A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.
CVSS Details
- CVSS 3.1 Base Score: 6.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade shim-x64Upgrade shim-ia32Upgrade shim-aa64 | May 13, 2024 | Jan 29, 2024 |
| Centos_linux | — | Upgrade shim-ia32Upgrade mokutilUpgrade shim-unsigned-ia32Upgrade mokutil-debuginfoUpgrade shim-x64Upgrade shim-unsigned-x64 | Apr 24, 2024 | Jan 29, 2024 |
| Debian | — | Upgrade shim | May 15, 2024 | Jan 29, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade shim | Jan 10, 2024 | Dec 11, 2023 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Sep 10, 2024 |
| Oracle_linux | — | Upgrade shim-unsigned-x64Upgrade mokutilUpgrade shim-x64Upgrade shim-aa64Upgrade shim-ia32 | Apr 24, 2024 | Jan 23, 2024 |
| Redhat_linux | — | Upgrade shim-unsigned-x64Upgrade mokutilUpgrade shim-unsigned-ia32Upgrade shim-ia32Upgrade mokutil-debuginfoUpgrade shim-x64 | Apr 17, 2024 | Jan 29, 2024 |
| Suse | — | Upgrade shim | Apr 23, 2024 | Jan 29, 2024 |
| Ubuntu | — | Upgrade shim-signedUpgrade shim | Nov 19, 2024 | Jan 29, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jan 29, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub