Browse CVEs

HIGH 7.8 CVE-2026-34963 barebox version prior to 2026.04.0 contains multiple memory-safety vulnerabilities in the EFI PE loader in efi/loader/pe.c where integer overflow in … Barebox 2026.04.0+ Fix from $1,9502026-05-11 MEDIUM 5.5 CVE-2026-34962 barebox version prior to 2026.04.0 contains a denial-of-service vulnerability in ext4 directory parsing in fs/ext4/ext4_common.c where the ext4fs_ite… Barebox 2026.04.0+ Fix from $1,6002026-05-11 HIGH 7.7 CVE-2026-34961 barebox prior to version 2026.04.0 contains out-of-bounds read vulnerabilities in ext4 extent parsing due to missing validation of the eh_entries fie… Barebox 2026.04.0+ Fix from $1,9502026-05-11 MEDIUM 6.5 CVE-2026-34960 barebox prior to version 2026.04.0 contains an out-of-bounds read vulnerability in DHCP option parsing within the dhcp_message_type() function that f… Barebox 2026.04.0+ Fix from $1,6002026-05-11 MEDIUM 5.3 CVE-2026-34155 RAUC controls the update process on embedded Linux systems. Prior to version 1.15.2, RAUC bundles using the 'plain' format exceeding a payload size o… Rauc 1.15.2+ Fix from $1,6002026-03-31 HIGH 7.5 CVE-2021-37847 crypto/digest.c in Pengutronix barebox through 2021.07.0 leaks timing information because memcmp is used during digest verification. Barebox after 2021.07.0 Fix from $1,9502021-08-02 HIGH 7.5 CVE-2021-37848 common/password.c in Pengutronix barebox through 2021.07.0 leaks timing information because strncmp is used during hash comparison. Barebox after 2021.07.0 Fix from $1,9502021-08-02 MEDIUM 6.6 CVE-2020-25860 The install.c module in the Pengutronix RAUC update client prior to version 1.5 has a Time-of-Check Time-of-Use vulnerability, where signature verifi… Rauc 1.5+ Fix from $1,6002020-12-21 CRITICAL 9.1 CVE-2020-13910 Pengutronix Barebox through v2020.05.0 has an out-of-bounds read in nfs_read_reply in net/nfs.c because a field of an incoming network packet is dire… Barebox after 2020.05.0 Fix from $2,3002020-06-07 CRITICAL 9.8 CVE-2019-15937 Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_reply in net/nfs.c because a length field is directly used for a m… Barebox after 2019.08.1 Fix from $2,3002019-09-05 CRITICAL 9.8 CVE-2019-15938 Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_req in fs/nfs.c because a length field is directly used for a memc… Barebox after 2019.08.1 Fix from $2,3002019-09-05