| 1 | ## @file
|
|---|
| 2 | # Security Fixes for SecurityPkg
|
|---|
| 3 | #
|
|---|
| 4 | # Copyright (c) Microsoft Corporation
|
|---|
| 5 | # SPDX-License-Identifier: BSD-2-Clause-Patent
|
|---|
| 6 | ##
|
|---|
| 7 | CVE_2022_36763:
|
|---|
| 8 | commit_titles:
|
|---|
| 9 | - "SecurityPkg: DxeTpm2Measurement: SECURITY PATCH 4117 - CVE 2022-36763"
|
|---|
| 10 | - "SecurityPkg: DxeTpmMeasurement: SECURITY PATCH 4117 - CVE 2022-36763"
|
|---|
| 11 | - "SecurityPkg: : Adding CVE 2022-36763 to SecurityFixes.yaml"
|
|---|
| 12 | - "SecurityPkg: DxeTpm2MeasureBootLib: SECURITY PATCH 4117/4118 symbol rename"
|
|---|
| 13 | - "SecurityPkg: DxeTpmMeasureBootLib: SECURITY PATCH 4117/4118 symbol rename"
|
|---|
| 14 | - "SecurityPkg: : Updating SecurityFixes.yaml after symbol rename"
|
|---|
| 15 | cve: CVE-2022-36763
|
|---|
| 16 | date_reported: 2022-10-25 11:31 UTC
|
|---|
| 17 | description: (CVE-2022-36763) - Heap Buffer Overflow in Tcg2MeasureGptTable()
|
|---|
| 18 | note: This patch is related to and supersedes TCBZ2168
|
|---|
| 19 | files_impacted:
|
|---|
| 20 | - Library\DxeTpm2MeasureBootLib\DxeTpm2MeasureBootLib.c
|
|---|
| 21 | - Library\DxeTpmMeasureBootLib\DxeTpmMeasureBootLib.c
|
|---|
| 22 | links:
|
|---|
| 23 | - https://bugzilla.tianocore.org/show_bug.cgi?id=4117
|
|---|
| 24 | - https://bugzilla.tianocore.org/show_bug.cgi?id=2168
|
|---|
| 25 | - https://bugzilla.tianocore.org/show_bug.cgi?id=1990
|
|---|
| 26 | CVE_2022_36764:
|
|---|
| 27 | commit_titles:
|
|---|
| 28 | - "SecurityPkg: DxeTpm2MeasureBootLib: SECURITY PATCH 4118 - CVE 2022-36764"
|
|---|
| 29 | - "SecurityPkg: DxeTpmMeasureBootLib: SECURITY PATCH 4118 - CVE 2022-36764"
|
|---|
| 30 | - "SecurityPkg: : Adding CVE 2022-36764 to SecurityFixes.yaml"
|
|---|
| 31 | - "SecurityPkg: DxeTpm2MeasureBootLib: SECURITY PATCH 4117/4118 symbol rename"
|
|---|
| 32 | - "SecurityPkg: DxeTpmMeasureBootLib: SECURITY PATCH 4117/4118 symbol rename"
|
|---|
| 33 | - "SecurityPkg: : Updating SecurityFixes.yaml after symbol rename"
|
|---|
| 34 | cve: CVE-2022-36764
|
|---|
| 35 | date_reported: 2022-10-25 12:23 UTC
|
|---|
| 36 | description: Heap Buffer Overflow in Tcg2MeasurePeImage()
|
|---|
| 37 | note:
|
|---|
| 38 | files_impacted:
|
|---|
| 39 | - Library\DxeTpm2MeasureBootLib\DxeTpm2MeasureBootLib.c
|
|---|
| 40 | - Library\DxeTpmMeasureBootLib\DxeTpmMeasureBootLib.c
|
|---|
| 41 | links:
|
|---|
| 42 | - https://bugzilla.tianocore.org/show_bug.cgi?id=4118
|
|---|
