CVE-2019-12067

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The ahci_commit_buf function in ide/ahci.c in QEMU allows attackers to cause a denial of service (NULL dereference) when the command header 'ad->cur_cmd' is null.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugzilla.suse.com/show_bug.cgi?id=1145642Issue Tracking, Third Party Advisory
https://lists.gnu.org/archive/html/qemu-devel/2019-08/msg01358.htmlMailing List, Patch, Third Party Advisory
https://lists.gnu.org/archive/html/qemu-devel/2019-08/msg01487.htmlMailing List, Patch, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2019-12067Third Party Advisory
https://security.netapp.com/advisory/ntap-20210727-0001/Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1145642Issue Tracking, Third Party Advisory
https://lists.gnu.org/archive/html/qemu-devel/2019-08/msg01358.htmlMailing List, Patch, Third Party Advisory
https://lists.gnu.org/archive/html/qemu-devel/2019-08/msg01487.htmlMailing List, Patch, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2019-12067Third Party Advisory
https://security.netapp.com/advisory/ntap-20210727-0001/Third Party Advisory

Timeline

Published: Jun 2, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-120683.8In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12 (fixed), w CVE-2019-12087.5A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execut CVE-2019-120838.1The Rust Programming Language Standard Library 1.34.x before 1.34.2 contains a stabilized method which, if overridden, can violate Rust's sa CVE-2019-120867.5A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or CVE-2019-120875.5Samsung S9+, S10, and XCover 4 P(9.0) devices can become temporarily inoperable because of an unprotected intent in the ContainerAgent appli CVE-2019-12096.5An information disclosure vulnerability exists in Lync 2013, aka 'Lync 2013 Information Disclosure Vulnerability'.CVE-2019-120917.8The Netskope client service, v57 before 57.2.0.219 and v60 before 60.2.0.214, running with NT\SYSTEM privilege, accepts network connections CVE-2019-120946.1Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=update_f&user_name= or admin/user.php?form=remove_f&use CVE-2019-120958.8Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmark CVE-2019-120977.8Telerik Fiddler v5.0.20182.28034 doesn't verify the hash of EnableLoopback.exe before running it, which could lead to code execution or loca CVE-2019-120987.4In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack.CVE-2019-120998.8In PHP-Fusion 9.03.00, edit_profile.php allows remote authenticated users to execute arbitrary code because includes/dynamics/includes/form_