Every CVE Search/ Get API key

CVE-2017-5735

Red Hat Security Advisory: ovmf security and enhancement update

6.7 MediumRejected

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

What each source reports

OSV Score usedRHSA-2019:2125 6.7

Red Hat Security Advisory: ovmf security and enhancement update

Record
RHSA-2019:2125
CVSS 3.0
6.7 MediumCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
CVE List No score

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none

Record
CVE-2017-5735
Updated
2026-11-02
EUVDEUVD-2017-14812 No score

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none

Record
EUVD-2017-14812
Updated
2026-11-03
NVD No score

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none

Record
CVE-2017-5735
Updated
2026-11-02
OSVSUSE-SU-2018:4155-1 No score

Security update for ovmf

This update for ovmf fixes the following issues:

Security issues fixed:

  • CVE-2018-3613: Fixed AuthVariable Timestamp zeroing issue on APPEND_WRITE (bsc#1115916).
  • CVE-2017-5731: Fixed privilege escalation via processing of malformed files in TianoCompress.c (bsc#1115917).
  • CVE-2017-5732: Fixed privilege escalation via processing of malformed files in BaseUefiDecompressLib.c (bsc#1115917).
  • CVE-2017-5733: Fixed privilege escalation via heap-based buffer overflow in MakeTable() function (bsc#1115917).
  • CVE-2017-5734: Fixed privilege escalation via stack-based buffer overflow in MakeTable() function (bsc#1115917).
  • CVE-2017-5735: Fixed privilege escalation via heap-based buffer overflow in Decode() function (bsc#1115917).

Non security issues fixed:

  • Fixed an issue with the default owner of PK/KEK/db/dbx and make the auto-enrollment only happen at the very first time. (bsc#1117998)
Record
SUSE-SU-2018:4155-1
Updated
2026-11-02
OSVSUSE-SU-2018:4194-1 No score

Security update for ovmf

This update for ovmf fixes the following issues:

Security issues fixed:

  • CVE-2018-3613: Fixed AuthVariable Timestamp zeroing issue on APPEND_WRITE (bsc#1115916).
  • CVE-2017-5731: Fixed privilege escalation via processing of malformed files in TianoCompress.c (bsc#1115917).
  • CVE-2017-5732: Fixed privilege escalation via processing of malformed files in BaseUefiDecompressLib.c (bsc#1115917).
  • CVE-2017-5733: Fixed privilege escalation via heap-based buffer overflow in MakeTable() function (bsc#1115917).
  • CVE-2017-5734: Fixed privilege escalation via stack-based buffer overflow in MakeTable() function (bsc#1115917).
  • CVE-2017-5735: Fixed privilege escalation via heap-based buffer overflow in Decode() function (bsc#1115917).

Non security issues fixed:

  • Fixed an issue with the default owner of PK/KEK/db/dbx and make the auto-enrollment only happen at the very first time. (bsc#1117998)
Record
SUSE-SU-2018:4194-1
Updated
2026-11-02
OSVSUSE-SU-2018:4207-1 No score

Security update for ovmf

This update for ovmf fixes the following issues:

Security issues fixed:

  • CVE-2018-3613: Fixed AuthVariable Timestamp zeroing issue on APPEND_WRITE (bsc#1115916).
  • CVE-2017-5731: Fixed privilege escalation via processing of malformed files in TianoCompress.c (bsc#1115917).
  • CVE-2017-5732: Fixed privilege escalation via processing of malformed files in BaseUefiDecompressLib.c (bsc#1115917).
  • CVE-2017-5733: Fixed privilege escalation via heap-based buffer overflow in MakeTable() function (bsc#1115917).
  • CVE-2017-5734: Fixed privilege escalation via stack-based buffer overflow in MakeTable() function (bsc#1115917).
  • CVE-2017-5735: Fixed privilege escalation via heap-based buffer overflow in Decode() function (bsc#1115917).
Record
SUSE-SU-2018:4207-1
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
OVMF
Red Hat:enterprise_linux:7::server
From an advisory covering 10 CVEs
 before 0:20180508-6.gitee3198e672e2.el7
0:20180508-6.gitee3198e672e2.el7
ovmf
Red Hat:enterprise_linux:7::server
From an advisory covering 10 CVEs
 before 0:20180508-6.gitee3198e672e2.el7
0:20180508-6.gitee3198e672e2.el7
ovmf
SUSE:Linux Enterprise Module for Server Applications 15
From an advisory covering 6 CVEs
 before 2017+git1510945757.b2662641d5-5.11.1
2017+git1510945757.b2662641d5-5.11.1
ovmf
SUSE:Linux Enterprise Desktop 12 SP4
From an advisory covering 6 CVEs
 before 2017+git1510945757.b2662641d5-3.5.1
2017+git1510945757.b2662641d5-3.5.1
ovmf
SUSE:Linux Enterprise Server 12 SP4
From an advisory covering 6 CVEs
 before 2017+git1510945757.b2662641d5-3.5.1
2017+git1510945757.b2662641d5-3.5.1
ovmf
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 6 CVEs
 before 2017+git1510945757.b2662641d5-3.5.1
2017+git1510945757.b2662641d5-3.5.1
ovmf
SUSE:Linux Enterprise Server 12 SP3
From an advisory covering 6 CVEs
 before 2017+git1492060560.b6d11d7c46-4.17.1
2017+git1492060560.b6d11d7c46-4.17.1
ovmf
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 6 CVEs
 before 2017+git1492060560.b6d11d7c46-4.17.1
2017+git1492060560.b6d11d7c46-4.17.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-5735 has been rejected by its source and should not be treated as a live vulnerability, published December 17, 2018.

References

Show 55 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open