{"id":"CVE-2019-14587","aliases":["DEBIAN-CVE-2019-14587","DLA-2645-1","EUVD-2019-5748","GHSA-5732-xrx9-2xhf","MGASA-2021-0035","UBUNTU-CVE-2019-14587","USN-4349-1","openSUSE-SU-2024:11134-1"],"status":"published","title":"Logic issue EDK II may allow an unauthenticated user to potentially enable denial of service via...","description":"Logic issue EDK II may allow an unauthenticated user to potentially enable denial of service via adjacent access.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00636,"percentile":0.50741,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2019-12-31T00:00:00Z","modified":"2026-09-21T07:02:40Z","fixes":[{"ecosystem":"Debian:12","package":"edk2","fixed_in":["0~20200229.4c0f6e34-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"edk2","fixed_in":["0~20200229.4c0f6e34-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"edk2","fixed_in":["0~20200229.4c0f6e34-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"edk2","fixed_in":["0~20160408.ffea0a2c-2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"edk2","fixed_in":["0~20180205.c0d9813c-2ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20200229.4c0f6e34-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20200229.4c0f6e34-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20200229.4c0f6e34-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20161202.7bbe0b3e-1+deb9u2"}]}],"versions":["0~20161202.7bbe0b3e-1","0~20161202.7bbe0b3e-1+deb9u1"],"bundled":11},{"source":"osv","ecosystem":"Mageia:7","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20201127stable-1.mga7"}]}],"bundled":14},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20160408.ffea0a2c-2ubuntu0.1"}]}],"versions":["0~20150106.5c2d456b-2","0~20160104.c2a892d7-1","0~20160408.ffea0a2c-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20180205.c0d9813c-2ubuntu0.2"}]}],"versions":["0~20170911.5dfba97c-1","0~20171010.234dbcef-1","0~20171027.76fd5a66-1","0~20171205.a9212288-1","0~20180105.0bc94c74-1","0~20180205.c0d9813c-1","0~20180205.c0d9813c-2","0~20180205.c0d9813c-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20160408.ffea0a2c-2ubuntu0.1"}]}],"versions":["0~20150106.5c2d456b-2","0~20160104.c2a892d7-1","0~20160408.ffea0a2c-2"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0~20180205.c0d9813c-2ubuntu0.2"}]}],"versions":["0~20170911.5dfba97c-1","0~20171010.234dbcef-1","0~20171027.76fd5a66-1","0~20171205.a9212288-1","0~20180105.0bc94c74-1","0~20180205.c0d9813c-1","0~20180205.c0d9813c-2","0~20180205.c0d9813c-2ubuntu0.1"],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202105-3.4"}]}],"bundled":21}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"extensible firmware interface development kit (edk ii)","product":"extensible firmware interface development kit (edk ii)"},{"vendor":"tianocore","product":"edk2"}],"references":[{"url":"https://bugzilla.tianocore.org/show_bug.cgi?id=1989","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/04/msg00032.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-14587"},{"url":"https://github.com/advisories/GHSA-5732-xrx9-2xhf"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-14587","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0035.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25939","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/TQYVZRFEXSN3KS43AVH4D7QX553EZQYP/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1712","tags":["web"]},{"url":"https://usn.ubuntu.com/4349-1/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/A23OH3MXQU7WURSP4PC66EXMG6INYFH6/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-4684-1","tags":["advisory"]},{"url":"https://github.com/tianocore/edk2/releases","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-14587","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4349-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-14587","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-12178","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-12180","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-12181","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-14558","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-14559","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-14563","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-14575","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-14586","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5731","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-0160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-0161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14559","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14562","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14575","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14584","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14587","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28211","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-14587","description":"Logic issue EDK II may allow an unauthenticated user to potentially enable denial of service via adjacent access.","status":"published","published":"2020-11-23T16:15:08Z","modified":"2024-08-05T00:19:41.342Z","updated_at":"2026-11-02T14:20:18.085548Z"}],"euvd":[{"id":"EUVD-2019-5748","description":"Logic issue EDK II may allow an unauthenticated user to potentially enable denial of service via adjacent access.","status":"published","published":"2020-11-23T16:15:08Z","modified":"2024-08-05T00:19:41Z","updated_at":"2026-11-03T02:40:39.076786Z"}],"ghsa":[{"id":"GHSA-5732-xrx9-2xhf","title":"Logic issue EDK II may allow an unauthenticated user to potentially enable denial of service via...","description":"Logic issue EDK II may allow an unauthenticated user to potentially enable denial of service via adjacent access.","status":"published","published":"2022-05-24T17:34:48Z","modified":"2023-01-29T05:04:50Z","updated_at":"2026-11-02T14:45:38.830072Z"}],"nvd":[{"id":"CVE-2019-14587","description":"Logic issue EDK II may allow an unauthenticated user to potentially enable denial of service via adjacent access.","status":"published","published":"2020-11-23T17:15:12.11Z","modified":"2026-06-17T02:18:40.657Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":3.3,"vector":"AV:A/AC:L/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"updated_at":"2026-11-02T14:05:48.502374Z"}],"osv":[{"id":"CVE-2019-14587","description":"Logic