CVE-2019-14587: 
Linux Debian vulnerability analysis and mitigation

A logic issue was identified in EDK II (CVE-2019-14587) that could allow an unauthenticated user to potentially enable denial of service through adjacent access. The vulnerability was discovered and assigned on August 3, 2019, affecting various versions of the EDK II firmware for virtual machines (CVE MITRE, Ubuntu Security).

The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium severity). The technical assessment indicates the attack vector is Adjacent, attack complexity is Low, requires No privileges, and needs No user interaction. While the vulnerability does not impact Confidentiality or Integrity, it has a High impact on Availability. The scope of the vulnerability remains Unchanged (Ubuntu Security).

The primary impact of this vulnerability is on system availability, potentially leading to denial of service conditions. The vulnerability specifically affects the EDK II firmware system, with no reported impacts on confidentiality or integrity of the system (Ubuntu Security).

The vulnerability can be exploited by an unauthenticated user through adjacent access, requiring low attack complexity and no user interaction. The attack vector being adjacent rather than remote somewhat limits the potential for widespread exploitation (Ubuntu Security).

Multiple distributions have released patches to address this vulnerability. Ubuntu has fixed the issue in versions 19.10 (eoan), 18.04 LTS (bionic), and 16.04 LTS (xenial). Debian has addressed the vulnerability in various releases including bullseye, bookworm, and trixie (Ubuntu Security, Debian Security).