Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2021-3420

critical

CVE-2021-3420

A flaw was found in newlib in versions prior to 4.0.0. Improper overfl ...

Published Modified CWE 190
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Ubuntu (medium).

Description

A flaw was found in newlib in versions prior to 4.0.0. Improper overflow validation in the memory allocation functions mEMALIGn, pvALLOc, nano_memalign, nano_valloc, nano_pvalloc could case an integer overflow, leading to an allocation of a small buffer and then to a heap-based buffer overflow.

Affected packages and fixed versions

SourcePackageFixed in
alpine 3.14newlib4.1.0-r0
alpine 3.15newlib4.1.0-r0
alpine 3.16newlib4.1.0-r0
alpine 3.17newlib4.1.0-r0
alpine 3.18newlib4.1.0-r0
alpine 3.19newlib4.1.0-r0
alpine 3.20newlib4.1.0-r0
alpine 3.21newlib4.1.0-r0
alpine 3.22newlib4.1.0-r0
alpine 3.23newlib4.1.0-r0
alpine 3.24newlib4.1.0-r0
alpine edgenewlib4.1.0-r0
Show all 29 entries from 23 sources
SourcePackageFixed in
alpine 3.14newlib4.1.0-r0
alpine 3.15newlib4.1.0-r0
alpine 3.16newlib4.1.0-r0
alpine 3.17newlib4.1.0-r0
alpine 3.18newlib4.1.0-r0
alpine 3.19newlib4.1.0-r0
alpine 3.20newlib4.1.0-r0
alpine 3.21newlib4.1.0-r0
alpine 3.22newlib4.1.0-r0
alpine 3.23newlib4.1.0-r0
alpine 3.24newlib4.1.0-r0
alpine edgenewlib4.1.0-r0
debian 10libnewlib-nanono fix listed
debian 10newlibno fix listed
debian 11newlibno fix listed
debian 11picolibc1.5-1
debian 12newlib3.3.0-1.3+deb12u1
debian 12picolibc1.5-1
debian 13newlib4.4.0.20231231-2
debian 13picolibc1.5-1
debian 14newlib4.4.0.20231231-2
debian 14picolibc1.5-1
debian 9newlibno fix listed
echonewlib3.3.0-1.3+deb12u1
echopicolibc1.5-1
ubuntu 18.04-ESMnewlibno fix listed
ubuntu 20.04-ESMnewlibno fix listed
ubuntu 22.04newlibno fix listed
ubuntu 24.04newlibno fix listed

References

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.