Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    106 vulnerabilities by tianocore

    CVE-2021-28213 (GCVE-0-2021-28213)

    Vulnerability from cvelistv5 – Published: 2021-06-11 15:11 – Updated: 2024-08-03 21:40
    VLAI
    Summary
    Example EDK2 encrypted private key in the IpSecDxe.efi present potential security risks.
    Severity
    No CVSS data available.
    CWE
    • Replacing example EDK II encrypted private key stored in PcdIpsecUefiCertificateKey presents potential security risks that will expose manufacturer key pair in EDK II.
    Assigner
    References
    Impacted products
    Vendor Product Version
    TianoCore EDK II Affected: edk2-stable201905
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T21:40:12.905Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=1866"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EDK II",
          "vendor": "TianoCore",
          "versions": [
            {
              "status": "affected",
              "version": "edk2-stable201905"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Example EDK2 encrypted private key in the IpSecDxe.efi present potential security risks."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Replacing example EDK II encrypted private key stored in PcdIpsecUefiCertificateKey presents potential security risks that will expose manufacturer key pair in EDK II.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-06-11T15:11:23.000Z",
        "orgId": "65518388-201a-4f93-8712-366d21fe8d2c",
        "shortName": "TianoCore"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=1866"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "infosec@edk2.groups.io",
          "ID": "CVE-2021-28213",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "EDK II",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "edk2-stable201905"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "TianoCore"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Example EDK2 encrypted private key in the IpSecDxe.efi present potential security risks."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Replacing example EDK II encrypted private key stored in PcdIpsecUefiCertificateKey presents potential security risks that will expose manufacturer key pair in EDK II."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.tianocore.org/show_bug.cgi?id=1866",
              "refsource": "MISC",
              "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=1866"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "65518388-201a-4f93-8712-366d21fe8d2c",
    "assignerShortName": "TianoCore",
    "cveId": "CVE-2021-28213",
    "datePublished": "2021-06-11T15:11:23.000Z",
    "dateReserved": "2021-03-12T00:00:00.000Z",
    "dateUpdated": "2024-08-03T21:40:12.905Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2021-28210 (GCVE-0-2021-28210)

    Vulnerability from cvelistv5 – Published: 2021-06-11 15:11 – Updated: 2024-08-03 21:40
    VLAI
    Summary
    An unlimited recursion in DxeCore in EDK II.
    Severity
    No CVSS data available.
    CWE
    • CWE-674 - A case of CWE-674 is occurring in MdeModulePkg, which can lead to stack and heap corruption.
    Assigner
    References
    Impacted products
    Vendor Product Version
    TianoCore EDK II Affected: unspecified , ≤ edk2-stable202008 (custom)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T21:40:12.971Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=1743"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EDK II",
          "vendor": "TianoCore",
          "versions": [
            {
              "lessThanOrEqual": "edk2-stable202008",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An unlimited recursion in DxeCore in EDK II."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "A case of CWE-674 is occurring in MdeModulePkg, which can lead to stack and heap corruption.",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-06-11T15:11:23.000Z",
        "orgId": "65518388-201a-4f93-8712-366d21fe8d2c",
        "shortName": "TianoCore"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=1743"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "infosec@edk2.groups.io",
          "ID": "CVE-2021-28210",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "EDK II",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "edk2-stable202008"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "TianoCore"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An unlimited recursion in DxeCore in EDK II."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "A case of CWE-674 is occurring in MdeModulePkg, which can lead to stack and heap corruption."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.tianocore.org/show_bug.cgi?id=1743",
              "refsource": "MISC",
              "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=1743"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "65518388-201a-4f93-8712-366d21fe8d2c",
    "assignerShortName": "TianoCore",
    "cveId": "CVE-2021-28210",
    "datePublished": "2021-06-11T15:11:23.000Z",
    "dateReserved": "2021-03-12T00:00:00.000Z",
    "dateUpdated": "2024-08-03T21:40:12.971Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2019-14584 (GCVE-0-2019-14584)

    Vulnerability from cvelistv5 – Published: 2021-06-03 19:56 – Updated: 2024-08-05 00:19
    VLAI
    Summary
    Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privilege via local access.
    Severity
    No CVSS data available.
    CWE
    • escalation of privilege
    Assigner
    References
    Impacted products
    Vendor Product Version
    n/a Tianocore EDK2 Affected: See reference
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:19:41.364Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889486"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Tianocore EDK2",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "See reference"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privilege via local access."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "escalation of privilege",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-06-03T19:56:01.000Z",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889486"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@intel.com",
          "ID": "CVE-2019-14584",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Tianocore EDK2",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "See reference"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privilege via local access."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "escalation of privilege"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1889486",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889486"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2019-14584",
    "datePublished": "2021-06-03T19:56:01.000Z",
    "dateReserved": "2019-08-03T00:00:00.000Z",
    "dateUpdated": "2024-08-05T00:19:41.364Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2019-14587 (GCVE-0-2019-14587)

    Vulnerability from cvelistv5 – Published: 2020-11-23 16:15 – Updated: 2024-08-05 00:19
    VLAI
    Summary
    Logic issue EDK II may allow an unauthenticated user to potentially enable denial of service via adjacent access.
    Severity
    No CVSS data available.
    CWE
    • denial of service
    Assigner
    References
    Impacted products
    Vendor Product Version
    n/a Extensible Firmware Interface Development Kit (EDK II) Affected: EDK II
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:19:41.342Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=1989"
          },
          {
            "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Extensible Firmware Interface Development Kit (EDK II)",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "EDK II"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Logic issue EDK II may allow an unauthenticated user to potentially enable denial of service via adjacent access."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "denial of service",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-04-29T21:06:23.000Z",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=1989"
        },
        {
          "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@intel.com",
          "ID": "CVE-2019-14587",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Extensible Firmware Interface Development Kit (EDK II)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "EDK II"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Logic issue EDK II may allow an unauthenticated user to potentially enable denial of service via adjacent access."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "denial of service"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.tianocore.org/show_bug.cgi?id=1989",
              "refsource": "MISC",
              "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=1989"
            },
            {
              "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2019-14587",
    "datePublished": "2020-11-23T16:15:08.000Z",
    "dateReserved": "2019-08-03T00:00:00.000Z",
    "dateUpdated": "2024-08-05T00:19:41.342Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2019-14586 (GCVE-0-2019-14586)

