Summary
Laszlo Ersek discovered that EDK II incorrectly handled recursion. A
remote attacker could possibly use this issue to cause EDK II to consume
resources, leading to a denial of service. (CVE-2021-28210)
Satoshi Tanda discovered that EDK II incorrectly handled decompressing
certain images. A remote attacker could use this issue to cause EDK II to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2021-28211)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | edk2 | 0~20191122.bd85bf54-2ubuntu3.2 |
Vulnerabilities 2
-
Unscored —
An unlimited recursion in DxeCore in EDK II.
-
Unscored —
A heap overflow in LzmaUefiDecompressGetInfo function in EDK II.