issue EDK II may allow an unauthenticated user to potentially enable denial of service via adjacent access.","status":"published","published":"2020-11-23T17:15:12.11Z","modified":"2026-04-16T04:36:34.638338365Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:11.029493Z"},{"id":"DEBIAN-CVE-2019-14587","description":"Logic issue EDK II may allow an unauthenticated user to potentially enable denial of service via adjacent access.","status":"published","published":"2020-11-23T17:15:12.11Z","modified":"2026-09-21T07:02:40.301678449Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"UBUNTU-CVE-2019-14587","description":"Logic issue EDK II may allow an unauthenticated user to potentially enable denial of service via adjacent access.","status":"published","published":"2019-12-31T00:00:00Z","modified":"2026-02-04T02:59:51.135882Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:19.6877Z"},{"id":"DLA-2645-1","title":"edk2 - security update","status":"published","published":"2021-04-29T00:00:00Z","modified":"2026-03-09T01:23:38.91045Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"MGASA-2021-0035","title":"Updated edk2 packages fix multiples security vulnerabilities","description":"Improper configuration in system firmware for EDK II may allow unauthenticated\nuser to potentially enable escalation of privilege, information disclosure\nand/or denial of service via local access. (CVE-2018-12179).\n\nInsufficient memory write check in SMM service for EDK II may allow an\nauthenticated user to potentially enable escalation of privilege, information\ndisclosure and/or denial of service via local access. (CVE-2018-12182).\n\nStack overflow in DxeCore for EDK II may allow an unauthenticated user to\npotentially enable escalation of privilege, information disclosure and/or\ndenial of service via local access. (CVE-2018-12183).\n\nBuffer overflow in system firmware for EDK II may allow unauthenticated user\nto potentially enable escalation of privilege and/or denial of service via\nnetwork access. (CVE-2019-0160).\n\nStack overflow in XHCI for EDK II may allow an unauthenticated user to\npotentially enable denial of service via local access. (CVE-2019-0161).\n\nImproper authentication in EDK II may allow a privileged user to potentially\nenable information disclosure via network access. (CVE-2019-14553).\n\nInsufficient control flow management in BIOS firmware for 8th, 9th, 10th\nGeneration Intel(R) Core(TM), Intel(R) Celeron(R) Processor 4000 \u0026 5000 Series\nProcessors may allow an authenticated user to potentially enable denial of\nservice via adjacent access. (CVE-2019-14558).\n\nUncontrolled resource consumption in EDK II may allow an unauthenticated user\nto potentially enable denial of service via network access. (CVE-2019-14559).\n\nInteger truncation in EDK II may allow an authenticated user to potentially\nenable escalation of privilege via local access. (CVE-2019-14563).\n\nLogic issue in DxeImageVerificationHandler() for EDK II may allow an\nauthenticated user to potentially enable escalation of privilege via local\naccess. (CVE-2019-14575).\n\nEDK II incorrectly parsed signed PKCS #7 data. An attacker could use this\nissue to cause EDK II to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. (CVE-2019-14584).\n\nUse after free vulnerability in EDK II may allow an authenticated user to\npotentially enable escalation of privilege, information disclosure and/or\ndenial of service via adjacent access. (CVE-2019-14586).\n\nLogic issue EDK II may allow an unauthenticated user to potentially enable\ndenial of service via adjacent access. (CVE-2019-14587).\n\nInteger overflow in DxeImageVerificationHandler() EDK II may allow an\nauthenticated user to potentially enable denial of service via local access.\n(CVE-2019-14562).\n","status":"published","published":"2021-01-17T16:07:01Z","modified":"2026-04-16T04:42:41.889312057Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2024:11134-1","title":"ovmf-202105-3.4 on GA media","description":"These are all security issues fixed in the ovmf-202105-3.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:25:46.183484Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"USN-4349-1","title":"edk2 vulnerabilities","description":"A buffer overflow was discovered in the network stack. An unprivileged user\ncould potentially enable escalation of privilege and/or denial of service.\nThis issue was already fixed in a previous release for 18.04 LTS and 19.10.\n(CVE-2018-12178)\n\nA buffer overflow was discovered in BlockIo service. An unauthenticated user\ncould potentially enable escalation of privilege, information disclosure and/or\ndenial of service. This issue was already fixed in a previous release for 18.04\nLTS and 19.10. (CVE-2018-12180)\n\nA stack overflow was discovered in bmp. An unprivileged user\ncould potentially enable denial of service or elevation of privilege via\nlocal access. This issue was already fixed in a previous release for 18.04\nLTS and 19.10. (CVE-2018-12181)\n\nIt was discovered that memory was not cleared before free that could lead\nto potential password leak. (CVE-2019-14558)\n\nA memory leak was discovered in ArpOnFrameRcvdDpc. An attacker could\npossibly use this issue to cause a denial of service or other unspecified\nimpact. (CVE-2019-14559)\n\nAn integer overflow was discovered in MdeModulePkg/PiDxeS3BootScriptLib.\nAn attacker could possibly use this issue to cause a denial of service or\nother unspecified impact. (CVE-2019-14563)\n\nIt was discovered that the affected version doesn't properly check whether an\nunsigned EFI file should be allowed or not. An attacker could possibly load\nunsafe content by bypassing the verification. (CVE-2019-14575)\n\nIt was discovered that original configuration runtime memory is freed, but it\nis still exposed to the OS runtime. (CVE-2019-14586)\n\nA double-unmap was discovered in TRB creation. An attacker could use it to\ncause a denial of service or other unspecified impact. (CVE-2019-14587)\n","status":"published","published":"2020-04-30T22:54:56Z","modified":"2026-02-10T04:41:49Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}