{"id":"CVE-2021-28211","aliases":["DEBIAN-CVE-2021-28211","DLA-2645-1","EUVD-2021-14901","GHSA-9f7r-6p3j-j5wj","OESA-2021-1338","RHSA-2021:2591","RLSA-2021:2591","SUSE-SU-2021:0972-1","SUSE-SU-2021:0987-1","SUSE-SU-2021:2117-1","SUSE-SU-2021:2161-1","UBUNTU-CVE-2021-28211","USN-4923-1","USN-7060-1","openSUSE-SU-2021:0495-1","openSUSE-SU-2024:11134-1"],"status":"published","title":"A heap overflow in LzmaUefiDecompressGetInfo function in EDK II.","description":"A heap overflow in LzmaUefiDecompressGetInfo function in EDK II.","severity":{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00386,"percentile":0.32928,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122","CWE-787"],"published":"2021-03-16T00:00:00Z","modified":"2026-10-24T10:30:25Z","fixes":[{"ecosystem":"Debian:12","package":"edk2","fixed_in":["2020.11-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"edk2","fixed_in":["2020.11-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"edk2","fixed_in":["2020.11-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"edk2","fixed_in":["202002-5.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"edk2","fixed_in":["202002-5.oe1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"edk2","fixed_in":["0:20200602gitca407c7246bf-4.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"edk2-aarch64","fixed_in":["0:20200602gitca407c7246bf-4.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"edk2-ovmf","fixed_in":["0:20200602gitca407c7246bf-4.el8_4.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"edk2","fixed_in":["0:20200602gitca407c7246bf-4.el8_4.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"edk2","fixed_in":["0~20160408.ffea0a2c-2ubuntu0.2+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"edk2","fixed_in":["0~20180205.c0d9813c-2ubuntu0.3+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"edk2","fixed_in":["0~20191122.bd85bf54-2ubuntu3.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.11-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.11-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.11-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20161202.7bbe0b3e-1+deb9u2"}]}],"versions":["0~20161202.7bbe0b3e-1","0~20161202.7bbe0b3e-1+deb9u1"],"bundled":11},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202002-5.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202002-5.oe1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20200602gitca407c7246bf-4.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"edk2-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20200602gitca407c7246bf-4.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20200602gitca407c7246bf-4.el8_4.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20200602gitca407c7246bf-4.el8_4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP2","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"201911-7.11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017+git1510945757.b2662641d5-3.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017+git1510945757.b2662641d5-3.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2015+git1462940744.321151f-19.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017+git1510945757.b2662641d5-5.43.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017+git1510945757.b2662641d5-5.43.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017+git1510945757.b2662641d5-5.43.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017+git1510945757.b2662641d5-5.43.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017+git1510945757.b2662641d5-5.43.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017+git1510945757.b2662641d5-5.43.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017+git1510945757.b2662641d5-5.43.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017+git1510945757.b2662641d5-5.43.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017+git1510945757.b2662641d5-5.43.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017+git1510945757.b2662641d5-5.43.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017+git1510945757.b2662641d5-5.43.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017+git1510945757.b2662641d5-5.43.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017+git1510945757.b2662641d5-5.43.