Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise Micro 5.2 package shim, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.
CVEs (8)
CVE-2023-40547 — CVSS 8.3 (high): A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP…
CVE-2023-40548 — CVSS 7.4 (high): A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled…
CVE-2024-2312 — CVSS 6.7 (medium): GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks…
CVE-2022-28737 — CVSS 6.5 (medium): There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables; The handle_image() function…
CVE-2023-40549 — CVSS 6.2 (medium): An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw…
CVE-2023-40546 — CVSS 6.2 (medium): A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to…
CVE-2023-40550 — CVSS 5.5 (medium): An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during…
CVE-2023-40551 — CVSS 5.1 (medium): A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive…