Most recent entries from all

ALSA-2023:6330 — Moderate: edk2 security, bug fix, and enhancement update

Affected: AlmaLinux:9: edk2-aarch64, AlmaLinux:9: edk2-ovmf, AlmaLinux:9: edk2-tools, AlmaLinux:9: edk2-tools-doc

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM.

Security Fix(es):

* edk2: Function GetEfiGlobalVariable2() return value not checked in DxeImageVerificationHandler() (CVE-2019-14560) * openssl: Possible DoS translating ASN.1 object identifiers (CVE-2023-2650)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

fkie_cve-2019-14560

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.

gsd-2019-14560

openSUSE-SU-2024:13451-1 — ovmf-202308-3.1 on GA media

ovmf-202308-3.1 on GA media

RHSA-2024:0408 — Red Hat Security Advisory: edk2 security update

edk2: Function GetEfiGlobalVariable2() return value not checked in DxeImageVerificationHandler() openssl: Excessive time spent checking DH keys and parameters

SUSE-SU-2023:1921-1 — Security update for ovmf

Security update for ovmf

Withdrawn: UBUNTU-CVE-2019-14560

Withdrawn by the publisher.

Affected: Ubuntu:Pro:16.04:LTS: edk2, Ubuntu:Pro:18.04:LTS: edk2, Ubuntu:Pro:20.04:LTS: edk2, Ubuntu:22.04:LTS: edk2

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.

WID-SEC-W-2023-2922 — Red Hat Enterprise Linux: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Dateien zu manipulieren oder einen Denial-of-Service-Zustand zu verursachen.