TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

In

eager

mode

(default

in

TF

and

later)

session

operations

are

invalid.

However

users

could

still

call

the

raw

ops

associated

with

them

and

trigger

a

pointer

dereference.

The

dereferences

the

session

state

pointer

without

checking

if

it

is

valid.

Thus

in

eager

mode

is

nullptr

and

the

call

of

the

member

function

is

undefined

behavior.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

An

attacker

can

trigger

a

pointer

dereference

by

providing

an

invalid

`permutation`

to

`tf.raw_ops.SparseMatrixSparseCholesky`.

This

is

because

the

fails

to

properly

validate

the

input

arguments.

Although

`ValidateInputs`

is

called

and

there

are

checks

in

the

body

of

this

function

the

code

proceeds

to

the

next

line

in

`ValidateInputs`

since

is

a

macro

that

only

exits

the

current

function.

Thus

the

first

validation

condition

that

fails

in

`ValidateInputs`

will

cause

an

early

return

from

that

function.

However

the

caller

will

continue

execution

from

the

next

line.

The

fix

is

to

either

explicitly

check

`context->status()`

or

to

convert

`ValidateInputs`

to

return

a

`Status`.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


** UNSUPPORTED WHEN ASSIGNED **Null Pointer Dereference vulnerability exists in D-Link DSP-W215 1.10 which could let a remote malicious user cause a denial of servie via usr/bin/lighttpd. It could be triggered by sending an HTTP request without URL in the start line directly to the device. NOTE: The DSP-W215 and all hardware revisions is considered End of Life and as such this issue will not be patched.


A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.26 handled component references in CDEF box in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened.


Unexpected

Pointer

Aliasing

in

IEEE

Fragment

Reassembly

in

Zephyr.

Zephyr

versions

contain

Pointer

Dereference

For

more

information

see


When using a sync_repl client in 389-ds-base an authenticated attacker can cause a NULL pointer dereference using a specially crafted query causing a crash.


A flaw null pointer dereference in the Nitro Enclaves kernel driver was found in the way that Enclaves VMs forces closures on the enclave file descriptor. A local user of a host machine could use this flaw to crash the system or escalate their privileges on the system.


Type

Confusion

in

ACK

Frames

Handling.

Zephyr

versions

contain

Pointer

Dereference

For

more

information

see


A NULL pointer dereference flaw was found in ImageMagick in versions prior to 7.0.10-31 in ReadSVGImage() in coders/svg.c. This issue is due to not checking the return value from libxml2's xmlCreatePushParserCtxt() and uses the value directly which leads to a crash and segmentation fault.


A flaw was found in slapi-nis in versions before 0.56.7. A NULL pointer dereference during the parsing of the Binding DN could allow an unauthenticated attacker to crash the 389-ds-base directory server. The highest threat from this vulnerability is to system availability.


Possible null pointer dereference due to lack of validation check for passed pointer during key import in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon IoT Snapdragon Voice & Music Snapdragon Wearables


Null pointer dereference occurs due to improper validation when the preemption feature enablement is toggled in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Wearables


Null Pointer Dereference may occur due to improper validation while processing crafted SDP body in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile


Null pointer dereference can occur due to memory allocation failure in DIAG in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Industrial IOT Snapdragon Wearables


Null pointer dereference can occur due to lack of null check for user provided input in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Wearables


A Null Pointer Dereference vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update allows a local administrator to cause Windows to crash via a specific system call which is not handled correctly. This varies by machine and had partial protection prior to this update.


An issue was discovered in YottaDB through r1.32 and V7.0-000 and FIS GT.M through V7.0-000. Using crafted input attackers can cause a type to be incorrectly initialized in the function f_incr in sr_port/f_incr.c and cause a crash due to a NULL pointer dereference.


In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3 special files are not considered leading to a move_data_page NULL pointer dereference.


Acrobat Reader DC version 21.007.20099 (and earlier) 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or for configurations mixing forward and reverse proxy declarations can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).


An issue was discovered in YottaDB through r1.32 and V7.0-000 and FIS GT.M through V7.0-000. Using crafted input an attacker can cause a NULL pointer dereference after calls to ZPrint.


An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input an attacker can cause a NULL pointer dereference after calls to ZPrint.


An issue was discovered in YottaDB through r1.32 and V7.0-000 and FIS GT.M through V7.0-000. Using crafted input an attacker can cause calls to ZRead to crash due to a NULL pointer dereference.


An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input an attacker can cause calls to ZRead to crash due to a NULL pointer dereference.


An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input attackers can cause a type to be incorrectly initialized in the function f_incr in sr_port/f_incr.c and cause a crash due to a NULL pointer dereference.


In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests may cause a Null pointer dereference in the CODESYS web server and may result in a denial-of-service condition.


The function bitstr_tell at bitstr.c in ffjpeg commit 4ab404e has a NULL pointer dereference.


Acrobat Reader DC versions 2021.005.20054 (and earlier) 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by a Null pointer dereference vulnerability. An authenticated attacker could leverage this vulnerability achieve an application denial-of-service in the context of the current user. Exploitation of this issue does not requires user interaction.


Lack of null check while freeing the device information buffer in the Bluetooth HFP protocol can lead to a NULL pointer dereference in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Voice & Music Snapdragon Wearables


Acrobat Reader DC versions 2021.005.20054 (and earlier) 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


The OPC autogenerated ANSI C stack stubs (in the NodeSets) do not handle all error cases. This can lead to a NULL pointer dereference.


A Null Pointer Dereference vulnerability exits in ffjpeg d5cfd49 (2021-12-06) in bmp_load(). When the size information in metadata of the bmp is out of range it returns without assign memory buffer to `pb->pdata` and did not exit the program. So the program crashes when it tries to access the pb->data in jfif_encode() at jfif.c:763. This is due to the incomplete patch for CVE-2020-13438.


A flaw was found in OpenEXR in versions before 3.0.0-beta. A crafted input file supplied by an attacker that is processed by the Dwa decompression functionality of OpenEXR's IlmImf library could cause a NULL pointer dereference. The highest threat from this vulnerability is to system availability.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

If

a

user

does

not

provide

a

valid

padding

value

to

then

the

code

triggers

a

pointer

dereference

(if

input

is

empty)

or

produces

invalid

behavior

ignoring

all

values

after

the

first.

The

reads

the

first

value

from

a

tensor

buffer

without

first

checking

that

the

tensor

has

values

to

read

from.

We

have

patched

the

issue

in

GitHub

commit

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

When

a

user

does

not

supply

arguments

that

determine

a

valid

sparse

tensor

implementation

can

be

made

to

dereference

a

pointer.

The

has

some

argument

validation

but

fails

to

consider

the

case

when

either

`indices`

or

`values`

are

provided

for

an

empty

sparse

tensor

when

the

other

is

not.

If

`indices`

is

empty

then

code

that

performs

(i.e.

checking

that

the

indices

are

monotonically

increasing)

results

in

a

pointer

dereference.

If

`indices`

as

provided

by

the

user

is

empty

then

`indices`

in

the

C++

code

above

is

backed

by

an

empty

`std::vector`

hence

calling

results

in

pointer

dereferencing

(same

as

calling

`std::vector::at()`

on

an

empty

vector).

We

have

patched

the

issue

in

GitHub

commit

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

Sending

invalid

argument

for

of

API

results

in

a

pointer

dereference

and

undefined

behavior.

The

accesses

the

first

element

of

a

user

supplied

list

of

values

without

validating

that

the

provided

list

is

not

empty.

We

have

patched

the

issue

in

GitHub

commit

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

In

affected

versions

the

code

for

does

not

properly

validate

the

inputs

and

an

attacker

can

trigger

a

pointer

dereference.

The

uses

`ValidateInputs`

to

check

that

the

input

arguments

are

valid.

This

validation

would

have

caught

the

illegal

state

represented

by

the

reproducer

above.

However

the

validation

uses

which

translates

to

setting

the

`Status`

object

of

the

current

`OpKernelContext`

to

an

error

status

followed

by

an

empty

`return`

statement

which

just

terminates

the

execution

of

the

function

it

is

present

in.

However

this

does

not

mean

that

the

kernel

execution

is

finalized:

instead

execution

continues

from

the

next

line

in

`Compute`

that

follows

the

call

to

`ValidateInputs`.

This

is

equivalent

to

lacking

the

validation.

We

have

patched

the

issue

in

GitHub

commit

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

The

code

for

can

be

made

to

trigger

a

pointer

dereference.

The

obtains

a

pointer

to

a

`CompressedElement`

from

a

`Variant`

tensor

and

then

proceeds

to

dereference

it

for

decompressing.

There

is

no

check

that

the

`Variant`

tensor

contained

a

`CompressedElement`

so

the

pointer

is

actually

`nullptr`.

We

have

patched

the

issue

in

GitHub

commit

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

It

is

possible

to

trigger

a

pointer

dereference

in

TensorFlow

by

passing

an

invalid

input

to

The

was

accessing

the

size

of

a

buffer

obtained

from

the

return

of

a

separate

function

call

before

validating

that

said

buffer

is

valid.

We

have

patched

the

issue

in

GitHub

commit

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


Modex v2.11 was discovered to contain a NULL pointer dereference in set_create_id() at xtract.c.


ACRN before 2.5 has a devicemodel/hw/pci/xhci.c NULL Pointer Dereference for a trb pointer.


ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon crash. This occurs because a return value is not properly managed in a certain situation.


ACRN before 2.5 has a hw/pci/virtio/virtio.c vq_endchains NULL Pointer Dereference.


An issue was discovered in ACRN before 2.5. It allows a devicemodel/hw/pci/virtio/virtio_net.c virtio_net_ping_rxq NULL pointer dereference for vq->used.


In CODESYS EtherNetIP before 4.1.0.0 specific EtherNet/IP requests may cause a null pointer dereference in the downloaded vulnerable EtherNet/IP stack that is executed by the CODESYS Control runtime system.


In CODESYS Gateway V3 before 3.5.17.10 there is a NULL Pointer Dereference. Crafted communication requests may cause a Null pointer dereference in the affected CODESYS products and may result in a denial-of-service condition.


An issue was discovered in Softing OPC UA C++ SDK before 5.70. A malformed OPC/UA message abort packet makes the client crash with a NULL pointer dereference.


Adobe Animate version 21.0.9 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted FLA file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


XMP Toolkit 2021.07 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Premiere Pro 15.4.1 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Bridge version 11.1.1 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe InCopy version 16.4 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Premiere Rush versions 1.5.16 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


The TRENDnet TI-PG1284i switch(hw v2.0R) prior to version 2.0.2.S0 suffers from a null pointer dereference vulnerability. This vulnerability exists in its lldp related component. Due to fail to check if ChassisID TLV is contained in the packet by sending a crafted lldp packet to the device an attacker can crash the process due to null pointer dereference.


TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for `DeserializeSparse` can trigger a null pointer dereference. This is because the shape inference function assumes that the `serialize_sparse` tensor is a tensor with positive rank (and having `3` as the last dimension). The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1 TensorFlow 2.5.2 and TensorFlow 2.4.4 as these are also affected and still in supported range.


Shibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw involving the session recovery feature. The flaw is exploitable (for a daemon crash) on systems not using this feature if a crafted cookie is supplied.


Fluent Bit 1.6.10 has a NULL pointer dereference when an flb_malloc return value is not validated by flb_avro.c or http_server/api/v1/metrics.c.


Possible null pointer dereference in thread cache operation handler due to lack of validation of user provided input in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Voice & Music Snapdragon Wearables Snapdragon Wired Infrastructure and Networking


An issue was discovered in the Linux kernel through 5.11.11. synic_get in arch/x86/kvm/hyperv.c has a NULL pointer dereference for certain accesses to the SynIC Hyper-V context aka CID-919f4ebc5987.


In filters/reframe_latm.c in GPAC 1.0.1 there is a Null Pointer Dereference when gf_filter_pck_get_data is called. The first arg pck may be null with a crafted mp4 file which results in a crash.


There

is

a

Pointer

Dereference

in

function

filter_core/filter_pck.c:gf_filter_pck_new_alloc_internal

in

GPAC

The

pid

comes

from

function

the

ctx.opid

maybe

NULL.

The

result

is

a

crash

in


Possible null pointer dereference due to lack of TLB validation for user provided address in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Voice & Music Snapdragon Wired Infrastructure and Networking


Possible null pointer dereference in trap handler due to lack of thread ID validation before dereferencing it in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Voice & Music Snapdragon Wearables Snapdragon Wired Infrastructure and Networking


An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_internal_dtd() while parsing a crafted XML file performs incorrect memory handling leading to a NULL pointer dereference while running strcmp() on a NULL pointer.


Possible null pointer dereference in thread profile trap handler due to lack of thread ID validation before dereferencing it in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Voice & Music Snapdragon Wearables Snapdragon Wired Infrastructure and Networking


Adobe After Effects version 18.4.1 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Premiere Pro 15.4.1 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Prelude version 10.1 (and earlier) is affected by a null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Audition version 14.4 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Media Encoder 15.4.1 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Character Animator version 4.4 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Premiere Elements 20210809.daily.2242976 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Bridge version 11.1.1 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


There is a Null pointer dereference vulnerability in the camera module in smartphones. Successful exploitation of this vulnerability may affect service integrity.


In Core Kernel in all Android releases from CAF using the Linux kernel a Null Pointer Dereference vulnerability could potentially exist.


The bdisk.sys driver in COMODO Backup before 4.4.1.23 allows remote attackers to gain privileges via a crafted device handle which triggers a NULL pointer dereference.


The do_exit function in kernel/exit.c in the Linux kernel before 2.6.36.2 does not properly handle a KERNEL_DS get_fs value which allows local users to bypass intended access_ok restrictions overwrite arbitrary kernel memory locations and gain privileges by leveraging a (1) BUG (2) NULL pointer dereference or (3) page fault as demonstrated by vectors involving the clear_child_tid feature and the splice system call.


The install_special_mapping function in mm/mmap.c in the Linux kernel before 2.6.37-rc6 does not make an expected security_file_mmap function call which allows local users to bypass intended mmap_min_addr restrictions and possibly conduct NULL pointer dereference attacks via a crafted assembly-language application.


The frame scheduling module has a null pointer dereference vulnerability. Successful exploitation of this vulnerability will affect the kernel availability.


Unchecked Return Value to NULL Pointer Dereference in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources the fix is available with commit f2b656e2.


A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2.


A NULL pointer dereference flaw was found in the Linux kernel's BPF subsystem in the way a user triggers the map_get_next_key function of the BPF bloom filter. This flaw allows a local user to crash the system. This flaw affects Linux kernel versions prior to 5.17-rc1.


Null Pointer Dereference Caused Segmentation Fault in GitHub repository gpac/gpac prior to 2.1.0-DEV.


A NULL pointer dereference flaw was found in pesign's cms_set_pw_data() function of the cms_common.c file. The function fails to handle the NULL pwdata invocation from daemon.c which leads to an explicit NULL dereference and crash on all attempts to daemonize pesign.


NGINX NJS 0.7.2 was discovered to contain a NULL pointer dereference via the component njs_vmcode_array at /src/njs_vmcode.c.


Redis is an in-memory database that persists on disk. Prior to versions 6.2.7 and 7.0.0 an attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result with a crash of the redis-server process. The problem is fixed in Redis versions 7.0.0 and 6.2.7. An additional workaround to mitigate this problem without patching the redis-server executable if Lua scripting is not being used is to block access to `SCRIPT LOAD` and `EVAL` commands using ACL rules.


Foxit PDF Reader and Editor before 11.2.1 and PhantomPDF before 10.1.7 allow a NULL pointer dereference during PDF parsing because the pointer is used without proper validation.


In Artifex MuJS through 1.2.0 jsP_dumpsyntax in jsdump.c has a NULL pointer dereference as demonstrated by mujs-pp.


An authenticated remote attacker can cause a null pointer dereference in the CmpSettings component of the affected CODESYS products which leads to a crash.


Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Tensorflow is an Open Source Machine Learning Framework. When building an XLA compilation cache if default settings are used TensorFlow triggers a null pointer dereference. In the default scenario all devices are allowed so `flr->config_proto` is `nullptr`. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1 TensorFlow 2.6.3 and TensorFlow 2.5.3 as these are also affected and still in supported range.


Tensorflow is an Open Source Machine Learning Framework. Under certain scenarios Grappler component of TensorFlow can trigger a null pointer dereference. There are 2 places where this can occur for the same malicious alteration of a `SavedModel` file (fixing the first one would trigger the same dereference in the second place). First during constant folding the `GraphDef` might not have the required nodes for the binary operation. If a node is missing the correposning `mul_*child` would be null and the dereference in the subsequent line would be incorrect. We have a similar issue during `IsIdentityConsumingSwitch`. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1 TensorFlow 2.6.3 and TensorFlow 2.5.3 as these are also affected and still in supported range.


The Linux kernel 2.6.0 through 2.6.30.4 and 2.4.4 through 2.4.37.4 does not initialize all function pointers for socket operations in proto_ops structures which allows local users to trigger a NULL pointer dereference and gain privileges by using mmap to map page zero placing arbitrary code on this page and then invoking an unavailable operation as demonstrated by the sendpage operation (sock_sendpage function) on a PF_PPPOX socket.


The kernel in Microsoft Windows 2000 SP4 XP SP2 and SP3 Server 2003 SP2 Vista Gold and SP1 and Server 2008 Gold does not properly validate data sent from user mode which allows local users to gain privileges via a crafted PE .exe file that triggers a NULL pointer dereference during chain traversal aka \Windows Kernel NULL Pointer Dereference Vulnerability.\


The Linux kernel before 2.6.31-rc7 does not properly prevent mmap operations that target page zero and other low memory addresses which allows local users to gain privileges by exploiting NULL pointer dereference vulnerabilities related to (1) the default configuration of the allow_unconfined_mmap_low boolean in SELinux on Red Hat Enterprise Linux (RHEL) 5 (2) an error that causes allow_unconfined_mmap_low to be ignored in the unconfined_t domain (3) lack of a requirement for the CAP_SYS_RAWIO capability for these mmap operations and (4) interaction between the mmap_min_addr protection mechanism and certain application programs.


