CVE-2019-14562 - edk2: DxeImageVerificationHandler integer overflow leads to endless loop

MEDIUM

edk2: DxeImageVerificationHandler integer overflow leads to endless loop

Published Nov 23, 2020

5.5

MEDIUM

CVSS 3.1

EPSS 0.31%

Integer overflow in DxeImageVerificationHandler() EDK II may allow an authenticated user to potentially enable denial of service via local access.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Extensible Firmware Interface Development Kit (EDK II)

n/a

Version	Status	Constraints
EDK II	affected	-

Product	Package	State	Advisory
Red Hat Enterprise Linux 8	edk2	Fix deferred	n/a
Red Hat Enterprise Linux 9	edk2	Not affected	n/a

No remediation recorded yet.

Weaknesses (2)

CWE-190

Integer Overflow

CWE-835

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2019-14562		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1869245		Issue Tracking
https://bugzilla.tianocore.org/show_bug.cgi?id=2215		x_refsource_MISCIssue TrackingVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-5723		Advisory
https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-14562
https://www.cve.org/CVERecord?id=CVE-2019-14562