musl libc through 1.1.23 has an x87 floating-point stack adjustment imbalance, related to the math/i386/ directory. In some cases, use of this library could introduce out-of-bounds writes that are not present in an application's source code.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - musl libc through 1.1.23 has an x87 floating-point stack adjustment imbalance, related to the math/i386/
    directory. In some cases, use of this library could introduce out-of-bounds writes that are not present in
    an application's source code. (CVE-2019-14697)

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5990-1 advisory.

    It was discovered that musl did not handle certain i386 math functions properly. An attacker could use     this vulnerability to cause a denial of service (crash) or possibly execute arbitrary code. This issue     only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, and Ubuntu 18.04 LTS. (CVE-2019-14697)

    It was discovered that musl did not handle wide-character conversion properly. A remote attacker could use     this vulnerability to cause resource consumption (infinite loop), denial of service, or possibly execute     arbitrary code. This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, Ubuntu 18.04 LTS, and Ubuntu     20.04 LTS. (CVE-2020-28928)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202003-13 (musl: x87 floating-point stack adjustment imbalance)

    A flaw in musl libc&rsquo;s arch-specific math assembly code for i386 was       found which can lead to x87 stack overflow in the execution of subsequent       math code.
  Impact :

    Impact depends on how the application built against musl libc handles       the ABI-violating x87 state.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
424170	Alpine: multiple musl packages: security update to 1.1.23-r2	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
424170	Alpine: multiple musl packages: security update to 1.1.23-r2	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
405671	Alpine: musl: security update to 1.1.22-r3	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
405671	Alpine: musl: security update to 1.1.22-r3	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
405669	Alpine: musl: security update to 1.1.20-r5	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
405669	Alpine: musl: security update to 1.1.20-r5	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
405668	Alpine: musl: security update to 1.1.19-r11	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
405668	Alpine: musl: security update to 1.1.19-r11	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
405667	Alpine: musl: security update to 1.1.18-r4	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
405667	Alpine: musl: security update to 1.1.18-r4	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
173730	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM : musl vulnerabilities (USN-5990-1)	Nessus	Ubuntu Local Security Checks	critical
134590	GLSA-202003-13 : musl: x87 floating-point stack adjustment imbalance	Nessus	Gentoo Local Security Checks	critical

Detections

Analytics

CVE-2019-14697

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical