Pengutronix
Pengutronix Barebox: vulnerabilidades y CVE
Pengutronix Barebox tiene 12 vulnerabilidades publicadas, 5 de ellas en los últimos 12 meses. 3 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE12
Últimos 12 meses5
Críticas3
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-34963 | Alta (8.6) | 0.22% | — | 11 may 2026 | barebox version prior to 2026.04.0 contains multiple memory-safety vulnerabilities in the EFI PE loader in efi/loader/pe.c where integer overflow in virtual image size computation using 32-bit arithmetic on section… |
| CVE-2026-34962 | Media (6.9) | 0.18% | — | 11 may 2026 | barebox version prior to 2026.04.0 contains a denial-of-service vulnerability in ext4 directory parsing in fs/ext4/ext4_common.c where the ext4fs_iterate_dir() function fails to validate that directory entry length… |
| CVE-2026-34961 | Media (6.9) | 0.22% | — | 11 may 2026 | barebox prior to version 2026.04.0 contains out-of-bounds read vulnerabilities in ext4 extent parsing due to missing validation of the eh_entries field against buffer capacity in fs/ext4/ext4_common.c. Attackers can… |
| CVE-2026-34960 | Alta (7.1) | 0.38% | — | 11 may 2026 | barebox prior to version 2026.04.0 contains an out-of-bounds read vulnerability in DHCP option parsing within the dhcp_message_type() function that fails to verify the options pointer remains within received packet… |
| CVE-2026-33243 | Alta (8.2) | 0.12% | — | 20 mar 2026 | barebox is a bootloader. In barebox from version 2016.03.0 to before version 2026.03.1 (and the corresponding backport to 2025.09.3), an attacker could exploit a FIT signature verification vulnerability to trick the… |
| CVE-2024-57262 | Alta (7.1) | 0.29% | — | 19 feb 2025 | In barebox before 2025.01.0, ext4fs_read_symlink has an integer overflow for zalloc (adding one to an le32 variable) via a crafted ext4 filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and… |
| CVE-2024-57261 | Alta (7.1) | 0.29% | — | 19 feb 2025 | In barebox before 2025.01.0, request2size in common/dlmalloc.c has an integer overflow, a related issue to CVE-2024-57258. |
| CVE-2021-37848 | Alta (7.5) | 1.5% | — | 2 ago 2021 | common/password.c in Pengutronix barebox through 2021.07.0 leaks timing information because strncmp is used during hash comparison. |
| CVE-2021-37847 | Alta (7.5) | 1.5% | — | 2 ago 2021 | crypto/digest.c in Pengutronix barebox through 2021.07.0 leaks timing information because memcmp is used during digest verification. |
| CVE-2020-13910 | Crítica (9.1) | 1.2% | — | 7 jun 2020 | Pengutronix Barebox through v2020.05.0 has an out-of-bounds read in nfs_read_reply in net/nfs.c because a field of an incoming network packet is directly used as a length field without any bounds check. |
| CVE-2019-15938 | Crítica (9.8) | 2.1% | — | 5 sept 2019 | Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_req in fs/nfs.c because a length field is directly used for a memcpy. |
| CVE-2019-15937 | Crítica (9.8) | 2.1% | — | 5 sept 2019 | Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_reply in net/nfs.c because a length field is directly used for a memcpy. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.