Msrc Azl3 Shim-Unsigned-Aarch64 15.8-5 On Azure Linux 3.0 vulnerabilities

CVE-2024-9143 [MEDIUM] CWE-787 Low-level invalid GF(2^m) parameters lead to OOB memory access Low-level invalid GF(2^m) parameters lead to OOB memory access FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source librari

CVE-2023-40548 [HIGH] CWE-787 Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with th

CVE-2023-40549 [MEDIUM] CWE-125 Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe file Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe file FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions o

CVE-2023-40550 [MEDIUM] CWE-125 Shim: out-of-bound read in verify_buffer_sbat() Shim: out-of-bound read in verify_buffer_sbat() FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is c

CVE-2023-40546 [MEDIUM] CWE-476 Shim: out-of-bounds read printing error messages Shim: out-of-bounds read printing error messages FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is

CVE-2022-28737 [MEDIUM] CWE-787 There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep

CVE-2023-2650 [MEDIUM] CWE-770 Possible DoS translating ASN.1 object identifiers Possible DoS translating ASN.1 object identifiers FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro i

CVE-2023-0215 [HIGH] CWE-416 Use-after-free following BIO_new_NDEF Use-after-free following BIO_new_NDEF FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is c

CVE-2022-0778 [HIGH] CWE-835 Infinite loop in BN_mod_sqrt() reachable when parsing certificates Infinite loop in BN_mod_sqrt() reachable when parsing certificates FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source l

CVE-2021-3712 [HIGH] CWE-125 Read buffer overruns processing ASN.1 strings Read buffer overruns processing ASN.1 strings FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed

CVE-2019-14584 [HIGH] CWE-476 Null pointer dereference in Tianocore EDK2 Null pointer dereference in Tianocore EDK2 FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Mic

CVE-2021-23840 [HIGH] CWE-190 Integer overflow in CipherUpdate Integer overflow in CipherUpdate FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed

CVE-2021-23841 [MEDIUM] CWE-476 Null pointer deref in X509_issuer_and_serial_hash() Null pointer deref in X509_issuer_and_serial_hash() FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the dis

CVE-2019-1547 [MEDIUM] ECDSA remote timing attack ECDSA remote timing attack FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in