Most recent entries from all

ALSA-2023:2453 — Moderate: libtpms security update

Affected: AlmaLinux:9: libtpms

The libtpms is a library providing Trusted Platform Module (TPM) functionality for virtual machines.

Security Fix(es):

* tpm: TCG TPM2.0 implementations vulnerable to memory corruption (CVE-2023-1017) * tpm2: TCG TPM2.0 implementations vulnerable to memory corruption (CVE-2023-1018)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2023-01029

certfr-2023-avi-0232 — De multiples vulnérabilités ont été corrigées dans Microsoft Windows. Elles permettent à un…

certfr-2023-avi-0232

ESEA-2023:0283 — virt:rhel bug fix update for RHSA-2023:2757

virt:rhel bug fix update for RHSA-2023:2757

EUVD-2026-259573

fkie_cve-2023-1018

An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can read or access sensitive data stored in the TPM.

GHSA-cr8w-xxqw-fm2m

gsd-2023-1018

OESA-2023-1299 — libtpms security update

Affected: openEuler:20.03-LTS-SP1: libtpms, openEuler:20.03-LTS-SP3: libtpms, openEuler:22.03-LTS: libtpms, openEuler:22.03-LTS-SP1: libtpms

A library providing TPM functionality for VMs. Targeted for integration into Qemu. Security Fix(es): An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can read or access sensitive data stored in the TPM.(CVE-2023-1018) An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it unusable) and/or arbitrary code execution in the TPM context.(CVE-2023-1017)

RHSA-2023:1833 — Red Hat Security Advisory: virt:rhel and virt-devel:rhel security and bug fix update

tpm: TCG TPM2.0 implementations vulnerable to memory corruption tpm2: TCG TPM2.0 implementations vulnerable to memory corruption

UBUNTU-CVE-2023-1018

Affected: Ubuntu:22.04:LTS: libtpms

WID-SEC-W-2023-0529 — TPM 2.0 Referenzimplementierung: Mehrere Schwachstellen

Ein lokaler Angreifer kann mehrere Schwachstellen in der TPM 2.0 Referenzimplementierung ausnutzen, um beliebigen Programmcode auszuführen, einen Denial of Service Zustand herbeizuführen und um Informationen aus dem TPM offenzulegen.