MediumCVE-2023-40238

    Insydeh2o: security vulnerability (CVE-2023-40238)

    Published Sources: CVE.org

    What is affected, what to do

    A LogoFAIL issue was discovered in BmpDecoderDxe in Insyde InsydeH2O with kernel 5.2 before 05.28.47, 5.3 before 05.37.47, 5.4 before 05.45.47, 5.5 before 05.53.47, and 5.6 before 05.60.47 for certain Lenovo devices. Image parsing of crafted BMP logo files can copy data to a specific address during the DXE phase of UEFI execution.

    Update Fujitsu Esprimo D556\/2 Firmware to version 1.35.0, Fujitsu Esprimo D6011 Firmware to version 1.31.0, Fujitsu Esprimo D6012 Firmware to version 3.08.0.

    Affected
    • Fujitsu Esprimo D556\/2 Firmware lt *..1.35.0
    • Fujitsu Esprimo D6011 Firmware lt *..1.31.0
    • Fujitsu Esprimo D6012 Firmware lt *..3.08.0
    • Fujitsu Esprimo D7010 Firmware lt *..1.64.0
    • Fujitsu Esprimo D7010\/8 Firmware lt *..1.64.0
    • Fujitsu Esprimo D7011 Firmware lt *..1.31.0
    • Fujitsu Esprimo D7012 Firmware lt *..3.08.0
    • Fujitsu Esprimo D7013 Firmware lt *..3.08.0
    • Fujitsu Esprimo D738 Firmware lt *..1.38.0
    • Fujitsu Esprimo D757 Firmware lt *..1.35.0
    • Fujitsu Esprimo D9010 Firmware lt *..1.64.0
    • Fujitsu Esprimo D9011 Firmware lt *..1.31.0
    • Fujitsu Esprimo D9012 Firmware lt *..3.08.0
    • Fujitsu Esprimo D9013 Firmware lt *..3.08.0
    • Fujitsu Esprimo D957 Firmware lt *..1.35.0
    • Fujitsu Esprimo D957\/e9x\+ Firmware lt *..1.35.0
    • Fujitsu Esprimo D958 Firmware lt *..1.38.0
    • Fujitsu Esprimo G5010 Firmware lt *..1.45.0
    • Fujitsu Esprimo G5011 Firmware lt *..1.27.0
    • Fujitsu Esprimo G558 Firmware lt *..1.38.0
    • Fujitsu Esprimo G6012 Firmware lt *..3.08.0
    • Fujitsu Esprimo G9010 Firmware lt *..1.45.0
    • Fujitsu Esprimo G9012 Firmware lt *..3.08.0
    • Fujitsu Esprimo G9013 Firmware lt *..3.08.0
    • Fujitsu Esprimo K5010\/24 Firmware lt *..1.64.0
    • Fujitsu Esprimo K557\/24 Firmware lt *..1.18.0
    • Fujitsu Esprimo K558\/24 Firmware lt *..1.38.0
    • Fujitsu Esprimo P5010 Firmware lt *..1.64.0
    • Fujitsu Esprimo P5011 Firmware lt *..1.31.0
    • Fujitsu Esprimo P557 Firmware lt *..1.35.0
    • Fujitsu Esprimo P558\/power Firmware lt *..1.38.0
    • Fujitsu Esprimo P6012 Firmware lt *..3.08.0
    • Fujitsu Esprimo P7010 Firmware lt *..1.64.0
    • Fujitsu Esprimo P7011 Firmware lt *..1.31.0
    • Fujitsu Esprimo P7012 Firmware lt *..3.08.0
    • Fujitsu Esprimo P7013 Firmware lt *..3.08.0
    • Fujitsu Esprimo P757 Firmware lt *..1.35.0
    • Fujitsu Esprimo P758 Firmware lt *..1.38.0
    • Fujitsu Esprimo P9010 Firmware lte *..1.64.0
