Lucene search

RedhatCVE-2019-14872

HistoryMar 19, 2020 - 1:15 p.m.

CVE-2019-14872

2020-03-1913:15:12

CWE-476

redhat

web.nvd.nist.gov

cve-2019-14872

newlib libc

memory allocation

security vulnerability

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

44.7%

JSON

The _dtoa_r function of the newlib libc library, prior to version 3.3.0, performs multiple memory allocations without checking their return value. This could result in NULL pointer dereference.

Affected configurations

Nvd

Vulners

Node

newlib_projectnewlibRange<3.3.0

VendorProductVersionCPE
newlib_projectnewlib*cpe:2.3:a:newlib_project:newlib:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
newlib_project	newlib	*	cpe:2.3:a:newlib_project:newlib::::::::

CNA Affected

[
  {
    "product": "newlib",
    "vendor": "Red Hat",
    "versions": [
      {
        "status": "affected",
        "version": "all newlib versions prior to 3.3.0"
      }
    ]
  }
]

References

census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

44.7%

JSON

Related for CVE-2019-14872