{"id":"CVE-2019-14584","aliases":["AZL-40833","AZL-41086","DEBIAN-CVE-2019-14584","DLA-2645-1","EUVD-2019-5745","GHSA-r5j3-cc22-8xx9","MGASA-2021-0035","OESA-2022-1986","OESA-2022-1987","RHSA-2021:4198","SUSE-SU-2020:3883-1","SUSE-SU-2020:3884-1","SUSE-SU-2020:3885-1","SUSE-SU-2021:2117-1","UBUNTU-CVE-2019-14584","USN-4684-1","openSUSE-SU-2020:2314-1","openSUSE-SU-2020:2336-1","openSUSE-SU-2021:0598-1","openSUSE-SU-2024:11134-1","openSUSE-SU-2024:11382-1"],"status":"published","title":"Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable...","description":"Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privilege via local access.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00325,"percentile":0.25944,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2019-12-31T00:00:00Z","modified":"2026-09-21T10:03:07Z","fixes":[{"ecosystem":"Azure Linux:3","package":"shim-unsigned-aarch64","fixed_in":["15.8-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"shim-unsigned-x64","fixed_in":["15.8-3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"edk2","fixed_in":["2020.11-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"edk2","fixed_in":["2020.11-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"edk2","fixed_in":["2020.11-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"ovmf","fixed_in":["2017+git1510945757.b2662641d5-3.32.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"ovmf","fixed_in":["2017+git1510945757.b2662641d5-3.32.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP2","package":"ovmf","fixed_in":["201911-7.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP1","package":"ovmf","fixed_in":["2017+git1510945757.b2662641d5-5.38.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"edk2","fixed_in":["0~20160408.ffea0a2c-2ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"edk2","fixed_in":["0~20180205.c0d9813c-2ubuntu0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"edk2","fixed_in":["0~20191122.bd85bf54-2ubuntu3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"ovmf","fixed_in":["201911-lp152.6.8.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"ovmf","fixed_in":["2017+git1510945757.b2662641d5-lp151.11.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"shim","fixed_in":["15.4-lp152.4.8.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"shim","fixed_in":["15.4-4.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"shim-unsigned-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.8-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"shim-unsigned-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.8-3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.11-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.11-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.11-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20161202.7bbe0b3e-1+deb9u2"}]}],"versions":["0~20161202.7bbe0b3e-1","0~20161202.7bbe0b3e-1+deb9u1"],"bundled":11},{"source":"osv","ecosystem":"Mageia:7","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20201127stable-1.mga7"}]}],"bundled":14},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202002-10.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202002-10.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20210527gite1999b264f1f-3.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"edk2-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20210527gite1999b264f1f-3.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20210527gite1999b264f1f-3.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017+git1510945757.b2662641d5-3.32.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017+git1510945757.b2662641d5-3.32.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP2","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"201911-7.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP1","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017+git1510945757.b2662641d5-5.38.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2015+git1462940744.321151f-19.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20160408.ffea0a2c-2ubuntu0.2"}]}],"versions":["0~20150106.5c2d456b-2","0~20160104.c2a892d7-1","0~20160408.ffea0a2c-2","0~20160408.ffea0a2c-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20180205.c0d9813c-2ubuntu0.3"}]}],"versions":["0~20170911.5dfba97c-1","0~20171010.234dbcef-1","0~20171027.76fd5a66-1","0~20171205.a9212288-1","0~20180105.0bc94c74-1","0~20180205.c0d9813c-1","0~20180205.c0d9813c-2","0~20180205.c0d9813c-2ubuntu0.1","0~20180205.c0d9813c-2ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20191122.bd85bf54-2ubuntu3.1"}]}],"versions":["0~20190606.20d2e5a1-2ubuntu1","0~20190828.37eef910-3","0~20190828.37eef910-4","0~20191122.bd85bf54-1","0~20191122.bd85bf54-1ubuntu1","0~20191122.bd85bf54-2","0~20191122.bd85bf54-2ubuntu1","0~20191122.bd85bf54-2ubuntu2","0~20191122.bd85bf54-2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20160408.ffea0a2c-2ubuntu0.2"}]}],"versions":["0~20150106.5c2d456b-2","0~20160104.c2a892d7-1","0~20160408.ffea0a2c-2","0~20160408.ffea0a2c-2ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20180205.c0d9813c-2ubuntu0.3"}]}],"versions":["0~20170911.5dfba97c-1","0~20171010.234dbcef-1","0~20171027.76fd5a66-1","0~20171205.a9212288-1","0~20180105.0bc94c74-1","0~20180205.c0d9813c-1","0~20180205.c0d9813c-2","0~20180205.c0d9813c-2ubuntu0.1","0~20180205.c0d9813c-2ubuntu0.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20191122.bd85bf54-2ubuntu3.1"}]}],"versions":["0~20190606.20d2e5a1-2ubuntu1","0~20190828.37eef910-3","0~20190828.37eef910-4","0~20191122.bd85bf54-1","0~20191122.bd85bf54-1ubuntu1","0~20191122.bd85bf54-2","0~20191122.bd85bf54-2ubuntu1","0~20191122.bd85bf54-2ubuntu2","0~20191122.bd85bf54-2ubuntu3"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"201911-lp152.6.8.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017+git1510945757.b2662641d5-lp151.11.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.4-lp152.4.8.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202105-3.4"}]}],"bundled":21},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.4-4.2"}]}]}],"products":[{"vendor":"tianocore","product":"edk2"},{"vendor":"tianocore","product":"tianocore edk2"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1889486","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-14584","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-r5j3-cc22-8xx9"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-14584","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0035.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25939","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/TQYVZRFEXSN3KS43AVH4D7QX553EZQYP/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1712","tags":["web"]},{"url":"https://usn.ubuntu.com/4349-1/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/A23OH3MXQU7WURSP4PC66EXMG6INYFH6/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-4684-1","tags":["advisory"]},{"url":"https://github.com/tianocore/edk2/releases","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1986","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11098","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1987","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:4198","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1930310","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1930324","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1937564","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1938238","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1938257","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1956837","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1988762","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4198.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-14584","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-14584","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-23840","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23840","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23840","tags":["advisory"]},{"url":"https://www.openssl.org/news/secadv/20210216.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-23841","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23841","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23841","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-28210","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1883552","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-28210","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28210","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203883-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1177789","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14584","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203884-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203885-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212117-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1183578","tags":["report"]},{"url":"https://bugzilla.suse.com/1183579","tags":["report"]},{"url":"https://bugzilla.suse.com/1186151","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28211","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-14584","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-14562","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/P7TLVCW5VHXA7SSOSARLTBRZWC5MH642/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7Y57O2IBBHBOVJBEVV6JAOZWLGF53QFS/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/O2IF5TPLLS7U2RNC42HXIHTRUMS4Q6YV/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1173411","tags":["report"]},{"url":"https://bugzilla.suse.com/1174512","tags":["report"]},{"url":"https://bugzilla.suse.com/1175509","tags":["report"]},{"url":"https://bugzilla.suse.com/1177315","tags":["report"]},{"url":"https://bugzilla.suse.com/1177404","tags":["report"]},{"url":"https://bugzilla.suse.com/1182057","tags":["report"]},{"url":"https://bugzilla.suse.com/1184454","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5731","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-0160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-0161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14559","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14562","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14575","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14587","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-14584","description":"Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privilege via local access.","status":"published","published":"2021-06-03T19:56:01Z","modified":"2024-08-05T00:19:41.364Z","updated_at":"2026-11-02T14:20:17.722148Z"}],"euvd":[{"id":"EUVD-2019-5745","description":"Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privilege via local access.","status":"published","published":"2021-06-03T19:56:01Z","modified":"2024-08-05T00:19:41Z","updated_at":"2026-11-03T02:40:39.076786Z"}],"ghsa":[{"id":"GHSA-r5j3-cc22-8xx9","title":"Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable...","description":"Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privilege via local access.","status":"published","published":"2022-05-24T19:03:56Z","modified":"2023-01-29T05:06:25Z","cwes":["CWE-476"],"updated_at":"2026-11-02T14:46:01.439998Z"}],"nvd":[{"id":"CVE-2019-14584","description":"Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privilege