{"id":"CVE-2019-0161","aliases":["BELL-CVE-2019-0161","DEBIAN-CVE-2019-0161","DLA-2645-1","EUVD-2019-0968","GHSA-jf2h-frpc-5873","MGASA-2021-0035","RHSA-2019:2125","RHSA-2019:2437","RHSA-2019:3338","SUSE-SU-2019:1110-1","SUSE-SU-2019:1157-1","SUSE-SU-2019:1204-1","UBUNTU-CVE-2019-0161","USN-7060-1","openSUSE-SU-2019:1352-1","openSUSE-SU-2024:11134-1"],"status":"published","title":"Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial...","description":"Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access.","severity":{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00395,"percentile":0.33958,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2019-03-27T19:23:44Z","modified":"2026-10-08T10:01:37Z","fixes":[{"ecosystem":"Debian:12","package":"edk2","fixed_in":["0~20180803.dd4cae4d-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"edk2","fixed_in":["0~20180803.dd4cae4d-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"edk2","fixed_in":["0~20180803.dd4cae4d-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15","package":"ovmf","fixed_in":["2017+git1510945757.b2662641d5-5.22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"ovmf","fixed_in":["2017+git1510945757.b2662641d5-3.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"ovmf","fixed_in":["2017+git1510945757.b2662641d5-3.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"ovmf","fixed_in":["2017+git1510945757.b2662641d5-3.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"ovmf","fixed_in":["2017+git1492060560.b6d11d7c46-4.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"ovmf","fixed_in":["2017+git1492060560.b6d11d7c46-4.26.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"edk2","fixed_in":["0~20160408.ffea0a2c-2ubuntu0.2+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"edk2","fixed_in":["0~20180205.c0d9813c-2ubuntu0.3+esm2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.0","package":"ovmf","fixed_in":["2017+git1510945757.b2662641d5-lp150.4.19.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20180803.dd4cae4d-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20180803.dd4cae4d-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20180803.dd4cae4d-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20161202.7bbe0b3e-1+deb9u2"}]}],"versions":["0~20161202.7bbe0b3e-1","0~20161202.7bbe0b3e-1+deb9u1"],"bundled":11},{"source":"osv","ecosystem":"Mageia:7","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20201127stable-1.mga7"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"OVMF","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20180508-6.gitee3198e672e2.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20180508-6.gitee3198e672e2.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"redhat-virtualization-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.5-20190722.0.el7_7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"redhat-virtualization-host-image-update","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.5-20190722.0.el7_7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"imgbased","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.9-0.1.el7ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"ovirt-node-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.5-0.20190717.0.el7ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"ovirt-node-ng-nodectl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.5-0.20190717.0.el7ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"python-imgbased","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.9-0.1.el7ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"python2-ovirt-node-ng-nodectl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.5-0.20190717.0.el7ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"redhat-release-virtualization-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.5-2.el7ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"redhat-virtualization-host-image-update-placeholder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.5-2.el7ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20190308git89910a39dcfd-6.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"edk2-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20190308git89910a39dcfd-6.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20190308git89910a39dcfd-6.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017+git1510945757.b2662641d5-5.22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017+git1510945757.b2662641d5-3.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017+git1510945757.b2662641d5-3.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017+git1510945757.b2662641d5-3.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017+git1492060560.b6d11d7c46-4.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017+git1492060560.b6d11d7c46-4.26.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20160408.ffea0a2c-2ubuntu0.2+esm3"}]}],"versions":["0~20150106.5c2d456b-2","0~20160104.c2a892d7-1","0~20160408.ffea0a2c-2","0~20160408.ffea0a2c-2ubuntu0.1","0~20160408.ffea0a2c-2ubuntu0.2","0~20160408.ffea0a2c-2ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20180205.c0d9813c-2ubuntu0.3+esm2"}]}],"versions":["0~20170911.5dfba97c-1","0~20171010.234dbcef-1","0~20171027.76fd5a66-1","0~20171205.a9212288-1","0~20180105.0bc94c74-1","0~20180205.c0d9813c-1","0~20180205.c0d9813c-2","0~20180205.c0d9813c-2ubuntu0.1","0~20180205.c0d9813c-2ubuntu0.2","0~20180205.c0d9813c-2ubuntu0.3","0~20180205.c0d9813c-2ubuntu0.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20160408.ffea0a2c-2ubuntu0.2+esm3"}]}],"versions":["0~20150106.5c2d456b-2","0~20160104.c2a892d7-1","0~20160408.ffea0a2c-2","0~20160408.ffea0a2c-2ubuntu0.1","0~20160408.ffea0a2c-2ubuntu0.2","0~20160408.ffea0a2c-2ubuntu0.2+esm1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20180205.c0d9813c-2ubuntu0.3+esm2"}]}],"versions":["0~20170911.5dfba97c-1","0~20171010.234dbcef-1","0~20171027.76fd5a66-1","0~20171205.a9212288-1","0~20180105.0bc94c74-1","0~20180205.c0d9813c-1","0~20180205.c0d9813c-2","0~20180205.c0d9813c-2ubuntu0.1","0~20180205.c0d9813c-2ubuntu0.2","0~20180205.c0d9813c-2ubuntu0.3","0~20180205.c0d9813c-2ubuntu0.3+esm1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20191122.bd85bf54-2ubuntu3.6"}]}],"versions":["0~20190606.20d2e5a1-2ubuntu1","0~20190828.37eef910-3","0~20190828.37eef910-4","0~20191122.bd85bf54-1","0~20191122.bd85bf54-1ubuntu1","0~20191122.bd85bf54-2","0~20191122.bd85bf54-2ubuntu1","0~20191122.bd85bf54-2ubuntu2","0~20191122.bd85bf54-2ubuntu3","0~20191122.bd85bf54-2ubuntu3.1","0~20191122.bd85bf54-2ubuntu3.2","0~20191122.bd85bf54-2ubuntu3.3","0~20191122.bd85bf54-2ubuntu3.4","0~20191122.bd85bf54-2ubuntu3.5"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.02-3ubuntu0.22.04.3"}]}],"versions":["2021.08~rc0-2","2021.08-3","2021.11~rc1-1","2021.11-1","2021.11-2","2022.02~rc1-1","2022.02~rc1-1ubuntu1","2022.02-1","2022.02-2","2022.02-3","2022.02-3ubuntu0.22.04.1","2022.02-3ubuntu0.22.04.2"],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017+git1510945757.b2662641d5-lp150.4.19.