CVE-2021-28211

A heap overflow in LzmaUefiDecompressGetInfo function in EDK II...

Design/Logic Flaw

An unlimited recursion in DxeCore in EDK II...

Heap overflow

A heap overflow in LzmaUefiDecompressGetInfo function in EDK II...

CVE-2021-28210

An unlimited recursion in DxeCore in EDK II...

CVE-2021-28211

A heap overflow in LzmaUefiDecompressGetInfo function in EDK II...

CVE-2021-28210

An unlimited recursion in DxeCore in EDK II...

CVE-2021-28210

An unlimited recursion in DxeCore in EDK II...

CVE-2021-28211

CVE-2021-28211 is a heap overflow in the EDK II component function LzmaUefiDecompressGetInfo. The issue has been observed in multiple distributions via security advisories (e.g., ALAS2-2024-2722, ALINUX3-SA-2022:0214, etc.), affecting the edk2 package. Impact discussed in advisories centers on po...

CVE-2021-28211

A heap overflow in LzmaUefiDecompressGetInfo function in EDK II...

CVE-2021-28210

CVE-2021-28210 corresponds to an unlimited recursion vulnerability in the DxeCore component of EDK II. Affects EDK II implementations (DxeCore) across multiple platforms as cited in connected advisories (AstraLinux, EulerOS, Red Hat, SUSE, Ubuntu, etc.). The NVD data indicates a CVSS v3.1 base sc...

USN-4923-1: EDK II vulnerabilities

Laszlo Ersek discovered that EDK II incorrectly handled recursion. A remote attacker could possibly use this issue to cause EDK II to consume resources, leading to a denial of service. CVE-2021-28210 Satoshi Tanda discovered that EDK II incorrectly handled decompressing certain images. A remote...

Ubuntu 20.04 LTS : EDK II vulnerabilities (USN-4923-1)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4923-1 advisory. Laszlo Ersek discovered that EDK II incorrectly handled recursion. A remote attacker could possibly use this issue to cause EDK II to consume resources,...

UBUNTU-CVE-2021-28211

A heap overflow in LzmaUefiDecompressGetInfo function in EDK II...

CVE-2021-28211

A heap overflow in LzmaUefiDecompressGetInfo function in EDK II...

CVE-2021-28210

An unlimited recursion in DxeCore in EDK II...

Updated edk2 packages fix multiples security vulnerabilities

Improper configuration in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via local access. CVE-2018-12179. Insufficient memory write check in SMM service for EDK II may allow an authenticated...

MGASA-2021-0035 Updated edk2 packages fix multiples security vulnerabilities

Improper configuration in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via local access. CVE-2018-12179. Insufficient memory write check in SMM service for EDK II may allow an authenticated...

USN-4684-1 edk2 vulnerabilities

Laszlo Ersek discovered that EDK II incorrectly validated certain signed images. An attacker could possibly use this issue with a specially crafted image to cause EDK II to hang, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : EDK II vulnerabilities (USN-4684-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4684-1 advisory. Laszlo Ersek discovered that EDK II incorrectly validated certain signed images. An attacker could possibly use this issue with a...

EDK II Integer Truncation Vulnerability

EDK II is a modern, feature-rich cross-platform firmware development environment for UEFI and the UEFI Platform Initialization PI specification. EDK II suffers from an integer truncation vulnerability that can be exploited by authenticated users to elevate privileges...