    • Fujitsu Esprimo P9011 Firmware lt *..1.31.0
    • Fujitsu Esprimo P9012 Firmware lt *..3.08.0
    • Fujitsu Esprimo P9013 Firmware lt *..3.08.0
    • Fujitsu Esprimo P957 Firmware lt *..1.35.0
    • Fujitsu Lifebook U9313x Firmware lt *..2.12
    • Fujitsu Lifebook U939 Firmware lt *..2.23
    • Fujitsu Lifebook U939x Firmware lt *..2.26
    • Fujitsu Lifebook U9413 Firmware lt *..2.12
    • Fujitsu Stylistic Q5010 Firmware lt *..1.38
    • Fujitsu Stylistic Q509 Firmware lt *..1.37
    • Fujitsu Stylistic Q7310 Firmware lt *..2.27
    • Fujitsu Stylistic Q7311 Firmware lt *..2.36
    • Fujitsu Stylistic Q7312 Firmware lt *..2.17
    • Fujitsu Stylistic Q739 Firmware lt *..2.21
    • Fujitsu Primequest 3800b Firmware lt *..2.23.0
    • Fujitsu Primequest 3800b2 Firmware lt *..1.67.0
    • Fujitsu Primequest 3800e Firmware lt *..pa25021
    • Fujitsu Primequest 3800e2 Firmware lt *..pb25021
    • Fujitsu Primequest 4400e Firmware lt *..fa17001
    • Fujitsu Primergy Bx2560 M2 Firmware lt *..1.21.0
    • Fujitsu Primergy Bx2580 M2 Firmware lt *..1.21.0
    • Fujitsu Primergy Cx2550 M4 Firmware lt *..1.51.0
    • Fujitsu Primergy Cx2550 M5 Firmware lt *..1.25.0
    • Fujitsu Primergy Cx2550 M6 Firmware lt *..1.34.0
    • Fujitsu Primergy Cx2550 M7 Firmware lt *..2.6.0
    • Fujitsu Primergy Cx2560 M4 Firmware lt *..1..51.0
    • Fujitsu Primergy Cx2560 M5 Firmware lt *..1.34.0
    • Fujitsu Primergy Cx2560 M6 Firmware lt *..1.34.0
    • Fujitsu Primergy Cx2560 M7 Firmware lt *..2.2.0
    • Fujitsu Primergy Cx2570 M4 Firmware lt *..1.51.0
    • Fujitsu Primergy Cx2570 M5 Firmware lt *..1.25.0
    • Fujitsu Primergy Gx2460 M1 Firmware lt *..7.11.3
    • Fujitsu Primergy Gx2560 M7 Firmware lt *..2.6.0
    • Fujitsu Primergy Gx2570 M6 Firmware lt *..1.9
    • Fujitsu Primergy Rx1330 M3 Firmware lt *..1.39.0
    • Fujitsu Primergy Rx1330 M4 Firmware lt *..1.30.0
    • Fujitsu Primergy Rx1330 M5 Firmware lt *..1.50.0
    • Fujitsu Primergy Rx1440 M2 Firmware lt *..1.6.0
    • Fujitsu Primergy Rx2450 M1 Firmware lt *..3.0
    • Fujitsu Primergy Rx2450 M2 Firmware lt *..1.6.0
    • Fujitsu Primergy Rx2520 M4 Firmware lt *..1.63.0
    • Fujitsu Primergy Rx2520 M5 Firmware lt *..1.41.0
    • Fujitsu Primergy Rx2530 M4 Firmware lt *..1.63.0
    • Fujitsu Primergy Rx2530 M5 Firmware lt *..1.41.0
    • Fujitsu Esprimo P958 Firmware lt *..1.38.0
    • Fujitsu Esprimo P958\/power Firmware lt *..1.38.0
    • Fujitsu Esprimo P9910 Firmware lt *..1.64.0
    • Fujitsu Esprimo Q556\/2 Firmware lt *..1.35.0
    • Fujitsu Esprimo Q556\/2\/d Firmware lt *..1.35.0
    • Fujitsu Esprimo Q558 Firmware lt *..1.38.0
