VDB
CVE-2023-5058
CVE-2023-5058
PUBLISHED
BRLY-LOGOFAIL-2023-025 Low CVE-2023-5058 BINARLY efiXplorer team has discovered a memory contents leak / information disclosure vulnerability. Lack of synchronization between PaletteSize calculated from BitsPerPixel in BMP Image Header and PaletteIndex calculated from data in BMP Image allows OOB Read in Phoenix firmware.
EPSS 0.27% · 17.4th percentile
Risk Scores
EPSS Score
0.27%
17.4th percentile
Timeline
- Dec 6, 2023 CVE Published
- Dec 8, 2023 EPSS Score
- Dec 11, 2023 PoC Published
- Dec 31, 2023 PoC Published
- Jan 7, 2024 EPSS Score
- Feb 6, 2024 EPSS Score
- Mar 6, 2024 EPSS Score
- Apr 5, 2024 EPSS Score
- May 5, 2024 EPSS Score
- Jun 4, 2024 EPSS Score
- Jul 4, 2024 EPSS Score
- Aug 2, 2024 EPSS Score
References
- [BRLY-DVA-2023-026] SMM memory corruption vulnerability in combined DXE/SMM driver on Fujitsu device (SMRAM write) advisory
- Memory contents leak / information disclosure vulnerability in DXE driver. advisory
- [BRLY-2023-006] Multiple vulnerabilities in image parsing functions can be exploited by an attacker with local access. advisory
- [BRLY-DVA-2023-025] SMM memory corruption vulnerability in combined DXE/SMM driver on Fujitsu device (SMRAM write) advisory
- Memory Corruption vulnerability in DXE driver. advisory
- Memory contents leak / information disclosure vulnerability in DXE driver. advisory
- Memory Corruption vulnerability in DXE driver. advisory
- Memory Corruption vulnerability in DXE driver. advisory
- Memory contents leak / information disclosure vulnerability in DXE driver. advisory
- [BRLY-DVA-2023-028] SMM memory corruption vulnerability in SMM module on Fujitsu device (SMRAM write) advisory
- [BRLY-DVA-2023-027] SMM arbitrary code execution vulnerability in SMM module on Fujitsu device advisory
- Memory Corruption vulnerability in DXE driver. advisory
- Memory contents leak / information disclosure vulnerability in DXE driver. advisory
- Memory contents leak / information disclosure vulnerability in DXE driver. advisory
- Memory Corruption vulnerability in DXE driver. advisory
- Memory contents leak / information disclosure vulnerability in DXE driver. advisory
- Memory Corruption vulnerability in DXE driver. advisory