    Vulnerability from cvelistv5 – Published: 2020-11-23 16:11 – Updated: 2024-08-05 00:19
    VLAI
    Summary
    Use after free vulnerability in EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via adjacent access.
    Severity
    No CVSS data available.
    CWE
    • escalation of privilege, information disclosure, denial of service
    Assigner
    References
    Impacted products
    Vendor Product Version
    n/a Extensible Firmware Interface Development Kit (EDK II) Affected: EDK II
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:19:41.393Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=1995"
          },
          {
            "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Extensible Firmware Interface Development Kit (EDK II)",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "EDK II"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Use after free vulnerability in EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via adjacent access."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "escalation of privilege, information disclosure, denial of service",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-04-29T21:06:28.000Z",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=1995"
        },
        {
          "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@intel.com",
          "ID": "CVE-2019-14586",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Extensible Firmware Interface Development Kit (EDK II)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "EDK II"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Use after free vulnerability in EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via adjacent access."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "escalation of privilege, information disclosure, denial of service"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.tianocore.org/show_bug.cgi?id=1995",
              "refsource": "MISC",
              "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=1995"
            },
            {
              "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2019-14586",
    "datePublished": "2020-11-23T16:11:27.000Z",
    "dateReserved": "2019-08-03T00:00:00.000Z",
    "dateUpdated": "2024-08-05T00:19:41.393Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2019-14575 (GCVE-0-2019-14575)

    Vulnerability from cvelistv5 – Published: 2020-11-23 16:11 – Updated: 2024-08-05 00:19
    VLAI
    Summary
    Logic issue in DxeImageVerificationHandler() for EDK II may allow an authenticated user to potentially enable escalation of privilege via local access.
    Severity
    No CVSS data available.
    CWE
    • escalation of privilege
    Assigner
    References
    Impacted products
    Vendor Product Version
    n/a Extensible Firmware Interface Development Kit (EDK II) Affected: EDK II
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:19:41.254Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=1608"
          },
          {
            "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Extensible Firmware Interface Development Kit (EDK II)",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "EDK II"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Logic issue in DxeImageVerificationHandler() for EDK II may allow an authenticated user to potentially enable escalation of privilege via local access."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "escalation of privilege",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-04-29T21:06:24.000Z",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=1608"
        },
        {
          "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@intel.com",
          "ID": "CVE-2019-14575",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Extensible Firmware Interface Development Kit (EDK II)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "EDK II"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Logic issue in DxeImageVerificationHandler() for EDK II may allow an authenticated user to potentially enable escalation of privilege via local access."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "escalation of privilege"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.tianocore.org/show_bug.cgi?id=1608",
              "refsource": "MISC",
              "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=1608"
            },
            {
              "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2019-14575",
    "datePublished": "2020-11-23T16:11:19.000Z",
    "dateReserved": "2019-08-03T00:00:00.000Z",
    "dateUpdated": "2024-08-05T00:19:41.254Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2019-14563 (GCVE-0-2019-14563)

    Vulnerability from cvelistv5 – Published: 2020-11-23 16:11 – Updated: 2024-08-05 00:19
    VLAI
    Summary
    Integer truncation in EDK II may allow an authenticated user to potentially enable escalation of privilege via local access.
    Severity
    No CVSS data available.
    CWE
    • Escalation of Privilege
    Assigner
    References
    Impacted products
    Vendor Product Version
    n/a Extensible Firmware Interface Development Kit (EDK II) Affected: EDK II
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:19:41.365Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=2001"
          },
          {
            "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Extensible Firmware Interface Development Kit (EDK II)",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "EDK II"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Integer truncation in EDK II may allow an authenticated user to potentially enable escalation of privilege via local access."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Escalation of Privilege",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-04-29T21:06:23.000Z",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=2001"
        },
        {
          "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@intel.com",
          "ID": "CVE-2019-14563",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Extensible Firmware Interface Development Kit (EDK II)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "EDK II"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Integer truncation in EDK II may allow an authenticated user to potentially enable escalation of privilege via local access."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Escalation of Privilege"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.tianocore.org/show_bug.cgi?id=2001",
              "refsource": "MISC",
              "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=2001"
            },
            {
              "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2019-14563",
    "datePublished": "2020-11-23T16:11:10.000Z",
    "dateReserved": "2019-08-03T00:00:00.000Z",
    "dateUpdated": "2024-08-05T00:19:41.365Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2019-14562 (GCVE-0-2019-14562)

    Vulnerability from cvelistv5 – Published: 2020-11-23 15:50 – Updated: 2024-08-05 00:19
    VLAI
    Summary
    Integer overflow in DxeImageVerificationHandler() EDK II may allow an authenticated user to potentially enable denial of service via local access.
    Severity
    No CVSS data available.
    CWE
    • Denial of service
    Assigner
    References
    Impacted products
    Vendor Product Version
    n/a Extensible Firmware Interface Development Kit (EDK II) Affected: EDK II
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:19:41.322Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=2215"
          },
          {
            "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Extensible Firmware Interface Development Kit (EDK II)",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "EDK II"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Integer overflow in DxeImageVerificationHandler() EDK II may allow an authenticated user to potentially enable denial of service via local access."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Denial of service",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-04-29T21:06:26.000Z",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=2215"
        },
        {
          "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@intel.com",
          "ID": "CVE-2019-14562",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Extensible Firmware Interface Development Kit (EDK II)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "EDK II"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Integer overflow in DxeImageVerificationHandler() EDK II may allow an authenticated user to potentially enable denial of service via local access."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Denial of service"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.tianocore.org/show_bug.cgi?id=2215",
              "refsource": "MISC",
              "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=2215"
            },
            {
              "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2019-14562",
    "datePublished": "2020-11-23T15:50:41.000Z",
    "dateReserved": "2019-08-03T00:00:00.000Z",
    "dateUpdated": "2024-08-05T00:19:41.322Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2019-14559 (GCVE-0-2019-14559)

