually either crash or overwrite other data.",
"id": "GSD-2019-13103",
"modified": "2023-12-13T01:23:41.412914Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-13103",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A crafted self-referential DOS partition table will cause all Das U-Boot versions through 2019.07-rc4 to infinitely recurse, causing the stack to grow infinitely and eventually either crash or overwrite other data."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/u-boot/u-boot/commits/master",
"refsource": "MISC",
"url": "https://github.com/u-boot/u-boot/commits/master"
},
{
"name": "https://lists.denx.de/pipermail/u-boot/2019-July/375512.html",
"refsource": "MISC",
"url": "https://lists.denx.de/pipermail/u-boot/2019-July/375512.html"
},
{
"name": "https://gist.github.com/deephooloovoo/d91b81a1674b4750e662dfae93804d75",
"refsource": "MISC",
"url": "https://gist.github.com/deephooloovoo/d91b81a1674b4750e662dfae93804d75"
},
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-618620.pdf",
"refsource": "CONFIRM",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-618620.pdf"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:denx:u-boot:2019.04:rc3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:denx:u-boot:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2019.04",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:denx:u-boot:2019.07:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:denx:u-boot:2019.07:rc3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:denx:u-boot:2019.07:rc4:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:denx:u-boot:2019.04:rc4:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:denx:u-boot:2019.04:-:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:denx:u-boot:2019.04:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:denx:u-boot:2019.04:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:denx:u-boot:2019.07:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-13103"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "A crafted self-referential DOS partition table will cause all Das U-Boot versions through 2019.07-rc4 to infinitely recurse, causing the stack to grow infinitely and eventually either crash or overwrite other data."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-674"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/u-boot/u-boot/commits/master",
"refsource": "MISC",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/u-boot/u-boot/commits/master"
},
{
"name": "https://lists.denx.de/pipermail/u-boot/2019-July/375512.html",
"refsource": "MISC",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://lists.denx.de/pipermail/u-boot/2019-July/375512.html"
},
{
"name": "https://gist.github.com/deephooloovoo/d91b81a1674b4750e662dfae93804d75",
"refsource": "MISC",
"tags": [
"Third Party Advisory"
],
"url": "https://gist.github.com/deephooloovoo/d91b81a1674b4750e662dfae93804d75"
},
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-618620.pdf",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-618620.pdf"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 3.6,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "LOW",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.2
}
},
"lastModifiedDate": "2020-08-24T17:37Z",
"publishedDate": "2019-07-29T15:15Z"
}
}
}
GHSA-WFJV-JM8J-274F
Vulnerability from github – Published: 2022-05-24 16:51 – Updated: 2022-05-24 16:51
VLAI?
Details
A crafted self-referential DOS partition table will cause all Das U-Boot versions through 2019.07-rc4 to infinitely recurse, causing the stack to grow infinitely and eventually either crash or overwrite other data.
{
"affected": [],
"aliases": [
"CVE-2019-13103"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-07-29T15:15:00Z",
"severity": "LOW"
},
"details": "A crafted self-referential DOS partition table will cause all Das U-Boot versions through 2019.07-rc4 to infinitely recurse, causing the stack to grow infinitely and eventually either crash or overwrite other data.",
"id": "GHSA-wfjv-jm8j-274f",
"modified": "2022-05-24T16:51:38Z",
"published": "2022-05-24T16:51:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-13103"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-618620.pdf"
},
{
"type": "WEB",
"url": "https://gist.github.com/deephooloovoo/d91b81a1674b4750e662dfae93804d75"
},
{
"type": "WEB",
"url": "https://github.com/u-boot/u-boot/commits/master"
},
{
"type": "WEB",
"url": "https://lists.denx.de/pipermail/u-boot/2019-July/375512.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…