GCVE - cpe:2.3:a:newlib_project:newlib:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:newlib_project:newlib:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Newlib Project (`c31a842d-dcdb-5143-876a-4c3f3be8780d`)
Product	Newlib (`8abeb0a3-614e-51c7-8baa-3860ffcdf9e6`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:bitbucket/elenagit/newlib`	purl2cpe	2026-06-01 10:15:05.885743
`pkg:deb/debian/newlib`	purl2cpe	2026-06-01 10:15:05.885746
`pkg:deb/ubuntu/newlib`	purl2cpe	2026-06-01 10:15:05.885749
`pkg:github/bminor/newlib`	purl2cpe	2026-06-01 10:15:05.885752
`pkg:github/mirror/newlib-cygwin`	purl2cpe	2026-06-01 10:15:05.885754
`pkg:rpm/opensuse/newlib`	purl2cpe	2026-06-01 10:15:05.885757

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2021-3420`	vulnerable	2026-06-08 05:33:51.296926	Details available A flaw was found in newlib in versions prior to 4.0.0. Improper overflow validation in the memory allocation functions mEMALIGn, pvALLOc, nano_memalign, nano_valloc, nano_pvalloc could case an integer overflow, leading to an allocation of a small buffer and then to a heap-based buffer overflow. Published: 2021-03-05T19:19:28.000Z Updated: 2024-08-03T16:53:17.747Z Open on db.gcve.eu Reference links https://bugzilla.redhat.com/show_bug.cgi?id=1934088 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEBF6YHWFNCBW5A2ENSQ3Z56ELF4MTRE/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSQZEUANAWBBAOC4TF5PTPJVLMUR7SFD/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AMK54N6UOPBFFX2YT32TWSAEFTHGSKAA/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-14878`	vulnerable	2026-06-08 05:12:56.329573	Details available MEDIUM (6.5) In the __d2b function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate a big integer, however no check is performed to verify if the allocation succeeded or not. Accessing _x will trigger a null pointer dereference bug in case of a memory allocation failure. Published: 2020-03-19T15:04:19.000Z Updated: 2024-08-05T00:26:39.162Z Open on db.gcve.eu Reference links https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-14877`	vulnerable	2026-06-08 05:12:56.329145	Details available MEDIUM (6.5) In the __mdiff function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate big integers, however no check is performed to verify if the allocation succeeded or not. The access to _wds and _sign will trigger a null pointer dereference bug in case of a memory allocation failure. Published: 2020-03-19T15:04:15.000Z Updated: 2024-08-05T00:26:39.121Z Open on db.gcve.eu Reference links https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-14876`	vulnerable	2026-06-08 05:12:56.328840	Details available MEDIUM (6.5) In the __lshift function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate a big integer, however no check is performed to verify if the allocation succeeded or not. The access to b1 will trigger a null pointer dereference bug in case of a memory allocation failure. Published: 2020-03-19T15:08:25.000Z Updated: 2024-08-05T00:26:39.129Z Open on db.gcve.eu Reference links https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-14875`	vulnerable	2026-06-08 05:12:56.328536	Details available MEDIUM (6.5) In the __multiply function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate a big integer, however no check is performed to verify if the allocation succeeded or not. The access of _x[0] will trigger a null pointer dereference bug in case of a memory allocation failure. Published: 2020-03-19T15:08:12.000Z Updated: 2024-08-05T00:26:39.202Z Open on db.gcve.eu Reference links https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-14874`	vulnerable	2026-06-08 05:12:56.328228	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-14873`	vulnerable	2026-06-08 05:12:56.327896	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-14872`	vulnerable	2026-06-08 05:12:56.327557	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-14871`	vulnerable	2026-06-08 05:12:56.327128	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Newlib

Notes

PURL mappings

Vulnerability references

Contribute