The personality subsystem in the Linux kernel before 2.6.31-rc3 has a PER_CLEAR_ON_SETID setting that does not clear the ADDR_COMPAT_LAYOUT and MMAP_PAGE_ZERO flags when executing a setuid or setgid program which makes it easier for local users to leverage the details of memory usage to (1) conduct NULL pointer dereference attacks (2) bypass the mmap_min_addr protection mechanism or (3) defeat address space layout randomization (ASLR).


win32k.sys in the kernel in Microsoft Windows 2000 SP4 XP SP2 and SP3 Server 2003 SP2 Vista Gold SP1 and SP2 and Server 2008 Gold and SP2 does not correctly validate an argument to an unspecified system call which allows local users to gain privileges via a crafted application that triggers a NULL pointer dereference aka \Win32k NULL Pointer Dereferencing Vulnerability.\


The tun_chr_poll function in drivers/net/tun.c in the tun subsystem in the Linux kernel 2.6.30 and 2.6.30.1 when the -fno-delete-null-pointer-checks gcc option is omitted allows local users to gain privileges via vectors involving a NULL pointer dereference and an mmap of /dev/net/tun a different vulnerability than CVE-2009-1894.


In Apache Xerces-C XML Parser library before 3.2.1 processing of external DTD paths can result in a null pointer dereference under certain conditions.


A security flaw was discovered in the nl80211_set_rekey_data() function in net/wireless/nl80211.c in the Linux kernel through 4.13.3. This function does not check whether the required attributes are present in a Netlink request. This request can be issued by a user with the CAP_NET_ADMIN capability and may result in a NULL pointer dereference and system crash.


In Wireshark 2.4.0 the Modbus dissector could crash with a NULL pointer dereference. This was addressed in epan/dissectors/packet-mbtcp.c by adding length validation.


A NULL Pointer Dereference exists in VideoLAN x265 as used in libbpg 0.9.7 and other products because the CUData::initialize function in common/cudata.cpp mishandles memory-allocation failure.


libxar.so in xar 1.6.1 has a NULL pointer dereference in the xar_get_path function in util.c.


libxar.so in xar 1.6.1 has a NULL pointer dereference in the xar_unserialize function in archive.c.


ReadPNMImage in coders/pnm.c in GraphicsMagick 1.3.26 does not ensure the correct number of colors for the XV 332 format leading to a NULL Pointer Dereference.


The DecodeNumber function in unrarlib.c in unrar 0.0.1 (aka unrar-free or unrar-gpl) suffers from a NULL pointer dereference flaw triggered by a crafted RAR archive. NOTE: this may be the same as one of the several test cases in the CVE-2017-11189 references.


The av_color_primaries_name function in libavutil/pixdesc.c in FFmpeg 3.3.3 may return a NULL pointer depending on a value contained in a file but callers do not anticipate this as demonstrated by the avcodec_string function in libavcodec/utils.c leading to a NULL pointer dereference. (It is also conceivable that there is security relevance for a NULL pointer dereference in av_color_primaries_name calls within the ffprobe command-line program.)


GoAhead 3.4.0 through 3.6.5 has a NULL Pointer Dereference in the websDecodeUrl function in http.c leading to a crash for a \POST / HTTP/1.1\ request.


AP4_AtomFactory::CreateAtomFromStream in Core/Ap4AtomFactory.cpp in Bento4 version 1.5.0-617 has missing NULL checks leading to a NULL pointer dereference segmentation fault and application crash in AP4_Atom::SetType in Core/Ap4Atom.h.


The find_nearest_line function in addr2line in GNU Binutils 2.28 does not handle the case where the main file name and the directory name are both empty triggering a NULL pointer dereference and an invalid write and leading to a program crash.


GnuTLS version 3.5.12 and earlier is vulnerable to a NULL pointer dereference while decoding a status response TLS extension with valid contents. This could lead to a crash of the GnuTLS server application.


Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash.


poppler since version 0.17.3 has been vulnerable to NULL pointer dereference in pdfunite triggered by specially crafted documents.


An issue was discovered in ImageMagick 6.9.7. A specially crafted xcf file could lead to a NULL pointer dereference.


The IofCallDriver function in USBPcap 1.1.0.0 allows local users to gain privileges via a crafted 0x00090028 IOCTL call which triggers a NULL pointer dereference.


In Irssi before 1.0.5 overlong nicks or targets may result in a NULL pointer dereference while splitting the message.


In Watchdog Anti-Malware 2.74.186.150 and Online Security Pro 2.74.186.150 the zam32.sys driver contains a NULL pointer dereference vulnerability that gets triggered when sending an operation to ioctl 0x80002010. This is due to the input buffer being NULL or the input buffer size being 0 as they are not validated.


In Watchdog Anti-Malware 2.74.186.150 and Online Security Pro 2.74.186.150 the zam32.sys driver contains a NULL pointer dereference vulnerability that gets triggered when sending an operation to ioctl 0x80002054. This is due to the input buffer being NULL or the input buffer size being 0 as they are not validated.


In ReadOneJNGImage in coders/png.c in GraphicsMagick 1.3.26 a Null Pointer Dereference occurs while transferring JPEG scanlines related to a PixelPacket pointer.


libjpeg-turbo 1.5.2 has a NULL Pointer Dereference in jdpostct.c and jquant1.c via a crafted JPEG file.


In Irssi before 1.0.5 certain incorrectly formatted DCC CTCP messages could cause a NULL pointer dereference. This is a separate but similar issue relative to CVE-2017-9468.


VMware Workstation Pro/Player contains a NULL pointer dereference vulnerability that exists in the vstor2 driver. Successful exploitation of this issue may allow host users with normal user privileges to trigger a denial-of-service in a Windows host machine.


VMware Workstation Pro/Player 12.x before 12.5.3 contains a NULL pointer dereference vulnerability that exists in the SVGA driver. Successful exploitation of this issue may allow attackers with normal user privileges to crash their VMs.


VMware ESXi 6.5 without patch ESXi650-201707101-SG ESXi 6.0 without patch ESXi600-201706101-SG ESXi 5.5 without patch ESXi550-201709101-SG Workstation (12.x before 12.5.3) Fusion (8.x before 8.5.4) contain a NULL pointer dereference vulnerability. This issue occurs when handling guest RPC requests. Successful exploitation of this issue may allow attackers with normal user privileges to crash their VMs.


VMware Workstation (12.x before 12.5.8) and Fusion (8.x before 8.5.9) contain a guest RPC NULL pointer dereference vulnerability. Successful exploitation of this issue may allow attackers with normal user privileges to crash their VMs.


Huawei

IPS

Module

NGFW

Module

Secospace

Secospace

Secospace

ViewPoint

ViewPoint

have

a

pointer

dereference

vulnerability

in

protocol.

An

unauthenticated

remote

attacker

could

craft

malformed

packets

and

send

the

packets

to

the

affected

products.

Due

to

insufficient

validation

of

packets

which

could

be

exploited

to

cause

process

crash.


K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x95002574 DeviceIoControl request.


K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025c8 DeviceIoControl request.


K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025a4 DeviceIoControl request.


K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025ac DeviceIoControl request.


K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x95002570 DeviceIoControl request.


Some Huawei smart phones with versions earlier than Harry-AL00C 9.1.0.206(C00E205R3P1) have a null pointer dereference vulnerability. An attacker crafts specific packets and sends to the affected product to exploit this vulnerability. Successful exploitation may cause the affected phone abnormal.


ntguard_x64.sys 0.18780.0.0 in IKARUS anti.virus 2.16.15 has a NULL pointer dereference via a 0x830000c4 DeviceIoControl request.


An

issue

was

discovered

in

Artifex

MuPDF

before

The

function

in

pdf-op-run.c

encounters

a

pointer

dereference

during

a

Fitz

painting

operation.

Versions

and

later

are

unaffected.


In the startread function in xa.c in Sound eXchange (SoX) through 14.4.2 a corrupt header specifying zero channels triggers an infinite loop with a resultant NULL pointer dereference which may allow a remote attacker to cause a denial-of-service.


In builtin.c in zsh before 5.4 when sh compatibility mode is used there is a NULL pointer dereference during processing of the cd command with no argument if HOME is not set.


In the GetOpenCLCachedFilesDirectory function in magick/opencl.c in ImageMagick 7.0.7 a NULL pointer dereference vulnerability occurs because a memory allocation result is not checked related to GetOpenCLCacheDirectory.


Exiv2 0.26 has a Null Pointer Dereference in the Exiv2::DataValue::toLong function in value.cpp related to crafted metadata in a TIFF file.


libjbig2dec.a in Artifex jbig2dec 0.13 as used in MuPDF and Ghostscript has a NULL pointer dereference in the jbig2_huffman_get function in jbig2_huffman.c. For example the jbig2dec utility will crash (segmentation fault) when parsing an invalid file.


When an atomic commit is issued on a writeback panel with a NULL output_layer parameter in Android for MSM Firefox OS for MSM and QRD Android before 2017-06-03 a NULL pointer dereference may potentially occur.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W SD 210/SD 212/SD 205 SD 400 SD 410/12 SD 615/16/SD 415 and SD 810 possible null pointer dereference occurs due to failure of memory allocation when a large value is passed for buffer allocation in the Playready App.


In

Android

before

or

earlier

security

patch

level

on

Qualcomm

Snapdragon

Automobile

Snapdragon

Mobile

and

Snapdragon

Wear

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

and

lack

of

input

validation

in

NPA

driver

functions

leads

to

pointer

dereference.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W SD 210/SD 212/SD 205 SD 400 SD 410/12 SD 615/16/SD 415 SD 617 SD 650/52 SD 808 and SD 810 in a PlayReady function a NULL pointer dereference can occur.


