Skip to content

Commit 46b99a9

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2689-5p89-6j3j GHSA-hm2w-vr2p-hq7w GHSA-r8rp-5f55-5j9x GHSA-rm5f-3c25-p4cw
1 parent bf6ec78 commit 46b99a9

4 files changed

Lines changed: 178 additions & 10 deletions

File tree

‎advisories/github-reviewed/2026/04/GHSA-2689-5p89-6j3j/GHSA-2689-5p89-6j3j.json‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2689-5p89-6j3j",
4+
"modified": "2026-04-16T01:30:48Z",
5+
"published": "2026-04-16T01:30:48Z",
6+
"aliases": [],
7+
"summary": "UEFI Firmware Parser has a stack out-of-bounds write in tiano decompressor MakeTable",
8+
"details": "`uefi-firmware` contains a stack out-of-bounds write vulnerability in the native tiano/EFI decompressor. in `uefi_firmware/compression/Tiano/Decompress.c`, `MakeTable()` does not validate that bit-length values read from the compressed bitstream are within the expected range (`0..16`). a crafted firmware blob can supply bit lengths greater than `16`, causing out-of-bounds writes to the stack-allocated `Count[17]` array and related decode tables.\n\nreachability is through the normal parsing path: `CompressedSection.process()` -> `efi_compressor.TianoDecompress()` -> `TianoDecompress()` -> `ReadPTLen()` -> `MakeTable()`.\n\nMinimum impact is a deterministic crash; depending on build/runtime details, the stack memory corruption may be exploitable for code execution in the context of the parsing process. this project shipped its own copy of the decompressor without the upstream EDK2 hardening for this bug class.\n\nReferences:\n\n- PR: <https://github.com/theopolis/uefi-firmware-parser/pull/145>\n- fix commit: <https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e>\n- upstream related fixes: CVE-2017-5731, CVE-2017-5732, CVE-2017-5733, CVE-2017-5734, CVE-2017-5735",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "PyPI",
19+
"name": "uefi-firmware"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"last_affected": "1.12"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/theopolis/uefi-firmware-parser/security/advisories/GHSA-2689-5p89-6j3j"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://github.com/theopolis/uefi-firmware-parser/pull/145"
44+
},
45+
{
46+
"type": "WEB",
47+
"url": "https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e"
48+
},
49+
{
50+
"type": "PACKAGE",
51+
"url": "https://github.com/theopolis/uefi-firmware-parser"
52+
}
53+
],
54+
"database_specific": {
55+
"cwe_ids": [
56+
"CWE-787"
57+
],
58+
"severity": "CRITICAL",
59+
"github_reviewed": true,
60+
"github_reviewed_at": "2026-04-16T01:30:48Z",
61+
"nvd_published_at": null
62+
}
63+
}

‎advisories/github-reviewed/2026/04/GHSA-hm2w-vr2p-hq7w/GHSA-hm2w-vr2p-hq7w.json‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hm2w-vr2p-hq7w",
4+
"modified": "2026-04-16T01:31:09Z",
5+
"published": "2026-04-16T01:31:09Z",
6+
"aliases": [],
7+
"summary": "UEFI Firmware Parser has a heap out-of-bounds write in tiano decompressor ReadCLen",
8+
"details": "`uefi-firmware` contains a heap out-of-bounds write vulnerability in the native tiano/EFI decompressor. in `uefi_firmware/compression/Tiano/Decompress.c`, `ReadCLen()` reads `Number = GetBits(Sd, CBIT)` with `CBIT = 9`, so `Number` can be as large as `511`, while the destination array `Sd->mCLen` has `NC = 510` elements. the loop writes while `Index < Number` without enforcing `Index < NC`. additionally, the `CharC == 2` run-length path performs `GetBits(Sd, 9) + 20`, allowing up to `531` zero writes through `Sd->mCLen[Index++] = 0`.\n\nReachability is through the normal parsing path: `CompressedSection.process()` -> `efi_compressor.TianoDecompress()` -> `TianoDecompress()` -> `DecodeC()` -> `ReadCLen()`.\n\nMinimum impact is a deterministic crash; depending on build/runtime details, the heap memory corruption may be exploitable for code execution in the context of the parsing process. this project shipped its own copy of the decompressor without the upstream EDK2 hardening for this bug class.\n\n- PR: <https://github.com/theopolis/uefi-firmware-parser/pull/145>\n- fix commit: <https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e>\n- upstream related fixes: CVE-2017-5731, CVE-2017-5732, CVE-2017-5733, CVE-2017-5734, CVE-2017-5735",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "PyPI",
19+
"name": "uefi-firmware"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"last_affected": "1.12"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/theopolis/uefi-firmware-parser/security/advisories/GHSA-hm2w-vr2p-hq7w"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://github.com/theopolis/uefi-firmware-parser/pull/145"
44+
},
45+
{
46+
"type": "WEB",
47+
"url": "https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e"
48+
},
49+
{
50+
"type": "PACKAGE",
51+
"url": "https://github.com/theopolis/uefi-firmware-parser"
52+
}
53+
],
54+
"database_specific": {
55+
"cwe_ids": [
56+
"CWE-787"
57+
],
58+
"severity": "CRITICAL",
59+
"github_reviewed": true,
60+
"github_reviewed_at": "2026-04-16T01:31:09Z",
61+
"nvd_published_at": null
62+
}
63+
}

