CVE catalog

CVE-2017-5731

ovmf-202105-3.4 on GA media

Severity: High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: Dec 17, 2018, 3:07:48 PM UTC
Updated: Feb 4, 2026, 4:10:24 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.39% · Oct 25, 2026

Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user to potentially enable an escalation of privilege via local access.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Ubuntu	edk2	pro	`0~20150106.5c2d456b-2`	vulnerable
Ubuntu	edk2	pro	`0~20160104.c2a892d7-1`	vulnerable
Ubuntu	edk2	pro	`0~20160408.ffea0a2c-2`	vulnerable
Ubuntu	edk2	pro	`0~20160408.ffea0a2c-2ubuntu0.1`	vulnerable
Ubuntu	edk2	pro	`0~20160408.ffea0a2c-2ubuntu0.2`	vulnerable
Ubuntu	edk2	pro	`0~20160408.ffea0a2c-2ubuntu0.2+esm1`	fixed
Ubuntu	edk2	pro	`0~20170911.5dfba97c-1`	vulnerable
Ubuntu	edk2	pro	`0~20171010.234dbcef-1`	vulnerable
Ubuntu	edk2	pro	`0~20171027.76fd5a66-1`	vulnerable
Ubuntu	edk2	pro	`0~20171205.a9212288-1`	vulnerable
Ubuntu	edk2	pro	`0~20180105.0bc94c74-1`	vulnerable
Ubuntu	edk2	pro	`0~20180205.c0d9813c-1`	vulnerable
Ubuntu	edk2	pro	`0~20180205.c0d9813c-2`	vulnerable
Ubuntu	edk2	pro	`0~20180205.c0d9813c-2ubuntu0.1`	vulnerable
Ubuntu	edk2	pro	`0~20180205.c0d9813c-2ubuntu0.2`	vulnerable
Ubuntu	edk2	pro	`0~20180205.c0d9813c-2ubuntu0.3`	vulnerable
Ubuntu	edk2	pro	`0~20180205.c0d9813c-2ubuntu0.3+esm1`	fixed
Suse	ovmf	linux enterprise desktop 12 sp4	`2017+git1510945757.b2662641d5-3.5.1`	fixed
Suse	ovmf	linux enterprise server 12 sp4	`2017+git1510945757.b2662641d5-3.5.1`	fixed
Suse	ovmf	linux enterprise server for sap applications 12 sp4	`2017+git1510945757.b2662641d5-3.5.1`	fixed
Suse	ovmf	linux enterprise module for server applications 15	`2017+git1510945757.b2662641d5-5.11.1`	fixed
Suse	ovmf	linux enterprise server 12 sp3	`2017+git1492060560.b6d11d7c46-4.17.1`	fixed
Suse	ovmf	linux enterprise server for sap applications 12 sp3	`2017+git1492060560.b6d11d7c46-4.17.1`	fixed
Opensuse	ovmf	tumbleweed	`202105-3.4`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Ubuntu	edk2	deb	pro	`0~20160408.ffea0a2c-2ubuntu0.2+esm1`	Not reported	UBUNTU-CVE-2017-5731	Not reported
Ubuntu	edk2	deb	pro	`0~20180205.c0d9813c-2ubuntu0.3+esm1`	Not reported	UBUNTU-CVE-2017-5731	Not reported
Suse	ovmf	rpm	linux enterprise desktop 12 sp4	`2017+git1510945757.b2662641d5-3.5.1`	Not reported	SUSE-SU-2018:4194-1	Not reported
Suse	ovmf	rpm	linux enterprise server 12 sp4	`2017+git1510945757.b2662641d5-3.5.1`	Not reported	SUSE-SU-2018:4194-1	Not reported
Suse	ovmf	rpm	linux enterprise server for sap applications 12 sp4	`2017+git1510945757.b2662641d5-3.5.1`	Not reported	SUSE-SU-2018:4194-1	Not reported
Suse	ovmf	rpm	linux enterprise module for server applications 15	`2017+git1510945757.b2662641d5-5.11.1`	Not reported	SUSE-SU-2018:4155-1	Not reported
Suse	ovmf	rpm	linux enterprise server 12 sp3	`2017+git1492060560.b6d11d7c46-4.17.1`	Not reported	SUSE-SU-2018:4207-1	Not reported
Suse	ovmf	rpm	linux enterprise server for sap applications 12 sp3	`2017+git1492060560.b6d11d7c46-4.17.1`	Not reported	SUSE-SU-2018:4207-1	Not reported
Opensuse	ovmf	rpm	tumbleweed	`202105-3.4`	Not reported	OPENSUSE-SU-2024:11134-1	Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

[ovmf-tools]Unknown
Source package: [ovmf]
Details (1)
- 202605-3.1 · x86_64 · tumbleweed
  Unknown · Fixed: 202105-3.4
  Version impact unknown
  pypi · ovmf · opensuse · tumbleweed
[qemu-ovmf-x86_64]Unknown
Source package: [ovmf]
Details (1)
- 202605-3.1 · noarch · tumbleweed
  Unknown · Fixed: 202105-3.4
  Version impact unknown
  pypi · ovmf · opensuse · tumbleweed
[qemu-ovmf-x86_64-debug]Unknown
Source package: [ovmf]
Details (1)
- 202605-3.1 · x86_64 · tumbleweed
  Unknown · Fixed: 202105-3.4
  Version impact unknown
  pypi · ovmf · opensuse · tumbleweed
[qemu-uefi-aarch64]Unknown
Source package: [ovmf]
Details (1)
- 202605-3.1 · noarch · tumbleweed
  Unknown · Fixed: 202105-3.4
  Version impact unknown
  pypi · ovmf · opensuse · tumbleweed
[qemu-uefi-riscv64]Unknown
Source package: [ovmf]
Details (1)
- 202605-3.1 · noarch · tumbleweed
  Unknown · Fixed: 202105-3.4
  Version impact unknown
  pypi · ovmf · opensuse · tumbleweed
[ovmf]Fixed
Source package: [ovmf]
Details (1)
- 202605-3.1 · x86_64 · tumbleweed
  Fixed · Fixed: 202105-3.4
  pypi · ovmf · opensuse · tumbleweed

Observed: Oct 23, 2026, 5:29:40 PM UTC

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]