CVE-2019-12380

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

**DISPUTED** An issue was discovered in the efi subsystem in the Linux kernel through 5.1.5. phys_efi_set_virtual_address_map in arch/x86/platform/efi/efi.c and efi_call_phys_prolog in arch/x86/platform/efi/efi_64.c mishandle memory allocation failures. NOTE: This id is disputed as not being an issue because “All the code touched by the referenced commit runs only at boot, before any user processes are started. Therefore, there is no possibility for an unprivileged user to control it.”.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-388

Affected software

No affected versions have been published.

Timeline

Published: May 28, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-123815.5An issue was discovered in ip_ra_control in net/ipv4/ip_sockglue.c in the Linux kernel through 5.1.5. There is an unchecked kmalloc of new_r CVE-2019-123825.5An issue was discovered in drm_load_edid_firmware in drivers/gpu/drm/drm_edid_load.c in the Linux kernel through 5.1.5. There is an unchecke CVE-2019-123834.3Tor Browser before 8.0.1 has an information exposure vulnerability. It allows remote attackers to detect the browser's UI locale by measurin CVE-2019-123845.9FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-CVE-2019-123858.8An issue was discovered in Ampache through 3.9.1. The search engine is affected by a SQL Injection, so any user able to perform lib/class/se CVE-2019-123865.4An issue was discovered in Ampache through 3.9.1. A stored XSS exists in the localplay.php LocalPlay "add instance" functionality. The injec CVE-2019-123876.1In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters s CVE-2019-123887.5Anviz access control devices perform cleartext transmission of sensitive information (passwords/pins and names) when replying to query on po CVE-2019-123897.5Anviz access control devices expose credentials (names and passwords) by allowing remote attackers to query this information without credent CVE-2019-12397.5A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execut CVE-2019-123905.3Anviz access control devices expose private Information (pin code and name) by allowing remote attackers to query this information without c CVE-2019-123917.5The Anviz Management System for access control has insufficient logging for device events such as door open requests.