There are 2 open security issues in bookworm.
2 issues left for the package maintainer to handle:
- CVE-2023-45236:
(needs triaging)
EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality.
- CVE-2023-45237:
(needs triaging)
EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality.
You can find information about how to handle these issues in the security team's documentation.
2 issues that should be fixed with the next stable update:
- CVE-2024-1298:
EDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division-By-Zero due to a UNIT32 overflow via local access. A successful exploit of this vulnerability may lead to a loss of Availability.
- CVE-2024-38796:
EDK2 contains a vulnerability in the PeCoffLoaderRelocateImage(). An Attacker may cause memory corruption due to an overflow via an adjacent network. A successful exploit of this vulnerability may lead to a loss of Confidentiality, Integrity, and/or Availability.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/e/edk2.png){kind=link}