Bugzilla – Bug 1162457
VUL-1: CVE-2019-14876: newlib: __lshift null pointer dereference bug
Last modified: 2023-03-08 12:23:31 UTC
__lshift null pointer dereference bug (CVE-2019-14876)
In the __lshift function of the newlib libc library (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate a big integer, however no check is performed to verify if the allocation succeeded or not:
We meanwhile have newlib 4.1.0 and never shipped newlib on any SLE product.