edk2-tools-doc (AlmaLinux:9) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the AlmaLinux:9 package edk2-tools-doc, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (27)

• CVE-2023-45234 — CVSS 8.3 (high): EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers option from a DHCPv6 Advertise…
• CVE-2023-45235 — CVSS 8.3 (high): EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option from a DHCPv6 proxy Advertise…
• CVE-2023-45230 — CVSS 8.3 (high): EDK2's Network Package is susceptible to a buffer overflow vulnerability via a long server ID option in DHCPv6 client. This vulnerability…
• CVE-2022-4450 — CVSS 7.5 (high): The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the…
• CVE-2023-45232 — CVSS 7.5 (high): EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in the Destination Options header of…
• CVE-2023-0215 — CVSS 7.5 (high): The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to…
• CVE-2023-45233 — CVSS 7.5 (high): EDK2's Network Package is susceptible to an infinite lop vulnerability when parsing a PadN option in the Destination Options header of…
• CVE-2025-9230 — CVSS 7.5 (high): Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read…
• CVE-2024-6119 — CVSS 7.5 (high): Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an…
• CVE-2021-38578 — CVSS 7.4 (high): Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize.
• CVE-2023-0286 — CVSS 7.4 (high): There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an…
• CVE-2022-36764 — CVSS 7.0 (high): EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a heap buffer overflow via a local…
• CVE-2022-36763 — CVSS 7.0 (high): EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a heap buffer overflow via a local…
• CVE-2022-36765 — CVSS 7.0 (high): EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer overflow to buffer overflow via a…
• CVE-2023-45231 — CVSS 6.5 (medium): EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing Neighbor Discovery Redirect message. This…
• CVE-2023-2650 — CVSS 6.5 (medium): Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary…
• CVE-2023-45229 — CVSS 6.5 (medium): EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or IA_TA option in a DHCPv6…
• CVE-2023-6129 — CVSS 6.5 (medium): Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of…
• CVE-2024-1298 — CVSS 6.0 (medium): EDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division-By-Zero due to a UNIT32 overflow via local…
• CVE-2024-38796 — CVSS 5.9 (medium): EDK2 contains a vulnerability in the PeCoffLoaderRelocateImage(). An Attacker may cause memory corruption due to an overflow via an…
• CVE-2022-4304 — CVSS 5.9 (medium): A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a…
• CVE-2023-6237 — CVSS 5.9 (medium): Issue summary: Checking excessively long invalid RSA public keys may take a long time. Impact summary: Applications that use the function…
• CVE-2023-45236 — CVSS 5.8 (medium): EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to…
• CVE-2024-0727 — CVSS 5.5 (medium): Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack…
• CVE-2023-45237 — CVSS 5.3 (medium): EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to…
• CVE-2023-3446 — CVSS 5.3 (medium): Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions…
• CVE-2019-14560: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any…