CVE-2023-45237

EDK2 Network Package is vulnerable to a predictable TCP Initial Sequence Number (CVE-2023-45237) which could lead to unauthorized access and confidentiality loss. Several connected advisories note a patched version is available; remediation is to update edk2 to a fixed release per vendor/ distro ...

CVE-2023-45237 Use of a Weak PseudoRandom Number Generator in EDK II Network Package

EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality...

CVE-2023-45236

EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality...

CVE-2023-45236

CVE-2023-45236 affects EDK II’s Network Package, which is vulnerable to a predictable TCP Initial Sequence Number. Public descriptions in connected documents identify the affected component as EDK II’s Network Package and note that exploitation could lead to unauthorized access and potential loss...

CVE-2023-45231

EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing Neighbor Discovery Redirect message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality...

CVE-2023-45231

EDK2 Network Package contains CVE-2023-45231: an out-of-bounds read when processing a ND Redirect message. Affected product: EDK2 (Network Package). Impact stated as potential loss of Confidentiality. Connected advisories (Debian, AlmaLinux, Amazon, etc.) indicate this vulnerability and note that...

CVE-2023-45230

CVE-2023-45230 affects EDK2’s Network Package (edk2). The issue is a buffer overflow via a long Server ID option in the DHCPv6 client, potentially impacting confidentiality, integrity and availability. Multiple connected advisories confirm affected packages (edk2) and note that patched/upgraded v...

CVE-2023-45229 Out-of-Bounds Read in EDK II Network Package

EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IANA or IATA option in a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality...

CVE-2023-45229

EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IANA or IATA option in a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality...

CVE-2023-45229

CVE-2023-45229 affects the EDK2 Network Package. The root cause is an out-of-bounds read when processing DHCPv6 IA_NA/IA_TA options in Advertise messages, potentially compromising confidentiality. Affected product: edk2 (EDK II). Several connected advisories note that patches or updated edk2 pack...

PT-2024-1255 · Edk2 +11 · Edk2 +11

Name of the Vulnerable Software and Affected Versions: EDK2 affected versions not specified Description: The issue is related to a buffer overflow vulnerability in EDK2's Network Package when handling the Server ID option from a DHCPv6 proxy Advertise message. This can be exploited by an attacker...

PT-2024-1249 · Tianocore +11 · Edk2 +11

Name of the Vulnerable Software and Affected Versions: EDK2 affected versions not specified Description: The issue is related to an infinite loop vulnerability in EDK2's Network Package when parsing unknown options in the Destination Options header of IPv6. This can be exploited by an attacker to...

EDK2 Security Vulnerability

EDK2 is a cross-platform firmware development environment from the Tianocore community based on the UEFI and PI specifications. A security vulnerability exists in EDK2 that stems from the Network Package's susceptibility to an out-of-bounds read vulnerability when processing the IANA or IATA opti...

PT-2024-1144

Name of the Vulnerable Software and Affected Versions: EDK2 affected versions not specified Description: The issue is related to a buffer overflow vulnerability in the Dhcp6SendRequestMsg function of the Tianocore edk2 library, specifically in the NetworkPkg/Dhcp6Dxe/Dhcp6Io.c file. This...

PT-2024-1257 · Edk2 +11 · Edk2 +11

Name of the Vulnerable Software and Affected Versions: EDK2 affected versions not specified Description: The issue is related to a buffer overflow vulnerability in the DHCPv6 Advertise Message Handler component of the EDK2 library. This vulnerability can be exploited by an attacker to gain...

EDK2 Security Feature Issue Vulnerability

EDK2 is a cross-platform firmware development environment from the Tianocore community based on the UEFI and PI specifications. A security vulnerability exists in EDK2 that stems from the Network Package being susceptible to predictable TCP initial sequence numbers...

PT-2024-1143

Name of the Vulnerable Software and Affected Versions EDK2 affected versions not specified Description The EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA NA or IA TA option in a DHCPv6 Advertise message. This can be exploited by an attacker to...

PT-2024-1256

Name of the Vulnerable Software and Affected Versions EDK2 affected versions not specified Description The EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number, which can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of...

CVE-2023-5678 affecting package edk2 for versions less than 20230301gitf80f052277c8-38

CVE-2023-5678 affecting package edk2 for versions less than 20230301gitf80f052277c8-38. A patched version of the package is available...

edk2 bug fix update

An update is available for edk2. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list EDK Embedded Development Kit is a project to enable UEFI support for Virtual...