    Vulnerability from cvelistv5 – Published: 2020-11-23 15:50 – Updated: 2024-08-05 00:19
    VLAI
    Summary
    Uncontrolled resource consumption in EDK II may allow an unauthenticated user to potentially enable denial of service via network access.
    Severity
    No CVSS data available.
    CWE
    • Denial of Service
    Assigner
    References
    Impacted products
    Vendor Product Version
    n/a Extensible Firmware Interface Development Kit (EDK II) Affected: EDK II
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:19:41.363Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=2031"
          },
          {
            "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Extensible Firmware Interface Development Kit (EDK II)",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "EDK II"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Uncontrolled resource consumption in EDK II may allow an unauthenticated user to potentially enable denial of service via network access."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Denial of Service",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-04-29T21:06:27.000Z",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=2031"
        },
        {
          "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@intel.com",
          "ID": "CVE-2019-14559",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Extensible Firmware Interface Development Kit (EDK II)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "EDK II"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Uncontrolled resource consumption in EDK II may allow an unauthenticated user to potentially enable denial of service via network access."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Denial of Service"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.tianocore.org/show_bug.cgi?id=2031",
              "refsource": "MISC",
              "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=2031"
            },
            {
              "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2019-14559",
    "datePublished": "2020-11-23T15:50:32.000Z",
    "dateReserved": "2019-08-03T00:00:00.000Z",
    "dateUpdated": "2024-08-05T00:19:41.363Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2019-14553 (GCVE-0-2019-14553)

    Vulnerability from cvelistv5 – Published: 2020-11-23 15:50 – Updated: 2024-08-05 00:19
    VLAI
    Summary
    Improper authentication in EDK II may allow a privileged user to potentially enable information disclosure via network access.
    Severity
    No CVSS data available.
    CWE
    • information disclosure
    Assigner
    References
    Impacted products
    Vendor Product Version
    n/a Extensible Firmware Interface Development Kit (EDK II) Affected: EDK II
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:19:41.314Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=960"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Extensible Firmware Interface Development Kit (EDK II)",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "EDK II"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper authentication in EDK II may allow a privileged user to potentially enable information disclosure via network access."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "information disclosure",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-11-23T15:50:19.000Z",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=960"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@intel.com",
          "ID": "CVE-2019-14553",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Extensible Firmware Interface Development Kit (EDK II)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "EDK II"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Improper authentication in EDK II may allow a privileged user to potentially enable information disclosure via network access."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "information disclosure"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.tianocore.org/show_bug.cgi?id=960",
              "refsource": "MISC",
              "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=960"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2019-14553",
    "datePublished": "2020-11-23T15:50:19.000Z",
    "dateReserved": "2019-08-03T00:00:00.000Z",
    "dateUpdated": "2024-08-05T00:19:41.314Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2014-8271 (GCVE-0-2014-8271)

    Vulnerability from cvelistv5 – Published: 2020-02-06 14:03 – Updated: 2024-08-06 13:10
    VLAI
    Summary
    Buffer overflow in the Reclaim function in Tianocore EDK2 before SVN 16280 allows physically proximate attackers to gain privileges via a long variable name.
    Severity
    No CVSS data available.
    CWE
    • Buffer Overflow
    Assigner
    References
    Impacted products
    Vendor Product Version
    Tianocore EDK2 Affected: before SVN 16280
    		Create a notification for this product.
    Date Public
    2014-12-28 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T13:10:51.117Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://sourceforge.net/p/edk2/code/16280/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/533140"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EDK2",
          "vendor": "Tianocore",
          "versions": [
            {
              "status": "affected",
              "version": "before SVN 16280"
            }
          ]
        }
      ],
      "datePublic": "2014-12-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Buffer overflow in the Reclaim function in Tianocore EDK2 before SVN 16280 allows physically proximate attackers to gain privileges via a long variable name."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Buffer Overflow",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-02-06T14:03:57.000Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://sourceforge.net/p/edk2/code/16280/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.kb.cert.org/vuls/id/533140"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cert@cert.org",
          "ID": "CVE-2014-8271",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "EDK2",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before SVN 16280"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Tianocore"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Buffer overflow in the Reclaim function in Tianocore EDK2 before SVN 16280 allows physically proximate attackers to gain privileges via a long variable name."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Buffer Overflow"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://sourceforge.net/p/edk2/code/16280/",
              "refsource": "MISC",
              "url": "http://sourceforge.net/p/edk2/code/16280/"
            },
            {
              "name": "http://www.kb.cert.org/vuls/id/533140",
              "refsource": "MISC",
              "url": "http://www.kb.cert.org/vuls/id/533140"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2014-8271",
    "datePublished": "2020-02-06T14:03:57.000Z",
    "dateReserved": "2014-10-12T00:00:00.000Z",
    "dateUpdated": "2024-08-06T13:10:51.117Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2014-4859 (GCVE-0-2014-4859)

    Vulnerability from cvelistv5 – Published: 2020-01-31 15:08 – Updated: 2024-08-06 11:27
    VLAI
    Summary
    Integer overflow in the Drive Execution Environment (DXE) phase in the Capsule Update feature in the UEFI implementation in EDK2 allows physically proximate attackers to bypass intended access restrictions via crafted data.
    Severity
    No CVSS data available.
    CWE
    • Integer Overflow
    Assigner
    References
    URL Tags
    http://www.kb.cert.org/vuls/id/552286 x_refsource_MISC
    Impacted products
    Date Public
    2014-08-07 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T11:27:36.851Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/552286"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SCT3",
          "vendor": "Phoenix Technologies Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "before 5/23/2014"
            }
          ]
        },
        {
          "product": "BIOS",
          "vendor": "American Megatrends Incorporated (AMI)",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "datePublic": "2014-08-07T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Integer overflow in the Drive Execution Environment (DXE) phase in the Capsule Update feature in the UEFI implementation in EDK2 allows physically proximate attackers to bypass intended access restrictions via crafted data."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Integer Overflow",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-01-31T15:08:20.000Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.kb.cert.org/vuls/id/552286"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cert@cert.org",
          "ID": "CVE-2014-4859",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SCT3",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 5/23/2014"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Phoenix Technologies Ltd."
              },
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "BIOS",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "unknown"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "American Megatrends Incorporated (AMI)"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Integer overflow in the Drive Execution Environment (DXE) phase in the Capsule Update feature in the UEFI implementation in EDK2 allows physically proximate attackers to bypass intended access restrictions via crafted data."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Integer Overflow"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.kb.cert.org/vuls/id/552286",
              "refsource": "MISC",
              "url": "http://www.kb.cert.org/vuls/id/552286"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2014-4859",
    "datePublished": "2020-01-31T15:08:20.000Z",
    "dateReserved": "2014-07-10T00:00:00.000Z",
    "dateUpdated": "2024-08-06T11:27:36.851Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2014-4860 (GCVE-0-2014-4860)