In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10 the PVFS dissector could crash. This was addressed in epan/dissectors/packet-pvfs2.c by preventing a NULL pointer dereference.


Poppler

before

has

a

pointer

dereference

in

when

called

from

poppler_annot_file_attachment_get_attachment.


The

Goodix

touchscreen

driver

for

custom

Linux

kernels

on

Xiaomi

daisy-o-oss

and

daisy-p-oss

as

used

in

Mi

Lite

and

pro

devices

through

has

a

pointer

dereference

in

kfree

after

a

kmalloc

failure

in

in


An issue was discovered in Qt before 5.11.3. A malformed GIF image causes a NULL pointer dereference in QGifHandler resulting in a segmentation fault.


aubio v0.4.0 to v0.4.8 has a new_aubio_onset NULL pointer dereference.


An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.1. There is a NULL pointer dereference in ifilter_bank() in libfaad/filtbank.c.


aubio v0.4.0 to v0.4.8 has a NULL pointer dereference in new_aubio_filterbank via invalid n_filters.


An issue was discovered in Foxit Reader before 2.4.4. It has a NULL pointer dereference.


In SQLite through 3.22.0 databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL pointer dereference related to build.c and prepare.c.


LibRaw::copy_bayer in libraw_cxx.cpp in LibRaw 0.19.1 has a NULL pointer dereference.


GNU Libextractor through 1.8 has a NULL Pointer Dereference vulnerability in the function process_metadata() in plugins/ole2_extractor.c.


An

issue

was

discovered

in

in

PoDoFo

For

a

crafted

PDF

document

pPage->GetObject()->GetDictionary().AddKey(PdfName(\MediaBox\)

var)

can

be

problematic

due

to

the

function

GetObject()

being

called

for

the

pPage

pointer

object.

The

value

of

pPage

at

this

point

is

which

causes

a

pointer

dereference.


LibRaw::raw2image in libraw_cxx.cpp in LibRaw 0.19.1 has a NULL pointer dereference.


A NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash because adding to windowed output is mishandled in the EIGHT_SHORT_SEQUENCE case.


An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function ras_putdatastd in ras/ras_enc.c.


An issue was discovered in LibTIFF 4.0.9. There is a NULL pointer dereference in the function LZWDecode in the file tif_lzw.c.


An issue was discovered in libgig 4.1.0. There is a NULL pointer dereference in the function DLS::File::GetFirstSample() in DLS.cpp.


There exists a NULL pointer dereference in ff_vc1_parse_frame_header_adv in vc1.c in Libav 12.3 which allows attackers to cause a denial-of-service through a crafted aac file.


A denial-of-service vulnerability exists in the Pixar Renderman IT Display Service 21.6 (0x69). The vulnerability is present in the parsing of a network packet without proper validation of the packet. The data read-in is not validated and its use can lead to a null pointer dereference. The IT application is opened by a user and then listens for a connection on port 4001. An attacker can deliver an attack once the application has been opened.


A denial-of-service vulnerability exists in the Pixar Renderman IT Display Service 21.6 (0x67). The vulnerability is present in the parsing of a network packet without proper validation of the packet. The data read by the application is not validated and its use can lead to a null pointer dereference. The IT application is opened by a user and then listens for a connection on port 4001. An attacker can deliver an attack once the application has been opened.


An issue was discovered in mruby 1.4.1. There is a NULL pointer dereference in mrb_class related to certain .clone usage because mrb_obj_clone in kernel.c copies flags other than the MRB_FLAG_IS_FROZEN flag (e.g. the embedded flag).


md4c 0.2.6 has a NULL pointer dereference in the function md_process_line in md4c.c related to ctx->current_block.


The

function

in

in

Exempi

has

a

pointer

dereference.


An issue was discovered in mruby 1.4.1. There is a NULL pointer dereference in mrb_class_real because \class BasicObject\ is not properly supported in class.c.


qh_core in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability which allows attackers to cause a local denial-of-service condition by sending a crafted payload to the listening UNIX socket.


qh_help in Nagios Core version 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability which allows attacker to cause a local denial-of-service condition by sending a crafted payload to the listening UNIX socket.


qh_echo in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability which allows attackers to cause a local denial-of-service condition by sending a crafted payload to the listening UNIX socket.


An issue was discovered in fs/xfs/xfs_icache.c in the Linux kernel through 4.17.3. There is a NULL pointer dereference and panic in lookup_slow() on a NULL inode->i_ops pointer when doing pathwalks on a corrupted xfs image. This occurs because of a lack of proper validation that cached inodes are free during allocation.


A null pointer dereference flaw was found in the way samba checked database outputs from the LDB database layer. An authenticated attacker could use this flaw to crash a samba server in an Active Directory Domain Controller configuration. Samba versions before 4.7.9 and 4.8.4 are vulnerable.


The

Linux

kernel

before

version

is

vulnerable

to

a

pointer

dereference

in

fs/cifs/cifsencrypt.c:setup_ntlmv2_rsp()

that

allows

an

attacker

controlling

a

CIFS

server

to

kernel

panic

a

client

that

has

this

server

mounted

because

an

empty

TargetInfo

field

in

an

NTLMSSP

setup

negotiation

response

is

mishandled

during

session

recovery.


jsish version 2.4.67 contains a CWE-476: NULL Pointer Dereference vulnerability in Jsi_LogMsg (jsiUtils.c:196) that can result in Crash due to segmentation fault. This attack appear to be exploitable via the victim executing specially crafted javascript code. This vulnerability appears to have been fixed in 2.4.69.


JerryScript

version

Tested

on

commit

Analysing

history

it

seems

that

the

issue

has

been

present

since

commit

contains

a

Pointer

Dereference

vulnerability

in

Triggering

undefined

behavior

at

jerry-core/ecma/builtin-objects/typedarray/ecma-builtin-typedarray-prototype.c:598

(passing

to

memcpy

as

argument)

results

in

pointer

dereference

(segfault)

at

that

can

result

in

Crash

due

to

segmentation

fault.

This

attack

appear

to

be

exploitable

via

The

victim

must

execute

specially

crafted

javascript

code.

This

vulnerability

appears

to

have

been

fixed

in

after

commit


Jsish version 2.4.65 contains a CWE-476: NULL Pointer Dereference vulnerability in Function jsi_ValueCopyMove from jsiValue.c:240 that can result in Crash due to segmentation fault. This attack appear to be exploitable via a crafted javascript code. This vulnerability appears to have been fixed in 2.4.67.


The Linux Kernel versions 4.14 4.15 and 4.16 has a null pointer dereference which can result in an out of memory (OOM) killing of large mlocked processes. The issue arises from an oom killed process's final thread calling exit_mmap() which calls munlock_vma_pages_all() for mlocked vmas.This can happen synchronously with the oom reaper's unmap_page_range() since the vma's VM_LOCKED bit is cleared before munlocking (to determine if any other vmas share the memory and are mlocked).


An issue was discovered in Clementine Music Player 1.3.1. Clementine.exe is vulnerable to a user mode write access violation due to a NULL pointer dereference in the Init call in the MoodbarPipeline::NewPadCallback function in moodbar/moodbarpipeline.cpp. The vulnerability is triggered when the user opens a malformed mp3 file.


An issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02. A NULL pointer dereference can occur in pbc_wmessage_string in wmessage.c.


NULL Pointer Dereference vulnerability in QTS 4.3.5 build 20181013 QTS 4.3.4 build 20181008 QTS 4.3.3 build 20180829 QTS 4.2.6 build 20180829 and earlier versions could allow remote attackers to crash the NAS media server.


An issue was discovered in the Linux kernel through 4.17.10. There is a NULL pointer dereference in fscrypt_do_page_crypto() in fs/crypto/crypto.c when operating on a file in a corrupted f2fs image.


gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to crash an application via a specific function call sequence. Only affects PHP when linked with an external libgd (not bundled).


An issue was discovered in libthulac.so in THULAC through 2018-02-25. A NULL pointer dereference can occur in the BasicModel class in include/cb_model.h.


A

pointer

dereference

in

in

in

the

Wi-Fi

driver

on

the

Samsung

Galaxy

allows

an

attacker

(who

has

obtained

code

execution

on

the

Wi-Fi

chip)

to

cause

the

device

to

reboot.

The

Samsung

ID

is


There exists one NULL pointer dereference vulnerability in AP4_JsonInspector::AddField in Ap4Atom.cpp in Bento4 1.5.1-624 which can allow attackers to cause a denial-of-service via a crafted mp4 file. This vulnerability can be triggered by the executable mp4dump.


Codec::parse in track.cpp in Untrunc through 2018-06-07 has a NULL pointer dereference via a crafted MP4 file because of improper interaction with libav.


An issue was discovered in the Linux kernel through 4.17.10. There is a NULL pointer dereference and panic in hfsplus_lookup() in fs/hfsplus/dir.c when opening a file (that is purportedly a hard link) in an hfs+ filesystem that has malformed catalog data and is mounted read-only without a metadata directory.


An exploitable denial-of-service vulnerability exists in the thumbnail display functionality of the NT9665X Chipset firmware running on the Anker Roav A1 Dashcam version RoavA1SWV1.9. A specially crafted packet can cause a null pointer dereference resulting in a device reboot.


