CVE-2014-4859

Integer overflow in the Drive Execution Environment (DXE) phase in the Capsule Update feature in the UEFI implementation in EDK2 allows physically proximate attackers to bypass intended access restrictions via crafted data.

Score

CVSS 3.1 6.8 Medium

Status

Modified - cret@cert.org

Published

2020-01-31

Last modified

2024-08-06

Weaknesses

CWE-190

Affected products

• Bios (American Megatrends Incorporated Ami)
• Sct3 (Phoenix Technologies Ltd.)
• Edk2 (Tianocore)

References

• http://www.kb.cert.org/vuls/id/552286