Most recent entries from all

ALSA-2024:2264 — Important: edk2 security update

Affected: AlmaLinux:9: edk2-aarch64, AlmaLinux:9: edk2-ovmf, AlmaLinux:9: edk2-tools, AlmaLinux:9: edk2-tools-doc

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM.

Security Fix(es):

* edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message (CVE-2023-45235) * EDK2: heap buffer overflow in Tcg2MeasureGptTable() (CVE-2022-36763) * EDK2: heap buffer overflow in Tcg2MeasurePeImage() (CVE-2022-36764) * edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message (CVE-2023-45229) * edk2: Out of Bounds read when handling a ND Redirect message with truncated options (CVE-2023-45231) * edk2: Infinite loop when parsing unknown options in the Destination Options header (CVE-2023-45232) * edk2: Infinite loop when parsing a PadN option in the Destination Options header (CVE-2023-45233) * openssl: Excessive time spent checking DH keys and parameters (CVE-2023-3446)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2024-00459

BELL-CVE-2023-45229

Affected: Alpaquita:23: edk2, Alpaquita:stream: edk2

certfr-2024-avi-0679 — De multiples vulnérabilités ont été découvertes dans les produits Intel. Certaines d'entre elles permettent à un attaqu…

certfr-2024-avi-0679

EUVD-2026-259211

fkie_cve-2023-45229

EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or IA_TA option in a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality.

gsd-2023-45229

ICSA-26-141-02 — ABB B&R PCs

ABB became aware of vulnerability in the product versions listed as affected in the advisory. An update is now available that addresses and remediates the vulnerability.

A network attacker could exploit the vulnerabilities to execute remote code, initiate DoS attacks, conduct DNS cache poisoning, or extract sensitive information.

msrc_CVE-2023-45229 — Out-of-Bounds Read in EDK II Network Package

msrc_CVE-2023-45229

OESA-2024-1280 — edk2 security update

Affected: openEuler:20.03-LTS-SP1: edk2, openEuler:22.03-LTS: edk2, openEuler:22.03-LTS-SP1: edk2, openEuler:22.03-LTS-SP2: edk2, openEuler:22.03-LTS-SP3: edk2

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fix(es): EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or IA_TA option in a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality.(CVE-2023-45229) EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing Neighbor Discovery Redirect message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality.(CVE-2023-45231) EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers option from a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability. (CVE-2023-45234)

openSUSE-SU-2024:14199-1 — ovmf-202402-1.1 on GA media

ovmf-202402-1.1 on GA media

RHSA-2024:4419 — Red Hat Security Advisory: edk2 security update

edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message edk2: Out of Bounds read when handling a ND Redirect message with truncated options edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message edk2: Predictable TCP Initial Sequence Numbers edk2: Use of a Weak PseudoRandom Number Generator

SA24P003 — B&R PCs vulnerable to PixieFail attack