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20160408.ffea0a2c-2ubuntu0.2+esm3"}]}],"versions":["0~20150106.5c2d456b-2","0~20160104.c2a892d7-1","0~20160408.ffea0a2c-2","0~20160408.ffea0a2c-2ubuntu0.1","0~20160408.ffea0a2c-2ubuntu0.2","0~20160408.ffea0a2c-2ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20180205.c0d9813c-2ubuntu0.3+esm2"}]}],"versions":["0~20170911.5dfba97c-1","0~20171010.234dbcef-1","0~20171027.76fd5a66-1","0~20171205.a9212288-1","0~20180105.0bc94c74-1","0~20180205.c0d9813c-1","0~20180205.c0d9813c-2","0~20180205.c0d9813c-2ubuntu0.1","0~20180205.c0d9813c-2ubuntu0.2","0~20180205.c0d9813c-2ubuntu0.3","0~20180205.c0d9813c-2ubuntu0.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20191122.bd85bf54-2ubuntu3.2"}]}],"versions":["0~20190606.20d2e5a1-2ubuntu1","0~20190828.37eef910-3","0~20190828.37eef910-4","0~20191122.bd85bf54-1","0~20191122.bd85bf54-1ubuntu1","0~20191122.bd85bf54-2","0~20191122.bd85bf54-2ubuntu1","0~20191122.bd85bf54-2ubuntu2","0~20191122.bd85bf54-2ubuntu3","0~20191122.bd85bf54-2ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20191122.bd85bf54-2ubuntu3.2"}]}],"versions":["0~20190606.20d2e5a1-2ubuntu1","0~20190828.37eef910-3","0~20190828.37eef910-4","0~20191122.bd85bf54-1","0~20191122.bd85bf54-1ubuntu1","0~20191122.bd85bf54-2","0~20191122.bd85bf54-2ubuntu1","0~20191122.bd85bf54-2ubuntu2","0~20191122.bd85bf54-2ubuntu3","0~20191122.bd85bf54-2ubuntu3.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20160408.ffea0a2c-2ubuntu0.2+esm3"}]}],"versions":["0~20150106.5c2d456b-2","0~20160104.c2a892d7-1","0~20160408.ffea0a2c-2","0~20160408.ffea0a2c-2ubuntu0.1","0~20160408.ffea0a2c-2ubuntu0.2","0~20160408.ffea0a2c-2ubuntu0.2+esm1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20180205.c0d9813c-2ubuntu0.3+esm2"}]}],"versions":["0~20170911.5dfba97c-1","0~20171010.234dbcef-1","0~20171027.76fd5a66-1","0~20171205.a9212288-1","0~20180105.0bc94c74-1","0~20180205.c0d9813c-1","0~20180205.c0d9813c-2","0~20180205.c0d9813c-2ubuntu0.1","0~20180205.c0d9813c-2ubuntu0.2","0~20180205.c0d9813c-2ubuntu0.3","0~20180205.c0d9813c-2ubuntu0.3+esm1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20191122.bd85bf54-2ubuntu3.6"}]}],"versions":["0~20190606.20d2e5a1-2ubuntu1","0~20190828.37eef910-3","0~20190828.37eef910-4","0~20191122.bd85bf54-1","0~20191122.bd85bf54-1ubuntu1","0~20191122.bd85bf54-2","0~20191122.bd85bf54-2ubuntu1","0~20191122.bd85bf54-2ubuntu2","0~20191122.bd85bf54-2ubuntu3","0~20191122.bd85bf54-2ubuntu3.1","0~20191122.bd85bf54-2ubuntu3.2","0~20191122.bd85bf54-2ubuntu3.3","0~20191122.bd85bf54-2ubuntu3.4","0~20191122.bd85bf54-2ubuntu3.5"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.02-3ubuntu0.22.04.3"}]}],"versions":["2021.08~rc0-2","2021.08-3","2021.11~rc1-1","2021.11-1","2021.11-2","2022.02~rc1-1","2022.02~rc1-1ubuntu1","2022.02-1","2022.02-2","2022.02-3","2022.02-3ubuntu0.22.04.1","2022.02-3ubuntu0.22.04.2"],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"201911-lp152.6.11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202105-3.4"}]}],"bundled":21}],"products":[{"vendor":"tianocore","product":"edk ii"},{"vendor":"tianocore","product":"edk2"}],"references":[{"url":"https://bugzilla.tianocore.org/show_bug.cgi?id=1816","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Vendor Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28211","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9f7r-6p3j-j5wj"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-28211","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1338","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:2591","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1883529","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2591.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-28211","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-28211","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2021:2591","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210972-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1183578","tags":["report"]},{"url":"https://bugzilla.suse.com/1183579","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28211","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210987-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212117-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1177789","tags":["report"]},{"url":"https://bugzilla.suse.com/1186151","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14584","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212161-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-28211","tags":["report"]},{"url":"https://github.com/tianocore/edk2/pull/1138","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4923-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7060-