---
title: "CVE-2019-14575\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2019-14575?format=md
keywords: index, follow
---

# CVE-2019-14575

Publication date 31 December 2019

Last updated 25 August 2025

---

Ubuntu priority

**Low**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

## Cvss 3 Severity Score

**7.8 · High**

[Score breakdown](https://ubuntu.com/security/CVE-2019-14575?format=md#impact-score)

Toggle side navigation

## Description

Logic issue in DxeImageVerificationHandler() for EDK II may allow an
authenticated user to potentially enable escalation of privilege via local
access.

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| edk2 | 20.04 LTS focal | Not affected |
| 19.10 eoan | Fixed 0~20190606.20d2e5a1-2ubuntu1.1 |
| 18.04 LTS bionic | Fixed 0~20180205.c0d9813c-2ubuntu0.2 |
| 16.04 LTS xenial | Fixed 0~20160408.ffea0a2c-2ubuntu0.1 |
| 14.04 LTS trusty | Not in release |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)
* [Patch details](https://ubuntu.com/security/CVE-2019-14575?format=md#patch-details)

### Patch details

For informational purposes only. We recommend not to cherry-pick updates. [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)

| Package | Patch details |
| --- | --- |
| edk2 | * Upstream:   [fbb9607](https://github.com/tianocore/edk2/commit/fbb96072233b5eaecf4d229cbee47b13dcab39e1) * Upstream:   [c13742b](https://github.com/tianocore/edk2/commit/c13742b180095e5181e41dffda954581ecbd9b9c) * Upstream:   [9e56970](https://github.com/tianocore/edk2/commit/9e569700901857d0ba418ebdd30b8086b908688c) * Upstream:   [929d1a2](https://github.com/tianocore/edk2/commit/929d1a24d12822942fd4f9fa83582e27f92de243) * Upstream:   [adc6898](https://github.com/tianocore/edk2/commit/adc6898366298d1f64b91785e50095527f682758) * Upstream:   [a83dbf0](https://github.com/tianocore/edk2/commit/a83dbf008cc73406cbdc0d5ac3164cc19fff6683) * Upstream:   [5cd8be6](https://github.com/tianocore/edk2/commit/5cd8be6079ea7e5638903b2f3da0f4c10ec7f1da) * Upstream:   [cb30c8f](https://github.com/tianocore/edk2/commit/cb30c8f25162e6d8142c6b098f14c1e4e7f125ce) * Upstream:   [b1c1147](https://github.com/tianocore/edk2/commit/b1c11470598416c89c67b75c991fd0773bcbab9d) * Upstream:   [c230c00](https://github.com/tianocore/edk2/commit/c230c002accc4281ccc57bba7153a9b2d9b9ccd3) |

## Severity score breakdown

CVSS version:
CVSS v3.0

**Base score**

7.8 · High

* Base metrics

  | Parameter | Value |
  | --- | --- |
  | Attack vector | Local |
  | Attack complexity | Low |
  | Privileges required | Low |
  | User interaction | None |
  | Scope | Unchanged |
  | Confidentiality impact | High |
  | Integrity impact | High |
  | Availability impact | High |
* Scores

  | Parameter | Value |
  | --- | --- |
  | Base score | 7.8 · High |
  | Exploitability score | - |
  | Impact score | - |

**Vector:** CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14575)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2019-14575)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2019-14575)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2019-14575)

### Related Ubuntu Security Notices (USN)

+ [USN-4349-1](https://usn.ubuntu.com/USN-4349-1)
+ EDK II vulnerabilities
+ 30 April 2020

### Other references

* <https://www.cve.org/CVERecord?id=CVE-2019-14575>