CVE-2023-45231

EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing Neighbor Discovery Redirect message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality...

CVE-2023-45231

EDK2 Network Package contains CVE-2023-45231: an out-of-bounds read when processing a ND Redirect message. Affected product: EDK2 (Network Package). Impact stated as potential loss of Confidentiality. Connected advisories (Debian, AlmaLinux, Amazon, etc.) indicate this vulnerability and note that...

CVE-2023-45230

CVE-2023-45230 affects EDK2’s Network Package (edk2). The issue is a buffer overflow via a long Server ID option in the DHCPv6 client, potentially impacting confidentiality, integrity and availability. Multiple connected advisories confirm affected packages (edk2) and note that patched/upgraded v...

CVE-2023-45229 Out-of-Bounds Read in EDK II Network Package

EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IANA or IATA option in a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality...

CVE-2023-45229

CVE-2023-45229 affects the EDK2 Network Package. The root cause is an out-of-bounds read when processing DHCPv6 IA_NA/IA_TA options in Advertise messages, potentially compromising confidentiality. Affected product: edk2 (EDK II). Several connected advisories note that patches or updated edk2 pack...

CVE-2023-45229

EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IANA or IATA option in a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality...

PT-2024-1256

Name of the Vulnerable Software and Affected Versions EDK2 affected versions not specified Description The EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number, which can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of...

EDK2 Security Feature Issue Vulnerability

EDK2 is a cross-platform firmware development environment from the Tianocore community based on the UEFI and PI specifications. A security vulnerability exists in EDK2 that stems from the Network Package being susceptible to predictable TCP initial sequence numbers...

PT-2024-1143

Name of the Vulnerable Software and Affected Versions EDK2 affected versions not specified Description The EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA NA or IA TA option in a DHCPv6 Advertise message. This can be exploited by an attacker to...

PT-2024-1144

Name of the Vulnerable Software and Affected Versions: EDK2 affected versions not specified Description: The issue is related to a buffer overflow vulnerability in the Dhcp6SendRequestMsg function of the Tianocore edk2 library, specifically in the NetworkPkg/Dhcp6Dxe/Dhcp6Io.c file. This...

PT-2024-1255 · Edk2 +11 · Edk2 +11

Name of the Vulnerable Software and Affected Versions: EDK2 affected versions not specified Description: The issue is related to a buffer overflow vulnerability in EDK2's Network Package when handling the Server ID option from a DHCPv6 proxy Advertise message. This can be exploited by an attacker...

PT-2024-1249 · Tianocore +11 · Edk2 +11

Name of the Vulnerable Software and Affected Versions: EDK2 affected versions not specified Description: The issue is related to an infinite loop vulnerability in EDK2's Network Package when parsing unknown options in the Destination Options header of IPv6. This can be exploited by an attacker to...

PT-2024-1257 · Edk2 +11 · Edk2 +11

Name of the Vulnerable Software and Affected Versions: EDK2 affected versions not specified Description: The issue is related to a buffer overflow vulnerability in the DHCPv6 Advertise Message Handler component of the EDK2 library. This vulnerability can be exploited by an attacker to gain...

EDK2 Security Vulnerability

EDK2 is a cross-platform firmware development environment from the Tianocore community based on the UEFI and PI specifications. A security vulnerability exists in EDK2 that stems from the Network Package's susceptibility to an out-of-bounds read vulnerability when processing the IANA or IATA opti...

CVE-2023-5678 affecting package edk2 for versions less than 20230301gitf80f052277c8-38

CVE-2023-5678 affecting package edk2 for versions less than 20230301gitf80f052277c8-38. A patched version of the package is available...

edk2 bug fix update

An update is available for edk2. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list EDK Embedded Development Kit is a project to enable UEFI support for Virtual...

SUSE CVE-2022-36765

EDK2 is susceptible to a vulnerability in the CreateHob function, allowing a user to trigger a integer overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability...

CVE-2022-36765

A flaw was found in the CreateHob function in EDK2. An attacker, leveraging a local network, can initiate an integer overflow leading to a buffer overflow. This issue arises during size alignment within the CreateHob function, requiring activation in the PEI phase. Successful exploitation of this...

CVE-2022-36763

A heap buffer overflow flaw was found via the Tcg2MeasureGptTable function in EDK2, arising from inadequate validation of the GPT Primary Header, presenting a minor risk to confidentiality and integrity. The primary consequence is likely a crash or denial of service. This issue may allow a local...

AZL-38920 CVE-2022-36765 affecting package edk2 for versions less than 20240223gitedc6681206c1-1

EDK2 is susceptible to a vulnerability in the CreateHob function, allowing a user to trigger a integer overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability...