ovmf-202105-3.4 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:11134-1 Final 1 1 2024-06-15T00:00:00Z current 2024-06-15T00:00:00Z 2024-06-15T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z ovmf-202105-3.4 on GA media These are all security issues fixed in the ovmf-202105-3.4 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-11134 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2017-5731/ SUSE CVE CVE-2017-5731 page https://www.suse.com/security/cve/CVE-2017-5732/ SUSE CVE CVE-2017-5732 page https://www.suse.com/security/cve/CVE-2018-0739/ SUSE CVE CVE-2018-0739 page https://www.suse.com/security/cve/CVE-2018-12178/ SUSE CVE CVE-2018-12178 page https://www.suse.com/security/cve/CVE-2018-12180/ SUSE CVE CVE-2018-12180 page https://www.suse.com/security/cve/CVE-2018-12181/ SUSE CVE CVE-2018-12181 page https://www.suse.com/security/cve/CVE-2018-3613/ SUSE CVE CVE-2018-3613 page https://www.suse.com/security/cve/CVE-2018-3630/ SUSE CVE CVE-2018-3630 page https://www.suse.com/security/cve/CVE-2019-0160/ SUSE CVE CVE-2019-0160 page https://www.suse.com/security/cve/CVE-2019-0161/ SUSE CVE CVE-2019-0161 page https://www.suse.com/security/cve/CVE-2019-14553/ SUSE CVE CVE-2019-14553 page https://www.suse.com/security/cve/CVE-2019-14558/ SUSE CVE CVE-2019-14558 page https://www.suse.com/security/cve/CVE-2019-14559/ SUSE CVE CVE-2019-14559 page https://www.suse.com/security/cve/CVE-2019-14562/ SUSE CVE CVE-2019-14562 page https://www.suse.com/security/cve/CVE-2019-14563/ SUSE CVE CVE-2019-14563 page https://www.suse.com/security/cve/CVE-2019-14575/ SUSE CVE CVE-2019-14575 page https://www.suse.com/security/cve/CVE-2019-14584/ SUSE CVE CVE-2019-14584 page https://www.suse.com/security/cve/CVE-2019-14586/ SUSE CVE CVE-2019-14586 page https://www.suse.com/security/cve/CVE-2019-14587/ SUSE CVE CVE-2019-14587 page https://www.suse.com/security/cve/CVE-2021-28210/ SUSE CVE CVE-2021-28210 page https://www.suse.com/security/cve/CVE-2021-28211/ SUSE CVE CVE-2021-28211 page openSUSE Tumbleweed ovmf-202105-3.4 ovmf-tools-202105-3.4 qemu-ovmf-ia32-202105-3.4 qemu-ovmf-x86_64-202105-3.4 qemu-ovmf-x86_64-debug-202105-3.4 qemu-uefi-aarch32-202105-3.4 qemu-uefi-aarch64-202105-3.4 ovmf-202105-3.4 as a component of openSUSE Tumbleweed ovmf-tools-202105-3.4 as a component of openSUSE Tumbleweed qemu-ovmf-ia32-202105-3.4 as a component of openSUSE Tumbleweed qemu-ovmf-x86_64-202105-3.4 as a component of openSUSE Tumbleweed qemu-ovmf-x86_64-debug-202105-3.4 as a component of openSUSE Tumbleweed qemu-uefi-aarch32-202105-3.4 as a component of openSUSE Tumbleweed qemu-uefi-aarch64-202105-3.4 as a component of openSUSE Tumbleweed Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user to potentially enable an escalation of privilege via local access. CVE-2017-5731 openSUSE Tumbleweed:ovmf-202105-3.4 openSUSE Tumbleweed:ovmf-tools-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-ia32-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-debug-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch32-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch64-202105-3.4 important 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-5731.html CVE-2017-5731 https://bugzilla.suse.com/1115917 SUSE Bug 1115917 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none. CVE-2017-5732 openSUSE Tumbleweed:ovmf-202105-3.4 openSUSE Tumbleweed:ovmf-tools-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-ia32-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-debug-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch32-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch64-202105-3.4 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-5732.html CVE-2017-5732 https://bugzilla.suse.com/1115917 SUSE Bug 1115917 Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n). CVE-2018-0739 openSUSE Tumbleweed:ovmf-202105-3.4 openSUSE Tumbleweed:ovmf-tools-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-ia32-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-debug-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch32-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch64-202105-3.4 important 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-0739.html CVE-2018-0739 https://bugzilla.suse.com/1087102 SUSE Bug 1087102 https://bugzilla.suse.com/1089997 SUSE Bug 1089997 https://bugzilla.suse.com/1094291 SUSE Bug 1094291 https://bugzilla.suse.com/1108542 SUSE Bug 1108542 Buffer overflow in network stack for EDK II may allow unprivileged user to potentially enable escalation of privilege and/or denial of service via network. CVE-2018-12178 openSUSE Tumbleweed:ovmf-202105-3.4 openSUSE Tumbleweed:ovmf-tools-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-ia32-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-debug-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch32-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch64-202105-3.4 critical 6.4 AV:N/AC:L/Au:N/C:N/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-12178.html CVE-2018-12178 