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202105-3.4"}]}],"bundled":21}],"products":[{"vendor":"extensible firmware interface development kit (edk ii)","product":"extensible firmware interface development kit (edk ii)"},{"vendor":"tianocore","product":"edk_ii"}],"references":[{"url":"https://edk2-docs.gitbooks.io/security-advisory/content/xhci-stack-local-stack-overflow.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","article","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00019.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00046.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2125","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2437","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQYVZRFEXSN3KS43AVH4D7QX553EZQYP/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-0161","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQYVZRFEXSN3KS43AVH4D7QX553EZQYP/"},{"url":"https://github.com/advisories/GHSA-jf2h-frpc-5873"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-0161","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-0161","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0035.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25939","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/TQYVZRFEXSN3KS43AVH4D7QX553EZQYP/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1712","tags":["web"]},{"url":"https://usn.ubuntu.com/4349-1/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/A23OH3MXQU7WURSP4PC66EXMG6INYFH6/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-4684-1","tags":["advisory"]},{"url":"https://github.com/tianocore/edk2/releases","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1641433","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1641442","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1641446","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1641450","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1641458","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1641465","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1645695","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1686783","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1691640","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1694065","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2125.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-5731","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-5731","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5731","tags":["advisory"]},{"url":"https://edk2-docs.gitbooks.io/security-advisory/content/edk-ii-tianocompress-bounds-checking-issues.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-5732","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-5732","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5732","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-5733","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-5733","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5733","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-5734","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-5734","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5734","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-5735","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-5735","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5735","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-3613","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-3613","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-3613","tags":["advisory"]},{"url":"https://edk2-docs.gitbooks.io/security-advisory/content/edk-ii-authenticated-variable-bypass.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-5407","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-5407","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-5407","tags":["advisory"]},{"url":"https://github.com/bbbrumley/portsmash","tags":["article"]},{"url":"https://www.openssl.org/news/secadv/20181112.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-12181","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-12181","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-12181","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-0160","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-0160","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-0160","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-0161","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-0161","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1640820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1658366","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1683804","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1687920","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1702223","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1709829","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1718388","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1720156","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1720160","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1720310","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1720434","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1720435","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1720436","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1724044","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1726534","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1727007","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1727859","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1728998","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1729023","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2437.