CVE catalog

CVE-2023-45235

edk2 affected and fixed versions

[CVE catalog]

EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option from a DHCPv6 proxy Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.

Severity
High · CVSS 8.8CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.22% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiantrixieedk22023.11-6FixedDistribution-reported fixed boundary[CVE-2023-45235]
Debiantrixieedk22025.02-8+deb13u1Fixed[CVE-2023-45235]
Debiansidedk22023.11-6FixedDistribution-reported fixed boundary[CVE-2023-45235]
Debiansidedk22026.08+ds-2Fixed[CVE-2023-45235]
Debianforkyedk22023.11-6FixedDistribution-reported fixed boundary[CVE-2023-45235]
Debianforkyedk22026.08+ds-2Fixed[CVE-2023-45235]
Debianbookworm-securityedk22022.11-6+deb12u1Fixed[CVE-2023-45235]
Debianbookwormedk22022.11-6+deb12u1FixedDistribution-reported fixed boundary[CVE-2023-45235]
Debianbookwormedk22022.11-6+deb12u2Fixed[CVE-2023-45235]

Showing 9 fix observations. All 48 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
Debianbookwormedk22022.11-6+deb12u1FixedDistribution-reported fixed boundary[CVE-2023-45235]
Debianbookwormedk22022.11-6+deb12u2Fixed[CVE-2023-45235]
Debianbookworm-securityedk22022.11-6+deb12u1Fixed[CVE-2023-45235]
Debianforkyedk22023.11-6FixedDistribution-reported fixed boundary[CVE-2023-45235]
Debianforkyedk22026.08+ds-2Fixed[CVE-2023-45235]
Debiansidedk22023.11-6FixedDistribution-reported fixed boundary[CVE-2023-45235]
Debiansidedk22026.08+ds-2Fixed[CVE-2023-45235]
Debiantrixieedk22023.11-6FixedDistribution-reported fixed boundary[CVE-2023-45235]
Debiantrixieedk22025.02-8+deb13u1Fixed[CVE-2023-45235]
Ubuntu20.04edk20~20190606.20d2e5a1-2ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntu20.04edk20~20190828.37eef910-3UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntu20.04edk20~20190828.37eef910-4UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntu20.04edk20~20191122.bd85bf54-1UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntu20.04edk20~20191122.bd85bf54-1ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntu20.04edk20~20191122.bd85bf54-2UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntu20.04edk20~20191122.bd85bf54-2ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntu20.04edk20~20191122.bd85bf54-2ubuntu2UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntu20.04edk20~20191122.bd85bf54-2ubuntu3UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntu20.04edk20~20191122.bd85bf54-2ubuntu3.1UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntu20.04edk20~20191122.bd85bf54-2ubuntu3.2UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntu20.04edk20~20191122.bd85bf54-2ubuntu3.3UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntu20.04edk20~20191122.bd85bf54-2ubuntu3.4UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntu20.04edk20~20191122.bd85bf54-2ubuntu3.5UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntu22.04edk22021.08-3UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntu22.04edk22021.08~rc0-2UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntu22.04edk22021.11-1UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntu22.04edk22021.11-2UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntu22.04edk22021.11~rc1-1UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntu22.04edk22022.02-1UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntu22.04edk22022.02-2UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntu22.04edk22022.02-3UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntu22.04edk22022.02-3ubuntu0.22.04.1UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntu22.04edk22022.02-3ubuntu0.22.04.2UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntu22.04edk22022.02~rc1-1UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntu22.04edk22022.02~rc1-1ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntuproedk20~20170911.5dfba97c-1UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntuproedk20~20171010.234dbcef-1UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntuproedk20~20171027.76fd5a66-1UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntuproedk20~20171205.a9212288-1UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntuproedk20~20180105.0bc94c74-1UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntuproedk20~20180205.c0d9813c-1UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntuproedk20~20180205.c0d9813c-2UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntuproedk20~20180205.c0d9813c-2ubuntu0.1UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntuproedk20~20180205.c0d9813c-2ubuntu0.2UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntuproedk20~20180205.c0d9813c-2ubuntu0.3UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntuproedk20~20180205.c0d9813c-2ubuntu0.3+esm1UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntuproedk20~20180205.c0d9813c-2ubuntu0.3+esm2UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Ubuntuproedk20~20180205.c0d9813c-2ubuntu0.3+esm3UnknownSource applicability is not established[UBUNTU-CVE-2023-45235]
Original provider fields
{
  "package_releases": [
    {
      "name": "edk2",
      "status": "fixed",
      "release": "sid",
      "version": "2026.08+ds-2"
    },
    {
      "name": "edk2",
      "status": "fixed",
      "release": "forky",
      "version": "2026.08+ds-2"
    },
    {
      "name": "edk2",
      "status": "fixed",
      "release": "trixie",
      "version": "2025.02-8+deb13u1"
    },
    {
      "name": "edk2",
      "status": "fixed",
      "release": "bookworm",
      "version": "2022.11-6+deb12u2"
    },
    {
      "name": "edk2",
      "status": "fixed",
      "release": "bookworm-security",
      "version": "2022.11-6+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1061256,
      "name": "edk2",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "2023.11-6"
    },
    {
      "bug": 1061256,
      "name": "edk2",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "2023.11-6"
    },
    {
      "bug": 1061256,
      "name": "edk2",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "2023.11-6"
    },
    {
      "bug": 1061256,
      "name": "edk2",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "2022.11-6+deb12u1"
    }
  ],
  "distribution_packages": [
    {
      "name": "edk2",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "0~20170911.5dfba97c-1",
        "0~20171010.234dbcef-1",
        "0~20171027.76fd5a66-1",
        "0~20171205.a9212288-1",
        "0~20180105.0bc94c74-1",
        "0~20180205.c0d9813c-1",
        "0~20180205.c0d9813c-2",
        "0~20180205.c0d9813c-2ubuntu0.1",
        "0~20180205.c0d9813c-2ubuntu0.2",
        "0~20180205.c0d9813c-2ubuntu0.3",
        "0~20180205.c0d9813c-2ubuntu0.3+esm1",
        "0~20180205.c0d9813c-2ubuntu0.3+esm2",
        "0~20180205.c0d9813c-2ubuntu0.3+esm3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2023-45235",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2023-45235",
      "provider_updated_at": "2026-10-05T19:20:38.313624466Z",
      "applicability_unknown": true
    },
    {
      "name": "edk2",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0~20191122.bd85bf54-2ubuntu3.5"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "0~20190606.20d2e5a1-2ubuntu1",
        "0~20190828.37eef910-3",
        "0~20190828.37eef910-4",
        "0~20191122.bd85bf54-1",
        "0~20191122.bd85bf54-1ubuntu1",
        "0~20191122.bd85bf54-2",
        "0~20191122.bd85bf54-2ubuntu1",
        "0~20191122.bd85bf54-2ubuntu2",
        "0~20191122.bd85bf54-2ubuntu3",
        "0~20191122.bd85bf54-2ubuntu3.1",
        "0~20191122.bd85bf54-2ubuntu3.2",
        "0~20191122.bd85bf54-2ubuntu3.3",
        "0~20191122.bd85bf54-2ubuntu3.4"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2023-45235",
      "fixed_version": "0~20191122.bd85bf54-2ubuntu3.5",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2023-45235",
      "provider_updated_at": "2026-10-05T19:20:38.313624466Z",
      "applicability_unknown": true
    },
    {
      "name": "edk2",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2022.02-3ubuntu0.22.04.2"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "2021.08~rc0-2",
        "2021.08-3",
        "2021.11~rc1-1",
        "2021.11-1",
        "2021.11-2",
        "2022.02~rc1-1",
        "2022.02~rc1-1ubuntu1",
        "2022.02-1",
        "2022.02-2",
        "2022.02-3",
        "2022.02-3ubuntu0.22.04.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2023-45235",
      "fixed_version": "2022.02-3ubuntu0.22.04.2",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2023-45235",
      "provider_updated_at": "2026-10-05T19:20:38.313624466Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #1061256]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [ovmf]Unknown