https://bugzilla.suse.com/1127821 SUSE Bug 1127821 Buffer overflow in BlockIo service for EDK II may allow an unauthenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via network access. CVE-2018-12180 openSUSE Tumbleweed:ovmf-202105-3.4 openSUSE Tumbleweed:ovmf-tools-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-ia32-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-debug-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch32-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch64-202105-3.4 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-12180.html CVE-2018-12180 https://bugzilla.suse.com/1127820 SUSE Bug 1127820 Stack overflow in corrupted bmp for EDK II may allow unprivileged user to potentially enable denial of service or elevation of privilege via local access. CVE-2018-12181 openSUSE Tumbleweed:ovmf-202105-3.4 openSUSE Tumbleweed:ovmf-tools-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-ia32-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-debug-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch32-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch64-202105-3.4 moderate 3.6 AV:L/AC:L/Au:N/C:N/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-12181.html CVE-2018-12181 https://bugzilla.suse.com/1128503 SUSE Bug 1128503 Logic issue in variable service module for EDK II/UDK2018/UDK2017/UDK2015 may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via local access. CVE-2018-3613 openSUSE Tumbleweed:ovmf-202105-3.4 openSUSE Tumbleweed:ovmf-tools-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-ia32-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-debug-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch32-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch64-202105-3.4 moderate 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-3613.html CVE-2018-3613 https://bugzilla.suse.com/1115916 SUSE Bug 1115916 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2018. Notes: none. CVE-2018-3630 openSUSE Tumbleweed:ovmf-202105-3.4 openSUSE Tumbleweed:ovmf-tools-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-ia32-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-debug-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch32-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch64-202105-3.4 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-3630.html CVE-2018-3630 https://bugzilla.suse.com/1127822 SUSE Bug 1127822 Buffer overflow in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege and/or denial of service via network access. CVE-2019-0160 openSUSE Tumbleweed:ovmf-202105-3.4 openSUSE Tumbleweed:ovmf-tools-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-ia32-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-debug-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch32-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch64-202105-3.4 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-0160.html CVE-2019-0160 https://bugzilla.suse.com/1130267 SUSE Bug 1130267 Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access. CVE-2019-0161 openSUSE Tumbleweed:ovmf-202105-3.4 openSUSE Tumbleweed:ovmf-tools-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-ia32-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-debug-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch32-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch64-202105-3.4 moderate 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-0161.html CVE-2019-0161 https://bugzilla.suse.com/1131361 SUSE Bug 1131361 Improper authentication in EDK II may allow a privileged user to potentially enable information disclosure via network access. CVE-2019-14553 openSUSE Tumbleweed:ovmf-202105-3.4 openSUSE Tumbleweed:ovmf-tools-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-ia32-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-debug-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch32-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch64-202105-3.4 important 4 AV:N/AC:L/Au:S/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-14553.html CVE-2019-14553 https://bugzilla.suse.com/1153072 SUSE Bug 1153072 Insufficient control flow management in BIOS firmware for 8th, 9th, 10th Generation Intel(R) Core(TM), Intel(R) Celeron(R) Processor 4000 & 5000 Series Processors may allow an authenticated user to potentially enable denial of service via adjacent access. CVE-2019-14558 openSUSE Tumbleweed:ovmf-202105-3.4 openSUSE Tumbleweed:ovmf-tools-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-ia32-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-debug-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch32-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch64-202105-3.4 moderate 2.7 AV:A/AC:L/Au:S/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-14558.html CVE-2019-14558 https://bugzilla.suse.com/1168193 SUSE Bug 1168193 Uncontrolled resource consumption in EDK II may allow an unauthenticated user to potentially enable denial of service via network access. CVE-2019-14559 openSUSE Tumbleweed:ovmf-202105-3.4 