{"id":"CVE-2019-14697","aliases":["ALPINE-CVE-2019-14697","BELL-CVE-2019-14697","DEBIAN-CVE-2019-14697","EUVD-2019-5847","GHSA-x5qg-pw5v-r37v","UBUNTU-CVE-2019-14697","USN-5990-1","openSUSE-SU-2024:10761-1"],"status":"published","title":"musl libc through 1.1.23 has an x87 floating-point stack adjustment imbalance, related to the...","description":"musl libc through 1.1.23 has an x87 floating-point stack adjustment imbalance, related to the math/i386/ directory. In some cases, use of this library could introduce out-of-bounds writes that are not present in an application's source code.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02527,"percentile":0.85001,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2019-08-06T15:34:50Z","modified":"2026-09-21T07:01:52Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"musl","fixed_in":["1.1.22-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"musl","fixed_in":["1.1.23-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"musl","fixed_in":["1.1.23-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"musl","fixed_in":["1.1.23-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"musl","fixed_in":["1.1.23-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"musl","fixed_in":["1.1.23-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"musl","fixed_in":["1.1.23-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"musl","fixed_in":["1.1.23-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"musl","fixed_in":["1.1.23-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"musl","fixed_in":["1.1.23-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"musl","fixed_in":["1.1.23-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"musl","fixed_in":["1.1.23-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"musl","fixed_in":["1.1.23-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"musl","fixed_in":["1.1.23-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"musl","fixed_in":["1.1.23-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"musl","fixed_in":["1.1.18-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"musl","fixed_in":["1.1.19-r11"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"musl","fixed_in":["1.1.20-r5"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"musl","fixed_in":["1.1.23-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"musl","fixed_in":["1.1.23-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"musl","fixed_in":["1.1.23-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"musl","fixed_in":["0.9.15-1ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"musl","fixed_in":["1.1.9-1ubuntu0.1~esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"musl","fixed_in":["1.1.19-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.12"},{"fixed":"1.1.22-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.12"},{"fixed":"1.1.23-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.12"},{"fixed":"1.1.23-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.12"},{"fixed":"1.1.23-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.12"},{"fixed":"1.1.23-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.12"},{"fixed":"1.1.23-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.12"},{"fixed":"1.1.23-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.12"},{"fixed":"1.1.23-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.12"},{"fixed":"1.1.23-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.12"},{"fixed":"1.1.23-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.12"},{"fixed":"1.1.23-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.12"},{"fixed":"1.1.23-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.12"},{"fixed":"1.1.23-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.12"},{"fixed":"1.1.23-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.12"},{"fixed":"1.1.23-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.12"},{"fixed":"1.1.18-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.12"},{"fixed":"1.1.19-r11"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.12"},{"fixed":"1.1.20-r5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.23-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.23-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.23-2"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.15-1ubuntu0.1~esm2"}]}],"versions":["0.9.14-2","0.9.14-2ubuntu1","0.9.15-1","0.9.15-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.9-1ubuntu0.1~esm3"}]}],"versions":["1.1.9-1","1.1.9-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.19-1ubuntu0.1~esm1"}]}],"versions":["1.1.16-3","1.1.18-1","1.1.19-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.15-1ubuntu0.1~esm2"}]}],"versions":["0.9.14-2","0.9.14-2ubuntu1","0.9.15-1","0.9.15-1ubuntu0.1~esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.9-1ubuntu0.1~esm3"}]}],"versions":["1.1.9-1","1.1.9-1ubuntu0.1~esm2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.19-1ubuntu0.1~esm1"}]}],"versions":["1.1.16-3","1.1.18-1","1.1.19-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.24-1ubuntu0.1~esm1"}]}],"versions":["1.1.23-2build1","1.1.24-1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"flannel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.0-1.2"}]}],"bundled":4}],"products":[{"vendor":"musl-libc","product":"musl"}],"references":[{"url":"https://www.openwall.com/lists/musl/2019/08/06/1","tags":["x_refsource_MISC","x_transferred","Exploit","Mailing List","Patch","Third Party Advisory","fix","report"]},{"url":"http://www.openwall.com/lists/oss-security/2019/08/06/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","Mailing List","Patch","Third Party Advisory","fix","report"]},{"url":"https://security.gentoo.org/glsa/202003-13","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-14697"},{"url":"https://github.com/advisories/GHSA-x5qg-pw5v-r37v"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-14697","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-14697","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-14697","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-14697","tags":["report"]},{"url":"https://git.musl-libc.org/cgit/musl/patch/?id=f3ed8bfe8a82af1870ddc8696ed4cc1d5aa6b441","tags":["report"]},{"url":"https://git.musl-libc.org/cgit/musl/patch/?id=6818c31c9bc4bbad5357f1de14bedf781e5b349e","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2019/08/06/1","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5990-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-14697","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-28928","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14697","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-14697","description":"musl libc through 1.1.23 has an x87 floating-point stack adjustment imbalance, related to the math/i386/ directory. In some cases, use of this library could introduce out-of-bounds writes that are not present in an application's source code.","status":"published","published":"2019-08-06T15:34:50Z","modified":"2024-08-05T00:26:37.471Z","updated_at":"2026-11-02T14:20:17.722148Z"}],"euvd":[{"id":"EUVD-2019-5847","description":"musl libc through 1.1.23 has an x87 floating-point stack adjustment imbalance, related to the math/i386/ directory. In some cases, use of this library could introduce out-of-bounds writes that are not present in an application's source code.","status":"published","published":"2019-08-06T15:34:50Z","modified":"2024-08-05T00:26:37Z","updated_at":"2026-11-03T02:40:38.622868Z"}],"ghsa":[{"id":"GHSA-x5qg-pw5v-r37v","title":"musl libc through 1.1.23 has an x87 floating-point stack adjustment imbalance, related to the...","description":"musl libc through 1.1.23 has an x87 floating-point stack adjustment imbalance, related to the math/i386/ directory. In some cases, use of this library could introduce out-of-bounds writes that are not present in an application's source code.","status":"published","published":"2022-05-24T16:52:40Z","modified":"2023-03-11T05:06:27Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:54:19.253359Z"}],"nvd":[{"id":"CVE-2019-14697","description":"musl libc through 1.1.23 has an x87 floating-point stack adjustment imbalance, related to the math/i386/ directory. In some cases, use of this library could introduce out-of-bounds writes that are not present in an application's source code.","status":"published","published":"2019-08-06T16:15:11.72Z","modified":"2026-06-17T02:18:50.25Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:05:21.892729Z"}],"osv":[{"id":"ALPINE-CVE-2019-14697","description":"musl libc through 1.1.23 has an x87 floating-point stack adjustment imbalance, related to the math/i386/ directory. In some cases, use of this library could introduce out-of-bounds writes that are not present in an application's source code.","status":"published","published":"2019-08-06T16:15:11.72Z","modified":"2026-09-21T06:17:52.484507415Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:47.663013Z"},{"id":"BELL-CVE-2019-14697","title":"CVE-2019-14697 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:41.946681Z","modified":"2026-01-26T09:46:51.508581Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-14697","description":"musl libc through 1.1.23 has an x87 floating-point stack adjustment imbalance, related to the math/i386/ directory. In some cases, use of this library could introduce out-of-bounds writes that are not present in an application's source code.","status":"published","published":"2019-08-06T16:15:11.72Z","modified":"2026-03-15T14:33:31.117285Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:11.029493Z"},{"id":"DEBIAN-CVE-2019-14697","description":"musl libc through 1.1.23 has an x87 floating-point stack adjustment imbalance, related to the math/i386/ directory. In some cases, use of this library could introduce out-of-bounds writes that are not present in an application's source code.","status":"published","published":"2019-08-06T16:15:11.72Z","modified":"2026-09-21T07:01:52.565070318Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"UBUNTU-CVE-2019-14697","description":"musl libc through 1.1.23 has an x87 floating-point stack adjustment imbalance, related to the math/i386/ directory. In some cases, use of this library could introduce out-of-bounds writes that are not present in an application's source code.","status":"published","published":"2019-08-06T16:15:00Z","modified":"2026-04-22T12:11:20.657291Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:19.6877Z"},{"id":"openSUSE-SU-2024:10761-1","title":"flannel-0.14.0-1.2 on GA media","description":"These are all security issues fixed in the flannel-0.14.0-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:25:39.06643Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"USN-5990-1","title":"musl vulnerabilities","description":"It was discovered that musl did not handle certain i386 math functions\nproperly. An attacker could use this vulnerability to cause a denial of\nservice (crash) or possibly execute arbitrary code. This issue only\naffected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, and Ubuntu 18.04 LTS.\n(CVE-2019-14697)\n\nIt was discovered that musl did not handle wide-character conversion\nproperly. A remote attacker could use this vulnerability to cause resource\nconsumption (infinite loop), denial of service, or possibly execute\narbitrary code. This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04\nESM, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2020-28928)\n","status":"published","published":"2023-03-31T00:44:58Z","modified":"2026-06-29T13:50:51.044714834Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}