CVE-2023-48733

An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. This allows an OS-resident attacker to bypass Secure Boot...

[SECURITY] [DSA 5624-1] edk2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5624-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff February 14, 2024 https://www.debian.org/security/faq -...

PT-2024-13784 · Canonical · Lxd

Name of the Vulnerable Software and Affected Versions: LXD affected versions not specified Description: The issue is related to an insecure default setting that allows the UEFI Shell in EDK2, which was left enabled in LXD. This setting enables an OS-resident attacker to bypass Secure Boot...

CVE-2023-48733

An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. This allows an OS-resident attacker to bypass Secure Boot...

DSA-5624-1 edk2 - security update

Bulletin has no description...

CVE-2023-49721

An insecure default to allow UEFI Shell in EDK2 was left enabled in LXD. This allows an OS-resident attacker to bypass Secure Boot...

Moderate: Red Hat Security Advisory: edk2 security update

An update for edk2 is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...

The vulnerability of the DHCPv6 Advertise Message Handler component in the Tianocore EDK2 library, which allows a attacker to compromise the confidentiality, integrity, and accessibility of data.

The vulnerability of the DHCPv6 Advertise Message Handler component in the Tianocore EDK2 library is related to buffer overflow attacks. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of data...

The vulnerability of the NetRandomInitSeed() function in the Tianocore edk2 library, which allows a hacker to gain unauthorized access to protected information or cause service failures.

The vulnerability of the NetRandomInitSeed function in the Tianocore edk2 library is related to errors in the code of the pseudo-random number generator when processing the Seed parameter. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information or...

The vulnerability of the Ip6IsOptionValid() function in the Tianocore edk2 library, which allows a attacker to compromise the accessibility of protected information or cause service failures.

The vulnerability of the Ip6IsOptionValid function in the Tianocore edk2 library is related to the execution of a loop with an unreachable exit condition when processing the PadN parameter. Exploiting this vulnerability could allow a remote attacker to compromise the accessibility of protected...

The vulnerability of the IPv6 Options Header Handler component in the Tianocore EDK2 library, which allows a hacker to cause a service failure.

The vulnerability of the IPv6 Options Header Handler component in the Tianocore EDK2 library is related to buffer overflow. Exploiting this vulnerability allows a remote attacker to cause a service failure...

The vulnerability of the Dhcp6SendRequestMsg function in the Tianocore edk2 library allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Dhcp6SendRequestMsg function in the Tianocore edk2 library is related to buffer overflow. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

SUSE CVE-2023-45229

EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IANA or IATA option in a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality...

SUSE CVE-2023-45230

EDK2's Network Package is susceptible to a buffer overflow vulnerability via a long server ID option in DHCPv6 client. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability...

SUSE CVE-2023-45235

EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option from a DHCPv6 proxy Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or...

SUSE CVE-2023-45234

EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers option from a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or...

CVE-2023-45237

A security flaw has been identified in the cryptographic system of EDK2, the open-source reference implementation of the UEFI specification. This vulnerability enables an unauthorized remote attacker to potentially expose sensitive information. Mitigation Mitigation for this issue is either not...

CVE-2023-45235

A security flaw involving buffer overflow was identified in EDK2, the open-source reference implementation of the UEFI specification. This vulnerability enables an unauthorized attacker within the vicinity network to transmit a specifically crafted DHCPv6 proxy Advertise message, resulting in the...

CVE-2023-45233

The Network Package in EDK2 is vulnerable to an infinite loop exploit when parsing a PadN option within the Destination Options header of IPv6. This flaw allows an unauthorized attacker to gain access and potentially result in a loss of system availability. Mitigation Mitigation for this issue is...

CVE-2023-45236

A security flaw has been identified in EDK2, the open-source reference implementation of the UEFI specification. This vulnerability enables an unauthorized attacker to potentially disclose sensitive information. Mitigation Mitigation for this issue is either not available or the currently availab...