openSUSE Tumbleweed:ovmf-tools-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-ia32-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-debug-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch32-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch64-202105-3.4 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-14559.html CVE-2019-14559 https://bugzilla.suse.com/1163927 SUSE Bug 1163927 Integer overflow in DxeImageVerificationHandler() EDK II may allow an authenticated user to potentially enable denial of service via local access. CVE-2019-14562 openSUSE Tumbleweed:ovmf-202105-3.4 openSUSE Tumbleweed:ovmf-tools-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-ia32-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-debug-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch32-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch64-202105-3.4 low 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-14562.html CVE-2019-14562 https://bugzilla.suse.com/1175476 SUSE Bug 1175476 Integer truncation in EDK II may allow an authenticated user to potentially enable escalation of privilege via local access. CVE-2019-14563 openSUSE Tumbleweed:ovmf-202105-3.4 openSUSE Tumbleweed:ovmf-tools-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-ia32-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-debug-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch32-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch64-202105-3.4 moderate 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-14563.html CVE-2019-14563 https://bugzilla.suse.com/1163959 SUSE Bug 1163959 Logic issue in DxeImageVerificationHandler() for EDK II may allow an authenticated user to potentially enable escalation of privilege via local access. CVE-2019-14575 openSUSE Tumbleweed:ovmf-202105-3.4 openSUSE Tumbleweed:ovmf-tools-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-ia32-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-debug-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch32-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch64-202105-3.4 important 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-14575.html CVE-2019-14575 https://bugzilla.suse.com/1163969 SUSE Bug 1163969 Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privilege via local access. CVE-2019-14584 openSUSE Tumbleweed:ovmf-202105-3.4 openSUSE Tumbleweed:ovmf-tools-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-ia32-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-debug-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch32-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch64-202105-3.4 low 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-14584.html CVE-2019-14584 https://bugzilla.suse.com/1177789 SUSE Bug 1177789 Use after free vulnerability in EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via adjacent access. CVE-2019-14586 openSUSE Tumbleweed:ovmf-202105-3.4 openSUSE Tumbleweed:ovmf-tools-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-ia32-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-debug-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch32-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch64-202105-3.4 moderate 5.2 AV:A/AC:L/Au:S/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-14586.html CVE-2019-14586 https://bugzilla.suse.com/1168189 SUSE Bug 1168189 Logic issue EDK II may allow an unauthenticated user to potentially enable denial of service via adjacent access. CVE-2019-14587 openSUSE Tumbleweed:ovmf-202105-3.4 openSUSE Tumbleweed:ovmf-tools-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-ia32-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-debug-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch32-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch64-202105-3.4 moderate 3.3 AV:A/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-14587.html CVE-2019-14587 https://bugzilla.suse.com/1168192 SUSE Bug 1168192 An unlimited recursion in DxeCore in EDK II. CVE-2021-28210 openSUSE Tumbleweed:ovmf-202105-3.4 openSUSE Tumbleweed:ovmf-tools-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-ia32-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-debug-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch32-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch64-202105-3.4 moderate 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-28210.html CVE-2021-28210 https://bugzilla.suse.com/1183579 SUSE Bug 1183579 A heap overflow in LzmaUefiDecompressGetInfo function in EDK II. CVE-2021-28211 openSUSE Tumbleweed:ovmf-202105-3.4 openSUSE Tumbleweed:ovmf-tools-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-ia32-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-202105-3.4 openSUSE Tumbleweed:qemu-ovmf-x86_64-debug-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch32-202105-3.4 openSUSE Tumbleweed:qemu-uefi-aarch64-202105-3.4 moderate 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-28211.html CVE-2021-28211 https://bugzilla.suse.com/1183578 SUSE Bug 1183578