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-16838","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-16838","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-16838","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-16881","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-16881","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-16881","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1559","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1559","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1559","tags":["advisory"]},{"url":"https://github.com/RUB-NDS/TLS-Padding-Oracles","tags":["article"]},{"url":"https://www.openssl.org/news/secadv/20190226.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10139","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10139","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10139","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10160","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10160","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10160","tags":["advisory"]},{"url":"https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization2.html","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3338","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1666941","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1687731","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1693205","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1714446","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3338.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191110-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1131361","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-0161","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191157-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191204-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-0161","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7060-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-28210","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-28211","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-38575","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-38578","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-1292","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VEFMCCRZCRKIPIPKMJRYMISOUXAM4RWH/#VEFMCCRZCRKIPIPKMJRYMISOUXAM4RWH","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5731","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-0160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14559","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14562","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14575","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14584","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14587","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28211","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-0161","description":"Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access.","status":"published","published":"2019-03-27T19:23:44Z","modified":"2024-08-04T17:44:14.759Z","updated_at":"2026-11-02T14:32:24.473448Z"}],"euvd":[{"id":"EUVD-2019-0968","description":"Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access.","status":"published","published":"2019-03-27T19:23:44Z","modified":"2024-08-04T17:44:14Z","updated_at":"2026-11-03T03:07:02.510914Z"}],"ghsa":[{"id":"GHSA-jf2h-frpc-5873","title":"Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial...","description":"Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access.","status":"published","published":"2022-05-13T01:10:26Z","modified":"2023-02-01T05:03:30Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:50:03.88435Z"}],"nvd":[{"id":"CVE-2019-0161","description":"Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access.","status":"published","published":"2019-03-27T20:29:03.957Z","modified":"2026-06-17T02:07:51.13Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:05:09.523883Z"}],"osv":[{"id":"BELL-CVE-2019-0161","title":"CVE-2019-0161 does not affect BellSoft software","status":"withdrawn","published":"2019-03-27T20:29:00Z","modified":"2026-01-26T09:46:56.168828Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2019-0161","description":"Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access.","status":"published","published":"2019-03-27T20:29:03.957Z","modified":"2026-04-16T04:36:46.665676492Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:10.051046Z"},{"id":"DEBIAN-CVE-2019-0161","description":"Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access.","status":"published","published":"2019-03-27T20:29:03.957Z","modified":"2026-09-21T07:00:05.593573811Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:31.170944Z"},{"id":"RHSA-2019:2125","title":"Red Hat Security Advisory: ovmf security and enhancement update","status":"published","published":"2024-09-16T02:06:51Z","modified":"2026-09-21T10:02:10Z","cvss":[{"version":"3.0","score":6.7,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"RHSA-2019:2437","title":"Red Hat Security Advisory: Red Hat Virtualization security update","status":"published","published":"2024-09-13T19:53:41Z","modified":"2026-10-08T10:01:37Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"RHSA-2019:3338","title":"Red Hat Security Advisory: edk2 security, bug fix, and enhancement update","status":"published","published":"2024-09-16T02:06:58Z","modified":"2026-06-28T10:32:51Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"UBUNTU-CVE-2019-0161","description":"Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access.","status":"published","published":"2019-03-27T20:29:00Z","modified":"2026-02-04T03:12:13.426389Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:18.772093Z"},{"id":"DLA-2645-1","title":"edk2 - security update","status":"published","published":"2021-04-29T00:00:00Z","modified":"2026-03-09T01:23:38.91045Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"MGASA-2021-0035","title":"Updated edk2 packages fix multiples security vulnerabilities","description":"Improper configuration in system firmware for EDK II may allow unauthenticated\nuser to potentially enable escalation of privilege, information disclosure\nand/or denial of service via local access. (CVE-2018-12179).