CVE-2019-0160
edk2: Buffer overflows in PartitionDxe and UdfDxe with long file names and invalid UDF media
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Red Hat (media), Amazon (media), Oracle (media), Ubuntu (media).
Descripción
Buffer overflow in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege and/or denial of service via network access.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| amazon linux 2 | edk2-aarch64, edk2-debuginfo, edk2-ovmf y 3 más | 20190501stable-2.amzn2.0.1 |
| debian 11 | edk2 | 0~20181115.85588389-1 |
| debian 12 | edk2 | 0~20181115.85588389-1 |
| debian 13 | edk2 | 0~20181115.85588389-1 |
| debian 14 | edk2 | 0~20181115.85588389-1 |
| debian 8 | edk2 | sin corrección indicada |
| echo | edk2 | 0~20181115.85588389-1 |
| Oracle Linux 7 | OVMF | 20180508-6.gitee3198e672e2.el7 |
| Oracle Linux 8 | edk2-aarch64, edk2-ovmf | 20190308git89910a39dcfd-6.el8 |
| ubuntu 18.04-ESM | edk2 | 0~20180205.c0d9813c-2ubuntu0.3+esm1 |
Mostrar las 16 entradas de 10 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| amazon linux 2 | edk2-aarch64 | 20190501stable-2.amzn2.0.1 |
| amazon linux 2 | edk2-debuginfo | 20190501stable-2.amzn2.0.1 |
| amazon linux 2 | edk2-ovmf | 20190501stable-2.amzn2.0.1 |
| amazon linux 2 | edk2-tools | 20190501stable-2.amzn2.0.1 |
| amazon linux 2 | edk2-tools-doc | 20190501stable-2.amzn2.0.1 |
| amazon linux 2 | edk2-tools-python | 20190501stable-2.amzn2.0.1 |
| debian 11 | edk2 | 0~20181115.85588389-1 |
| debian 12 | edk2 | 0~20181115.85588389-1 |
| debian 13 | edk2 | 0~20181115.85588389-1 |
| debian 14 | edk2 | 0~20181115.85588389-1 |
| debian 8 | edk2 | sin corrección indicada |
| echo | edk2 | 0~20181115.85588389-1 |
| Oracle Linux 7 | OVMF | 20180508-6.gitee3198e672e2.el7 |
| Oracle Linux 8 | edk2-aarch64 | 20190308git89910a39dcfd-6.el8 |
| Oracle Linux 8 | edk2-ovmf | 20190308git89910a39dcfd-6.el8 |
| ubuntu 18.04-ESM | edk2 | 0~20180205.c0d9813c-2ubuntu0.3+esm1 |
Referencias
- https://access.redhat.com/security/cve/CVE-2019-0160
- https://linux.oracle.com/cve/CVE-2019-0160.html
- https://linux.oracle.com/errata/ELSA-2019-3338.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-0160
- https://tianocore-docs.github.io/SecurityAdvisory/draft/partitiondxe-and-udf-buffer-overflow.html
- https://ubuntu.com/security/notices/USN-6920-1
- https://www.cve.org/CVERecord?id=CVE-2019-0160