    • Fujitsu Esprimo Q7010 Firmware lt *..2.20.0
    • Fujitsu Esprimo Q957\/mre Firmware lt *..1.35.0
    • Fujitsu Esprimo Q957 Firmware lt *..1.35.0
    • Fujitsu Esprimo Q958 Firmware lt *..1.38.0
    • Fujitsu Esprimo Q958\/mre Firmware lt *..1.38.0
    • Fujitsu Celsius C780 Firmware lt *..1.28.0
    • Fujitsu Celsius J5010 Firmware lt *..1.64.0
    • Fujitsu Celsius J550\/2 Firmware lt *..1.35.0
    • Fujitsu Celsius J580 Firmware lt *..1.38.0
    • Fujitsu Celsius M7010 Firmware lt *..1.12.0
    • Fujitsu Celsius M7010power Firmware lt *..1.12.0
    • Fujitsu Celsius M7010x Firmware lt *..1.06.0
    • Fujitsu Celsius M7010xpower Firmware lt *..1.06.0
    • Fujitsu Celsius R970 Firmware lt *..1.14.0
    • Fujitsu Celsius R970b Firmware lt *..1.14.0
    • Fujitsu Celsius R970bpower Firmware lt *..1.14.0
    • Fujitsu Celsius W5010 Firmware lt *..1.64.0
    • Fujitsu Celsius W5010\/l Firmware lt *..1.64.0
    • Fujitsu Celsius W5011 Firmware lt *..1.31.0
    • Fujitsu Celsius W5012 Firmware lt *..3.08.0
    • Fujitsu Celsius W5012-ll Firmware lt *..3.08.0
    • Fujitsu Celsius W570 Firmware lt *..1.35.0
    • Fujitsu Celsius W570power Firmware lt *..1.35.0
    • Fujitsu Celsius W570power\+ Firmware lt *..1.35.0
    • Fujitsu Celsius W580 Firmware lt *..1.38.0
    • Fujitsu Celsius W580power Firmware lt *..1.38.0
    • Fujitsu Celsius W580power\+ Firmware lt *..1.38.0
    • Fujitsu Celsius H5511 Firmware lt *..1.16
    • Fujitsu Celsius H7510 Firmware lt *..1.17
    • Fujitsu Celsius H7613 Firmware lt *..1.14
    • Fujitsu Celsius H780 Firmware lt *..1.23
    • Fujitsu Lifebook A3510 Firmware lt *..1.16
    • Fujitsu Primergy Rx2530 M6 Firmware lt *..1.28.0
    • Fujitsu Primergy Rx2530 M7 Firmware lt *..2.8.0
    • Fujitsu Primergy Rx2540 M4 Firmware lt *..1.63.0
    • Fujitsu Primergy Rx2540 M5 Firmware lt *..1.41.0
    • Fujitsu Primergy Rx2540 M6 Firmware lt *..1.28.0
    • Fujitsu Primergy Rx2540 M7 Firmware lt *..2.8.0
    • Fujitsu Primergy Rx4770 M3 Firmware lt *..1.27.0
    • Fujitsu Primergy Rx4770 M4 Firmware lt *..1.63.0
    • Fujitsu Primergy Rx4770 M5 Firmware lt *..1.41.0
    • Fujitsu Primergy Rx4770 M6 Firmware lt *..1.23.0
    • Fujitsu Primergy Rx4770 M7 Firmware lt *..2.8.0
    • Fujitsu Primergy Rx8770 M7 Firmware lt *..2.8.0
    • Fujitsu Primergy Tx1310 M3 Firmware lt *..1.39.0
    • Fujitsu Primergy Tx1310 M5 Firmware lt *..1.50.0
    • Fujitsu Primergy Tx1320 M3 Firmware lt *..1.39.0
    • Fujitsu Primergy Tx1320 M4 Firmware lt *..1.30.0
    • Fujitsu Primergy Tx1320 M5 Firmware lt *..1.50.0
    • Fujitsu Primergy Tx1330 M3 Firmware lt *..1.39.0