A null pointer dereference was addressed with improved validation. This issue is fixed in macOS High Sierra 10.13 iCloud for Windows 7.0 watchOS 4 iOS 11 iTunes 12.7 for Windows. Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution.


Unchecked NULL pointer usage in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file that triggers an xkb_intern_atom failure.


Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file because geometry tokens were desupported incorrectly.


Unchecked NULL pointer usage when handling invalid aliases in CopyKeyAliasesToKeymap in xkbcomp/keycodes.c in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file.


Unchecked NULL pointer usage when parsing invalid atoms in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file because lookup failures are mishandled.


An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains a NULL Pointer Dereference vulnerability due to not validating the size of the output buffer value from IOCtl 0x80002028.


Unchecked NULL pointer usage in resolve_keysym in xkbcomp/parser.y in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file because a map access attempt can occur for a map that was never created.


Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file because the XkbFile for an xkb_geometry section was mishandled.


Unchecked NULL pointer usage in LookupModMask in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with invalid virtual modifiers.


An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. The server mishandles some HTTP request fields associated with time which results in a NULL pointer dereference as demonstrated by If-Modified-Since or If-Unmodified-Since with a month greater than 11.


Unchecked NULL pointer usage in ResolveStateAndPredicate in xkbcomp/compat.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with a no-op modmask expression.


An issue was discovered in cplus-dem.c in GNU libiberty as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in work_stuff_copy_to_from when called from iterate_demangle_function.


A NULL pointer dereference in the function _TIFFmemcmp at tif_unix.c (called from TIFFWriteDirectoryTagTransferfunction) in LibTIFF 4.0.9 allows an attacker to cause a denial-of-service through a crafted tiff file. This vulnerability can be triggered by the executable tiffcp.


An issue was discovered in Exiv2 v0.26. The function Exiv2::DataValue::copy in value.cpp has a NULL pointer dereference.


wernsey/bitmap before 2018-08-18 allows a NULL pointer dereference via a 4-bit image.


An issue was discovered in Icinga 2.x through 2.8.1. By sending specially crafted messages an attacker can cause a NULL pointer dereference which can cause the product to crash.


w3m through 0.5.3 is prone to a NULL pointer dereference flaw in formUpdateBuffer in form.c.


VMware Workstation (14.x before 14.1.2) and Fusion (10.x before 10.1.2) contain multiple denial-of-service vulnerabilities that occur due to NULL pointer dereference issues in the RPC handler. Successful exploitation of these issues may allow an attacker with limited privileges on the guest machine trigger a denial-of-Service of their guest machine.


VMware ESXi (6.7 before ESXi670-201806401-BG 6.5 before ESXi650-201806401-BG 6.0 before ESXi600-201806401-BG and 5.5 before ESXi550-201806401-BG) Workstation (14.x before 14.1.2) and Fusion (10.x before 10.1.2) contain a denial-of-service vulnerability due to NULL pointer dereference issue in RPC handler. Successful exploitation of this issue may allow attackers with normal user privileges to crash their VMs.


In FreeBSD before 11.2-STABLE(r338986) 11.2-RELEASE-p4 11.1-RELEASE-p15 10.4-STABLE(r338985) and 10.4-RELEASE-p13 due to improper maintenance of IPv6 protocol control block flags through various failure paths an unprivileged authenticated local user may be able to cause a NULL pointer dereference causing the kernel to crash.


Google TensorFlow 1.6.x and earlier is affected by: Null Pointer Dereference. The type of exploitation is: context-dependent.


An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. A NULL pointer dereference occurs for an \empty\ nick.


An

issue

was

discovered

in

Exempi

through

does

not

check

whether

a

bitstream

has

a

value

leading

to

a

pointer

dereference

in

the

class.


An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. When the number of windows exceeds the available space a crash due to a NULL pointer dereference would occur.


In subst.c in zsh through 5.4.2 there is a NULL pointer dereference when using ${(PA)...} on an empty array result.


A

Pointer

Dereference

occurs

in

the

function

TIFFPrintDirectory

in

in

LibTIFF

and

when

using

the

tiffinfo

tool

to

print

crafted

TIFF

information

a

different

vulnerability

than

(This

affects

an

earlier

part

of

the

TIFFPrintDirectory

function

that

was

not

addressed

by

the

patch.)


In GNOME GLib 2.56.1 g_markup_parse_context_end_parse() in gmarkup.c has a NULL pointer dereference.


A flaw was found in the Linux kernel's NFS implementation all versions 3.x and all versions 4.x up to 4.20. An attacker who is able to mount an exported NFS filesystem is able to trigger a null pointer dereference by using an invalid NFS sequence. This can panic the machine and deny access to the NFS server. Any outstanding disk writes to the NFS server will be lost.


There's a flaw in binutils /bfd/pef.c. An attacker who is able to submit a crafted input file to be processed by the objdump program could cause a null pointer dereference. The greatest threat from this flaw is to application availability. This flaw affects binutils versions prior to 2.34.


RedisGraph 2.x through 2.2.11 has a NULL Pointer Dereference that leads to a server crash because it mishandles an unquoted string such as an alias that has not yet been introduced.


An issue was discovered in the futures-task crate before 0.3.5 for Rust. futures_task::noop_waker_ref allows a NULL pointer dereference.


Gobby 0.4.11 allows a NULL pointer dereference in the D-Bus handler for certain set_language calls.


There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability. This flaw affects binutils versions prior to 2.34.


There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability.


pdf2json v0.71 was discovered to contain a NULL pointer dereference in the component ObjectStream::getObject.


Incorrect handling of input data in changeAttribute function in the libmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and segmentation fault error in case of restrictive memory protection or near NULL pointer overwrite in case of no memory restrictions (e.g. in embedded environments).


Incorrect handling of input data in verifyAttribute function in the libmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and segmentation fault error in case of restrictive memory protection or near NULL pointer overwrite in case of no memory restrictions (e.g. in embedded environments).


CA Unified Infrastructure Management (Nimsoft/UIM) 20.1 20.3.x and 9.20 and below contains a null pointer dereference vulnerability in the robot (controller) component. A remote attacker can crash the Controller service.


The find_color_or_error function in gifsicle 1.92 contains a NULL pointer dereference.


In SQLite 3.31.1 isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column optimizations.


A NULL Pointer Dereference exists in libzint in Zint 2.7.1 because multiple + characters are mishandled in add_on in upcean.c when called from eanx in upcean.c during EAN barcode generation.


Adobe Flash Player version 32.0.0.433 (and earlier) are affected by an exploitable NULL pointer dereference vulnerability that could result in a crash and arbitrary code execution. Exploitation of this issue requires an attacker to insert malicious strings in an HTTP response that is by default delivered over TLS/SSL.


An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent with unexpected timing and then an invalid second handshake occurs. The crash happens in the application's error handling path where the gnutls_deinit function is called after detecting a handshake failure.


ldebug.c in Lua 5.4.0 attempts to access debug information via the line hook of a stripped function leading to a NULL pointer dereference.


Adobe InDesign version 15.1.2 (and earlier) is affected by a NULL pointer dereference bug that occurs when handling a malformed .indd file. The impact is limited to causing a denial-of-service of the client application. User interaction is required to exploit this issue.


** DISPUTED ** libraw 20.0 has a null pointer dereference vulnerability in parse_tiff_ifd in src/metadata/tiff.cpp which may result in context-dependent arbitrary code execution. Note: this vulnerability occurs only if you compile the software in a certain way.


In MidnightBSD before 1.2.6 and 1.3 before August 2020 and FreeBSD before 7 a NULL pointer dereference was found in the Linux emulation layer that allows attackers to crash the running kernel. During binary interaction td->td_emuldata in sys/compat/linux/linux_emul.h is not getting initialized and returns NULL from em_find().


hw/ide/pci.c in QEMU before 5.1.1 can trigger a NULL pointer dereference because it lacks a pointer check before an ide_cancel_dma_sync call.


In Wireshark 3.2.0 to 3.2.6 and 3.0.0 to 3.0.13 the BLIP protocol dissector has a NULL pointer dereference because a buffer was sized for compressed (not uncompressed) messages. This was addressed in epan/dissectors/packet-blip.c by allowing reasonable compression ratios and rejecting ZIP bombs.


** UNSUPPORTED WHEN ASSIGNED ** peg-markdown 0.4.14 has a NULL pointer dereference in process_raw_blocks in markdown_lib.c. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.


pci_change_irq_level in hw/pci/pci.c in QEMU before 5.1.1 has a NULL pointer dereference because pci_get_bus() might not return a valid pointer.


fdctrl_write_data in hw/block/fdc.c in QEMU 5.0.0 has a NULL pointer dereference via a NULL block pointer for the current drive.


There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0. An attacker who is able to provide crafted input to be processed by openjpeg could cause a null pointer dereference. The highest impact of this flaw is to application availability.


An issue was discovered in Foxit Reader and PhantomPDF before 10.1. There is a NULL pointer dereference via a crafted PDF document.


An exploitable denial-of-service vulnerability exists in the message-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing mDNS messages in mdns_recv the return value of the mdns_read_header function is not checked leading to an uninitialized variable usage that eventually results in a null pointer dereference leading to service crash. An attacker can send a series of mDNS messages to trigger this vulnerability.