    Source package: [edk2]

    Details (4)
    • 2022.11-6+deb12u2 · all · bookworm

      Fixed · Fixed: 2022.11-6+deb12u1

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

    • 2022.11-6+deb12u2 · all · bookworm

      Fixed · Fixed: 2022.11-6+deb12u1

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

    • 2022.11-6+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2022.11-6+deb12u1

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

    • 2022.11-6+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2022.11-6+deb12u1

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

  • [ovmf-ia32]Unknown

    Source package: [edk2]

    Details (4)
    • 2022.11-6+deb12u2 · all · bookworm

      Fixed · Fixed: 2022.11-6+deb12u1

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

    • 2022.11-6+deb12u2 · all · bookworm

      Fixed · Fixed: 2022.11-6+deb12u1

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

    • 2022.11-6+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2022.11-6+deb12u1

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

    • 2022.11-6+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2022.11-6+deb12u1

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

  • [qemu-efi]Unknown

    Source package: [edk2]

    Details (4)
    • 2022.11-6+deb12u2 · all · bookworm

      Fixed · Fixed: 2022.11-6+deb12u1

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

    • 2022.11-6+deb12u2 · all · bookworm

      Fixed · Fixed: 2022.11-6+deb12u1

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

    • 2022.11-6+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2022.11-6+deb12u1

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

    • 2022.11-6+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2022.11-6+deb12u1

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

  • Source package: [edk2]

    Details (4)
    • 2022.11-6+deb12u2 · all · bookworm

      Fixed · Fixed: 2022.11-6+deb12u1

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

    • 2022.11-6+deb12u2 · all · bookworm

      Fixed · Fixed: 2022.11-6+deb12u1

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

    • 2022.11-6+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2022.11-6+deb12u1

