CRITICAL BOOT LOADER VULNERABILITY IN SHIM IMPACTS NEARLY ALL LINUX DISTROS

Summary from the TLDR InfoSec newsletter

The maintainers of Shim have released a new version to fix 6 security vulnerabilities, including one critical flaw that could allow for remote code execution. Shim is used as a first-stage bootloader in many Linux distros for UEFI systems. The vulnerability stems from Shim’s HTTP boot support trusting attacker-controlled values when parsing an HTTP response.