VDB
CVE-2019-14871
CVE-2019-14871
PUBLISHED
CVSS 6.5 MEDIUM
The REENT_CHECK macro (see newlib/libc/include/sys/reent.h) as used by REENT_CHECK_TM, REENT_CHECK_MISC, REENT_CHECK_MP and other newlib macros in versions prior to 3.3.0, does not check for memory allocation problems when the DEBUG flag is unset (as is the case in production firmware builds).
EPSS 1.01% · 60.7th percentile
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS Score
1.01%
60.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:16.04:LTS | newlib | 2.1.0+git20141201.db59ff3-2, *, 0 |
| Ubuntu:18.04:LTS | newlib | 0, 2.4.0.20160527-2, 2.4.0.20160527-3 |
Timeline
- Mar 18, 2020 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 25, 2021 EPSS Score
- Dec 28, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Mar 1, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- May 3, 2022 EPSS Score
- Sep 6, 2022 EPSS Score
- Nov 8, 2022 EPSS Score
References
- https://ubuntu.com/security/CVE-2019-14871 third-party-advisory
- https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/ third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2019-14871 third-party-advisory