There are 5 open security issues in bullseye.
5 issues left for the package maintainer to handle:
- CVE-2019-14560:
(needs triaging)
- CVE-2021-28216:
(needs triaging)
BootPerformanceTable pointer is read from an NVRAM variable in PEI. Recommend setting PcdFirmwarePerformanceDataTableS3Support to FALSE.
- CVE-2021-38575:
(needs triaging)
NetworkPkg/IScsiDxe has remotely exploitable buffer overflows.
- CVE-2021-38576:
(needs triaging)
A BIOS bug in firmware for a particular PC model leaves the Platform authorization value empty. This can be used to permanently brick the TPM in multiple ways, as well as to non-permanently DoS the system.
- CVE-2021-38578:
(needs triaging)
Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize.
You can find information about how to handle these issues in the security team's documentation.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/e/edk2.png){kind=link}