CVE-2014-4860
Publication date 31 January 2020
Last updated 25 August 2025
Ubuntu priority
Description
Multiple integer overflows in the Pre-EFI Initialization (PEI) boot phase in the Capsule Update feature in the UEFI implementation in EDK2 allow physically proximate attackers to bypass intended access restrictions by providing crafted data that is not properly handled during the coalescing phase.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| edk2 | ||
| 14.04 LTS trusty | Not in release | |
Severity score breakdown
CVSS version: CVSS v3.0
Base score
6.8 · Medium
Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H