321 matches found
CVE-2021-28211
A heap overflow in LzmaUefiDecompressGetInfo function in EDK II...
CVE-2021-28210
CVE-2021-28210 corresponds to an unlimited recursion vulnerability in the DxeCore component of EDK II. Affects EDK II implementations (DxeCore) across multiple platforms as cited in connected advisories (AstraLinux, EulerOS, Red Hat, SUSE, Ubuntu, etc.). The NVD data indicates a CVSS v3.1 base sc...
Bn-Uefi-Helper - Helper Plugin For Analyzing UEFI Firmware
Helper plugin for analyzing UEFI firmware. This plugin contains the following features: Apply the correct prototype to the entry point function Fix segments so all segments are RWX and have the correct semantics This allows for global function pointers to be rendered correctly Apply types for cor...
USN-4923-1: EDK II vulnerabilities
Laszlo Ersek discovered that EDK II incorrectly handled recursion. A remote attacker could possibly use this issue to cause EDK II to consume resources, leading to a denial of service. CVE-2021-28210 Satoshi Tanda discovered that EDK II incorrectly handled decompressing certain images. A remote...
Ubuntu 20.04 LTS : EDK II vulnerabilities (USN-4923-1)
The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4923-1 advisory. Laszlo Ersek discovered that EDK II incorrectly handled recursion. A remote attacker could possibly use this issue to cause EDK II to consume resources,...
UBUNTU-CVE-2021-28211
A heap overflow in LzmaUefiDecompressGetInfo function in EDK II...
CVE-2021-28210
An unlimited recursion in DxeCore in EDK II...
CVE-2021-28211
A heap overflow in LzmaUefiDecompressGetInfo function in EDK II...
Updated edk2 packages fix multiples security vulnerabilities
Improper configuration in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via local access. CVE-2018-12179. Insufficient memory write check in SMM service for EDK II may allow an authenticated...
MGASA-2021-0035 Updated edk2 packages fix multiples security vulnerabilities
Improper configuration in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via local access. CVE-2018-12179. Insufficient memory write check in SMM service for EDK II may allow an authenticated...
USN-4684-1 edk2 vulnerabilities
Laszlo Ersek discovered that EDK II incorrectly validated certain signed images. An attacker could possibly use this issue with a specially crafted image to cause EDK II to hang, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS...
Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : EDK II vulnerabilities (USN-4684-1)
The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4684-1 advisory. Laszlo Ersek discovered that EDK II incorrectly validated certain signed images. An attacker could possibly use this issue with a...
EDK2 Code Issue Vulnerability
EDK2 is a set of cross-platform firmware development environments based on UEFI and PI specifications from the TianoCore Tianocore community. Tianocore Edk2 is vulnerable to code issues affecting the following products and versions: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Ubuntu...
EDK II Integer Truncation Vulnerability
EDK II is a modern, feature-rich cross-platform firmware development environment for UEFI and the UEFI Platform Initialization PI specification. EDK II suffers from an integer truncation vulnerability that can be exploited by authenticated users to elevate privileges...
EDK II Elevation of Privilege Vulnerability
EDK II is a modern, feature-rich cross-platform firmware development environment for UEFI and the UEFI Platform Initialization PI specification. An elevation of privilege vulnerability exists in EDK II that stems from a logic issue in EDK II's DxeImageVerificationHandler, which can be exploited b...
EDK II Resource Management Error Vulnerability
EDK II is a modern, feature-rich cross-platform firmware development environment for UEFI and the UEFI Platform Initialization PI specification. EDK II suffers from a resource management error vulnerability that can be exploited by an attacker to cause a denial of service...
CVE-2019-14587
Logic issue EDK II may allow an unauthenticated user to potentially enable denial of service via adjacent access...
CVE-2019-14586
Use after free vulnerability in EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via adjacent access...