Linux · Security advisory · May 10, 2024

RLSA-2024:2264: edk2 security update

RLSA-2024:2264, released May 10, 2024, fixes 8 CVEs in edk2 (version 0:20231122-6.el9). None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
8
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0653
93rd percentile

Priority of the 8 CVEs

Patch now 0 Urgent 0 High 7 Routine 1

Fixed package versions

ProductReleaseFixed in
edk2rocky 90:20231122-6.el9

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2023-45232 ovmf: This update for ovmf fixes the following issues: - CVE-2023-45229: out-of-bounds read in edk2 when processing IA_N... 8.8 0.0208 None reported
High CVE-2023-45233 ovmf: This update for ovmf fixes the following issues: - CVE-2023-45229: out-of-bounds read in edk2 when processing IA_N... 8.8 0.0208 None reported
High CVE-2023-45235 ovmf: This update for ovmf fixes the following issues: - CVE-2023-45229: out-of-bounds read in edk2 when processing IA_N... 8.8 0.0122 None reported
High CVE-2023-45229 ovmf: This update for ovmf fixes the following issues: - CVE-2023-45229: Fixed integer underflow when processing IA_NA... 8.8 0.0097 None reported
High CVE-2023-45231 ovmf: This update for ovmf fixes the following issues: - CVE-2023-45229: out-of-bounds read in edk2 when processing IA_N... 8.8 0.0085 None reported
High CVE-2022-36763 edk2-aarch64: EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines 8.8 0.0029 None reported
High CVE-2022-36764 edk2-aarch64: EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines 8.8 0.0029 None reported
Routine CVE-2023-3446 openssl: OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as... 5.9 0.0653 None reported
Showing 1 to 8 of 8 1