    Vulnerability from cvelistv5 – Published: 2020-01-31 15:08 – Updated: 2024-08-06 11:27
    VLAI
    Summary
    Multiple integer overflows in the Pre-EFI Initialization (PEI) boot phase in the Capsule Update feature in the UEFI implementation in EDK2 allow physically proximate attackers to bypass intended access restrictions by providing crafted data that is not properly handled during the coalescing phase.
    Severity
    No CVSS data available.
    CWE
    • Other
    Assigner
    References
    URL Tags
    http://www.kb.cert.org/vuls/id/552286 x_refsource_MISC
    Impacted products
    Date Public
    2014-08-07 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T11:27:36.943Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/552286"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SCT3",
          "vendor": "Phoenix Technologies Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "before 5/23/2014"
            }
          ]
        },
        {
          "product": "BIOS",
          "vendor": "American Megatrends Incorporated (AMI)",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "datePublic": "2014-08-07T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple integer overflows in the Pre-EFI Initialization (PEI) boot phase in the Capsule Update feature in the UEFI implementation in EDK2 allow physically proximate attackers to bypass intended access restrictions by providing crafted data that is not properly handled during the coalescing phase."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Other",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-01-31T15:08:16.000Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.kb.cert.org/vuls/id/552286"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cert@cert.org",
          "ID": "CVE-2014-4860",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SCT3",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 5/23/2014"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Phoenix Technologies Ltd."
              },
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "BIOS",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "unknown"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "American Megatrends Incorporated (AMI)"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple integer overflows in the Pre-EFI Initialization (PEI) boot phase in the Capsule Update feature in the UEFI implementation in EDK2 allow physically proximate attackers to bypass intended access restrictions by providing crafted data that is not properly handled during the coalescing phase."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Other"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.kb.cert.org/vuls/id/552286",
              "refsource": "MISC",
              "url": "http://www.kb.cert.org/vuls/id/552286"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2014-4860",
    "datePublished": "2020-01-31T15:08:16.000Z",
    "dateReserved": "2014-07-10T00:00:00.000Z",
    "dateUpdated": "2024-08-06T11:27:36.943Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2017-5731 (GCVE-0-2017-5731)

    Vulnerability from cvelistv5 – Published: 2019-10-28 14:47 – Updated: 2024-08-05 15:11
    VLAI
    Summary
    Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user to potentially enable an escalation of privilege via local access.
    Severity
    No CVSS data available.
    CWE
    • Escalation of Privilege, Denial of Service, Information Disclosure
    Assigner
    References
    Impacted products
    Vendor Product Version
    n/a Tianocore Affected: before November 7, 2017
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T15:11:48.716Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=686"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Tianocore",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "before November 7, 2017"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user to potentially enable an escalation of privilege via local access."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Escalation of Privilege, Denial of Service, Information Disclosure",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-11-15T14:07:02.000Z",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=686"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@intel.com",
          "ID": "CVE-2017-5731",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Tianocore",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before November 7, 2017"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user to potentially enable an escalation of privilege via local access."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Escalation of Privilege, Denial of Service, Information Disclosure"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.tianocore.org/show_bug.cgi?id=686",
              "refsource": "MISC",
              "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=686"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2017-5731",
    "datePublished": "2019-10-28T14:47:35.000Z",
    "dateReserved": "2017-02-01T00:00:00.000Z",
    "dateUpdated": "2024-08-05T15:11:48.716Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2019-0161 (GCVE-0-2019-0161)

    Vulnerability from cvelistv5 – Published: 2019-03-27 19:23 – Updated: 2024-08-04 17:44
    VLAI
    Summary
    Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access.
    Severity
    No CVSS data available.
    CWE
    • Denial of Service
    Assigner
    References
    Impacted products
    Date Public
    2019-03-26 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T17:44:14.759Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://edk2-docs.gitbooks.io/security-advisory/content/xhci-stack-local-stack-overflow.html"
          },
          {
            "name": "openSUSE-SU-2019:1352",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00019.html"
          },
          {
            "name": "openSUSE-SU-2019:1425",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00046.html"
          },
          {
            "name": "RHSA-2019:2125",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2125"
          },
          {
            "name": "RHSA-2019:2437",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2437"
          },
          {
            "name": "FEDORA-2019-d47a9d4b8b",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQYVZRFEXSN3KS43AVH4D7QX553EZQYP/"
          },
          {
            "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Extensible Firmware Interface Development Kit (EDK II)",
          "vendor": "Extensible Firmware Interface Development Kit (EDK II)",
          "versions": [
            {
              "status": "affected",
              "version": "N/A"
            }
          ]
        }
      ],
      "datePublic": "2019-03-26T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Denial of Service",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-04-29T21:06:25.000Z",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://edk2-docs.gitbooks.io/security-advisory/content/xhci-stack-local-stack-overflow.html"
        },
        {
          "name": "openSUSE-SU-2019:1352",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00019.html"
        },
        {
          "name": "openSUSE-SU-2019:1425",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00046.html"
        },
        {
          "name": "RHSA-2019:2125",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2125"
        },
        {
          "name": "RHSA-2019:2437",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2437"
        },
        {
          "name": "FEDORA-2019-d47a9d4b8b",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQYVZRFEXSN3KS43AVH4D7QX553EZQYP/"
        },
        {
          "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@intel.com",
          "ID": "CVE-2019-0161",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Extensible Firmware Interface Development Kit (EDK II)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "N/A"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Extensible Firmware Interface Development Kit (EDK II)"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Denial of Service"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://edk2-docs.gitbooks.io/security-advisory/content/xhci-stack-local-stack-overflow.html",
              "refsource": "CONFIRM",
              "url": "https://edk2-docs.gitbooks.io/security-advisory/content/xhci-stack-local-stack-overflow.html"
            },
            {
              "name": "openSUSE-SU-2019:1352",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00019.html"
            },
            {
              "name": "openSUSE-SU-2019:1425",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00046.html"
            },
            {
              "name": "RHSA-2019:2125",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2125"
            },
            {
              "name": "RHSA-2019:2437",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2437"
            },
            {
              "name": "FEDORA-2019-d47a9d4b8b",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQYVZRFEXSN3KS43AVH4D7QX553EZQYP/"
            },
            {
              "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2019-0161",
    "datePublished": "2019-03-27T19:23:44.000Z",
    "dateReserved": "2018-11-13T00:00:00.000Z",
    "dateUpdated": "2024-08-04T17:44:14.759Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2021-28213 (GCVE-0-2021-28213)

