CVE catalog

CVE-2019-14877

newlib: CVE-2019-14877

Severity: Medium
Published: Mar 19, 2020, 4:15:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 1.29% · Oct 25, 2026

In the __mdiff function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate big integers, however no check is performed to verify if the allocation succeeded or not. The access to _wds and _sign will trigger a null pointer dereference bug in case of a memory allocation failure.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	newlib	sid	`4.6.0.20260123-2`	fixed
Debian	newlib	forky	`4.6.0.20260123-2`	fixed
Debian	newlib	trixie	`4.5.0.20241231-1`	fixed
Debian	newlib	bookworm	`3.3.0-1.3+deb12u1`	fixed
Debian	picolibc	sid	`1.8.12-1`	fixed
Debian	picolibc	forky	`1.8.12-1`	fixed
Debian	picolibc	trixie	`1.8.10-2`	fixed
Debian	picolibc	bookworm	`1.8-1`	fixed
Ubuntu	newlib	16.04	`2.1.0+git20141201.db59ff3-2`	vulnerable
Ubuntu	newlib	16.04	`2.2.0+git20150830.5a3d536-1`	vulnerable
Ubuntu	newlib	18.04	`2.4.0.20160527-2`	vulnerable
Ubuntu	newlib	18.04	`2.4.0.20160527-3`	vulnerable
Ubuntu	newlib	18.04	`2.4.0.20160527-3ubuntu0.1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	newlib	source	sid	`3.3.0-1`	not yet assigned	Not reported	Not reported
Debian	newlib	source	forky	`3.3.0-1`	not yet assigned	Not reported	Not reported
Debian	newlib	source	trixie	`3.3.0-1`	not yet assigned	Not reported	Not reported
Debian	newlib	source	bookworm	`3.3.0-1`	not yet assigned	Not reported	Not reported
Debian	picolibc	source	sid	`1.4.3-1`	not yet assigned	Not reported	Not reported
Debian	picolibc	source	forky	`1.4.3-1`	not yet assigned	Not reported	Not reported
Debian	picolibc	source	trixie	`1.4.3-1`	not yet assigned	Not reported	Not reported
Debian	picolibc	source	bookworm	`1.4.3-1`	not yet assigned	Not reported	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libnewlib-arm-none-eabi]Fixed
Source package: [newlib]
Details (2)
- 3.3.0-1.3+deb12u1 · all · bookworm
  Fixed · Fixed: 3.3.0-1
  dsa · newlib · debian · bookworm; dsa · newlib · debian · 12
- 3.3.0-1.3+deb12u1 · all · bookworm
  Fixed · Fixed: 3.3.0-1
  dsa · newlib · debian · bookworm; dsa · newlib · debian · 12
[libnewlib-dev]Fixed
Source package: [newlib]
Details (2)
- 3.3.0-1.3+deb12u1 · all · bookworm
  Fixed · Fixed: 3.3.0-1
  dsa · newlib · debian · bookworm; dsa · newlib · debian · 12
- 3.3.0-1.3+deb12u1 · all · bookworm
  Fixed · Fixed: 3.3.0-1
  dsa · newlib · debian · bookworm; dsa · newlib · debian · 12
[libnewlib-doc]Fixed
Source package: [newlib]
Details (2)
- 3.3.0-1.3+deb12u1 · all · bookworm
  Fixed · Fixed: 3.3.0-1
  dsa · newlib · debian · bookworm; dsa · newlib · debian · 12
- 3.3.0-1.3+deb12u1 · all · bookworm
  Fixed · Fixed: 3.3.0-1
  dsa · newlib · debian · bookworm; dsa · newlib · debian · 12
[newlib-source]Fixed
Source package: [newlib]
Details (2)
- 3.3.0-1.3+deb12u1 · all · bookworm
  Fixed · Fixed: 3.3.0-1
  dsa · newlib · debian · bookworm; dsa · newlib · debian · 12
- 3.3.0-1.3+deb12u1 · all · bookworm
  Fixed · Fixed: 3.3.0-1
  dsa · newlib · debian · bookworm; dsa · newlib · debian · 12
[picolibc-aarch64-linux-gnu]Fixed
Source package: [picolibc]
Details (2)
- 1.8-1 · all · bookworm
  Fixed · Fixed: 1.4.3-1
  dsa · picolibc · debian · bookworm; dsa · picolibc · debian · 12
- 1.8-1 · all · bookworm
  Fixed · Fixed: 1.4.3-1
  dsa · picolibc · debian · bookworm; dsa · picolibc · debian · 12
[picolibc-arm-none-eabi]Fixed
Source package: [picolibc]
Details (2)
- 1.8-1 · all · bookworm
  Fixed · Fixed: 1.4.3-1
  dsa · picolibc · debian · bookworm; dsa · picolibc · debian · 12
- 1.8-1 · all · bookworm
  Fixed · Fixed: 1.4.3-1
  dsa · picolibc · debian · bookworm; dsa · picolibc · debian · 12
[picolibc-riscv64-unknown-elf]Fixed
Source package: [picolibc]
Details (2)
- 1.8-1 · all · bookworm
  Fixed · Fixed: 1.4.3-1
  dsa · picolibc · debian · bookworm; dsa · picolibc · debian · 12
- 1.8-1 · all · bookworm
  Fixed · Fixed: 1.4.3-1
  dsa · picolibc · debian · bookworm; dsa · picolibc · debian · 12
[picolibc-xtensa-lx106-elf]Fixed
Source package: [picolibc]
Details (2)
- 1.8-1 · all · bookworm
  Fixed · Fixed: 1.4.3-1
  dsa · picolibc · debian · bookworm; dsa · picolibc · debian · 12
- 1.8-1 · all · bookworm
  Fixed · Fixed: 1.4.3-1
  dsa · picolibc · debian · bookworm; dsa · picolibc · debian · 12

