Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2019-14877: Newlib Library Allocates Memory Without Checking for Failure
CVE-2019-14877 · published 6 years ago
Summary
The newlib library's memory allocation for big integers can fail, leading to a crash. This affects systems using affected versions of the library, potentially causing them to stop working. Update to newlib 3.3.0 or later to fix this issue.
What to do
- Update debian picolibc to version 1.4.3-1.
- Update debian newlib to version 3.3.0-1.
- Update newlib_project newlib to version 3.3.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:14 | debian | picolibc |
< 1.4.3-1 Fix: upgrade to 1.4.3-1
|
| Debian:11 | debian | newlib |
< 3.3.0-1 Fix: upgrade to 3.3.0-1
|
| Debian:12 | debian | newlib |
< 3.3.0-1 Fix: upgrade to 3.3.0-1
|
| Debian:13 | debian | newlib |
< 3.3.0-1 Fix: upgrade to 3.3.0-1
|
| Debian:14 | debian | newlib |
< 3.3.0-1 Fix: upgrade to 3.3.0-1
|
| Debian:11 | debian | picolibc |
< 1.4.3-1 Fix: upgrade to 1.4.3-1
|
| Debian:12 | debian | picolibc |
< 1.4.3-1 Fix: upgrade to 1.4.3-1
|
| Debian:13 | debian | picolibc |
< 1.4.3-1 Fix: upgrade to 1.4.3-1
|
| – | newlib_project | newlib |
< 3.3.0 cpe:2.3:a:newlib_project:newlib:*:*:*:*:*:*:*:* |
Original advisory text
In the __mdiff function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate big integers, however no check is performed to verify if...
In the __mdiff function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate big integers, however no check is performed to verify if the allocation succeeded or not. The access to _wds and _sign will trigger a null pointer dereference bug in case of a memory allocation failure.
References
- https://security-tracker.debian.org/tracker/CVE-2019-14877 Vendor Advisory
- https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulner... Exploit Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-476NULL Pointer Dereference
Timeline
Published19 Mar 2020
Updated4 Nov 2026
First seen19 Apr 2026
Track software like this
Free during beta