    • Fujitsu Primergy Tx1330 M4 Firmware lt *..1.30.0
    • Fujitsu Primergy Tx1330 M5 Firmware lt *..1.50.0
    • Fujitsu Primergy Tx2550 M4 Firmware lt *..1.63.0
    • Fujitsu Primergy Tx2550 M5 Firmware lt *..1.41.0
    • Fujitsu Primergy Tx2550 M7 Firmware lt *..2.5.0
    • Fujitsu Lifebook E4411 Firmware lt *..2.40
    • Fujitsu Lifebook E4511 Firmware lt *..2.40
    • Fujitsu Lifebook E5410 Firmware lt *..2.33
    • Fujitsu Lifebook E5411 Firmware lt *..2.40
    • Fujitsu Lifebook E5412 Firmware lt *..2.33
    • Fujitsu Lifebook E5412\/mtc Firmware lt *..2.33
    • Fujitsu Lifebook E5413 Firmware lt *..2.15
    • Fujitsu Lifebook E549 Firmware lt *..2.25
    • Fujitsu Lifebook E5510 Firmware lt *..2.33
    • Fujitsu Lifebook E5511 Firmware lt *..2.40
    • Fujitsu Lifebook E5512 Firmware lt *..2.33
    • Fujitsu Lifebook E5513 Firmware lt *..2.15
    • Fujitsu Lifebook E559 Firmware lt *..2.25
    • Fujitsu Lifebook T939 Firmware lt *..2.20
    • Fujitsu Lifebook U5313x Firmware lt *..2.08
    • Fujitsu Lifebook U729 Firmware lt *..2.30
    • Fujitsu Lifebook U729x Firmware lt *..2.21
    • Fujitsu Lifebook U7310 Firmware lt *..2.29
    • Fujitsu Lifebook U7311 Firmware lt *..2.44
    • Fujitsu Lifebook U7312 Firmware lt *..2.33
    • Fujitsu Lifebook U7313 Firmware lt *..2.15
    • Fujitsu Lifebook U7410 Firmware lt *..2.29
    • Fujitsu Lifebook U7411 Firmware lt *..2.44
    • Fujitsu Lifebook U7412 Firmware lt *..2.33
    • Fujitsu Lifebook U7413 Firmware lt *..2.15
    • Fujitsu Lifebook U749 Firmware lt *..2.30
    • Fujitsu Lifebook U7510 Firmware lt *..2.29
    • Fujitsu Lifebook U7511 Firmware lt *..2.44
    • Fujitsu Lifebook U7512 Firmware lt *..2.33
    • Fujitsu Lifebook U759 Firmware lt *..2.30
    • Fujitsu Lifebook U7613 Firmware lt *..2.15
    • Fujitsu Lifebook U9310 Firmware lt *..2.27
    • Fujitsu Lifebook U9310x Firmware lt *..2.27
    • Fujitsu Lifebook U9311 Firmware lt *..2.53
    • Fujitsu Lifebook U9312 Firmware lt *..2.31
    • Fujitsu Lifebook U9312x Firmware lt *..2.21
    • Insydeh2o lt 5.2..5.2.05.28.47
    • Insydeh2o lt 5.3..5.3.05.37.47
    • Insydeh2o lt 5.4..5.4.05.45.47
    • Insydeh2o lt 5.5..5.5.05.53.47
    • Insydeh2o lt 5.6..5.6.05.60.47
    Fixed in
    • Fujitsu Esprimo D556\/2 Firmware 1.35.0
    • Fujitsu Esprimo D6011 Firmware 1.31.0
    • Fujitsu Esprimo D6012 Firmware 3.08.0
    • Fujitsu Esprimo D7010 Firmware 1.64.0
    • Fujitsu Esprimo D7010\/8 Firmware 1.64.0
    • Fujitsu Esprimo D7011 Firmware 1.31.0
    • Fujitsu Esprimo D7012 Firmware 3.08.0
    • Fujitsu Esprimo D7013 Firmware 3.08.0
    • Fujitsu Esprimo D738 Firmware 1.38.0