via local access.","status":"published","published":"2021-06-03T20:15:08.337Z","modified":"2026-06-17T02:18:40.4Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:05:48.502374Z"}],"osv":[{"id":"AZL-40833","title":"CVE-2019-14584 affecting package shim-unsigned-aarch64 for versions less than 15.8-3","description":"Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privilege via local access.","status":"published","published":"2021-06-03T20:15:08Z","modified":"2026-04-21T04:33:08.087162Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"AZL-41086","title":"CVE-2019-14584 affecting package shim-unsigned-x64 for versions less than 15.8-3","description":"Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privilege via local access.","status":"published","published":"2021-06-03T20:15:08Z","modified":"2026-04-21T04:56:01.542711Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"CVE-2019-14584","description":"Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privilege via local access.","status":"published","published":"2021-06-03T20:15:08.337Z","modified":"2026-04-16T04:31:07.035026708Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:11.029493Z"},{"id":"DEBIAN-CVE-2019-14584","description":"Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privilege via local access.","status":"published","published":"2021-06-03T20:15:08.337Z","modified":"2026-09-21T07:01:32.711916235Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"OESA-2022-1986","title":"edk2 security update","description":"EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.\r\n\r\nSecurity Fix(es):\r\n\r\nNull pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privilege via local access.(CVE-2019-14584)\r\n\r\nInsufficient input validation in MdeModulePkg in EDKII may allow an unauthenticated user to potentially enable escalation of privilege, denial of service and/or information disclosure via physical access.(CVE-2019-11098)","status":"published","published":"2022-10-14T11:05:18Z","modified":"2026-08-18T01:17:19.942433963Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"OESA-2022-1987","title":"edk2 security update","description":"EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.\r\n\r\nSecurity Fix(es):\r\n\r\nNull pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privilege via local access.(CVE-2019-14584)\r\n\r\nInsufficient input validation in MdeModulePkg in EDKII may allow an unauthenticated user to potentially enable escalation of privilege, denial of service and/or information disclosure via physical access.(CVE-2019-11098)","status":"published","published":"2022-10-14T11:05:18Z","modified":"2026-08-18T01:17:20.023692508Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"RHSA-2021:4198","title":"Red Hat Security Advisory: edk2 security, bug fix, and enhancement update","status":"published","published":"2024-09-16T05:53:15Z","modified":"2026-09-21T10:03:07Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"UBUNTU-CVE-2019-14584","description":"Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privilege via local access.","status":"published","published":"2019-12-31T00:00:00Z","modified":"2026-02-04T03:51:05.645025Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:19.6877Z"},{"id":"DLA-2645-1","title":"edk2 - security update","status":"published","published":"2021-04-29T00:00:00Z","modified":"2026-03-09T01:23:38.91045Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"MGASA-2021-0035","title":"Updated edk2 packages fix multiples security vulnerabilities","description":"Improper configuration in system firmware for EDK II may allow unauthenticated\nuser to potentially enable escalation of privilege, information disclosure\nand/or denial of service via local access. (CVE-2018-12179).\n\nInsufficient memory write check in SMM service for EDK II may allow an\nauthenticated user to potentially enable escalation of privilege, information\ndisclosure and/or denial of service via local access. (CVE-2018-12182).\n\nStack overflow in DxeCore for EDK II may allow an unauthenticated user to\npotentially enable escalation of privilege, information disclosure and/or\ndenial of service via local access. (CVE-2018-12183).\n\nBuffer overflow in system firmware for EDK II may allow unauthenticated user\nto potentially enable escalation of privilege and/or denial of service via\nnetwork access. (CVE-2019-0160).\n\nStack overflow in XHCI for EDK II may allow an unauthenticated user to\npotentially enable denial of service via local access. (CVE-2019-0161).\n\nImproper authentication in EDK II may allow a privileged user to potentially\nenable information disclosure via network access. (CVE-2019-14553).\n\nInsufficient control flow management in BIOS firmware for 8th, 9th, 10th\nGeneration Intel(R) Core(TM), Intel(R) Celeron(R) Processor 4000 \u0026 5000 Series\nProcessors may allow an authenticated user to potentially enable denial of\nservice via adjacent access. (CVE-2019-14558).\n\nUncontrolled resource consumption in EDK II may allow an unauthenticated user\nto potentially enable denial of service via network access. (CVE-2019-14559).\n\nInteger truncation in EDK II may allow an authenticated user to potentially\nenable escalation of privilege via local access. (CVE-2019-14563).\n\nLogic issue in DxeImageVerificationHandler() for EDK II may allow an\nauthenticated user to potentially enable escalation of privilege via local\naccess. (CVE-2019-14575).\n\nEDK II incorrectly parsed signed PKCS #7 data. An attacker could use this\nissue to cause EDK II to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. (CVE-2019-14584).