CVE-2019-14697: musl-libc musl Out-of-bounds Write
Vulnerability summary
CVE-2019-14697 is a critical (CVSS 9.8) Out-of-bounds Write vulnerability in musl-libc musl. EPSS estimates a 2.53% chance of exploitation in the next 30 days, higher than 84.7% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 06-08-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
musl libc through 1.1.23 has an x87 floating-point stack adjustment imbalance, related to the math/i386/ directory. In some cases, use of this library could introduce out-of-bounds writes that are not present in an application's source code.
CVSS metrics
6 scores · 4 sources · 3 versions- OSV · AlpineEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
2.53%
Chance of exploitation in the next 30 days
Percentile
85%
Versus all other CVEs
30-day change
0.00 pp
From 2.53% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (openwall.com)
Maturity: unknown
Exploit Reference (openwall.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- musl≥ 0.9.12, < 1.1.22-r3 | ≥ 0.9.12, < 1.1.23-r2 | ≥ 0.9.12, < 1.1.18-r4 | ≥ 0.9.12, < 1.1.19-r11 | ≥ 0.9.12, < 1.1.20-r5
Debian1 product
- musl< 1.1.23-2
Musl-libc1 product
- musl≥ 0.9.12, ≤ 1.1.23
Ubuntu1 product
- musl< 0.9.15-1ubuntu0.1~esm2 | < 1.1.9-1ubuntu0.1~esm3 | < 1.1.19-1ubuntu0.1~esm1
4 vendors · 4 products
References
11 links- www.openwall.com/lists/musl/2019/08/06/1X Refsource MISCExploitMailing ListPatchThird Party AdvisoryREPORT
- www.openwall.com/lists/oss-security/2019/08/06/4Mailing ListX Refsource MLISTExploitPatchThird Party AdvisoryREPORT
