CVE-2018-10712
published 2018-10-30CVE-2018-10712: The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, and RestartToUEFI…
PriorityP343high7.8CVSS 3.0
AVLACLPRLUINSUCHIHAH
EXPLOIT
EPSS
1.35%
67.9th percentile
The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, and RestartToUEFI before v1.0.6.2 expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| asrock | a-tuning | < 3.0.210 | 3.0.210 |
| asrock | f-stream | < 3.0.210 | 3.0.210 |
| asrock | restart_to_uefi | < 1.0.6.2 | 1.0.6.2 |
| asrock | rgbled | < 1.0.35.1 | 1.0.35.1 |
| php5 | php5 | >= 0 < 5.5.9+dfsg-1ubuntu4.24 | 5.5.9+dfsg-1ubuntu4.24 |
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-5vcg-x4hx-4gmx: The AsrDrv101
ghsa_unreviewed·2022-05-13
CVE-2018-10712 [HIGH] CWE-732 GHSA-5vcg-x4hx-4gmx: The AsrDrv101
The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, and RestartToUEFI before v1.0.6.2 expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.
OSV
php5, php7.0, php7.1 vulnerabilities
osv·2018-03-19·CVSS 7.5
CVE-2016-10712 php5, php7.0, php7.1 vulnerabilities
php5, php7.0, php7.1 vulnerabilities
It was discovered that PHP incorrectly handled certain stream metadata. A
remote attacker could possibly use this issue to set arbitrary metadata.
This issue only affected Ubuntu 14.04 LTS. (CVE-2016-10712)
It was discovered that PHP incorrectly handled the PHAR 404 error page. A
remote attacker could possibly use this issue to conduct cross-site
scripting (XSS) attacks. This issue only affected Ubuntu 16.04 LTS and
Ubuntu 17.10. (CVE-2018-5712)
It was discovered that PHP incorrectly handled parsing certain HTTP
responses. A remote attacker could use this issue to cause PHP to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2018-7584)
No detection rules found.
No writeups or analysis indexed.
2018-10-30
Published