    • Fujitsu Esprimo D757 Firmware 1.35.0
    • Fujitsu Esprimo D9010 Firmware 1.64.0
    • Fujitsu Esprimo D9011 Firmware 1.31.0
    • Fujitsu Esprimo D9012 Firmware 3.08.0
    • Fujitsu Esprimo D9013 Firmware 3.08.0
    • Fujitsu Esprimo D957 Firmware 1.35.0
    • Fujitsu Esprimo D957\/e9x\+ Firmware 1.35.0
    • Fujitsu Esprimo D958 Firmware 1.38.0
    • Fujitsu Esprimo G5010 Firmware 1.45.0
    • Fujitsu Esprimo G5011 Firmware 1.27.0
    • Fujitsu Esprimo G558 Firmware 1.38.0
    • Fujitsu Esprimo G6012 Firmware 3.08.0
    • Fujitsu Esprimo G9010 Firmware 1.45.0
    • Fujitsu Esprimo G9012 Firmware 3.08.0
    • Fujitsu Esprimo G9013 Firmware 3.08.0
    • Fujitsu Esprimo K5010\/24 Firmware 1.64.0
    • Fujitsu Esprimo K557\/24 Firmware 1.18.0
    • Fujitsu Esprimo K558\/24 Firmware 1.38.0
    • Fujitsu Esprimo P5010 Firmware 1.64.0
    • Fujitsu Esprimo P5011 Firmware 1.31.0
    • Fujitsu Esprimo P557 Firmware 1.35.0
    • Fujitsu Esprimo P558\/power Firmware 1.38.0
    • Fujitsu Esprimo P6012 Firmware 3.08.0
    • Fujitsu Esprimo P7010 Firmware 1.64.0
    • Fujitsu Esprimo P7011 Firmware 1.31.0
    • Fujitsu Esprimo P7012 Firmware 3.08.0
    • Fujitsu Esprimo P7013 Firmware 3.08.0
    • Fujitsu Esprimo P757 Firmware 1.35.0
    • Fujitsu Esprimo P758 Firmware 1.38.0
    • Fujitsu Esprimo P9011 Firmware 1.31.0
    • Fujitsu Esprimo P9012 Firmware 3.08.0
    • Fujitsu Esprimo P9013 Firmware 3.08.0
    • Fujitsu Esprimo P957 Firmware 1.35.0
    • Fujitsu Lifebook U9313x Firmware 2.12
    • Fujitsu Lifebook U939 Firmware 2.23
    • Fujitsu Lifebook U939x Firmware 2.26
    • Fujitsu Lifebook U9413 Firmware 2.12
    • Fujitsu Stylistic Q5010 Firmware 1.38
    • Fujitsu Stylistic Q509 Firmware 1.37
    • Fujitsu Stylistic Q7310 Firmware 2.27
    • Fujitsu Stylistic Q7311 Firmware 2.36
    • Fujitsu Stylistic Q7312 Firmware 2.17
    • Fujitsu Stylistic Q739 Firmware 2.21
    • Fujitsu Primequest 3800b Firmware 2.23.0
    • Fujitsu Primequest 3800b2 Firmware 1.67.0
    • Fujitsu Primequest 3800e Firmware pa25021
    • Fujitsu Primequest 3800e2 Firmware pb25021
    • Fujitsu Primequest 4400e Firmware fa17001
    • Fujitsu Primergy Bx2560 M2 Firmware 1.21.0
    • Fujitsu Primergy Bx2580 M2 Firmware 1.21.0
    • Fujitsu Primergy Cx2550 M4 Firmware 1.51.0
    • Fujitsu Primergy Cx2550 M5 Firmware 1.25.0
    • Fujitsu Primergy Cx2550 M6 Firmware 1.34.0
    • Fujitsu Primergy Cx2550 M7 Firmware 2.6.0
    • Fujitsu Primergy Cx2560 M4 Firmware 1..51.0
    • Fujitsu Primergy Cx2560 M5 Firmware 1.34.0
    • Fujitsu Primergy Cx2560 M6 Firmware 1.34.0
    • Fujitsu Primergy Cx2560 M7 Firmware 2.2.0