    Vulnerability from nvd – Published: 2021-06-11 15:11 – Updated: 2024-08-03 21:40
    VLAI
    Summary
    Example EDK2 encrypted private key in the IpSecDxe.efi present potential security risks.
    Severity
    No CVSS data available.
    CWE
    • Replacing example EDK II encrypted private key stored in PcdIpsecUefiCertificateKey presents potential security risks that will expose manufacturer key pair in EDK II.
    Assigner
    References
    Impacted products
    Vendor Product Version
    TianoCore EDK II Affected: edk2-stable201905
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T21:40:12.905Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=1866"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EDK II",
          "vendor": "TianoCore",
          "versions": [
            {
              "status": "affected",
              "version": "edk2-stable201905"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Example EDK2 encrypted private key in the IpSecDxe.efi present potential security risks."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Replacing example EDK II encrypted private key stored in PcdIpsecUefiCertificateKey presents potential security risks that will expose manufacturer key pair in EDK II.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-06-11T15:11:23.000Z",
        "orgId": "65518388-201a-4f93-8712-366d21fe8d2c",
        "shortName": "TianoCore"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=1866"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "infosec@edk2.groups.io",
          "ID": "CVE-2021-28213",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "EDK II",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "edk2-stable201905"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "TianoCore"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Example EDK2 encrypted private key in the IpSecDxe.efi present potential security risks."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Replacing example EDK II encrypted private key stored in PcdIpsecUefiCertificateKey presents potential security risks that will expose manufacturer key pair in EDK II."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.tianocore.org/show_bug.cgi?id=1866",
              "refsource": "MISC",
              "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=1866"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "65518388-201a-4f93-8712-366d21fe8d2c",
    "assignerShortName": "TianoCore",
    "cveId": "CVE-2021-28213",
    "datePublished": "2021-06-11T15:11:23.000Z",
    "dateReserved": "2021-03-12T00:00:00.000Z",
    "dateUpdated": "2024-08-03T21:40:12.905Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2021-28210 (GCVE-0-2021-28210)

    Vulnerability from nvd – Published: 2021-06-11 15:11 – Updated: 2024-08-03 21:40
    VLAI
    Summary
    An unlimited recursion in DxeCore in EDK II.
    Severity
    No CVSS data available.
    CWE
    • CWE-674 - A case of CWE-674 is occurring in MdeModulePkg, which can lead to stack and heap corruption.
    Assigner
    References
    Impacted products
    Vendor Product Version
    TianoCore EDK II Affected: unspecified , ≤ edk2-stable202008 (custom)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T21:40:12.971Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=1743"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EDK II",
          "vendor": "TianoCore",
          "versions": [
            {
              "lessThanOrEqual": "edk2-stable202008",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An unlimited recursion in DxeCore in EDK II."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "A case of CWE-674 is occurring in MdeModulePkg, which can lead to stack and heap corruption.",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-06-11T15:11:23.000Z",
        "orgId": "65518388-201a-4f93-8712-366d21fe8d2c",
        "shortName": "TianoCore"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=1743"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "infosec@edk2.groups.io",
          "ID": "CVE-2021-28210",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "EDK II",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "edk2-stable202008"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "TianoCore"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An unlimited recursion in DxeCore in EDK II."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "A case of CWE-674 is occurring in MdeModulePkg, which can lead to stack and heap corruption."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.tianocore.org/show_bug.cgi?id=1743",
              "refsource": "MISC",
              "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=1743"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "65518388-201a-4f93-8712-366d21fe8d2c",
    "assignerShortName": "TianoCore",
    "cveId": "CVE-2021-28210",
    "datePublished": "2021-06-11T15:11:23.000Z",
    "dateReserved": "2021-03-12T00:00:00.000Z",
    "dateUpdated": "2024-08-03T21:40:12.971Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2019-14584 (GCVE-0-2019-14584)

    Vulnerability from nvd – Published: 2021-06-03 19:56 – Updated: 2024-08-05 00:19
    VLAI
    Summary
    Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privilege via local access.
    Severity
    No CVSS data available.
    CWE
    • escalation of privilege
    Assigner
    References
    Impacted products
    Vendor Product Version
    n/a Tianocore EDK2 Affected: See reference
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:19:41.364Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889486"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Tianocore EDK2",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "See reference"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privilege via local access."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "escalation of privilege",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-06-03T19:56:01.000Z",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889486"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@intel.com",
          "ID": "CVE-2019-14584",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Tianocore EDK2",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "See reference"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privilege via local access."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "escalation of privilege"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1889486",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889486"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2019-14584",
    "datePublished": "2021-06-03T19:56:01.000Z",
    "dateReserved": "2019-08-03T00:00:00.000Z",
    "dateUpdated": "2024-08-05T00:19:41.364Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2019-14587 (GCVE-0-2019-14587)

    Vulnerability from nvd – Published: 2020-11-23 16:15 – Updated: 2024-08-05 00:19
    VLAI
    Summary
    Logic issue EDK II may allow an unauthenticated user to potentially enable denial of service via adjacent access.
    Severity
    No CVSS data available.
    CWE
    • denial of service
    Assigner
    References
    Impacted products
    Vendor Product Version
    n/a Extensible Firmware Interface Development Kit (EDK II) Affected: EDK II
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:19:41.342Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=1989"
          },
          {
            "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Extensible Firmware Interface Development Kit (EDK II)",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "EDK II"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Logic issue EDK II may allow an unauthenticated user to potentially enable denial of service via adjacent access."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "denial of service",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-04-29T21:06:23.000Z",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=1989"
        },
        {
          "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@intel.com",
          "ID": "CVE-2019-14587",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Extensible Firmware Interface Development Kit (EDK II)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "EDK II"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Logic issue EDK II may allow an unauthenticated user to potentially enable denial of service via adjacent access."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "denial of service"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.tianocore.org/show_bug.cgi?id=1989",
              "refsource": "MISC",
              "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=1989"
            },
            {
              "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2019-14587",
    "datePublished": "2020-11-23T16:15:08.000Z",
    "dateReserved": "2019-08-03T00:00:00.000Z",
    "dateUpdated": "2024-08-05T00:19:41.342Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2019-14586 (GCVE-0-2019-14586)

