Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -6 articles for you...
172
security advisorybuffer overflowremote code executionUbuntu 23.10: USN-6638-1 Moderate: EDK II Buffer Overflow Issues
Several security issues were fixed in EDK II.. ========================================================================== Ubuntu Security Notice USN-6638-1 February 15, 2024 edk2 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 23.10 - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS Summary: Several security issues were fixed in EDK II. Software Description: - edk2: UEFI firmware for virtual machines Details: Marc Beatove discovered buffer overflows exit in EDK2. An attacker on the local network could potentially use this to impact availability or possibly cause remote code execution. (CVE-2022-36763, CVE-2022-36764, CVE-2022-36765) It was discovered that a buffer overflows exists in EDK2's Network Package An attacker on the local network could potentially use these to impact availability or possibly cause remote code execution. (CVE-2023-45230, CVE-2023-45234, CVE-2023-45235) It was discovered that an out-of-bounds read exists in EDK2's Network Package An attacker on the local network could potentially use this to impact confidentiality. (CVE-2023-45231) It was discovered that infinite-loops exists in EDK2's Network Package An attacker on the local network could potentially use these to impact availability. (CVE-2023-45232, CVE-2023-45233) Mate Kukri discovered that an insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. An attacker could use this to bypass Secure Boot. (CVE-2023-48733) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 23.10: efi-shell-aa64 2023.05-2ubuntu0.1 efi-shell-arm 2023.05-2ubuntu0.1 efi-shell-x64 2023.05-2ubuntu0.1 ovmf 2023.05-2ubuntu0.1 qemu-efi-aarch64 2023.05-2ubuntu0.1 qemu-efi-arm 2023.05-2ubuntu0.1 Ubuntu 22.04 LTS: ovmf 2022.02-3ubuntu0.22.04.2 qemu-efi 2022.02-3ubuntu0.22.04.2 qemu-efi-aarch64 2022.02-3ubuntu0.22.04.2 qemu-efi-arm 2022.02-3ubuntu0.22.04.2 Ubuntu 20.04 LTS: ovmf 0~20191122.bd85bf54-2ubuntu3.5 qemu-efi 0~20191122.bd85bf54-2ubuntu3.5 qemu-efi-aarch64 0~20191122.bd85bf54-2ubuntu3.5 qemu-efi-arm 0~20191122.bd85bf54-2ubuntu3.5 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6638-1 CVE-2022-36763, CVE-2022-36764, CVE-2022-36765, CVE-2023-45230, CVE-2023-45231, CVE-2023-45232, CVE-2023-45233, CVE-2023-45234, CVE-2023-45235, CVE-2023-48733,https://bugs.launchpad.net/ubuntu/+source/edk2/+bug/2040137 Package Information: https://launchpad.net/ubuntu/+source/edk2/0~20191122.bd85bf54-2ubuntu3.5 . A range of vulnerabilities concerning Ubuntu's EDK II firmware has been addressed, leading to enhanced overall system protection.. EDK II Issues, Ubuntu Security Fixes, UEFI Firmware Updates. . LinuxSecurity.com Team
Feb 15, 2024
Ubuntu
203
security advisorycriticalMageiaMageia 8: MGASA-2022-0473 Critical: Golang Header Cache Management Issue
net/http: limit canonical header cache by bytes, not entries (bsc#1206135) (CVE-2022-41717) References: - https://bugs.mageia.org/show_bug.cgi?id=31267 . MGASA-2022-0473 - Updated golang packages fix security vulnerability Publication date: 17 Dec 2022 URL: https://advisories.mageia.org/MGASA-2022-0473.html Type: security Affected Mageia releases: 8 CVE: CVE-2022-41717 net/http: limit canonical header cache by bytes, not entries (bsc#1206135) (CVE-2022-41717) References: - https://bugs.mageia.org/show_bug.cgi?id=31267 - https://lists.suse.com/pipermail/sle-security-updates/2022-December/013213.html - https://lists.suse.com/pipermail/sle-security-updates/2022-December/013214.html - - - https://www.cve.org/CVERecord?id=CVE-2022-41717 SRPMS: - 8/core/golang-1.18.9-1.mga8 . Recent updates in Go packages address a significant security vulnerability in Mageia, related to the management of header caches.. Golang Security, Mageia Updates, Network Package Fixes. . Severity: Critical. LinuxSecurity.com Team
Dec 17, 2022
•Critical
Mageia
98
security advisorybuffer overflowred hatRed Hat Enterprise Linux 8.2: RHSA-2021:3369-01 Important Buffer Overflow
An update for edk2 is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: edk2 security update Advisory ID: RHSA-2021:3369-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:3369 Issue date: 2021-08-31 ==================================================================== 1. Summary: An update for edk2 is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream EUS (v. 8.2) - noarch 3. Description: EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * edk2: remote buffer overflow in IScsiHexToBin function in NetworkPkg/IScsiDxe (BZ#1956284) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1956284 - edk2: remote buffer overflow in IScsiHexToBin function in NetworkPkg/IScsiDxe 6. Package List: Red Hat Enterprise Linux AppStream EUS (v.8.2): Source: edk2-20190829git37eef91017ad-9.el8_2.1.src.rpm noarch: edk2-aarch64-20190829git37eef91017ad-9.el8_2.1.noarch.rpm edk2-ovmf-20190829git37eef91017ad-9.el8_2.1.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYS3y8NzjgjWX9erEAQjjeQ/+JNVLHU3M0FvVqAKpknAsJu7jkIkZ6JzM 8A8iQkzaCWYmDlFEQh8/FEpdqNjwRqvZLrm0WloxzBqlmNBy9xKGqievPZN8OK0h w8zlhTuE/q0sIHjPmugxUdzTxOrVKeRqj893gqSUXgFL+hwLYiZW1YEsHHUsvEy9 Og1H48TD6ewFxoBci9jaNzJE5q5xySCnv0raL6QLN4WfnlGP0EHvofqjIm+vdsp8 LJwKzFJg20R+PbrAbFV8aLCEIu46/00x1SjPeoLi4cBXtdb8JxrHZytIG2vXF/8k gOzqPmy9opblAky8HvamptBgCF5kP4rOCKLhtwtx/htvCB2u1ipq+CfRpLq0OW2O TvyfRVvbF+cS68uJHVxV5RTYhRDZD2H4cF8pYPnpzav7oFhaoChhx8UgN6WLVRK4 vaPiCx9O3wKvLY970jFR5nI626tV1dCOO7zUtZ/m+rcPq70U0LvQdR7eHgZ5bgxT mSCfmb/MVknLHR6ENYXUXzd6VI1JJmSKdyJUyygqMnCnw/BW8XLcCtoNyfm4Jig6 LgY3qSqK6eQOzKnYZ+aEnvAPxj2n7D7nOHTTj1X8zCiiRf5yyd44NhBTfKgugjyH tD4VrBgzaasbW0QhmDnN1fXWvV6MLiy1I/bEbHLWKcyfGo3V2ojPLXY/PgOmba6y HKrwZV6acd8=2tAN -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Aug 31, 2021
•Important
Red Hat
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!