    • Fujitsu Primergy Cx2570 M4 Firmware 1.51.0
    • Fujitsu Primergy Cx2570 M5 Firmware 1.25.0
    • Fujitsu Primergy Gx2460 M1 Firmware 7.11.3
    • Fujitsu Primergy Gx2560 M7 Firmware 2.6.0
    • Fujitsu Primergy Gx2570 M6 Firmware 1.9
    • Fujitsu Primergy Rx1330 M3 Firmware 1.39.0
    • Fujitsu Primergy Rx1330 M4 Firmware 1.30.0
    • Fujitsu Primergy Rx1330 M5 Firmware 1.50.0
    • Fujitsu Primergy Rx1440 M2 Firmware 1.6.0
    • Fujitsu Primergy Rx2450 M1 Firmware 3.0
    • Fujitsu Primergy Rx2450 M2 Firmware 1.6.0
    • Fujitsu Primergy Rx2520 M4 Firmware 1.63.0
    • Fujitsu Primergy Rx2520 M5 Firmware 1.41.0
    • Fujitsu Primergy Rx2530 M4 Firmware 1.63.0
    • Fujitsu Primergy Rx2530 M5 Firmware 1.41.0
    • Fujitsu Esprimo P958 Firmware 1.38.0
    • Fujitsu Esprimo P958\/power Firmware 1.38.0
    • Fujitsu Esprimo P9910 Firmware 1.64.0
    • Fujitsu Esprimo Q556\/2 Firmware 1.35.0
    • Fujitsu Esprimo Q556\/2\/d Firmware 1.35.0
    • Fujitsu Esprimo Q558 Firmware 1.38.0
    • Fujitsu Esprimo Q7010 Firmware 2.20.0
    • Fujitsu Esprimo Q957\/mre Firmware 1.35.0
    • Fujitsu Esprimo Q957 Firmware 1.35.0
    • Fujitsu Esprimo Q958 Firmware 1.38.0
    • Fujitsu Esprimo Q958\/mre Firmware 1.38.0
    • Fujitsu Celsius C780 Firmware 1.28.0
    • Fujitsu Celsius J5010 Firmware 1.64.0
    • Fujitsu Celsius J550\/2 Firmware 1.35.0
    • Fujitsu Celsius J580 Firmware 1.38.0
    • Fujitsu Celsius M7010 Firmware 1.12.0
    • Fujitsu Celsius M7010power Firmware 1.12.0
    • Fujitsu Celsius M7010x Firmware 1.06.0
    • Fujitsu Celsius M7010xpower Firmware 1.06.0
    • Fujitsu Celsius R970 Firmware 1.14.0
    • Fujitsu Celsius R970b Firmware 1.14.0
    • Fujitsu Celsius R970bpower Firmware 1.14.0
    • Fujitsu Celsius W5010 Firmware 1.64.0
    • Fujitsu Celsius W5010\/l Firmware 1.64.0
    • Fujitsu Celsius W5011 Firmware 1.31.0
    • Fujitsu Celsius W5012 Firmware 3.08.0
    • Fujitsu Celsius W5012-ll Firmware 3.08.0
    • Fujitsu Celsius W570 Firmware 1.35.0
    • Fujitsu Celsius W570power Firmware 1.35.0
    • Fujitsu Celsius W570power\+ Firmware 1.35.0
    • Fujitsu Celsius W580 Firmware 1.38.0
    • Fujitsu Celsius W580power Firmware 1.38.0
    • Fujitsu Celsius W580power\+ Firmware 1.38.0
    • Fujitsu Celsius H5511 Firmware 1.16
    • Fujitsu Celsius H7510 Firmware 1.17
    • Fujitsu Celsius H7613 Firmware 1.14
    • Fujitsu Celsius H780 Firmware 1.23
    • Fujitsu Lifebook A3510 Firmware 1.16
    • Fujitsu Primergy Rx2530 M6 Firmware 1.28.0
    • Fujitsu Primergy Rx2530 M7 Firmware 2.8.0
    • Fujitsu Primergy Rx2540 M4 Firmware 1.63.0
    • Fujitsu Primergy Rx2540 M5 Firmware 1.41.0