[Debian 13 (Trixie)]

[libnewlib-arm-none-eabi]Fixed
Source package: [newlib]
Details (2)
- 4.5.0.20241231-1 · all · trixie
  Fixed · Fixed: 3.3.0-1
  dsa · newlib · debian · 13
- 4.5.0.20241231-1 · all · trixie
  Fixed · Fixed: 3.3.0-1
  dsa · newlib · debian · 13
[libnewlib-dev]Fixed
Source package: [newlib]
Details (2)
- 4.5.0.20241231-1 · all · trixie
  Fixed · Fixed: 3.3.0-1
  dsa · newlib · debian · 13
- 4.5.0.20241231-1 · all · trixie
  Fixed · Fixed: 3.3.0-1
  dsa · newlib · debian · 13
[libnewlib-doc]Fixed
Source package: [newlib]
Details (2)
- 4.5.0.20241231-1 · all · trixie
  Fixed · Fixed: 3.3.0-1
  dsa · newlib · debian · 13
- 4.5.0.20241231-1 · all · trixie
  Fixed · Fixed: 3.3.0-1
  dsa · newlib · debian · 13
[newlib-source]Fixed
Source package: [newlib]
Details (2)
- 4.5.0.20241231-1 · all · trixie
  Fixed · Fixed: 3.3.0-1
  dsa · newlib · debian · 13
- 4.5.0.20241231-1 · all · trixie
  Fixed · Fixed: 3.3.0-1
  dsa · newlib · debian · 13
[picolibc-aarch64-linux-gnu]Fixed
Source package: [picolibc]
Details (2)
- 1.8.10-2 · all · trixie
  Fixed · Fixed: 1.4.3-1
  dsa · picolibc · debian · 13
- 1.8.10-2 · all · trixie
  Fixed · Fixed: 1.4.3-1
  dsa · picolibc · debian · 13
[picolibc-arm-none-eabi]Fixed
Source package: [picolibc]
Details (2)
- 1.8.10-2 · all · trixie
  Fixed · Fixed: 1.4.3-1
  dsa · picolibc · debian · 13
- 1.8.10-2 · all · trixie
  Fixed · Fixed: 1.4.3-1
  dsa · picolibc · debian · 13
[picolibc-riscv64-unknown-elf]Fixed
Source package: [picolibc]
Details (2)
- 1.8.10-2 · all · trixie
  Fixed · Fixed: 1.4.3-1
  dsa · picolibc · debian · 13
- 1.8.10-2 · all · trixie
  Fixed · Fixed: 1.4.3-1
  dsa · picolibc · debian · 13
[picolibc-xtensa-lx106-elf]Fixed
Source package: [picolibc]
Details (2)
- 1.8.10-2 · all · trixie
  Fixed · Fixed: 1.4.3-1
  dsa · picolibc · debian · 13
- 1.8.10-2 · all · trixie
  Fixed · Fixed: 1.4.3-1
  dsa · picolibc · debian · 13

Observed: Oct 23, 2026, 5:40:26 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]