CVE-2019-14871: The REENT_CHECK macro (see newlib/libc/include/sys/reent.h) as used by REENT_CHECK_TM, REENT_CHECK_MISC, REENT_CHECK_MP and other newlib macros in versions…

PriorityP430medium6.5CVSS 3.1

AVNACLPRLUINSUCNINAH

EPSS

1.01%

59.5th percentile

The REENT_CHECK macro (see newlib/libc/include/sys/reent.h) as used by REENT_CHECK_TM, REENT_CHECK_MISC, REENT_CHECK_MP and other newlib macros in versions prior to 3.3.0, does not check for memory allocation problems when the DEBUG flag is unset (as is the case in production firmware builds).

Affected

8 ranges

Vendor	Product	Version range	Fixed in
debian	newlib	< newlib 3.3.0-1 (bookworm)	newlib 3.3.0-1 (bookworm)
debian	picolibc	< newlib 3.3.0-1 (bookworm)	newlib 3.3.0-1 (bookworm)
newlib_project	newlib	< 3.3.0	3.3.0
newlib_project	newlib	>= 0 < 3.3.0-1	3.3.0-1
newlib_project	newlib	>= 0 < 3.3.0-1	3.3.0-1
newlib_project	newlib	>= 0 < 3.3.0-1	3.3.0-1
newlib_project	newlib	>= 0 < 3.3.0-1	3.3.0-1
red_hat	newlib	—	—

CVSS provenance

nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:N/A:P

osv6.5MEDIUM

vendor_debian6.5MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.