CVE-2019-0160
edk2: Buffer overflows in PartitionDxe and UdfDxe with long file names and invalid UDF media
Sévérité par source
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon Red Hat (moyenne), Amazon (moyenne), Oracle (moyenne), Ubuntu (moyenne).
Description
Buffer overflow in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege and/or denial of service via network access.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| amazon linux 2 | edk2-aarch64, edk2-debuginfo, edk2-ovmf et 3 autres | 20190501stable-2.amzn2.0.1 |
| debian 11 | edk2 | 0~20181115.85588389-1 |
| debian 12 | edk2 | 0~20181115.85588389-1 |
| debian 13 | edk2 | 0~20181115.85588389-1 |
| debian 14 | edk2 | 0~20181115.85588389-1 |
| debian 8 | edk2 | pas de correctif indiqué |
| echo | edk2 | 0~20181115.85588389-1 |
| Oracle Linux 7 | OVMF | 20180508-6.gitee3198e672e2.el7 |
| Oracle Linux 8 | edk2-aarch64, edk2-ovmf | 20190308git89910a39dcfd-6.el8 |
| ubuntu 18.04-ESM | edk2 | 0~20180205.c0d9813c-2ubuntu0.3+esm1 |
Afficher les 16 entrées de 10 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| amazon linux 2 | edk2-aarch64 | 20190501stable-2.amzn2.0.1 |
| amazon linux 2 | edk2-debuginfo | 20190501stable-2.amzn2.0.1 |
| amazon linux 2 | edk2-ovmf | 20190501stable-2.amzn2.0.1 |
| amazon linux 2 | edk2-tools | 20190501stable-2.amzn2.0.1 |
| amazon linux 2 | edk2-tools-doc | 20190501stable-2.amzn2.0.1 |
| amazon linux 2 | edk2-tools-python | 20190501stable-2.amzn2.0.1 |
| debian 11 | edk2 | 0~20181115.85588389-1 |
| debian 12 | edk2 | 0~20181115.85588389-1 |
| debian 13 | edk2 | 0~20181115.85588389-1 |
| debian 14 | edk2 | 0~20181115.85588389-1 |
| debian 8 | edk2 | pas de correctif indiqué |
| echo | edk2 | 0~20181115.85588389-1 |
| Oracle Linux 7 | OVMF | 20180508-6.gitee3198e672e2.el7 |
| Oracle Linux 8 | edk2-aarch64 | 20190308git89910a39dcfd-6.el8 |
| Oracle Linux 8 | edk2-ovmf | 20190308git89910a39dcfd-6.el8 |
| ubuntu 18.04-ESM | edk2 | 0~20180205.c0d9813c-2ubuntu0.3+esm1 |
Références
- https://access.redhat.com/security/cve/CVE-2019-0160
- https://linux.oracle.com/cve/CVE-2019-0160.html
- https://linux.oracle.com/errata/ELSA-2019-3338.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-0160
- https://tianocore-docs.github.io/SecurityAdvisory/draft/partitiondxe-and-udf-buffer-overflow.html
- https://ubuntu.com/security/notices/USN-6920-1
- https://www.cve.org/CVERecord?id=CVE-2019-0160