    • Fujitsu Primergy Rx2540 M6 Firmware 1.28.0
    • Fujitsu Primergy Rx2540 M7 Firmware 2.8.0
    • Fujitsu Primergy Rx4770 M3 Firmware 1.27.0
    • Fujitsu Primergy Rx4770 M4 Firmware 1.63.0
    • Fujitsu Primergy Rx4770 M5 Firmware 1.41.0
    • Fujitsu Primergy Rx4770 M6 Firmware 1.23.0
    • Fujitsu Primergy Rx4770 M7 Firmware 2.8.0
    • Fujitsu Primergy Rx8770 M7 Firmware 2.8.0
    • Fujitsu Primergy Tx1310 M3 Firmware 1.39.0
    • Fujitsu Primergy Tx1310 M5 Firmware 1.50.0
    • Fujitsu Primergy Tx1320 M3 Firmware 1.39.0
    • Fujitsu Primergy Tx1320 M4 Firmware 1.30.0
    • Fujitsu Primergy Tx1320 M5 Firmware 1.50.0
    • Fujitsu Primergy Tx1330 M3 Firmware 1.39.0
    • Fujitsu Primergy Tx1330 M4 Firmware 1.30.0
    • Fujitsu Primergy Tx1330 M5 Firmware 1.50.0
    • Fujitsu Primergy Tx2550 M4 Firmware 1.63.0
    • Fujitsu Primergy Tx2550 M5 Firmware 1.41.0
    • Fujitsu Primergy Tx2550 M7 Firmware 2.5.0
    • Fujitsu Lifebook E4411 Firmware 2.40
    • Fujitsu Lifebook E4511 Firmware 2.40
    • Fujitsu Lifebook E5410 Firmware 2.33
    • Fujitsu Lifebook E5411 Firmware 2.40
    • Fujitsu Lifebook E5412 Firmware 2.33
    • Fujitsu Lifebook E5412\/mtc Firmware 2.33
    • Fujitsu Lifebook E5413 Firmware 2.15
    • Fujitsu Lifebook E549 Firmware 2.25
    • Fujitsu Lifebook E5510 Firmware 2.33
    • Fujitsu Lifebook E5511 Firmware 2.40
    • Fujitsu Lifebook E5512 Firmware 2.33
    • Fujitsu Lifebook E5513 Firmware 2.15
    • Fujitsu Lifebook E559 Firmware 2.25
    • Fujitsu Lifebook T939 Firmware 2.20
    • Fujitsu Lifebook U5313x Firmware 2.08
    • Fujitsu Lifebook U729 Firmware 2.30
    • Fujitsu Lifebook U729x Firmware 2.21
    • Fujitsu Lifebook U7310 Firmware 2.29
    • Fujitsu Lifebook U7311 Firmware 2.44
    • Fujitsu Lifebook U7312 Firmware 2.33
    • Fujitsu Lifebook U7313 Firmware 2.15
    • Fujitsu Lifebook U7410 Firmware 2.29
    • Fujitsu Lifebook U7411 Firmware 2.44
    • Fujitsu Lifebook U7412 Firmware 2.33
    • Fujitsu Lifebook U7413 Firmware 2.15
    • Fujitsu Lifebook U749 Firmware 2.30
    • Fujitsu Lifebook U7510 Firmware 2.29
    • Fujitsu Lifebook U7511 Firmware 2.44
    • Fujitsu Lifebook U7512 Firmware 2.33
    • Fujitsu Lifebook U759 Firmware 2.30
    • Fujitsu Lifebook U7613 Firmware 2.15
    • Fujitsu Lifebook U9310 Firmware 2.27
    • Fujitsu Lifebook U9310x Firmware 2.27
    • Fujitsu Lifebook U9311 Firmware 2.53
    • Fujitsu Lifebook U9312 Firmware 2.31
    • Fujitsu Lifebook U9312x Firmware 2.21
    • Insydeh2o 5.2.05.28.47
    • Insydeh2o 5.3.05.37.47
    • Insydeh2o 5.4.05.45.47
    • Insydeh2o 5.5.05.53.47
    • Insydeh2o 5.6.05.60.47

