Search CVE reports


Toggle filters

71 – 80 of 123 results


CVE-2022-0778

High priority

Some fixes available 16 of 20

The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public...

4 affected packages

edk2, nodejs, openssl, openssl1.0

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS
edk2 Not affected Fixed Needs evaluation Needs evaluation
nodejs Not affected Fixed Not affected Not affected
openssl Fixed Fixed Fixed Fixed
openssl1.0 Not in release Not in release Not in release Fixed
Show less packages

CVE-2021-38578

Medium priority

Some fixes available 4 of 6

Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize.

1 affected package

edk2

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS
edk2 Not affected Fixed Fixed Fixed
Show less packages

CVE-2021-38577

Medium priority
Ignored

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage.

1 affected package

edk2

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS
edk2 Not affected Not affected Not affected
Show less packages

CVE-2021-4160

Low priority
Vulnerable

There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves. Impact was not analyzed in detail, because the pre-requisites for attack...

4 affected packages

edk2, nodejs, openssl, openssl1.0

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS
edk2 Not affected Not affected Not affected Not affected
nodejs Not affected Not affected Not affected Not affected
openssl Not affected Not affected Not affected Not affected
openssl1.0 Not in release Not in release Not in release Not affected
Show less packages

CVE-2021-38576

Low priority
Vulnerable

A BIOS bug in firmware for a particular PC model leaves the Platform authorization value empty. This can be used to permanently brick the TPM in multiple ways, as well as to non-permanently DoS the system.

1 affected package

edk2

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS
edk2 Not affected Not affected Vulnerable Vulnerable
Show less packages

CVE-2021-4044

Medium priority
Fixed

Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. That function may return a negative return value to indicate an internal error (for example out of memory)....

4 affected packages

openssl, openssl1.0, nodejs, edk2

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS
openssl Fixed Not affected Not affected
openssl1.0 Not in release Not in release Not affected
nodejs Not affected Not affected Not affected
edk2 Not affected Not affected Not affected
Show less packages

CVE-2021-38575

Medium priority
Fixed

NetworkPkg/IScsiDxe has remotely exploitable buffer overflows.

1 affected package

edk2

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS
edk2 Not affected Not affected Fixed Fixed
Show less packages

CVE-2021-3712

Medium priority

Some fixes available 18 of 21

ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented...

4 affected packages

edk2, nodejs, openssl, openssl1.0

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS
edk2 Not affected Fixed Fixed Needs evaluation
nodejs Not affected Not affected Not affected Not affected
openssl Fixed Fixed Fixed Fixed
openssl1.0 Not in release Not in release Not in release Fixed
Show less packages

CVE-2021-3711

High priority
Fixed

In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and,...

4 affected packages

edk2, nodejs, openssl, openssl1.0

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS
edk2 Not affected Not affected Not affected Not affected
nodejs Not affected Not affected Not affected Not affected
openssl Fixed Fixed Fixed Fixed
openssl1.0 Not in release Not in release Not in release Not affected
Show less packages

CVE-2021-28216

Low priority
Vulnerable

BootPerformanceTable pointer is read from an NVRAM variable in PEI. Recommend setting PcdFirmwarePerformanceDataTableS3Support to FALSE.

1 affected package

edk2

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS
edk2 Not affected Not affected Vulnerable Vulnerable
Show less packages