advisories/unreviewed/2026/04/GHSA-r8rp-5f55-5j9x/GHSA-r8rp-5f55-5j9x.json renamed to advisories/github-reviewed/2026/04/GHSA-r8rp-5f55-5j9x/GHSA-r8rp-5f55-5j9x.json

Lines changed: 26 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-r8rp-5f55-5j9x",
4-
"modified": "2026-04-14T18:30:35Z",
4+
"modified": "2026-04-16T01:31:46Z",
55
"published": "2026-04-14T18:30:35Z",
66
"aliases": [
77
"CVE-2026-38529"
88
],
9+
"summary": "Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php",
910
"details": "A Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily reset user passwords and perform a full account takeover via supplying a crafted HTTP request.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "krayin/laravel-crm"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "2.2.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
@@ -24,7 +45,7 @@
2445
"url": "https://github.com/TREXNEGRO/Security-Advisories/tree/main/CVE-2026-38529"
2546
},
2647
{
27-
"type": "WEB",
48+
"type": "PACKAGE",
2849
"url": "https://github.com/krayin/laravel-crm"
2950
}
3051
],
@@ -33,8 +54,8 @@
3354
"CWE-269"
3455
],
3556
"severity": "HIGH",
36-
"github_reviewed": false,
37-
"github_reviewed_at": null,
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2026-04-16T01:31:46Z",
3859
"nvd_published_at": "2026-04-14T16:16:43Z"
3960
}
4061
}

advisories/unreviewed/2026/04/GHSA-rm5f-3c25-p4cw/GHSA-rm5f-3c25-p4cw.json renamed to advisories/github-reviewed/2026/04/GHSA-rm5f-3c25-p4cw/GHSA-rm5f-3c25-p4cw.json

Lines changed: 26 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-rm5f-3c25-p4cw",
4-
"modified": "2026-04-14T18:30:35Z",
4+
"modified": "2026-04-16T01:31:36Z",
55
"published": "2026-04-14T18:30:35Z",
66
"aliases": [
77
"CVE-2026-38530"
88
],
9+
"summary": "Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php",
910
"details": "A Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any lead owned by other users via supplying a crafted GET request.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "krayin/laravel-crm"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "2.2.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
@@ -24,7 +45,7 @@
2445
"url": "https://github.com/TREXNEGRO/Security-Advisories/tree/main/CVE-2026-38530"
2546
},
2647
{
27-
"type": "WEB",
48+
"type": "PACKAGE",
2849
"url": "https://github.com/krayin/laravel-crm"
2950
}
3051
],
@@ -33,8 +54,8 @@
3354
"CWE-639"
3455
],
3556
"severity": "HIGH",
36-
"github_reviewed": false,
37-
"github_reviewed_at": null,
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2026-04-16T01:31:36Z",
3859
"nvd_published_at": "2026-04-14T16:16:43Z"
3960
}
4061
}

0 commit comments

Comments
 (0)