An issue was discovered in GPAC version 0.8.0. There is a NULL pointer dereference in the function gf_isom_get_media_data_size() in isomedia/isom_read.c.


GNU LibreDWG 0.9.3.2564 has a NULL pointer dereference in get_next_owned_entity in dwg.c.


When processing a message that contains multiple S/MIME signatures a bug in the MIME processing code caused a null pointer dereference leading to an unexploitable crash. This vulnerability affects Thunderbird < 68.5.


An issue was discovered in GPAC version 0.8.0. There is a NULL pointer dereference in the function gf_m2ts_stream_process_pmt() in media_tools/m2ts_mux.c.


In GNOME evolution-data-server before 3.35.91 a malicious server can crash the mail client with a NULL pointer dereference by sending an invalid (e.g. minimal) CAPABILITY line on a connection attempt. This is related to imapx_free_capability and imapx_connect_to_server.


In GNOME Balsa before 2.6.0 a malicious server operator or man in the middle can trigger a NULL pointer dereference and client crash by sending a PREAUTH response to imap_mbox_connect in libbalsa/imap/imap-handle.c.


async.c and dict.c in libhiredis.a in hiredis through 0.14.0 allow a NULL pointer dereference because malloc return values are unchecked.


In PHP versions 7.2.x below 7.2.28 7.3.x below 7.3.15 and 7.4.x below 7.4.3 when using file upload functionality if upload progress tracking is enabled but session.upload_progress.cleanup is set to 0 (disabled) and the file upload fails the upload procedure would try to clean up data that does not exist and encounter null pointer dereference which would likely lead to a crash.


An issue was discovered in LibVNCServer before 0.9.13. libvncclient/tls_openssl.c has a NULL pointer dereference.


A flaw null pointer dereference in the Linux kernel cgroupv2 subsystem in versions before 5.7.10 was found in the way when reboot the system. A local user could use this flaw to crash the system or escalate their privileges on the system.


An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.


NULL pointer dereferences vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version \05.65.00.BD\ and earlier GT1450-QMBDE CoreOS version \05.65.00.BD\ and earlier GT1450-QLBDE CoreOS version \05.65.00.BD\ and earlier GT1455HS-QTBDE CoreOS version \05.65.00.BD\ and earlier and GT1450HS-QMBDE CoreOS version \05.65.00.BD\ and earlier) allows a remote unauthenticated attacker to stop the network functions of the products via a specially crafted packet.


Null Pointer Dereference vulnerability in TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier allows remote attackers to stop the network functions or execute malware via a specially crafted packet.


Amcrest cameras and NVR are vulnerable to a null pointer dereference over port 37777. An authenticated remote attacker can abuse this issue to crash the device.


NULL pointer dereferences vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial number are '02' or before RJ71PN92 PROFINET IO Controller Module First 2 digits of serial number are '01' or before RD81DL96 High Speed Data Logger Module First 2 digits of serial number are '08' or before RD81MES96N MES Interface Module First 2 digits of serial number are '04' or before and RD81OPC96 OPC UA Server Module First 2 digits of serial number are '04' or before) allows a remote unauthenticated attacker to stop the network functions of the products via a specially crafted packet.


TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model GT25 Model and GT23 Model) contains a null pointer dereference vulnerability which may allow a remote attacker to stop the network functions of the products or execute a malicious program via a specially crafted packet.


In tensorflow-lite before versions 1.15.4 2.0.3 2.1.2 2.2.1 and 2.3.1 a crafted TFLite model can force a node to have as input a tensor backed by a `nullptr` buffer. This can be achieved by changing a buffer index in the flatbuffer serialization to convert a read-only tensor to a read-write one. The runtime assumes that these buffers are written to before a possible read hence they are initialized with `nullptr`. However by changing the buffer index for a tensor and implicitly converting that tensor to be a read-write one as there is nothing in the model that writes to it we get a null pointer dereference. The issue is patched in commit 0b5662bc and is released in TensorFlow versions 1.15.4 2.0.3 2.1.2 2.2.1 or 2.3.1.


In

eager

mode

TensorFlow

before

versions

and

does

not

set

the

session

state.

Hence

calling

or

results

in

a

pointer

dereference

In

linked

snippet

in

eager

mode

returns

`nullptr`.

Since

code

immediately

dereferences

this

we

get

a

segmentation

fault.

The

issue

is

patched

in

commit

and

is

released

in

TensorFlow

versions

or


GNU LibreDWG before 0.11 allows NULL pointer dereferences via crafted input files.


In QEMU 4.2.0 a MemoryRegionOps object may lack read/write callback methods leading to a NULL pointer dereference.


An issue was discovered in OpenEXR before 2.5.2. An invalid tiled input file could cause invalid memory access in TiledInputFile::TiledInputFile() in IlmImf/ImfTiledInputFile.cpp as demonstrated by a NULL pointer dereference.


An issue was discovered in the Linux kernel before 5.6.1. drivers/media/usb/gspca/ov519.c allows NULL pointer dereferences in ov511_mode_init_regs and ov518_mode_init_regs when there are zero endpoints aka CID-998912346c0d.


An

issue

was

discovered

in

the

subsystem

in

the

Linux

kernel

before

and

mishandle

invalid

descriptors

as

demonstrated

by

a

pointer

dereference

aka


ACRN through 2.2 has a devicemodel/hw/pci/virtio/virtio.c NULL Pointer Dereference.


The Apache NuttX (Incubating) project provides an optional separate \apps\ repository which contains various optional components and example programs. One of these ftpd had a NULL pointer dereference bug. The NuttX RTOS itself is not affected. Users of the optional apps repository are affected only if they have enabled ftpd. Versions 6.15 to 8.2 are affected.


The IGMP component in VxWorks 6.8.3 IPNET CVE patches created in 2019 has a NULL Pointer Dereference.


A NULL pointer dereference or possible use-after-free flaw was found in Samba AD LDAP server in versions before 4.10.17 before 4.11.11 and before 4.12.4. Although some versions of Samba shipped with Red Hat Enterprise Linux do not support Samba in AD mode the affected code is shipped with the libldb package. This flaw allows an authenticated user to possibly trigger a use-after-free or NULL pointer dereference. The highest threat from this vulnerability is to system availability.


TP-Link

through

through

through

through

through

through

and

through

devices

allow

a

remote

Pointer

Dereference.


Incorrect

Error

Handling

in

Bluetooth

HCI

core.

Zephyr

versions

contain

Pointer

Dereference

For

more

information

see


In Dovecot before 2.3.10.1 unauthenticated sending of malformed parameters to a NOOP command causes a NULL Pointer Dereference and crash in submission-login submission or lmtp.


An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. janus_sdp_preparse in sdp.c has a NULL pointer dereference.


An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. janus_sdp_process in sdp.c has a NULL pointer dereference.


ZNC 1.8.0 up to 1.8.1-rc1 allows authenticated users to trigger an application crash (with a NULL pointer dereference) if echo-message is not enabled and there is no network.


ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query.


address_space_map in exec.c in QEMU 4.2.0 can trigger a NULL pointer dereference related to BounceBuffer.


parser/js/js-scanner.c in JerryScript 2.2.0 mishandles errors during certain out-of-memory conditions as demonstrated by a scanner_reverse_info_list NULL pointer dereference and a scanner_scan_all assertion failure.


A NULL pointer dereference flaw was found in the way openjpeg 2.1.2 decoded certain input images. Due to a logic error in the code responsible for decoding the input image an application using openjpeg to process image data could crash when processing a crafted image.


JasPer before version 2.0.10 is vulnerable to a null pointer dereference was found in the decoded creation of JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash.


An exploitable null pointer dereference vulnerability exists in the Web Application /forms/web_runScript iw_filename functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. An HTTP POST request with a blank line in the header will cause a segmentation fault in the web server.


An exploitable null pointer dereference exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. Any HTTP GET request not preceded by an '/' will cause a segmentation fault in the web server. An attacker can send any of a multitude of potentially unexpected HTTP get requests to trigger this vulnerability.


In OpenSSL 1.1.0 before 1.1.0c applications parsing invalid CMS structures can crash with a NULL pointer dereference. This is caused by a bug in the handling of the ASN.1 CHOICE type in OpenSSL 1.1.0 which can result in a NULL value being passed to the structure callback if an attempt is made to free certain invalid encodings. Only CHOICE structures using a callback which do not handle NULL value are affected.


In

Android

before

or

earlier

security

patch

level

on

Qualcomm

Snapdragon

Mobile

and

Snapdragon

Wear

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

and

SD

in

a

GNSS

API

function

a

pointer

dereference

can

occur.


The png_set_text_2 function in libpng 0.71 before 1.0.67 1.2.x before 1.2.57 1.4.x before 1.4.20 1.5.x before 1.5.28 and 1.6.x before 1.6.27 allows context-dependent attackers to cause a NULL pointer dereference vectors involving loading a text chunk into a png structure removing the text and then adding another text chunk to the structure.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9635M SD 210/SD 212/SD 205 SD 410/12 SD 450 SD 615/16/SD 415 SD 625 SD 650/52 SD 808 and SD 810 A NULL pointer dereference can occur during an SSL handshake.


