UbuntuUpdates.org

Package "ovmf-inteltdx"

Name: ovmf-inteltdx

Description:

UEFI firmware for Intel TDX confidential virtual machines
Latest version: 2025.11-3ubuntu7.3
Release: resolute (26.04)
Level: security
Repository: main
Head package: edk2
Homepage: http://www.tianocore.org

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "ovmf-inteltdx"

All arch deb package
APT INSTALL

Other versions of "ovmf-inteltdx" in Resolute

Repository Area Version
base main 2025.11-3ubuntu7
updates main 2025.11-3ubuntu7.3

Changelog

Version: 2025.11-3ubuntu7.3 2026-10-07 15:39:04 UTC

edk2 (2025.11-3ubuntu7.3) resolute-security; urgency=medium

  * SECURITY UPDATE: Out-of-bounds Write
    - debian/patches/CVE-2026-63072.patch: Fix heap buffer overflow
      (8-byte OOB write) in AES-WRAP-PAD unwrap by sizing the buffer
      for worst case
    - CVE-2026-63072
  * SECURITY UPDATE: NULL Pointer Dereference
    - debian/patches/CVE-2026-63076.patch: Fix Remote NULL deref in
      ossl_cmp_calc_protection() via crafted protectionAlg by checking
      ASN.1 type before treating parameter as PBMParameter
    - CVE-2026-63076
  * SECURITY UPDATE: Asymmetric Resource Consumption
    - debian/patches/CVE-2026-54874.patch: Avoid full read buffer
      allocation when buffering DTLS next-epoch records by copying only
      the record's own on-wire bytes
    - CVE-2026-54874
  * SECURITY UPDATE: Improper Validation of Integrity Check Value
    - debian/patches/CVE-2026-75803_1.patch: Check the tag on
      EVP_Cipher() finalize for Poly1305 and OCB AEADs to prevent
      accepting forged messages with empty ciphertext
    - CVE-2026-75803

 -- Leonidas Da Silva Barbosa Wed, 23 Sep 2026 12:40:26 -0300
CVE-2026-63072 Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primit
CVE-2026-63076 Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type
CVE-2026-54874 Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record i
CVE-2026-75803 Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag


About   -   Send Feedback to @ubuntu_updates