Summary
[20180508-6.gitee3198e672e2.el7]
- ovmf-MdeModulePkg-HiiDatabase-Fix-potential-integer-overf.patch [bz#1691479]
- ovmf-MdeModulePkg-HiiImage-Fix-stack-overflow-when-corrup.patch [bz#1691479]
- ovmf-MdeModulePkg-PartitionDxe-Add-check-for-underlying-d.patch [bz#1691647]
- ovmf-MdeModulePkg-UdfDxe-Refine-boundary-checks-for-file-.patch [bz#1691647]
- ovmf-MdeModulePkg-UdfDxe-Add-boundary-check-the-read-of-F.patch [bz#1691647]
- ovmf-MdeModulePkg-UdfDxe-Add-boundary-check-for-Component.patch [bz#1691647]
- ovmf-MdeModulePkg-UdfDxe-Add-boundary-check-for-getting-v.patch [bz#1691647]
- ovmf-MdeModulePkg-UsbBusDxe-Fix-wrong-buffer-length-used-.patch [bz#1697534]
- Resolves: bz#1691479
(CVE-2018-12181 OVMF: edk2: Stack buffer overflow with corrupted BMP [rhel-7])
- Resolves: bz#1691647
(CVE-2019-0160 OVMF: edk2: buffer overflows in PartitionDxe and UdfDxe with long file names and invalid UDF media [rhel-7])
- Resolves: bz#1697534
(CVE-2019-0161 ovmf: edk2: stack overflow in XHCI causing denial of service [rhel-7])
[20180508-5.gitee3198e672e2.el7]
- ovmf-MdeModulePkg-Variable-Fix-Timestamp-zeroing-issue-on.patch [bz#1666586]
- ovmf-MdePkg-Add-more-checker-in-UefiDecompressLib-to-acce.patch [bz#1666586]
- ovmf-IntelFrameworkModulePkg-Add-more-checker-in-UefiTian.patch [bz#1666586]
- ovmf-BaseTools-Add-more-checker-in-Decompress-algorithm-t.patch [bz#1666586]
- ovmf-BaseTools-Fix-UEFI-and-Tiano-Decompression-logic-iss.patch [bz#1666586]
- ovmf-MdePkg-BaseUefiDecompressLib-Fix-UEFI-Decompression-.patch [bz#1666586]
- ovmf-IntelFrameworkModulePkg-Fix-UEFI-and-Tiano-Decompres.patch [bz#1666586]
- ovmf-MdeModulePkg-PartitionDxe-Ensure-blocksize-holds-MBR.patch [bz#1684007]
- ovmf-MdeModulePkg-RamDiskDxe-Restrict-on-RAM-disk-size-CV.patch [bz#1684007]
- ovmf-redhat-openssl-update-introduce-MOCK-shorthand-for-m.patch [bz#1650390]
- ovmf-redhat-openssl-update-enable-the-bootstrap-container.patch [bz#1650390]
- ovmf-redhat-consume-OpenSSL-1.1.0i-from-Fedora-28.patch [bz#1650390]
- ovmf-Upgrade-OpenSSL-to-1.1.0j.patch [bz#1650390]
- Resolves: bz#1650390
(CVE-2018-5407 OVMF: openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) [rhel-7])
- Resolves: bz#1666586
(CVE-2017-5731 CVE-2017-5732 CVE-2017-5733 CVE-2017-5734 CVE-2017-5735 CVE-2018-3613 OVMF: various flaws [rhel-7])
- Resolves: bz#1684007
(CVE-2018-12180 OVMF: edk2: Buffer Overflow in BlockIo service for RAM disk [rhel-7.7])
[20180508-4.gitee3198e672e2.el7]
- ovmf-redhat-provide-firmware-descriptor-meta-files.patch [bz#1608599]
- Resolves: bz#1608599
([RHEL 7.7] RFE: provide firmware descriptor meta-files for OVMF)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | OVMF | 0:20180508-6.gitee3198e672e2.el7 |
Vulnerabilities 10
-
High 8.7
Buffer overflow in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privil…
-
Unscored —
Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user to potentially enable an escal…
-
Unscored —CVE-2017-5732 Rejected
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to a…
-
Unscored —CVE-2017-5733 Rejected
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to a…
-
Unscored —CVE-2017-5734 Rejected
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
-
Unscored —CVE-2017-5735 Rejected
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to a…
-
Unscored —
Stack overflow in corrupted bmp for EDK II may allow unprivileged user to potentially enable denial of service or eleva…
-
Unscored —
Logic issue in variable service module for EDK II/UDK2018/UDK2017/UDK2015 may allow an authenticated user to potentiall…
-
Unscored —CVE-2018-5407 Public exploit
Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attack…
-
Unscored —
Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local a…