Oracle Linux: CVE-2023-45230: ELSA-2024-20865: edk2 security update (MODERATE) (Multiple Advisories)

Description

EDK2's Network Package is susceptible to a buffer overflow vulnerability via a long server ID option in DHCPv6 client. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability. A security flaw was identified in EDK2, the open-source reference implementation of the UEFI specification, involving a buffer overflow vulnerability. This particular weakness enables an unauthorized attacker within the vicinity of the network to transmit a specifically crafted DHCPv6 message. This, in turn, could result in an information disclosure and compromise the availability of the system.