Описание
A heap overflow in LzmaUefiDecompressGetInfo function in EDK II.
A flaw was found in edk2. A possible heap corruption in LzmaUefiDecompressGetInfo function may allow an attacker to execute code on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 7 | ovmf | Out of support scope | ||
| Red Hat Enterprise Linux 9 | edk2 | Not affected | ||
| Red Hat Enterprise Linux 8 | edk2 | Fixed | RHSA-2021:2591 | 29.06.2021 |
Показывать по
10
Дополнительная информация
Статус:
Moderate
Дефект:
CWE-120
https://bugzilla.redhat.com/show_bug.cgi?id=1883529edk2: possible heap corruption with LzmaUefiDecompressGetInfo
EPSS
Процентиль: 19%
0.0006
Низкий
6.7 Medium
CVSS3
Связанные уязвимости
EPSS
Процентиль: 19%
0.0006
Низкий
6.7 Medium
CVSS3