    Vulnerability from nvd – Published: 2020-11-23 16:11 – Updated: 2024-08-05 00:19
    VLAI
    Summary
    Use after free vulnerability in EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via adjacent access.
    Severity
    No CVSS data available.
    CWE
    • escalation of privilege, information disclosure, denial of service
    Assigner
    References
    Impacted products
    Vendor Product Version
    n/a Extensible Firmware Interface Development Kit (EDK II) Affected: EDK II
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:19:41.393Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=1995"
          },
          {
            "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Extensible Firmware Interface Development Kit (EDK II)",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "EDK II"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Use after free vulnerability in EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via adjacent access."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "escalation of privilege, information disclosure, denial of service",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-04-29T21:06:28.000Z",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=1995"
        },
        {
          "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@intel.com",
          "ID": "CVE-2019-14586",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Extensible Firmware Interface Development Kit (EDK II)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "EDK II"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Use after free vulnerability in EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via adjacent access."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "escalation of privilege, information disclosure, denial of service"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.tianocore.org/show_bug.cgi?id=1995",
              "refsource": "MISC",
              "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=1995"
            },
            {
              "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2019-14586",
    "datePublished": "2020-11-23T16:11:27.000Z",
    "dateReserved": "2019-08-03T00:00:00.000Z",
    "dateUpdated": "2024-08-05T00:19:41.393Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2019-14575 (GCVE-0-2019-14575)

    Vulnerability from nvd – Published: 2020-11-23 16:11 – Updated: 2024-08-05 00:19
    VLAI
    Summary
    Logic issue in DxeImageVerificationHandler() for EDK II may allow an authenticated user to potentially enable escalation of privilege via local access.
    Severity
    No CVSS data available.
    CWE
    • escalation of privilege
    Assigner
    References
    Impacted products
    Vendor Product Version
    n/a Extensible Firmware Interface Development Kit (EDK II) Affected: EDK II
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:19:41.254Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=1608"
          },
          {
            "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Extensible Firmware Interface Development Kit (EDK II)",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "EDK II"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Logic issue in DxeImageVerificationHandler() for EDK II may allow an authenticated user to potentially enable escalation of privilege via local access."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "escalation of privilege",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-04-29T21:06:24.000Z",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=1608"
        },
        {
          "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@intel.com",
          "ID": "CVE-2019-14575",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Extensible Firmware Interface Development Kit (EDK II)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "EDK II"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Logic issue in DxeImageVerificationHandler() for EDK II may allow an authenticated user to potentially enable escalation of privilege via local access."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "escalation of privilege"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.tianocore.org/show_bug.cgi?id=1608",
              "refsource": "MISC",
              "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=1608"
            },
            {
              "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2019-14575",
    "datePublished": "2020-11-23T16:11:19.000Z",
    "dateReserved": "2019-08-03T00:00:00.000Z",
    "dateUpdated": "2024-08-05T00:19:41.254Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2019-14563 (GCVE-0-2019-14563)

    Vulnerability from nvd – Published: 2020-11-23 16:11 – Updated: 2024-08-05 00:19
    VLAI
    Summary
    Integer truncation in EDK II may allow an authenticated user to potentially enable escalation of privilege via local access.
    Severity
    No CVSS data available.
    CWE
    • Escalation of Privilege
    Assigner
    References
    Impacted products
    Vendor Product Version
    n/a Extensible Firmware Interface Development Kit (EDK II) Affected: EDK II
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:19:41.365Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=2001"
          },
          {
            "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Extensible Firmware Interface Development Kit (EDK II)",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "EDK II"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Integer truncation in EDK II may allow an authenticated user to potentially enable escalation of privilege via local access."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Escalation of Privilege",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-04-29T21:06:23.000Z",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=2001"
        },
        {
          "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@intel.com",
          "ID": "CVE-2019-14563",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Extensible Firmware Interface Development Kit (EDK II)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "EDK II"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Integer truncation in EDK II may allow an authenticated user to potentially enable escalation of privilege via local access."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Escalation of Privilege"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.tianocore.org/show_bug.cgi?id=2001",
              "refsource": "MISC",
              "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=2001"
            },
            {
              "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2019-14563",
    "datePublished": "2020-11-23T16:11:10.000Z",
    "dateReserved": "2019-08-03T00:00:00.000Z",
    "dateUpdated": "2024-08-05T00:19:41.365Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2019-14562 (GCVE-0-2019-14562)

    Vulnerability from nvd – Published: 2020-11-23 15:50 – Updated: 2024-08-05 00:19
    VLAI
    Summary
    Integer overflow in DxeImageVerificationHandler() EDK II may allow an authenticated user to potentially enable denial of service via local access.
    Severity
    No CVSS data available.
    CWE
    • Denial of service
    Assigner
    References
    Impacted products
    Vendor Product Version
    n/a Extensible Firmware Interface Development Kit (EDK II) Affected: EDK II
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:19:41.322Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=2215"
          },
          {
            "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Extensible Firmware Interface Development Kit (EDK II)",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "EDK II"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Integer overflow in DxeImageVerificationHandler() EDK II may allow an authenticated user to potentially enable denial of service via local access."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Denial of service",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-04-29T21:06:26.000Z",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=2215"
        },
        {
          "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@intel.com",
          "ID": "CVE-2019-14562",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Extensible Firmware Interface Development Kit (EDK II)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "EDK II"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Integer overflow in DxeImageVerificationHandler() EDK II may allow an authenticated user to potentially enable denial of service via local access."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Denial of service"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.tianocore.org/show_bug.cgi?id=2215",
              "refsource": "MISC",
              "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=2215"
            },
            {
              "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2019-14562",
    "datePublished": "2020-11-23T15:50:41.000Z",
    "dateReserved": "2019-08-03T00:00:00.000Z",
    "dateUpdated": "2024-08-05T00:19:41.322Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2019-14559 (GCVE-0-2019-14559)

