CVE-2019-11139

lowpriority · track · 24EPSS 0.004 · 29 %ileDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.36% (29th) EPSS

CVSS 2.1 · low

Is it mine?

144 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-26

Improper conditions check in the voltage modulation interface for some Intel(R) Xeon(R) Scalable Processors may allow a privileged user to potentially enable denial of service via local access.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedmicrocode_ctl-4:20190618-1.20191112.1.el8_1.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHEA-2019:3845
Fixedmicrocode_ctl-4:20190618-1.20191112.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHEA-2019:3845
Fixedmicrocode_ctl-4:20180807a-2.20191112.1.el8_0.src as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Note: a system reboot is necessary for this update to take effect.
https://access.redhat.com/errata/RHEA-2020:0635
Fixedmicrocode_ctl-4:20180807a-2.20191112.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Note: a system reboot is necessary for this update to take effect.
https://access.redhat.com/errata/RHEA-2020:0635
Workaroundmicrocode_ctl-4:20190618-1.20191112.1.el8_1.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
As of this time there are no known mitigations. Please install relevant updated packages to address this flaw.
Workaroundmicrocode_ctl-4:20190618-1.20191112.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
As of this time there are no known mitigations. Please install relevant updated packages to address this flaw.
Workaroundmicrocode_ctl-4:20180807a-2.20191112.1.el8_0.src as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
As of this time there are no known mitigations. Please install relevant updated packages to address this flaw.
Workaroundmicrocode_ctl-4:20180807a-2.20191112.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
As of this time there are no known mitigations. Please install relevant updated packages to address this flaw.

cvss

Technical severity, 0–10. One row per scoring source.

6.0

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 2.1–6

v2.02.1lowAV:L/AC:L/Au:N/C:N/I:N/A:Pprimary · NVD / NIST USexploitability 3.9 · impact 2.9

v3.16mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:Hprimary · NVD / NIST USexploitability 1.5 · impact 4

v3.05.8mediumCVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:N/I:L/A:Hsecondary · Red Hat Product Security US

v3.15.8mediumAV:L/AC:H/PR:H/UI:R/S:C/C:N/I:L/A:Hsecondary · FSTEC (BDU) RU

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-754USprimaryCWE-440USCWE-754US

affected products (144)

Products and version ranges known to be affected.

Avaya Aura Communication Managerall versionscert_bundDEcpe:/a:avaya:communication_manager:-
Avaya Aura Session Managerall versionscert_bundDEcpe:/a:avaya:session_manager:-
Avaya Aura System Managerall versionscert_bundDEcpe:/a:avaya:aura_system_manager:-
Avaya Media Gatewayall versionscert_bundDEcpe:/h:avaya:media_gateway:-
Avaya Web License Managerall versionscert_bundDEcpe:/a:avaya:web_license_manager:-
Citrix Systems XenServerall versionscert_bundDEcpe:/a:citrix:xenserver:-
Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
Dell Computerall versionscert_bundDEcpe:/o:dell:dell_computer:-
F5 BIG-IPall versionscert_bundDEcpe:/a:f5:big-ip:-
FreeBSD Project FreeBSD OSall versionscert_bundDEcpe:/o:freebsd:freebsd:-
HP BIOSall versionscert_bundDEcpe:/h:hp:bios:-
HPE ProLiantall versionscert_bundDEcpe:/h:hp:proliant:-
Intel AMT SDKall versionscert_bundDEcpe:/a:intel:active_management_technology_software_development_kit:-
Intel Prozessorall versionscert_bundDEcpe:/h:intel:intel_prozessor:-
Intel System Management Softwareall versionscert_bundDEcpe:/a:intel:system_management_software:-
Intel Xeonall versionscert_bundDEcpe:/h:intel:xeon:-
Juniper Junos Space <20.1R1all versionscert_bundDE
NetApp Data ONTAPall versionscert_bundDEcpe:/a:netapp:data_ontap:-
NetApp FASall versionscert_bundDEcpe:/h:netapp:fas:-
Open Source Arch Linuxall versionscert_bundDEcpe:/o:archlinux:archlinux:-

showing 20 of 144

advisories (3)

Vendor and ecosystem advisories describing this.

RHEA-2019:3845Red Hat Enhancement Advisory: microcode_ctl bug fix and enhancement update2019-11-12csaf · redhat_csafUS
An update for microcode_ctl is now available for Red Hat Enterprise Linux 8.
RHEA-2020:0635Red Hat Enhancement Advisory: microcode_ctl bug fix and enhancement update2020-02-27csaf · redhat_csafUS
An update for microcode_ctl is now available for Red Hat Enterprise Linux 8.
WID-SEC-W-2023-1689Intel Prozessoren: Mehrere SchwachstellenDeutsch2019-11-12csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Intel Prozessoren ausnutzen, um seine Privilegien zu erhöhen, einen Denial of Service Angriff durchzuführen oder vertrauliche Daten einzusehen.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund redhat_csaf NVD CVE.org MITRE

published 2019-11-14modified 2026-06-17

related (782)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2025-39682US	critical9.8OT critical	3.25% (88th)	KEV	2025-09-05
In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contig…
CVE-2024-3393US	high7.5OT critical	29.1% (98th)	KEV	2024-12-27
A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data p…
CVE-2023-41993US	high8.8OT critical	24.3% (98th)	KEV	2023-09-21
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that t…
CVE-2023-41992US	high7.8OT critical	9.52% (95th)	KEV	2023-09-21
The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7, iOS 16.7 and iPadOS 16.7, macOS Ventura 13.6. A local attacker may be able to elevate thei…
CVE-2021-3560US	high7.8OT critical	23.7% (98th)	KEV	2022-02-16
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be us…

+777 more

references (45)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan