Skip to content
OpenAdvisories
Medium ALAS2-2020-1510 6 CVEs

Moderate: edk2 security update (Amazon Linux 2)

Published Oct 22, 2020 · Updated Oct 22, 2020

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-14587: No description is available for this CVE. 1833352: CVE-2019-14587 edk2: double-unmap issue in SdMmcCreateTrb function in MdeModulePkg/Bus/Pci/SdMmcPciHcDxe/SdMmcPciHci.c CVE-2019-14586: No description is available for this CVE. 1833340: CVE-2019-14586 edk2: potential use-after-free due to the original configuration runtime memory is freed but it is still exposed to the OS runtime CVE-2019-14575: No description is available for this CVE. 1736862: CVE-2019-14575 edk2: DxeImageVerificationHandler() fails open in case of dbx signature check CVE-2019-14563: No description is available for this CVE. 1758620: CVE-2019-14563 edk2: numeric truncation in MdeModulePkg/PiDxeS3BootScriptLib CVE-2019-14559: No description is available for this CVE. 1758601: CVE-2019-14559 edk2: memory leak in ArpOnFrameRcvdDpc CVE-2019-14558: Insufficient control flow management in BIOS firmware for 8th, 9th, 10th Generation Intel(R) Core(TM), Intel(R) Celeron(R) Processor 4000 & 5000 Series Processors may allow an authenticated user to potentially enable denial of service via adjacent access. 1833347: CVE-2019-14558 edk2: potentially leaking of secret information due to uncleared memory

Fixed packages 6

ReleasePackageFixed in
Amazon Linux · 2 edk2-aarch64 0:20200801stable-1.amzn2.0.1
Amazon Linux · 2 edk2-debuginfo 0:20200801stable-1.amzn2.0.1
Amazon Linux · 2 edk2-ovmf 0:20200801stable-1.amzn2.0.1
Amazon Linux · 2 edk2-tools 0:20200801stable-1.amzn2.0.1
Amazon Linux · 2 edk2-tools-doc 0:20200801stable-1.amzn2.0.1
Amazon Linux · 2 edk2-tools-python 0:20200801stable-1.amzn2.0.1

Vulnerabilities 6

  • Unscored —
    CVE-2019-14558

    Insufficient control flow management in BIOS firmware for 8th, 9th, 10th Generation Intel(R) Core(TM), Intel(R) Celeron…

    edk2 edk2 Debian Ubuntu
  • Unscored —
    CVE-2019-14559

    Uncontrolled resource consumption in EDK II may allow an unauthenticated user to potentially enable denial of service v…

    edk2 edk2 Debian Ubuntu
  • Unscored —
    CVE-2019-14563

    Integer truncation in EDK II may allow an authenticated user to potentially enable escalation of privilege via local ac…

    edk2 edk2 Debian Ubuntu
  • Unscored —
    CVE-2019-14575

    Logic issue in DxeImageVerificationHandler() for EDK II may allow an authenticated user to potentially enable escalatio…

    edk2 edk2 Debian Ubuntu
  • Unscored —
    CVE-2019-14586

    Use after free vulnerability in EDK II may allow an authenticated user to potentially enable escalation of privilege, i…

    edk2 edk2 Debian Ubuntu
  • Unscored —
    CVE-2019-14587

    Logic issue EDK II may allow an unauthenticated user to potentially enable denial of service via adjacent access.

    edk2 edk2 Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-14558.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-14559.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-14563.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-14575.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-14586.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-14587.html