PT-2020-9613 · Unknown · Newlib Libc

Dimitrios Glynos · Published 2020-03-19 · Updated 2020-03-24 · CVE-2019-14874

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions newlib libc library versions prior to 3.3.0

Description The issue arises in the i2b function of the newlib libc library, where memory allocation using Balloc does not include a check for allocation success. This oversight can lead to a null pointer dereference bug if memory allocation fails, specifically when accessing x[0].

Recommendations For versions prior to 3.3.0, update to version 3.3.0 or later to resolve the issue.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2019-14874

Affected Products

Newlib Libc

References · 8

• 🔥 https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-14874 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-14874 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-14874 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-14874 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-14874 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-14874 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-14874 · Security Note