VDB
CVE-2023-39538
CVE-2023-39538
PUBLISHED
BRLY-LOGOFAIL-2023-013 Medium CVE-2023-39538 BINARLY efiXplorer team has discovered a memory contents leak / information disclosure vulnerability. Image->ImageOffset is not validated during parsing of arbitrary BMP file on AMI firmware. The attacker can make it as high as 0xFFFFFFFF and thus display the contents of physical memory (in the form of pixels).
EPSS 0.22% · 12.9th percentile
Risk Scores
EPSS Score
0.22%
12.9th percentile
Timeline
- Dec 6, 2023 CVE Published
- Dec 7, 2023 EPSS Score
- Jan 6, 2024 EPSS Score
- Feb 4, 2024 EPSS Score
- Mar 5, 2024 EPSS Score
- Apr 3, 2024 EPSS Score
- May 3, 2024 EPSS Score
- Jun 2, 2024 EPSS Score
- Jul 1, 2024 EPSS Score
- Jul 31, 2024 EPSS Score
- Aug 29, 2024 EPSS Score
- Sep 28, 2024 EPSS Score
References
- Memory Corruption vulnerability in DXE driver. advisory
- Memory Corruption vulnerability in DXE driver. advisory
- Memory Corruption vulnerability in DXE driver. advisory
- Memory Corruption vulnerability in DXE driver. advisory
- Memory Corruption vulnerability in DXE driver. advisory
- Memory Corruption vulnerability in DXE driver. advisory
- Memory Corruption vulnerability in DXE driver. advisory
- Memory Corruption vulnerability in DXE driver. advisory
- Memory contents leak / information disclosure vulnerability in DXE driver. advisory
- [BRLY-2023-006] Multiple vulnerabilities in image parsing functions can be exploited by an attacker with local access. advisory
- [BRLY-LOGOFAIL-2023-015] Out-of-bounds Read in DXE driver advisory
- [BRLY-LOGOFAIL-2023-014] Out-of-bounds Read in DXE driver advisory
- Memory Corruption vulnerability in DXE driver. advisory
- Memory Corruption vulnerability in DXE driver. advisory
- Memory Corruption vulnerability in DXE driver. advisory
- Memory Corruption vulnerability in DXE driver. advisory
- Memory contents leak / information disclosure vulnerability in DXE driver. advisory
- Memory Corruption vulnerability in DXE driver. advisory
- Memory Corruption vulnerability in DXE driver. advisory
- Memory Corruption vulnerability in DXE driver. advisory
…and 1 more