Skip to content
OpenAdvisories
High ELSA-2022-9466 1 CVE

Important: shim-signed security update (Oracle Linux 7)

Published Jun 7, 2022 · Updated Jun 7, 2022

Ecosystem: Oracle Linux

Summary

[15.6-1.0.7]
- Update shimx64.efi and shimia32.efi signed by Microsoft [JIRA: OLDIS-16370]

[15.6-1.0.5]
- Update to shim-unsigned v15.6.rc2 [JIRA: OLDIS-16370]

[15.6-1.0.3]
- Add all algorithms using OPENSSL_add_all_algorithms [JIRA: OLDIS-16370]

[15.6-1.0.1]
- Update to 15.6.rc1 [JIRA: OLDIS-16370]
- update CVE-2022-28737 patches [JIRA: OLDIS-16370]
- Fix CVE-2022-28737 [JIRA: OLDIS-16370]

[15.5-1.0.1]
- update mokutils [JIRA: OLDIS-16370]
- Import shim-15.5-1.0.1 [JIRA: OLDIS-16370]
- Update vendor certs [JIRA: OLDIS-16370]
- Update oracle(grub2-sig-key) [JIRA: OLDIS-16370]

Fixed packages 3

ReleasePackageFixed in
Oracle Linux · 7 mokutil 0:15.6-1.0.7.el7
Oracle Linux · 7 shim-ia32 0:15.6-1.0.7.el7
Oracle Linux · 7 shim-x64 0:15.6-1.0.7.el7

Vulnerabilities 1

  • Medium 6.5
    CVE-2022-28737

    There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables

    There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables; The handle_image() function takes into account the SizeOfRawData field from each section to be loaded. An attacker can leverage this to perform out-of-b…

    Red Hat Bootloader Team shim shim shim-unsigned-x64 Debian Ubuntu Azure Linux