Unscored CVE-2014-4859 EUVD-2014-4778GHSA-hpff-53rm-95gf

Integer overflow in the Drive Execution Environment (DXE) phase in the Capsule Update feature in the UEFI implementation in EDK2 allows phy…

Published Jan 31, 2020 · Updated Aug 6, 2024 · Assigned by certcc

Vendor: American Megatrends Incorporated (AMI) Vendor: Phoenix Technologies Product: BIOS Product: SCT3

Description

Integer overflow in the Drive Execution Environment (DXE) phase in the Capsule Update feature in the UEFI implementation in EDK2 allows physically proximate attackers to bypass intended access restrictions via crafted data.

Affected products

Vendor	Product	Affected	Fixed
Phoenix Technologies	SCT3	before 5/23/2014	—
American Megatrends Incorporated (AMI)	BIOS	unknown	—

References

http://www.kb.cert.org/vuls/id/552286