An issue was discovered on Samsung mobile devices with KK(4.4) L(5.0/5.1) and M(6.0) (AP + CP MDM9x35 or Qualcomm Onechip) software. There is a NULL pointer dereference issue in the IPC socket code. The Samsung ID is SVE-2016-5980 (July 2016).


illumos smbsrv NULL pointer dereference allows system crash.


The getURL function in drivers/secfilter/urlparser.c in secfilter in the Samsung kernel for Android on SM-N9005 build N9005XXUGBOB6 (Note 3) and SM-G920F build G920FXXU2COH2 (Galaxy S6) devices allows attackers to trigger a NULL pointer dereference via a \GET HTTP/1.1\ request aka SVE-2016-5036.


win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP1 and SP2 Windows Server 2008 Gold SP2 R2 and R2 SP1 and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that triggers a NULL pointer dereference a different vulnerability than other \Vulnerability Type 2\ CVEs listed in MS11-034 aka \Win32k Null Pointer De-reference Vulnerability.\


win32k.sys in the kernel-mode drivers in Microsoft Windows Vista SP1 and SP2 Windows Server 2008 Gold SP2 R2 and R2 SP1 and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that triggers a NULL pointer dereference a different vulnerability than other CVEs listed in MS11-054 aka \Win32k Null Pointer De-reference Vulnerability.\


win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP1 and SP2 Windows Server 2008 Gold SP2 R2 and R2 SP1 and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that triggers a NULL pointer dereference a different vulnerability than other CVEs listed in MS11-054 aka \Win32k Null Pointer De-reference Vulnerability.\


win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP3 allows local users to gain privileges via a crafted application that triggers a NULL pointer dereference aka \Win32k Null Pointer De-reference Vulnerability.\


NULL Pointer Dereference in GitHub repository gpac/gpac prior to 1.1.0.


Null pointer dereference in SuiteLink server while processing command 0x07


Null pointer dereference in SuiteLink server while processing commands 0x04/0x0a


Null pointer dereference in SuiteLink server while processing command 0x0b


Null pointer dereference in SuiteLink server while processing commands 0x03/0x10


NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.4.


NULL Pointer Dereference in Homebrew mruby prior to 3.2.


NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4428.


NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.0.


NULL Pointer Dereference in GitHub repository mruby/mruby prior to 3.2.


NULL Pointer Dereference in mrb_vm_exec with super in GitHub repository mruby/mruby prior to 3.2. This vulnerability is capable of making the mruby interpreter crash thus affecting the availability of the system.


NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of making the radare2 crash thus affecting the availability of the system.


NULL pointer dereference in Samsung Exynos fimg2d driver for Android L(5.0/5.1) and M(6.0) allows attackers to have unspecified impact via unknown vectors. The Samsung ID is SVE-2016-6382.


In Poppler 0.59.0 a NULL Pointer Dereference exists in the SplashOutputDev::type3D0() function in SplashOutputDev.cc via a crafted PDF document.


In Poppler 0.59.0 a NULL Pointer Dereference exists in AnnotRichMedia::Content::Content in Annot.cc via a crafted PDF document.


In Poppler 0.59.0 a NULL Pointer Dereference exists in the XRef::parseEntry() function in XRef.cc via a crafted PDF document.


In

Poppler

a

Pointer

Dereference

exists

in

AnnotRichMedia::Configuration::Configuration

in

Annot.cc

via

a

crafted

PDF

document.


In Poppler 0.59.0 a NULL Pointer Dereference exists in the GfxImageColorMap::getGrayLine() function in GfxState.cc via a crafted PDF document.


ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function sixel_decode in coders/sixel.c.


ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function PostscriptDelegateMessage in coders/ps.c.


ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function sixel_output_create in coders/sixel.c.


ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in PDFDelegateMessage in coders/pdf.c.


ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in ReadEnhMetaFile in coders/emf.c.


ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in ReadOneMNGImage in coders/png.c.


Moddable SDK v11.5.0 was discovered to contain a NULL pointer dereference in the component fx_Function_prototype_hasInstance.


When SWFTools 0.9.2 processes a crafted file in swfcombine it can lead to a NULL Pointer Dereference in the swf_Relocate() function in lib/modules/swftools.c.


When SWFTools 0.9.2 processes a crafted file in swfcombine it can lead to a NULL Pointer Dereference in the swf_DeleteFilter() function in lib/modules/swffilter.c.


When SWFTools 0.9.2 processes a crafted file in swfc it can lead to a NULL Pointer Dereference in the dict_lookup() function in lib/q.c.


In the Linux kernel 5.0.21 mounting a crafted f2fs filesystem image can cause a NULL pointer dereference in f2fs_recover_fsync_data in fs/f2fs/recovery.c. This is related to F2FS_P_SB in fs/f2fs/f2fs.h.


In the Linux kernel 4.15.0 a NULL pointer dereference was discovered in hfs_ext_read_extent in hfs.ko. This can occur during a mount of a crafted hfs filesystem.


In the Linux kernel through 4.14.13 the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where page pinning fails or an invalid address is supplied leading to an rds_atomic_free_op NULL pointer dereference.


A vulnerability was found while fuzzing libbpg 0.9.7. It is a NULL pointer dereference issue due to missing check of the return value of function malloc in the BPG encoder. This vulnerability appeared while converting a malicious JPEG file to BPG.


NVIDIA Windows GPU Display Driver for Windows all versions contains a vulnerability in the kernel driver (nvlddmkm.sys) where a NULL pointer dereference may lead to system crash.


In Wireshark 2.6.0 2.4.0 to 2.4.6 and 2.2.0 to 2.2.14 the DNS dissector could crash. This was addressed in epan/dissectors/packet-dns.c by avoiding a NULL pointer dereference for an empty name in an SRV record.


In Wireshark 2.6.0 2.4.0 to 2.4.6 and 2.2.0 to 2.2.14 the RRC dissector and other dissectors could crash. This was addressed in epan/proto.c by avoiding a NULL pointer dereference.


Luxion KeyShot versions prior to 10.1 Luxion KeyShot Viewer versions prior to 10.1 Luxion KeyShot Network Rendering versions prior to 10.1 and Luxion KeyVR versions prior to 10.1 have multiple NULL pointer dereference issues while processing project files which may allow an attacker to execute arbitrary code.

null pointer dereference
arbitrary code execution


Integer signedness error in the fourxm_read_header function in libavformat/4xm.c in FFmpeg before revision 16846 allows remote attackers to execute arbitrary code via a malformed 4X movie file with a large current_track value which triggers a NULL pointer dereference.


Delta Electronics DOPSoft Version 4.0.8.21 and prior has a null pointer dereference issue while processing project files which may allow an attacker to execute arbitrary code.


Delta Electronics CNCSoft-B Versions 1.0.0.2 and prior has a null pointer dereference issue while processing project files which may allow an attacker to execute arbitrary code.


NULL Pointer Dereference in the \isomedia/track.c\ module's \MergeTrack()\ function of GPAC v0.5.2 allows attackers to execute arbitrary code or cause a Denial-of-Service (DoS) by uploading a malicious MP4 file.

null pointer dereference
arbitrary code execution
dos


pointer

dereference

in

in

in

GitHub

repository

prior

to

It

is

likely

to

be

exploitable.

For

more

general

description

of

heap

buffer

overflow

see

null pointer dereference
buffer overflow


A NULL pointer dereference in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via malformed commands.

null pointer dereference
denial of service
null pointer dereference


A NULL pointer dereference in the get_window function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service by opening a crafted Ogg Vorbis file.


A NULL pointer dereference in the function ReadPANGOImage in coders/pango.c and the function ReadVIDImage in coders/vid.c in ImageMagick 7.0.8-34 allows remote attackers to cause a denial of service via a crafted image.


A NULL pointer dereference vulnerability in the function nfc_genl_deactivate_target() in net/nfc/netlink.c in the Linux kernel before 5.1.13 can be triggered by a malicious user-mode program that omits certain NFC attributes leading to denial of service.


A null pointer dereference was addressed with improved input validation. This issue is fixed in AirPort Base Station Firmware Update 7.8.1 AirPort Base Station Firmware Update 7.9.1. A remote attacker may be able to cause a system denial of service.


A null pointer dereference in src/amf/namf-handler.c in Open5GS 2.3.6 and earlier allows remote attackers to Denial of Service via a crafted sbi request to amf.


A Null Pointer Dereference vulnerability exitgs in GPAC 1.0.1 in MP4Box via __strlen_avx2 which causes a Denial of Service.


A NULL pointer dereference in Busybox's man applet leads to denial of service when a section name is supplied but no page argument is given


A Null Pointer Dereference vulnerability exists in GPAC 1.1.0 via the xtra_box_write function in /box_code_base.c which causes a Denial of Service. This vulnerability was fixed in commit 71f9871.


A null pointer dereference vulnerability was found in the function stackswap (called from decompileSTACKSWAP) in util/decompile.c in Ming 0.4.8 which allows attackers to cause a denial of service via a crafted file.


A NULL pointer dereference was discovered in the AP4_DataAtom class in MetaData/Ap4MetaData.cpp in Bento4 version 1.5.0-617. The vulnerability causes a segmentation fault and application crash which leads to remote denial of service.


A NULL pointer dereference was discovered in sync_buffer in interface.c in mpglibDBL as used in MP3Gain version 1.5.2. The vulnerability causes a segmentation fault and application crash which leads to remote denial of service.