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-28210","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-0161","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-38575","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-38578","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-1292","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/O64FXHJK5XXCJEHCRQJDNI2X2UVMP6BS/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5731","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-0160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-0161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14559","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14562","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14575","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14587","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-28211","description":"A heap overflow in LzmaUefiDecompressGetInfo function in EDK II.","status":"published","published":"2021-06-11T15:11:23Z","modified":"2024-08-03T21:40:13.314Z","cwes":["CWE-122"],"updated_at":"2026-11-02T14:33:08.811269Z"}],"euvd":[{"id":"EUVD-2021-14901","description":"A heap overflow in LzmaUefiDecompressGetInfo function in EDK II.","status":"published","published":"2021-06-11T15:11:23Z","modified":"2024-08-03T21:40:13Z","updated_at":"2026-11-03T03:24:47.350261Z"}],"ghsa":[{"id":"GHSA-9f7r-6p3j-j5wj","title":"A heap overflow in LzmaUefiDecompressGetInfo function in EDK II.","description":"A heap overflow in LzmaUefiDecompressGetInfo function in EDK II.","status":"published","published":"2022-05-24T19:05:01Z","modified":"2023-01-29T05:06:58Z","cwes":["CWE-787"],"updated_at":"2026-11-02T14:46:07.768849Z"}],"nvd":[{"id":"CVE-2021-28211","description":"A heap overflow in LzmaUefiDecompressGetInfo function in EDK II.","status":"published","published":"2021-06-11T16:15:12.503Z","modified":"2026-06-17T03:46:04.583Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-122","CWE-787"],"updated_at":"2026-11-02T14:06:54.439974Z"}],"osv":[{"id":"CVE-2021-28211","description":"A heap overflow in LzmaUefiDecompressGetInfo function in EDK II.","status":"published","published":"2021-06-11T16:15:12.503Z","modified":"2026-10-24T10:30:25.120578207Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:19.129331Z"},{"id":"DEBIAN-CVE-2021-28211","description":"A heap overflow in LzmaUefiDecompressGetInfo function in EDK II.","status":"published","published":"2021-06-11T16:15:12.503Z","modified":"2026-10-23T18:03:36.975264317Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:34.94143Z"},{"id":"OESA-2021-1338","title":"edk2 security update","description":"EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.\r\n\r\nSecurity Fix(es):\r\n\r\nA heap overflow in LzmaUefiDecompressGetInfo function in EDK II.(CVE-2021-28211)","status":"published","published":"2021-09-10T11:04:36Z","modified":"2026-08-18T01:15:51.884214137Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2021:2591","title":"Red Hat Security Advisory: edk2 security update","status":"published","published":"2024-09-16T05:54:44Z","modified":"2025-11-22T12:22:26Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RLSA-2021:2591","title":"Moderate: edk2 security update","description":"EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. \n\nSecurity Fix(es):\n\n* edk2: possible heap corruption with LzmaUefiDecompressGetInfo (CVE-2021-28211)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-06-29T13:59:11Z","modified":"2026-02-04T12:00:08.591014Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2021-28211","description":"A heap overflow in LzmaUefiDecompressGetInfo function in EDK II.","status":"published","published":"2021-03-16T00:00:00Z","modified":"2026-02-04T03:54:51.905532Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"DLA-2645-1","title":"edk2 - security update","status":"published","published":"2021-04-29T00:00:00Z","modified":"2026-03-09T01:23:38.91045Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"openSUSE-SU-2021:0495-1","title":"Security update for ovmf","description":"This update for ovmf fixes the following issues:\n\n- CVE-2021-28211: ovmf: edk2: possible heap corruption with LzmaUefiDecompressGetInfo (bsc#1183578)\n- CVE-2021-28210: ovmf: unlimited FV recursion, round 2 (bsc#1183579)\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-04-02T04:04:49Z","modified":"2026-02-04T03:41:05.555934Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:11134-1","title":"ovmf-202105-3.4 on GA media","description":"These are all security issues fixed in the ovmf-202105-3.