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

    • 2022.11-6+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2022.11-6+deb12u1

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

  • [qemu-efi-arm]Unknown

    Source package: [edk2]

    Details (4)
    • 2022.11-6+deb12u2 · all · bookworm

      Fixed · Fixed: 2022.11-6+deb12u1

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

    • 2022.11-6+deb12u2 · all · bookworm

      Fixed · Fixed: 2022.11-6+deb12u1

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

    • 2022.11-6+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2022.11-6+deb12u1

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

    • 2022.11-6+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2022.11-6+deb12u1

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

[Debian 13 (Trixie)]

  • Source package: [edk2]

    Details (2)
    • 2025.02-8+deb13u1 · all · trixie

      Fixed · Fixed: 2023.11-6

      dsa · edk2 · debian · 13

    • 2025.02-8+deb13u1 · all · trixie

      Fixed · Fixed: 2023.11-6

      dsa · edk2 · debian · 13

  • [efi-shell-arm]Unknown

    Source package: [edk2]

    Details (2)
    • 2025.02-8+deb13u1 · all · trixie

      Fixed · Fixed: 2023.11-6

      dsa · edk2 · debian · 13

    • 2025.02-8+deb13u1 · all · trixie

      Fixed · Fixed: 2023.11-6

      dsa · edk2 · debian · 13

  • Source package: [edk2]

    Details (2)
    • 2025.02-8+deb13u1 · all · trixie

      Fixed · Fixed: 2023.11-6

      dsa · edk2 · debian · 13

    • 2025.02-8+deb13u1 · all · trixie

      Fixed · Fixed: 2023.11-6

      dsa · edk2 · debian · 13

  • Source package: [edk2]

    Details (2)
    • 2025.02-8+deb13u1 · all · trixie

      Fixed · Fixed: 2023.11-6

      dsa · edk2 · debian · 13

    • 2025.02-8+deb13u1 · all · trixie

      Fixed · Fixed: 2023.11-6

      dsa · edk2 · debian · 13

  • Source package: [edk2]

    Details (2)
    • 2025.02-8+deb13u1 · all · trixie

      Fixed · Fixed: 2023.11-6

      dsa · edk2 · debian · 13

    • 2025.02-8+deb13u1 · all · trixie

      Fixed · Fixed: 2023.11-6

      dsa · edk2 · debian · 13

  • [efi-shell-x64]Unknown

    Source package: [edk2]

    Details (2)
    • 2025.02-8+deb13u1 · all · trixie

      Fixed · Fixed: 2023.11-6

      dsa · edk2 · debian · 13

    • 2025.02-8+deb13u1 · all · trixie

      Fixed · Fixed: 2023.11-6

      dsa · edk2 · debian · 13

  • [ovmf]Unknown

    Source package: [edk2]

    Details (2)
    • 2025.02-8+deb13u1 · all · trixie

      Fixed · Fixed: 2023.11-6

      dsa · edk2 · debian · 13

    • 2025.02-8+deb13u1 · all · trixie

      Fixed · Fixed: 2023.11-6

      dsa · edk2 · debian · 13

  • [ovmf-ia32]Unknown

    Source package: [edk2]

    Details (2)
    • 2025.02-8+deb13u1 · all · trixie

      Fixed · Fixed: 2023.11-6

      dsa · edk2 · debian · 13

    • 2025.02-8+deb13u1 · all · trixie

      Fixed · Fixed: 2023.11-6

      dsa · edk2 · debian · 13

  • Source package: [edk2]

    Details (2)
    • 2025.02-8+deb13u1 · all · trixie

      Fixed · Fixed: 2023.11-6

      dsa · edk2 · debian · 13

    • 2025.02-8+deb13u1 · all · trixie

      Fixed · Fixed: 2023.11-6

      dsa · edk2 · debian · 13

  • [qemu-efi-arm]Unknown

    Source package: [edk2]

    Details (2)
    • 2025.02-8+deb13u1 · all · trixie

      Fixed · Fixed: 2023.11-6

      dsa · edk2 · debian · 13

    • 2025.02-8+deb13u1 · all · trixie

      Fixed · Fixed: 2023.11-6

      dsa · edk2 · debian · 13

  • Source package: [edk2]

    Details (2)
    • 2025.02-8+deb13u1 · all · trixie

      Fixed · Fixed: 2023.11-6

      dsa · edk2 · debian · 13

    • 2025.02-8+deb13u1 · all · trixie

      Fixed · Fixed: 2023.11-6

      dsa · edk2 · debian · 13

  • Source package: [edk2]

    Details (2)
    • 2025.02-8+deb13u1 · all · trixie

      Fixed · Fixed: 2023.11-6

      dsa · edk2 · debian · 13

    • 2025.02-8+deb13u1 · all · trixie

      Fixed · Fixed: 2023.11-6

      dsa · edk2 · debian · 13

Observed:

References