    Vulnerability from nvd – Published: 2020-11-23 15:50 – Updated: 2024-08-05 00:19
    VLAI
    Summary
    Uncontrolled resource consumption in EDK II may allow an unauthenticated user to potentially enable denial of service via network access.
    Severity
    No CVSS data available.
    CWE
    • Denial of Service
    Assigner
    References
    Impacted products
    Vendor Product Version
    n/a Extensible Firmware Interface Development Kit (EDK II) Affected: EDK II
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:19:41.363Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=2031"
          },
          {
            "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Extensible Firmware Interface Development Kit (EDK II)",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "EDK II"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Uncontrolled resource consumption in EDK II may allow an unauthenticated user to potentially enable denial of service via network access."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Denial of Service",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-04-29T21:06:27.000Z",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=2031"
        },
        {
          "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@intel.com",
          "ID": "CVE-2019-14559",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Extensible Firmware Interface Development Kit (EDK II)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "EDK II"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Uncontrolled resource consumption in EDK II may allow an unauthenticated user to potentially enable denial of service via network access."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Denial of Service"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.tianocore.org/show_bug.cgi?id=2031",
              "refsource": "MISC",
              "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=2031"
            },
            {
              "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2019-14559",
    "datePublished": "2020-11-23T15:50:32.000Z",
    "dateReserved": "2019-08-03T00:00:00.000Z",
    "dateUpdated": "2024-08-05T00:19:41.363Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2019-14553 (GCVE-0-2019-14553)

    Vulnerability from nvd – Published: 2020-11-23 15:50 – Updated: 2024-08-05 00:19
    VLAI
    Summary
    Improper authentication in EDK II may allow a privileged user to potentially enable information disclosure via network access.
    Severity
    No CVSS data available.
    CWE
    • information disclosure
    Assigner
    References
    Impacted products
    Vendor Product Version
    n/a Extensible Firmware Interface Development Kit (EDK II) Affected: EDK II
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:19:41.314Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=960"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Extensible Firmware Interface Development Kit (EDK II)",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "EDK II"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper authentication in EDK II may allow a privileged user to potentially enable information disclosure via network access."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "information disclosure",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-11-23T15:50:19.000Z",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=960"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@intel.com",
          "ID": "CVE-2019-14553",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Extensible Firmware Interface Development Kit (EDK II)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "EDK II"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Improper authentication in EDK II may allow a privileged user to potentially enable information disclosure via network access."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "information disclosure"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.tianocore.org/show_bug.cgi?id=960",
              "refsource": "MISC",
              "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=960"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2019-14553",
    "datePublished": "2020-11-23T15:50:19.000Z",
    "dateReserved": "2019-08-03T00:00:00.000Z",
    "dateUpdated": "2024-08-05T00:19:41.314Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2014-8271 (GCVE-0-2014-8271)

    Vulnerability from nvd – Published: 2020-02-06 14:03 – Updated: 2024-08-06 13:10
    VLAI
    Summary
    Buffer overflow in the Reclaim function in Tianocore EDK2 before SVN 16280 allows physically proximate attackers to gain privileges via a long variable name.
    Severity
    No CVSS data available.
    CWE
    • Buffer Overflow
    Assigner
    References
    Impacted products
    Vendor Product Version
    Tianocore EDK2 Affected: before SVN 16280
    		Create a notification for this product.
    Date Public
    2014-12-28 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T13:10:51.117Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://sourceforge.net/p/edk2/code/16280/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/533140"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EDK2",
          "vendor": "Tianocore",
          "versions": [
            {
              "status": "affected",
              "version": "before SVN 16280"
            }
          ]
        }
      ],
      "datePublic": "2014-12-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Buffer overflow in the Reclaim function in Tianocore EDK2 before SVN 16280 allows physically proximate attackers to gain privileges via a long variable name."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Buffer Overflow",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-02-06T14:03:57.000Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://sourceforge.net/p/edk2/code/16280/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.kb.cert.org/vuls/id/533140"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cert@cert.org",
          "ID": "CVE-2014-8271",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "EDK2",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before SVN 16280"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Tianocore"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Buffer overflow in the Reclaim function in Tianocore EDK2 before SVN 16280 allows physically proximate attackers to gain privileges via a long variable name."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Buffer Overflow"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://sourceforge.net/p/edk2/code/16280/",
              "refsource": "MISC",
              "url": "http://sourceforge.net/p/edk2/code/16280/"
            },
            {
              "name": "http://www.kb.cert.org/vuls/id/533140",
              "refsource": "MISC",
              "url": "http://www.kb.cert.org/vuls/id/533140"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2014-8271",
    "datePublished": "2020-02-06T14:03:57.000Z",
    "dateReserved": "2014-10-12T00:00:00.000Z",
    "dateUpdated": "2024-08-06T13:10:51.117Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2014-4859 (GCVE-0-2014-4859)

    Vulnerability from nvd – Published: 2020-01-31 15:08 – Updated: 2024-08-06 11:27
    VLAI
    Summary
    Integer overflow in the Drive Execution Environment (DXE) phase in the Capsule Update feature in the UEFI implementation in EDK2 allows physically proximate attackers to bypass intended access restrictions via crafted data.
    Severity
    No CVSS data available.
    CWE
    • Integer Overflow
    Assigner
    References
    URL Tags
    http://www.kb.cert.org/vuls/id/552286 x_refsource_MISC
    Impacted products
    Date Public
    2014-08-07 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T11:27:36.851Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/552286"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SCT3",
          "vendor": "Phoenix Technologies Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "before 5/23/2014"
            }
          ]
        },
        {
          "product": "BIOS",
          "vendor": "American Megatrends Incorporated (AMI)",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "datePublic": "2014-08-07T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Integer overflow in the Drive Execution Environment (DXE) phase in the Capsule Update feature in the UEFI implementation in EDK2 allows physically proximate attackers to bypass intended access restrictions via crafted data."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Integer Overflow",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-01-31T15:08:20.000Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.kb.cert.org/vuls/id/552286"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cert@cert.org",
          "ID": "CVE-2014-4859",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SCT3",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 5/23/2014"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Phoenix Technologies Ltd."
              },
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "BIOS",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "unknown"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "American Megatrends Incorporated (AMI)"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Integer overflow in the Drive Execution Environment (DXE) phase in the Capsule Update feature in the UEFI implementation in EDK2 allows physically proximate attackers to bypass intended access restrictions via crafted data."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Integer Overflow"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.kb.cert.org/vuls/id/552286",
              "refsource": "MISC",
              "url": "http://www.kb.cert.org/vuls/id/552286"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2014-4859",
    "datePublished": "2020-01-31T15:08:20.000Z",
    "dateReserved": "2014-07-10T00:00:00.000Z",
    "dateUpdated": "2024-08-06T11:27:36.851Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2014-4860 (GCVE-0-2014-4860)

