Most recent entries from all

ALSA-2024:4749 — Moderate: edk2 security update

Affected: AlmaLinux:9: edk2-aarch64, AlmaLinux:9: edk2-ovmf, AlmaLinux:9: edk2-tools, AlmaLinux:9: edk2-tools-doc

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM.

Security Fix(es):

* EDK2: integer overflow in CreateHob() could lead to HOB OOB R/W (CVE-2022-36765) * edk2: Predictable TCP Initial Sequence Numbers (CVE-2023-45236) * edk2: Use of a Weak PseudoRandom Number Generator (CVE-2023-45237)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-00626

BELL-CVE-2023-45237

Affected: Alpaquita:23: edk2, Alpaquita:stream: edk2

certfr-2024-avi-0679 — De multiples vulnérabilités ont été découvertes dans les produits Intel. Certaines d'entre elles permettent à un attaqu…

certfr-2024-avi-0679

EUVD-2026-259219

fkie_cve-2023-45237

EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality.

GHSA-fxqf-p2p3-gxvr

gsd-2023-45237

ICSA-26-141-02 — ABB B&R PCs

ABB became aware of vulnerability in the product versions listed as affected in the advisory. An update is now available that addresses and remediates the vulnerability.

A network attacker could exploit the vulnerabilities to execute remote code, initiate DoS attacks, conduct DNS cache poisoning, or extract sensitive information.

msrc_CVE-2023-45237 — Use of a Weak PseudoRandom Number Generator in EDK II Network Package

msrc_CVE-2023-45237

OESA-2024-2301 — edk2 security update

Affected: openEuler:22.03-LTS-SP4: edk2, openEuler:22.03-LTS-SP3: edk2, openEuler:20.03-LTS-SP4: edk2, openEuler:22.03-LTS-SP1: edk2, openEuler:24.03-LTS: edk2

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fix(es): EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality. (CVE-2023-45236) EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality. (CVE-2023-45237)

openSUSE-SU-2024:14336-1 — ovmf-202405-1.1 on GA media

ovmf-202405-1.1 on GA media

RHSA-2024:4419 — Red Hat Security Advisory: edk2 security update

edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message edk2: Out of Bounds read when handling a ND Redirect message with truncated options edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message edk2: Predictable TCP Initial Sequence Numbers edk2: Use of a Weak PseudoRandom Number Generator

SA24P003 — B&R PCs vulnerable to PixieFail attack