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:25:46.183484Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2021:0972-1","title":"Security update for ovmf","description":"This update for ovmf fixes the following issues:\n\n- CVE-2021-28211: ovmf: edk2: possible heap corruption with LzmaUefiDecompressGetInfo (bsc#1183578)\n- CVE-2021-28210: ovmf: unlimited FV recursion, round 2 (bsc#1183579)\n","status":"published","published":"2021-03-29T17:31:05Z","modified":"2026-02-04T03:52:18.184894Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:0987-1","title":"Security update for ovmf","description":"This update for ovmf fixes the following issues:\n\n- CVE-2021-28211: ovmf: edk2: possible heap corruption with LzmaUefiDecompressGetInfo (bsc#1183578)\n- CVE-2021-28210: ovmf: unlimited FV recursion, round 2 (bsc#1183579)\n","status":"published","published":"2021-03-30T15:57:39Z","modified":"2026-02-04T03:24:24.906721Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:2117-1","title":"Security update for ovmf","description":"This update for ovmf fixes the following issues:\n\n- Fixed a possible buffer overflow in IScsiDxe (bsc#1186151)\n- CVE-2021-28211: ovmf: edk2: possible heap corruption with LzmaUefiDecompressGetInfo (bsc#1183578)\n- CVE-2021-28210: ovmf: unlimited FV recursion, round 2 (bsc#1183579)\n- CVE-2019-14584: ovmf,shim: NULL pointer dereference in AuthenticodeVerify() (bsc#1177789)\n","status":"published","published":"2021-06-22T11:56:57Z","modified":"2026-02-04T02:17:46.830101Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:2161-1","title":"Security update for ovmf","description":"This update for ovmf fixes the following issues:\n\n- Fixed a possible buffer overflow in IScsiDxe (bsc#1186151)\n- CVE-2021-28211: ovmf: edk2: possible heap corruption with LzmaUefiDecompressGetInfo (bsc#1183578)\n- CVE-2021-28210: ovmf: unlimited FV recursion, round 2 (bsc#1183579)\n","status":"published","published":"2021-06-25T07:40:58Z","modified":"2026-02-04T04:19:30.387514Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"USN-4923-1","title":"edk2 vulnerabilities","description":"Laszlo Ersek discovered that EDK II incorrectly handled recursion. A\nremote attacker could possibly use this issue to cause EDK II to consume\nresources, leading to a denial of service. (CVE-2021-28210)\n\nSatoshi Tanda discovered that EDK II incorrectly handled decompressing\ncertain images. A remote attacker could use this issue to cause EDK II to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2021-28211)\n","status":"published","published":"2021-04-20T17:08:41Z","modified":"2026-02-10T04:42:09Z","updated_at":"2026-11-02T16:58:15.159055Z"},{"id":"USN-7060-1","title":"edk2 vulnerabilities","description":"It was discovered that EDK II did not check the buffer length in XHCI, \nwhich could lead to a stack overflow. A local attacker could potentially\nuse this issue to cause a denial of service. This issue only affected \nUbuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-0161)\n\nLaszlo Ersek discovered that EDK II incorrectly handled recursion. A\nremote attacker could possibly use this issue to cause EDK II to consume\nresources, leading to a denial of service. This issue only affected \nUbuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2021-28210)\n\nSatoshi Tanda discovered that EDK II incorrectly handled decompressing\ncertain images. A remote attacker could use this issue to cause EDK II to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.\n(CVE-2021-28211)\n\nIt was discovered that EDK II incorrectly decoded certain strings. A remote\nattacker could use this issue to cause EDK II to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. This issue only \naffected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2021-38575)\n\nIt was discovered that EDK II had integer underflow vulnerability in \nSmmEntryPoint, which could result in a buffer overflow. An attacker\ncould potentially use this issue to cause a denial of service.\n(CVE-2021-38578)\n\nElison Niven discovered that OpenSSL, vendored in EDK II, incorrectly \nhandled the c_rehash script. A local attacker could possibly use this \nissue to execute arbitrary commands when c_rehash is run. This issue \nonly affected Ubuntu 16.04 LTS. (CVE-2022-1292)\n","status":"published","published":"2024-10-10T03:41:37Z","modified":"2026-06-25T13:32:29.224935972Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}