CVE-2019-14876
Quick assessment
Affected
Red Hat newlib
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Red Hat newlib libc是美国红帽（Red Hat）公司的一款主要用于嵌入式系统的C语言库。 Red Hat newlib libc library 3.3.0之前版本中的‘__lshift()’函数存在代码问题漏洞，该漏洞源于网络系统或产品的代码开发过程中存在设计或实现不当的问题。
Possible ATT&CK Techniques 1 AI
T1068 · Exploitation for Privilege Escalation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2019-14876
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
In the __lshift function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate a big integer, however no check is performed to verify if the allocation succeeded or not. The access to b1 will trigger a null pointer dereference bug in case of a memory allocation failure.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
空指针解引用
Source: CVE Program / CVE List V5
Vulnerability Title
Red Hat newlib libc library 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Red Hat newlib libc是美国红帽（Red Hat）公司的一款主要用于嵌入式系统的C语言库。 Red Hat newlib libc library 3.3.0之前版本中的‘__lshift()’函数存在代码问题漏洞，该漏洞源于网络系统或产品的代码开发过程中存在设计或实现不当的问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2019-14876
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2019-14876
请登录查看更多情报信息。
Other References for CVE-2019-14876 (1)
Same Patch Batch · Red Hat · 2020-03-19 · 9 CVEs total
| CVE-2020-1705 | 7.0 HIGH | Red Hat OpenShift 安全漏洞 |
| CVE-2019-14872 | Red Hat newlib libc library 代码问题漏洞 | |
| CVE-2019-19336 | oVirt-engine‘s OAuth authorization endpoint 跨站脚本漏洞 | |
| CVE-2019-14873 | Red Hat newlib libc library 代码问题漏洞 | |
| CVE-2019-14877 | Red Hat newlib libc library 代码问题漏洞 | |
| CVE-2019-14878 | Red Hat newlib libc library 代码问题漏洞 | |
| CVE-2019-14874 | Red Hat newlib libc library 代码问题漏洞 | |
| CVE-2019-14875 | Red Hat newlib libc library 代码问题漏洞 |
IV. Related Vulnerabilities
Same vendor: Red Hat
-
CVE-2026-17113
Cri-o: cri-o: unvalidated image env var causes daemon crash -
CVE-2026-78475
Gimp: unbounded stack vla and 21-byte stack over-read in pix -
CVE-2026-78465
Gimp: integer overflow in pcx loader (planes=4) leads to hea -
CVE-2026-19685
Networkmanager: networkmanager: 802-1x ca-path and phase2-ca -
CVE-2026-71366
Awx: notification backends allow ssrf and credential leakage
Same weakness: CWE-476
-
CVE-2026-13213
Bluetooth HAS: NULL-pointer dereference DoS when a bonded pe -
CVE-2026-71922
DrayTek VigorSwitch Multiple Models Pre-Authentication NULL -
CVE-2026-71920
DrayTek VigorSwitch Multiple Models NULL Pointer Dereference -
CVE-2026-78148
ggml-org llama.cpp ggml-RPC Server ggml-rpc.cpp graph_comput -
CVE-2026-76905
kin-openapi openai3filter: nil-pointer panic in ConvertError
V. Comments for CVE-2019-14876
No comments yet