For Debian 9 stretch, these problems have been fixed in version 0~20161202.7bbe0b3e-1+deb9u2.

We recommend that you upgrade your edk2 packages.

For the detailed security status of edk2 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/edk2

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Uncontrolled resource consumption in EDK II may allow an unauthenticated user to potentially enable denial     of service via network access. (CVE-2019-14559)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for ovmf fixes the following issues :

Security issues fixed :

CVE-2019-14563: Fixed a memory corruption caused by insufficient numeric truncation (bsc#1163959).

CVE-2019-14553: Fixed the TLS certification verification in HTTPS-over-IPv6 boot sequences (bsc#1153072).

CVE-2019-14559: Fixed a remotely exploitable memory leak in the ARP handling code (bsc#1163927).

CVE-2019-14575: Fixed an insufficient signature check in the DxeImageVerificationHandler (bsc#1163969).

Enabled HTTPS-over-IPv6 (bsc#1153072).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ovmf fixes the following issues :

  - CVE-2019-14559: Fixed a memory leak in     ArpOnFrameRcvdDpc() (bsc#1163927).

This update was imported from the SUSE:SLE-15:Update update project.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:4805 advisory.

  - edk2: memory leak in ArpOnFrameRcvdDpc (CVE-2019-14559)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2021-1237:01 advisory.

    * edk2: memory leak in ArpOnFrameRcvdDpc (CVE-2019-14559)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
149103	Debian DLA-2645-1 : edk2 security update	Nessus	Debian Local Security Checks	2021/4/30	2024/1/12	high
222418	Linux Distros Unpatched Vulnerability : CVE-2019-14559	Nessus	Misc.	2025/3/4	2026/7/27	high
134654	SUSE SLES12 Security Update : ovmf (SUSE-SU-2020:0699-1)	Nessus	SuSE Local Security Checks	2020/3/18	2021/1/13	high
136451	openSUSE Security Update : ovmf (openSUSE-2020-622)	Nessus	SuSE Local Security Checks	2020/5/11	2024/3/13	high
145848	CentOS 8 : edk2 (CESA-2020:4805)	Nessus	CentOS Local Security Checks	2021/2/1	2021/3/23	high
293922	MiracleLinux 8 : edk2-20200602gitca407c7246bf-3.el8 (AXSA:2021-1237:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high

检测

插件搜索

high

high

high

high

high

high