    Vulnerability from nvd – Published: 2020-01-31 15:08 – Updated: 2024-08-06 11:27
    VLAI
    Summary
    Multiple integer overflows in the Pre-EFI Initialization (PEI) boot phase in the Capsule Update feature in the UEFI implementation in EDK2 allow physically proximate attackers to bypass intended access restrictions by providing crafted data that is not properly handled during the coalescing phase.
    Severity
    No CVSS data available.
    CWE
    • Other
    Assigner
    References
    URL Tags
    http://www.kb.cert.org/vuls/id/552286 x_refsource_MISC
    Impacted products
    Date Public
    2014-08-07 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T11:27:36.943Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/552286"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SCT3",
          "vendor": "Phoenix Technologies Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "before 5/23/2014"
            }
          ]
        },
        {
          "product": "BIOS",
          "vendor": "American Megatrends Incorporated (AMI)",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "datePublic": "2014-08-07T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple integer overflows in the Pre-EFI Initialization (PEI) boot phase in the Capsule Update feature in the UEFI implementation in EDK2 allow physically proximate attackers to bypass intended access restrictions by providing crafted data that is not properly handled during the coalescing phase."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Other",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-01-31T15:08:16.000Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.kb.cert.org/vuls/id/552286"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cert@cert.org",
          "ID": "CVE-2014-4860",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SCT3",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 5/23/2014"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Phoenix Technologies Ltd."
              },
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "BIOS",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "unknown"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "American Megatrends Incorporated (AMI)"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple integer overflows in the Pre-EFI Initialization (PEI) boot phase in the Capsule Update feature in the UEFI implementation in EDK2 allow physically proximate attackers to bypass intended access restrictions by providing crafted data that is not properly handled during the coalescing phase."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Other"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.kb.cert.org/vuls/id/552286",
              "refsource": "MISC",
              "url": "http://www.kb.cert.org/vuls/id/552286"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2014-4860",
    "datePublished": "2020-01-31T15:08:16.000Z",
    "dateReserved": "2014-07-10T00:00:00.000Z",
    "dateUpdated": "2024-08-06T11:27:36.943Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2017-5731 (GCVE-0-2017-5731)

    Vulnerability from nvd – Published: 2019-10-28 14:47 – Updated: 2024-08-05 15:11
    VLAI
    Summary
    Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user to potentially enable an escalation of privilege via local access.
    Severity
    No CVSS data available.
    CWE
    • Escalation of Privilege, Denial of Service, Information Disclosure
    Assigner
    References
    Impacted products
    Vendor Product Version
    n/a Tianocore Affected: before November 7, 2017
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T15:11:48.716Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=686"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Tianocore",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "before November 7, 2017"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user to potentially enable an escalation of privilege via local access."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Escalation of Privilege, Denial of Service, Information Disclosure",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-11-15T14:07:02.000Z",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=686"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@intel.com",
          "ID": "CVE-2017-5731",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Tianocore",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before November 7, 2017"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user to potentially enable an escalation of privilege via local access."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Escalation of Privilege, Denial of Service, Information Disclosure"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.tianocore.org/show_bug.cgi?id=686",
              "refsource": "MISC",
              "url": "https://bugzilla.tianocore.org/show_bug.cgi?id=686"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2017-5731",
    "datePublished": "2019-10-28T14:47:35.000Z",
    "dateReserved": "2017-02-01T00:00:00.000Z",
    "dateUpdated": "2024-08-05T15:11:48.716Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2019-0161 (GCVE-0-2019-0161)

    Vulnerability from nvd – Published: 2019-03-27 19:23 – Updated: 2024-08-04 17:44
    VLAI
    Summary
    Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access.
    Severity
    No CVSS data available.
    CWE
    • Denial of Service
    Assigner
    References
    Impacted products
    Date Public
    2019-03-26 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T17:44:14.759Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://edk2-docs.gitbooks.io/security-advisory/content/xhci-stack-local-stack-overflow.html"
          },
          {
            "name": "openSUSE-SU-2019:1352",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00019.html"
          },
          {
            "name": "openSUSE-SU-2019:1425",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00046.html"
          },
          {
            "name": "RHSA-2019:2125",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2125"
          },
          {
            "name": "RHSA-2019:2437",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2437"
          },
          {
            "name": "FEDORA-2019-d47a9d4b8b",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQYVZRFEXSN3KS43AVH4D7QX553EZQYP/"
          },
          {
            "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Extensible Firmware Interface Development Kit (EDK II)",
          "vendor": "Extensible Firmware Interface Development Kit (EDK II)",
          "versions": [
            {
              "status": "affected",
              "version": "N/A"
            }
          ]
        }
      ],
      "datePublic": "2019-03-26T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Denial of Service",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-04-29T21:06:25.000Z",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://edk2-docs.gitbooks.io/security-advisory/content/xhci-stack-local-stack-overflow.html"
        },
        {
          "name": "openSUSE-SU-2019:1352",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00019.html"
        },
        {
          "name": "openSUSE-SU-2019:1425",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00046.html"
        },
        {
          "name": "RHSA-2019:2125",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2125"
        },
        {
          "name": "RHSA-2019:2437",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2437"
        },
        {
          "name": "FEDORA-2019-d47a9d4b8b",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQYVZRFEXSN3KS43AVH4D7QX553EZQYP/"
        },
        {
          "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@intel.com",
          "ID": "CVE-2019-0161",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Extensible Firmware Interface Development Kit (EDK II)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "N/A"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Extensible Firmware Interface Development Kit (EDK II)"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Denial of Service"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://edk2-docs.gitbooks.io/security-advisory/content/xhci-stack-local-stack-overflow.html",
              "refsource": "CONFIRM",
              "url": "https://edk2-docs.gitbooks.io/security-advisory/content/xhci-stack-local-stack-overflow.html"
            },
            {
              "name": "openSUSE-SU-2019:1352",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00019.html"
            },
            {
              "name": "openSUSE-SU-2019:1425",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00046.html"
            },
            {
              "name": "RHSA-2019:2125",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2125"
            },
            {
              "name": "RHSA-2019:2437",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2437"
            },
            {
              "name": "FEDORA-2019-d47a9d4b8b",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQYVZRFEXSN3KS43AVH4D7QX553EZQYP/"
            },
            {
              "name": "[debian-lts-announce] 20210429 [SECURITY] [DLA 2645-1] edk2 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2019-0161",
    "datePublished": "2019-03-27T19:23:44.000Z",
    "dateReserved": "2018-11-13T00:00:00.000Z",
    "dateUpdated": "2024-08-04T17:44:14.759Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}