{"containers": {"cna": {"affected": [{"product": "SCT3", "vendor": "Phoenix Technologies Ltd.", "versions": [{"status": "affected", "version": "before 5/23/2014"}]}, {"product": "BIOS", "vendor": "American Megatrends Incorporated (AMI)", "versions": [{"status": "affected", "version": "unknown"}]}], "datePublic": "2014-08-07T00:00:00", "descriptions": [{"lang": "en", "value": "Integer overflow in the Drive Execution Environment (DXE) phase in the Capsule Update feature in the UEFI implementation in EDK2 allows physically proximate attackers to bypass intended access restrictions via crafted data."}], "problemTypes": [{"descriptions": [{"description": "Integer Overflow", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-01-31T15:08:20", "orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc"}, "references": [{"tags": ["x_refsource_MISC"], "url": "http://www.kb.cert.org/vuls/id/552286"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cert@cert.org", "ID": "CVE-2014-4859", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "SCT3", "version": {"version_data": [{"version_value": "before 5/23/2014"}]}}]}, "vendor_name": "Phoenix Technologies Ltd."}, {"product": {"product_data": [{"product_name": "BIOS", "version": {"version_data": [{"version_value": "unknown"}]}}]}, "vendor_name": "American Megatrends Incorporated (AMI)"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Integer overflow in the Drive Execution Environment (DXE) phase in the Capsule Update feature in the UEFI implementation in EDK2 allows physically proximate attackers to bypass intended access restrictions via crafted data."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Integer Overflow"}]}]}, "references": {"reference_data": [{"name": "http://www.kb.cert.org/vuls/id/552286", "refsource": "MISC", "url": "http://www.kb.cert.org/vuls/id/552286"}]}}}}, "cveMetadata": {"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "assignerShortName": "certcc", "cveId": "CVE-2014-4859", "datePublished": "2020-01-31T15:08:20", "dateReserved": "2014-07-10T00:00:00", "dateUpdated": "2020-01-31T15:08:20", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tianocore:edk2:-:*:*:*:*:*:*:*", "matchCriteriaId": "97ADE942-4E59-42FE-A941-6923025B04D5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Integer overflow in the Drive Execution Environment (DXE) phase in the Capsule Update feature in the UEFI implementation in EDK2 allows physically proximate attackers to bypass intended access restrictions via crafted data."}, {"lang": "es", "value": "Un desbordamiento de enteros en la fase Drive Execution Environment (DXE) en la funcionalidad Capsule Update en la implementaci\u00f3n de UEFI en EDK2, permite a atacantes f\u00edsicamente pr\u00f3ximos omitir las restricciones de acceso previstas por medio de datos dise\u00f1ados."}], "id": "CVE-2014-4859", "lastModified": "2020-02-06T15:26:20.557", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-01-31T16:15:10.300", "references": [{"source": "cret@cert.org", "tags": ["Third Party Advisory", "US Government Resource"], "url": "http://www.kb.cert.org/vuls/id/552286"}], "sourceIdentifier": "cret@cert.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}