This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============8913704183096245685==
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="KjbYSmpugVDrEEwqBn875bdCXvtXgoS4K"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--KjbYSmpugVDrEEwqBn875bdCXvtXgoS4K
Content-Type: multipart/mixed;
 boundary="F6ZDBlbiyO5f3Gy2k1FOM6k9O5qbDZZSZ";
 protected-headers="v1"
From: Marc Deslauriers <marc.deslauriers@canonical.com>
Reply-To: Ubuntu Security <security@ubuntu.com>
To: "ubuntu-security-announce@lists.ubuntu.com"
 <ubuntu-security-announce@lists.ubuntu.com>
Message-ID: <ae74eb80-5501-fcdc-729a-1435a6f3b877@canonical.com>
Subject: [USN-4923-1] EDK II vulnerabilities

--F6ZDBlbiyO5f3Gy2k1FOM6k9O5qbDZZSZ
Content-Type: text/plain; charset=utf-8
Content-Language: en-C
Content-Transfer-Encoding: quoted-printable

==========================================================================
Ubuntu Security Notice USN-4923-1
April 20, 2021

edk2 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.10
- Ubuntu 20.04 LTS

Summary:

Several security issues were fixed in EDK II.

Software Description:
- edk2: UEFI firmware for virtual machines

Details:

Laszlo Ersek discovered that EDK II incorrectly handled recursion. A
remote attacker could possibly use this issue to cause EDK II to consume
resources, leading to a denial of service. (CVE-2021-28210)

Satoshi Tanda discovered that EDK II incorrectly handled decompressing
certain images. A remote attacker could use this issue to cause EDK II to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2021-28211)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.10:
  ovmf                            2020.05-5ubuntu0.2
  qemu-efi                        2020.05-5ubuntu0.2
  qemu-efi-aarch64                2020.05-5ubuntu0.2
  qemu-efi-arm                    2020.05-5ubuntu0.2

Ubuntu 20.04 LTS:
  ovmf                            0~20191122.bd85bf54-2ubuntu3.2
  qemu-efi                        0~20191122.bd85bf54-2ubuntu3.2
  qemu-efi-aarch64                0~20191122.bd85bf54-2ubuntu3.2
  qemu-efi-arm                    0~20191122.bd85bf54-2ubuntu3.2

After a standard system update you need to restart the virtual machines
that use the affected firmware to make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-4923-1
  CVE-2021-28210, CVE-2021-28211

Package Information:
  https://launchpad.net/ubuntu/+source/edk2/2020.05-5ubuntu0.2
  https://launchpad.net/ubuntu/+source/edk2/0~20191122.bd85bf54-2ubuntu3.2


--F6ZDBlbiyO5f3Gy2k1FOM6k9O5qbDZZSZ--

--KjbYSmpugVDrEEwqBn875bdCXvtXgoS4K
Content-Type: application/pgp-signature; name="OpenPGP_signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="OpenPGP_signature"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAmB/Gv0ACgkQZWnYVadE
vpNBbhAAimqvP1nPkYPHaBO0ekZhYQ2TdAFAlIZ1Vo3IyF4yWMgNypuMwCSWJIAl
hKz7nBmMZOEGMMrYM7O7bBsmd0/tTefTJ7vYjUAvubhUGakhZ3l8SZ2MS0XF7POw
YLMmXQGkGJ9psNmh2pXbHVpcTQJMjUfpq44SeZNscu+qSC81jF+mctLuhucLUn2/
SsmETrFBf5xut+XBurDt3qChhAL5XMFgZnGlTB3bYxrE0O7Lg2r+IbzV4baCSoPY
jlWaOIVawN5k0G+M6VK7fcAl+qJQa2SGsWVCUbzHAW865R04KskeSLAWcnUu4ISP
Ps4SLmTdJVC526NdytR4NcsRcOnGMpD64mdascCF2nGbSyW33Zn5ThKqkth3423N
4A17CIFrPYaT3w842T232ojjKk9yaPRgSr21WwIy32KWHm3pwvWnkUDZajAfvgel
zA1rjWE172oZqZFuaVdn2bWZhUmkAN42wFPMftWRBFhgyEg+3me5m0mYMh+C0QzW
idLgw+08oQY4nzpHGmQ/ycaqfA3JFlx/+tKrd3AgYsSGozJ3NoYwfPV3F25f7KBf
wTaDKsr2LkveR6mjnJnooYSxTEyBS5ElqM1gCcy2X7xs/At+5F1pIZUaFqxC7IDI
1NI7jwbMhJx3pazdP2ZQAaVeiv+orhYNl+NOJ+5b5qpLh33J+Us=
=qnTn
-----END PGP SIGNATURE-----

--KjbYSmpugVDrEEwqBn875bdCXvtXgoS4K--


--===============8913704183096245685==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

LS0gCnVidW50dS1zZWN1cml0eS1hbm5vdW5jZSBtYWlsaW5nIGxpc3QKdWJ1bnR1LXNlY3VyaXR5
LWFubm91bmNlQGxpc3RzLnVidW50dS5jb20KTW9kaWZ5IHNldHRpbmdzIG9yIHVuc3Vic2NyaWJl
IGF0OiBodHRwczovL2xpc3RzLnVidW50dS5jb20vbWFpbG1hbi9saXN0aW5mby91YnVudHUtc2Vj
dXJpdHktYW5ub3VuY2UK

--===============8913704183096245685==--