Linux · Security advisory · May 22, 2024

RHSA-2024:3017: Security update for 2 packages

RHSA-2024:3017, released May 22, 2024, fixes 8 CVEs across 2 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
8
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0208
81st percentile

Priority of the 8 CVEs

Patch now 0 Urgent 0 High 8 Routine 0

Fixed package versions

ProductReleaseFixed in
edk2-aarch64RHEL 80:20220126gitbb1bba3d77-13.el8_10
edk2-ovmfRHEL 80:20220126gitbb1bba3d77-13.el8_10

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2023-45232 ovmf: This update for ovmf fixes the following issues: - CVE-2023-45229: out-of-bounds read in edk2 when processing IA_N... 8.8 0.0208 None reported
High CVE-2023-45233 ovmf: This update for ovmf fixes the following issues: - CVE-2023-45229: out-of-bounds read in edk2 when processing IA_N... 8.8 0.0208 None reported
High CVE-2023-45235 ovmf: This update for ovmf fixes the following issues: - CVE-2023-45229: out-of-bounds read in edk2 when processing IA_N... 8.8 0.0122 None reported
High CVE-2023-45229 ovmf: This update for ovmf fixes the following issues: - CVE-2023-45229: Fixed integer underflow when processing IA_NA... 8.8 0.0097 None reported
High CVE-2023-45231 ovmf: This update for ovmf fixes the following issues: - CVE-2023-45229: out-of-bounds read in edk2 when processing IA_N... 8.8 0.0085 None reported
High CVE-2022-36763 edk2-aarch64: EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines 8.8 0.0029 None reported
High CVE-2022-36764 edk2-aarch64: EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines 8.8 0.0029 None reported
High CVE-2022-36765 ovmf: This update for ovmf fixes the following issues: - CVE-2022-36765: Fixed integer overflow to buffer overflow via loc... 8.8 0.0029 None reported
Showing 1 to 8 of 8 1