Red Hat Security Advisory

RHSA-2024:1902

shim security update

Released 2024-04-18 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux BaseOS (v. 8) shim-15.8-4.el8_9, shim-aa64-15.8-4.el8_9, shim-ia32-15.8-4.el8_9 +1

TI-2023-21352 CVE-2023-40547 · GHSA-qjqj-4cq6-6f2f

MEDIUM 46

A remote code execution vulnerability was found in Shim.

CVSS 3.1HIGH 8.3 Adjacent network No auth No interaction EPSS 0.05417 Published 2024-01-25 Fixed in 15.8-3.el7, 15.8-1.el7 +9 CWE-787

TI-2023-21353 CVE-2023-40548 · GHSA-7cf2-63mg-hv4j

LOW 35

A buffer overflow was found in Shim in the 32-bit system.

CVSS 3.1HIGH 7.4 Local No auth No interaction EPSS 0.00436 Published 2024-01-29 Fixed in 15.8-3.el7, 15.8-1.el7 +9 CWE-190

TI-2023-21354 CVE-2023-40549 · GHSA-86pm-fpxw-jjjc

LOW 28

An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary.

CVSS 3.1MEDIUM 6.2 Local No auth No interaction EPSS 0.00412 Published 2024-01-29 Fixed in 15.8-3.el7, 15.8-1.el7 +9 CWE-125

TI-2023-21351 CVE-2023-40546 · GHSA-9fh5-955w-9jfh

LOW 28

A flaw was found in Shim when an error happened while creating a new ESL variable.

CVSS 3.1MEDIUM 6.2 Local No auth No interaction EPSS 0.00438 Published 2024-01-29 Fixed in 15.8-3.el7, 15.8-1.el7 +9 CWE-476

TI-2023-21355 CVE-2023-40550 · GHSA-grx2-83w4-8647

LOW 25

An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00397 Published 2024-01-29 Fixed in 15.8-3.el7, 15.8-1.el7 +9 CWE-125

TI-2023-21356 CVE-2023-40551 · GHSA-6j62-7qgg-9gww

LOW 23

A flaw was found in the MZ binary format in Shim.

CVSS 3.1MEDIUM 5.1 Local High privileges No interaction EPSS 0.00397 Published 2024-01-29 Fixed in 15.8-3.el7, 15.8-1.el7 +9 CWE-125