\n\nInsufficient memory write check in SMM service for EDK II may allow an\nauthenticated user to potentially enable escalation of privilege, information\ndisclosure and/or denial of service via local access. (CVE-2018-12182).\n\nStack overflow in DxeCore for EDK II may allow an unauthenticated user to\npotentially enable escalation of privilege, information disclosure and/or\ndenial of service via local access. (CVE-2018-12183).\n\nBuffer overflow in system firmware for EDK II may allow unauthenticated user\nto potentially enable escalation of privilege and/or denial of service via\nnetwork access. (CVE-2019-0160).\n\nStack overflow in XHCI for EDK II may allow an unauthenticated user to\npotentially enable denial of service via local access. (CVE-2019-0161).\n\nImproper authentication in EDK II may allow a privileged user to potentially\nenable information disclosure via network access. (CVE-2019-14553).\n\nInsufficient control flow management in BIOS firmware for 8th, 9th, 10th\nGeneration Intel(R) Core(TM), Intel(R) Celeron(R) Processor 4000 \u0026 5000 Series\nProcessors may allow an authenticated user to potentially enable denial of\nservice via adjacent access. (CVE-2019-14558).\n\nUncontrolled resource consumption in EDK II may allow an unauthenticated user\nto potentially enable denial of service via network access. (CVE-2019-14559).\n\nInteger truncation in EDK II may allow an authenticated user to potentially\nenable escalation of privilege via local access. (CVE-2019-14563).\n\nLogic issue in DxeImageVerificationHandler() for EDK II may allow an\nauthenticated user to potentially enable escalation of privilege via local\naccess. (CVE-2019-14575).\n\nEDK II incorrectly parsed signed PKCS #7 data. An attacker could use this\nissue to cause EDK II to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. (CVE-2019-14584).\n\nUse after free vulnerability in EDK II may allow an authenticated user to\npotentially enable escalation of privilege, information disclosure and/or\ndenial of service via adjacent access. (CVE-2019-14586).\n\nLogic issue EDK II may allow an unauthenticated user to potentially enable\ndenial of service via adjacent access. (CVE-2019-14587).\n\nInteger overflow in DxeImageVerificationHandler() EDK II may allow an\nauthenticated user to potentially enable denial of service via local access.\n(CVE-2019-14562).\n","status":"published","published":"2021-01-17T16:07:01Z","modified":"2026-04-16T04:42:41.889312057Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2019:1352-1","title":"Security update for ovmf","description":"This update for ovmf fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-0161: Fixed a stack overflow in UsbBusDxe and UsbBusPei, which could \n  potentially be triggered by a local unauthenticated user (bsc#1131361).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-05-08T15:04:17Z","modified":"2026-02-04T02:20:12.928395Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:11134-1","title":"ovmf-202105-3.4 on GA media","description":"These are all security issues fixed in the ovmf-202105-3.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:25:46.183484Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2019:1110-1","title":"Security update for ovmf","description":"This update for ovmf fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-0161: Fixed a stack overflow in UsbBusDxe and UsbBusPei, which could \n  potentially be triggered by a local unauthenticated user (bsc#1131361).\n","status":"published","published":"2019-04-30T10:58:49Z","modified":"2026-02-04T03:43:26.284327Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:1157-1","title":"Security update for ovmf","description":"This update for ovmf fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-0161: Fixed a stack overflow in UsbBusDxe and UsbBusPei, which could \n  potentially be triggered by a local unauthenticated user (bsc#1131361).\n","status":"published","published":"2019-05-06T11:46:32Z","modified":"2026-02-04T04:09:05.467665Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:1204-1","title":"Security update for ovmf","description":"This update for ovmf fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-0161: Fixed a stack overflow in UsbBusDxe and UsbBusPei, which could \n  potentially be triggered by a local unauthenticated user (bsc#1131361).\n","status":"published","published":"2019-05-10T12:00:06Z","modified":"2026-02-04T04:00:05.517117Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"USN-7060-1","title":"edk2 vulnerabilities","description":"It was discovered that EDK II did not check the buffer length in XHCI, \nwhich could lead to a stack overflow. A local attacker could potentially\nuse this issue to cause a denial of service. This issue only affected \nUbuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-0161)\n\nLaszlo Ersek discovered that EDK II incorrectly handled recursion. A\nremote attacker could possibly use this issue to cause EDK II to consume\nresources, leading to a denial of service. This issue only affected \nUbuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2021-28210)\n\nSatoshi Tanda discovered that EDK II incorrectly handled decompressing\ncertain images. A remote attacker could use this issue to cause EDK II to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.\n(CVE-2021-28211)\n\nIt was discovered that EDK II incorrectly decoded certain strings. A remote\nattacker could use this issue to cause EDK II to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. This issue only \naffected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2021-38575)\n\nIt was discovered that EDK II had integer underflow vulnerability in \nSmmEntryPoint, which could result in a buffer overflow. An attacker\ncould potentially use this issue to cause a denial of service.\n(CVE-2021-38578)\n\nElison Niven discovered that OpenSSL, vendored in EDK II, incorrectly \nhandled the c_rehash script. A local attacker could possibly use this \nissue to execute arbitrary commands when c_rehash is run. This issue \nonly affected Ubuntu 16.04 LTS. (CVE-2022-1292)\n","status":"published","published":"2024-10-10T03:41:37Z","modified":"2026-06-25T13:32:29.224935972Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}