Threat Intelligence Database

A security vulnerability (CVE-2025-2296) in the edk2 package used by Red Hat Enterprise Linux 10 allows arbitrary command execution due to improper input validation. The edk2 package provides UEFI firmware support for virtual machines such as QEMU and KVM. Red Hat has released an important security update addressing this issue for multiple architectures and variants of Red Hat Enterprise Linux 10 and related CodeReady Linux Builder products.

An integer overflow vulnerability (CVE-2024-38796) exists in the edk2 package's PeCoffLoaderRelocateImage function, part of the Embedded Development Kit (EDK) used to enable UEFI support for virtual machines such as QEMU and KVM. This vulnerability affects Red Hat Enterprise Linux 9.2 Extended Update Support and related variants. Red Hat has issued a security update to address this issue.

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: Possible denial of service in X.509 name checks (CVE-2024-6119) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.