\n\nUse after free vulnerability in EDK II may allow an authenticated user to\npotentially enable escalation of privilege, information disclosure and/or\ndenial of service via adjacent access. (CVE-2019-14586).\n\nLogic issue EDK II may allow an unauthenticated user to potentially enable\ndenial of service via adjacent access. (CVE-2019-14587).\n\nInteger overflow in DxeImageVerificationHandler() EDK II may allow an\nauthenticated user to potentially enable denial of service via local access.\n(CVE-2019-14562).\n","status":"published","published":"2021-01-17T16:07:01Z","modified":"2026-04-16T04:42:41.889312057Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2020:2314-1","title":"Security update for ovmf","description":"This update for ovmf fixes the following issues:\n\n- CVE-2019-14584: Fixed a null dereference in AuthenticodeVerify() (bsc#1177789).\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2020-12-22T05:22:52Z","modified":"2026-02-04T02:58:42.257435Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:2336-1","title":"Security update for ovmf","description":"This update for ovmf fixes the following issues:\n\n- CVE-2019-14584: Fixed a null dereference in AuthenticodeVerify() (bsc#1177789).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-12-26T17:22:18Z","modified":"2026-02-04T03:08:57.805012Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:0598-1","title":"Security update for shim","description":"This update for shim fixes the following issues:\n\n- Updated openSUSE x86 signature\n\n- Avoid the error message during linux system boot (boo#1184454)\n- Prevent the build id being added to the binary. That can cause issues with the signature\n\nUpdate to 15.4 (boo#1182057)\n\n+ Rename the SBAT variable and fix the self-check of SBAT\n+ sbat: add more dprint()\n+ arm/aa64: Swizzle some sections to make old sbsign happier\n+ arm/aa64 targets: put .rel* and .dyn* in .rodata\n\n- Change the SBAT variable name and enhance the handling of SBAT (boo#1182057)\n\nUpdate to 15.3 for SBAT support (boo#1182057)\n\n+ Drop gnu-efi from BuildRequires since upstream pull it into the\n- Generate vender-specific SBAT metadata\n  + Add dos2unix to BuildRequires since Makefile requires it for\n    vendor SBAT\n- Update dbx-cert.tar.xz and vendor-dbx.bin to block the following\n  sign keys:\n  + SLES-UEFI-SIGN-Certificate-2020-07.crt\n  + openSUSE-UEFI-SIGN-Certificate-2020-07.crt\n- Check CodeSign in the signer's EKU (boo#1177315)\n- Fixed NULL pointer dereference in AuthenticodeVerify() (boo#1177789, CVE-2019-14584)\n\n- All newly released openSUSE kernels enable kernel lockdown\n  and signature verification, so there is no need to add the\n  prompt anymore.\n- shim-install: Support changing default shim efi binary in\n  /usr/etc/default/shim and /etc/default/shim (boo#1177315)\n","status":"published","published":"2021-04-23T10:44:47Z","modified":"2026-02-04T02:25:58.919682Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:11134-1","title":"ovmf-202105-3.4 on GA media","description":"These are all security issues fixed in the ovmf-202105-3.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:25:46.183484Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:11382-1","title":"shim-15.4-4.2 on GA media","description":"These are all security issues fixed in the shim-15.4-4.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:53:38.255936Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2020:3883-1","title":"Security update for ovmf","description":"This update for ovmf fixes the following issues:\n\n- CVE-2019-14584: Fixed a null dereference in AuthenticodeVerify() (bsc#1177789).\n","status":"published","published":"2020-12-18T15:47:51Z","modified":"2025-05-02T04:30:05.738185Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2020:3884-1","title":"Security update for ovmf","description":"This update for ovmf fixes the following issues:\n\n- CVE-2019-14584: Fixed a null dereference in AuthenticodeVerify() (bsc#1177789).\n","status":"published","published":"2020-12-18T15:48:02Z","modified":"2026-02-04T03:29:25.281477Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2020:3885-1","title":"Security update for ovmf","description":"This update for ovmf fixes the following issues:\n\n- CVE-2019-14584: Fixed a null dereference in AuthenticodeVerify() (bsc#1177789).\n","status":"published","published":"2020-12-18T15:55:28Z","modified":"2026-02-04T04:04:32.574687Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:2117-1","title":"Security update for ovmf","description":"This update for ovmf fixes the following issues:\n\n- Fixed a possible buffer overflow in IScsiDxe (bsc#1186151)\n- CVE-2021-28211: ovmf: edk2: possible heap corruption with LzmaUefiDecompressGetInfo (bsc#1183578)\n- CVE-2021-28210: ovmf: unlimited FV recursion, round 2 (bsc#1183579)\n- CVE-2019-14584: ovmf,shim: NULL pointer dereference in AuthenticodeVerify() (bsc#1177789)\n","status":"published","published":"2021-06-22T11:56:57Z","modified":"2026-02-04T02:17:46.830101Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"USN-4684-1","title":"edk2 vulnerabilities","description":"Laszlo Ersek discovered that EDK II incorrectly validated certain signed\nimages. An attacker could possibly use this issue with a specially crafted\nimage to cause EDK II to hang, resulting in a denial of service. This issue\nonly affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.\n(CVE-2019-14562)\n\nIt was discovered that EDK II incorrectly parsed signed PKCS #7 data. An\nattacker could use this issue to cause EDK II to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. (CVE-2019-14584)\n","status":"published","published":"2021-01-07T13:51:25Z","modified":"2026-02-10T04:42:01Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}