62 matches found
PT-2025-32670
Name of the Vulnerable Software and Affected Versions: EDK2 affected versions not specified Description: EDK2 BIOS contains a vulnerability where a user may cause an Integer Overflow or Wraparound via network means. Successful exploitation of this issue may lead to a denial of service...
AZL-66119 CVE-2025-3770 affecting package edk2 for versions less than 20230301gitf80f052277c8-43
EDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact Confidentiality, Integrity, and Availability...
DEBIAN-CVE-2025-3770
EDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact Confidentiality, Integrity, and Availability...
SUSE CVE-2024-38797
EDK2 contains a vulnerability in the HashPeImageByType. A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability...
PT-2025-11308
Name of the Vulnerable Software and Affected Versions: EDK2 affected versions not specified Description: The issue is related to an Integer Overflow or Wraparound in the BIOS of EDK2, which can be triggered by a user through network means. A successful exploitation of this issue may lead to a...
AZL-55894 CVE-2024-13176 affecting package edk2 for versions less than 20240524git3e722403cd16-6
Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would...
edk2: Integer overflows in PeCoffLoaderRelocateImage
A flaw was found in the EDK2 package. This flaw allows an attacker to cause memory corruption due to an overflow via an adjacent network. This issue may lead to loss of confidentiality, integrity, and availability...
OESA-2024-2301 edk2 security update
EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized access...
SUSE CVE-2024-38796
EDK2 contains a vulnerability in the PeCoffLoaderRelocateImage. An Attacker may cause memory corruption due to an overflow via an adjacent network. A successful exploit of this vulnerability may lead to a loss of Confidentiality, Integrity, and/or Availability...
edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message
A security flaw involving buffer overflow was identified in EDK2, the open-source reference implementation of the UEFI specification. This vulnerability enables an unauthorized attacker within the vicinity network to transmit a specifically crafted DHCPv6 proxy Advertise message, resulting in the...
OESA-2024-2022 edk2 security update
EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable function, allowing a user to trigger a heap buffer overflow via a local network. Successful...
edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message
A security flaw involving buffer overflow was identified in EDK2, the open-source reference implementation of the UEFI specification. This vulnerability enables an unauthorized attacker within the vicinity network to transmit a specifically crafted DHCPv6 proxy Advertise message, resulting in the...
AZL-42346 CVE-2024-1298 affecting package edk2 for versions less than 20230301gitf80f052277c8-39
EDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division-By-Zero due to a UNIT32 overflow via local access. A successful exploit of this vulnerability may lead to a loss of Availability...
UBUNTU-CVE-2024-1298
EDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division-By-Zero due to a UNIT32 overflow via local access. A successful exploit of this vulnerability may lead to a loss of Availability...
edk2: Buffer overflow in the DHCPv6 client via a long Server ID option
A security flaw was identified in EDK2, the open-source reference implementation of the UEFI specification, involving a buffer overflow vulnerability. This particular weakness enables an unauthorized attacker within the vicinity of the network to transmit a specifically crafted DHCPv6 message...
EDK2: heap buffer overflow in Tcg2MeasurePeImage()
A heap-based buffer overflow flaw was found via the Tcg2MeasurePeImage function in EDK2. Successful exploitation requires a local attacker to trigger an integer overflow in the calculation of the EventSize variable at DxeTpm2MeasureBootLib.c, leading to the heap-buffer overflow, presenting a...
edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message
A security flaw involving buffer overflow was identified in EDK2, the open-source reference implementation of the UEFI specification. This vulnerability enables an unauthorized attacker within the vicinity network to transmit a specifically crafted DHCPv6 proxy Advertise message, resulting in the...
Infinite loop in EDK II Network Package
...