    Not sure whether and how you are affected? Ask a question about this vulnerability

    Metrics

    5.5

    Priority

    XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.

    Source: NVD, CVSS v3

    5.5

    CVSS v3

    Severity Medium on the scale from 0 to 10.

    Source: CVE.org

    1.8 %

    EPSS score

    Moderate — model estimates 1-10% exploitation likelihood.

    Source: FIRST EPSS, percentile 79.0

    Show all metrics
    Severity
    Medium
    Priority (0–325)

    The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?

    Read in glossary
    81.36 Methodology
    Exploit maturity

    An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.

    Read in glossary
    no public PoC known
    XIEM Effective CVSS

    XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.

    Read in glossary
    5.5 Methodology
    CVSS v3

    CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.

    Read in glossary
    5.5
    EPSS score

    The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“.

    Read in glossary
    1.8 %
    Moderate — model estimates 1-10% exploitation likelihood.
    EPSS percentile

    The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.

    Read in glossary
    79.0
    High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
    KEV status

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    —
    Published
    CISA assessment (SSVC)
    Exploitation: none known · not automatable · Technical impact: partial
    Source: CISA Vulnrichment, as of 8 December 2023
    CWE

    CWE is a catalogue of typical weakness types in software and hardware — such as flawed input validation, unsafe memory handling or poor authentication. Where a CVE names a concrete vulnerability in a concrete product, a CWE describes the underlying class of defect.

    Read in glossary
    CWE-312

    Detection rules

    No NEOSEC detection rule is available for this vulnerability yet.

    Classification under NIS2 and CRA

    Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

    NIS2

    NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

    Read in glossary
    Handle the vulnerability in regular vulnerability handling under Art. 21(2)(e) NIS2.
    CRA

    The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

    Read in glossary
    From 11.12.2027, Annex I Part II CRA requires manufacturers of affected products with digital elements to handle vulnerabilities without delay and provide security updates.
    ISO/IEC 27001

    ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

    Read in glossary
    Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

    Description

    A LogoFAIL issue was discovered in BmpDecoderDxe in Insyde InsydeH2O with kernel 5.2 before 05.28.47, 5.3 before 05.37.47, 5.4 before 05.45.47, 5.5 before 05.53.47, and 5.6 before 05.60.47 for certain Lenovo devices. Image parsing of crafted BMP logo files can copy data to a specific address during the DXE phase of UEFI execution. This occurs because of an integer signedness error involving PixelHeight and PixelWidth during RLE4/RLE8 compression.

    Source: NVD (NIST), cvelistv5

    Affected products

    The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

    Affected products
    Affected versionsFixed in
    insydeinsydeh2o
    • 5.3 – < 5.3.05.37.47
    • 5.4 – < 5.4.05.45.47
    • 5.6 – < 5.6.05.60.47
    • 5.5 – < 5.5.05.53.47
    • 5.2 – < 5.2.05.28.47
    • 5.3.05.37.47
    • 5.4.05.45.47
    • 5.6.05.60.47
    • 5.5.05.53.47
    • 5.2.05.28.47

    Vendors and products

    Affected operating systems

    Affected operating systems
    Otherfujitsucelsius_c780_firmware—
    Otherfujitsucelsius_h5511_firmware—
    Otherfujitsucelsius_h7510_firmware—
    Otherfujitsucelsius_h7613_firmware—
    Otherfujitsucelsius_h780_firmware—
    Otherfujitsucelsius_h980_firmware—
    Otherfujitsucelsius_j5010_firmware—
    Otherfujitsucelsius_j550\/2_firmware—
    Otherfujitsucelsius_j580_firmware—
    Otherfujitsucelsius_m7010_firmware—
    Otherfujitsucelsius_m7010power_firmware—
    Otherfujitsucelsius_m7010x_firmware—
    Otherfujitsucelsius_m7010xpower_firmware—
    Otherfujitsucelsius_r970_firmware—
    Otherfujitsucelsius_r970b_firmware—
    Otherfujitsucelsius_r970bpower_firmware—
    Otherfujitsucelsius_w5010\/l_firmware—
    Otherfujitsucelsius_w5010_firmware—
    Otherfujitsucelsius_w5011_firmware—
    Otherfujitsucelsius_w5012-ll_firmware—
    Otherfujitsucelsius_w5012_firmware—
    Otherfujitsucelsius_w570_firmware—
    Otherfujitsucelsius_w570power\+_firmware—
    Otherfujitsucelsius_w570power_firmware—

    Weakness classes (CWE)

    • CWE-312Cleartext Storage of Sensitive Information

      Base

      The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

      Entry at MITRE CWE-312

    References & sources

    • insyde.comsecurity-pledgeVendor advisory
    • kb.cert.orgVU#811862Third-party advisory, Third-party advisory
    • insyde.comsecurity-pledge/SA-2023053Vendor advisory
    • binarly.ioposts/finding_logofail_the_dangers_of_image_parsing_during_syst…Exploit
    • security.netapp.comadvisory/ntap-20240105-0002Third-party advisory
    Embed badge

    Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.

    Badge preview for CVE-2023-40238
    <a href="https://intel.neosec.eu/en/cve/CVE-2023-40238"><img src="https://intel.neosec.eu/badge/cve/CVE-2023-40238.svg?lang=en" alt="CVE-2023-40238 – NEOSEC Intel" height="20"></a>