A NULL pointer dereference was discovered in AP4_AtomSampleTable::GetSample in Core/Ap4AtomSampleTable.cpp in Bento4 version 1.5.0-617. The vulnerability causes a segmentation fault and application crash which leads to remote denial of service.


A NULL pointer dereference was discovered in Exiv2::Image::printIFDStructure in image.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash which leads to denial of service.


A NULL pointer dereference vulnerability exists in the function PdfTranslator::setTarget() in pdftranslator.cpp of PoDoFo 0.9.6 while creating the PdfXObject as demonstrated by podofoimpose. It allows an attacker to cause Denial of Service.


A NULL pointer dereference was discovered in ic_predict of libfaad/ic_predict.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash which leads to denial of service.


A null pointer dereference vulnerability in Fortinet FortiClientWindows 6.0.2 and earlier allows attacker to cause a denial of service via the NDIS miniport driver.


A NULL pointer dereference was discovered in H5S_hyper_make_spans in H5Shyper.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service attack.


A NULL pointer dereference was discovered in H5O__chunk_deserialize in H5Ocache.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service attack.


A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of service


A NULL pointer dereference in H5O_sdspace_encode() in H5Osdspace.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service via a crafted HDF5 file.


A NULL pointer dereference in XFAForm::scanFields in XFAForm.cc in xpdf 4.00 allows attackers to launch denial of service via a specific pdf file as demonstrated by pdftohtml.


A NULL pointer dereference was discovered in newVar3 in util/decompile.c in libming 0.4.8. The vulnerability causes a segmentation fault and application crash which leads to denial of service.


A NULL pointer dereference in JPXStream::fillReadBuf in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service via a specific pdf file as demonstrated by pdftohtml.


A null pointer dereference issue exists in GNU LibreDWG 0.10.2641 via htmlescape ../../programs/escape.c:29. which causes a denial of service (application crash).


A NULL pointer dereference in vrend_renderer.c in virglrenderer through 0.8.1 allows attackers to cause a denial of service via commands that attempt to launch a grid without previously providing a Compute Shader (CS).


A null pointer dereference vulnerability in devices/gdevtsep.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted postscript file. This is fixed in v9.51.


A null pointer dereference vulnerability in devices/vector/gdevtxtw.c and psi/zbfont.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted postscript file. This is fixed in v9.51.


A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.35 in scan_unit_for_symbols as demonstrated in addr2line that can cause a denial of service via a crafted file.


A null pointer dereference vulnerability in clj_media_size() in devices/gdevclj.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.


A NULL pointer dereference vulnerability in the Autodesk FBX-SDK versions 2019.0 and earlier may lead to denial of service of the application.


A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15 before 4.12.9 and before 4.13.1. A local user could use this flaw to crash the winbind service causing denial of service.


A NULL pointer dereference in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to cause a denial of service GHSL-2020-079.


A NULL pointer dereference in sanei_epson_net_read in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to cause a denial of service aka GHSL-2020-075.


A NULL pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf_node_unregister () at scenegraph/base_scenegraph.c. This vulnerability can lead to a Denial of Service (DoS).

null pointer dereference
denial of service
null pointer dereference
dos


A NULL pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf_dump_vrml_sffield () at scene_manager/scene_dump.c. This vulnerability can lead to a Denial of Service (DoS).


A NULL pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf_sg_destroy_routes () at scenegraph/vrml_route.c. This vulnerability can lead to a Denial of Service (DoS).


A NULL pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf_sg_vrml_field_pointer_del () at scenegraph/vrml_tools.c. This vulnerability can lead to a Denial of Service (DoS).


A null pointer dereference was discovered in ucompthread in stream.c in Irzip 0.631 which allows attackers to cause a denial of service (DOS) via a crafted compressed file.


A null pointer dereference was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.4 Safari 14.1.1 iOS 14.6 and iPadOS 14.6. A remote attacker may be able to cause a denial of service.


A NULL pointer dereference in the main() function dhry_1.c of dhrystone 2.1 causes a denial of service (DoS).


A NULL pointer dereference in the function TextPage::restoreState of pdf2xml v2.0 allows attackers to cause a denial of service (DoS).


A null pointer dereference was discovered lzo_decompress_buf in stream.c in Irzip 0.621 which allows an attacker to cause a denial of service (DOS) via a crafted compressed file.


In libwebm before 2019-03-08 a NULL pointer dereference caused by the functions OutputCluster and OutputTracks in webm_info.cc will trigger an abort which allows a DoS attack a similar issue to CVE-2018-19212.


Netwide Assembler (NASM) 2.14rc15 has a NULL pointer dereference in the function find_label in asm/labels.c that will lead to a DoS attack.


In Zeek Network Security Monitor (formerly known as Bro) before 2.6.2 a NULL pointer dereference in the Kerberos (aka KRB) protocol parser leads to DoS because a case-type index is mishandled.


TightVNC code version 1.3.10 contains null pointer dereference in HandleZlibBPP function which results Denial of System (DoS). This attack appear to be exploitable via network connectivity.


DOS:

Incorrect

Frame

Validation

for

Omitted

Source

Dest

Addresses.

Zephyr

versions

contain

Pointer

Dereference

Attempt

to

Access

Child

of

a

Non-structure

Pointer

For

more

information

see


NULL Pointer Dereference in MELSEC-F Series FX3U-ENET firmware version 1.14 and prior FX3U-ENET-L firmware version 1.14 and prior and FX3U-ENET-P502 firmware version 1.14 and prior allows a remote unauthenticated attacker to cause a DoS condition in communication by sending specially crafted packets. Control by MELSEC-F series PLC is not affected and system reset is required for recovery.


While fuzzing the 2.4.49 httpd a new null pointer dereference was detected during HTTP/2 request processing allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.


** DISPUTED ** Null Pointer Dereference vulnerability exists in numpy.sort in NumPy &lt and 1.19 in the PyArray_DescrNew function due to missing return-value validation which allows attackers to conduct DoS attacks by repetitively creating sort arrays. NOTE: While correct that validation is missing an error can only occur due to an exhaustion of memory. If the user can exhaust memory they are already privileged. Further it should be practically impossible to construct an attack which can target the memory exhaustion to occur at exactly this place.


Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status code indicating why the request was rejected. This rejection response was not fully initialised in the HTTP/2 protocol handler if the offending header was the very first one received or appeared in a a footer. This led to a NULL pointer dereference on initialised memory crashing reliably the child process. Since such a triggering HTTP/2 request is easy to craft and submit this can be exploited to DoS the server. This issue affected mod_http2 1.15.17 and Apache HTTP Server version 2.4.47 only. Apache HTTP Server 2.4.47 was never released.


An issue was discovered in ImageMagick 6.9.7. A specially crafted psd file could lead to a NULL pointer dereference (thus a DoS).


LibVNC

before

commit

contains

pointer

dereference

in

VNC

client

code

that

can

result

DoS.


libarchive

version

commit

onwards

(release

onwards)

contains

a

Pointer

Dereference

vulnerability

in

ACL

parser

that

can

result

in

Crash/DoS.

This

attack

appear

to

be

exploitable

via

the

victim

must

open

a

specially

crafted

archive

file.


An issue was discovered in FreeType 2 through 2.9. A NULL pointer dereference in the Ins_GETVARIATION() function within ttinterp.c could lead to DoS via a crafted font file.


A NULL pointer dereference flaw in Linux kernel versions prior to 5.11 may be seen if sco_sock_getsockopt function in net/bluetooth/sco.c do not have a sanity check for a socket connection when using BT_SNDMTU/BT_RCVMTU for SCO sockets. This could allow a local attacker with a special user privilege to crash the system (DOS) or leak kernel internal information.


Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a NULL Pointer Dereference that leads to a DoS in discoveryd


QEMU (aka Quick Emulator) built with the TPR optimization for 32-bit Windows guests support is vulnerable to a null pointer dereference flaw. It occurs while doing I/O port write operations via hmp interface. In that 'current_cpu' remains null which leads to the null pointer dereference. A user or process could use this flaw to crash the QEMU instance resulting in DoS issue.


QEMU (aka Quick Emulator) built with an IDE AHCI emulation support is vulnerable to a null pointer dereference flaw. It occurs while unmapping the Frame Information Structure (FIS) and Command List Block (CLB) entries. A privileged user inside guest could use this flaw to crash the QEMU process instance resulting in DoS.


QEMU (aka Quick Emulator) built with the USB EHCI emulation support is vulnerable to a null pointer dereference flaw. It could occur when an application attempts to write to EHCI capabilities registers. A privileged user inside quest could use this flaw to crash the QEMU process instance resulting in DoS.


Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privilege via local access.

null pointer dereference
escalated privilege


NULL pointer dereference in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of privilege via local access.


FTPGetter Professional 5.97.0.223 is vulnerable to a memory corruption bug when a user sends a specially crafted string to the application. This memory corruption bug can possibly be classified as a NULL pointer dereference.

null pointer dereference
memory corruption


pointer

dereference

occurs

for

channel

context

while

opening

glink

channel

in

Snapdragon

Auto

Snapdragon

Consumer

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


pointer

dereference

during

secure

application

termination

using

specific

application

ids.

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wired

Infrastructure

and

Networking

in

Qualcomm

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


A NULL pointer dereference is present in libyang before v1.0-r3 in the function lys_extension_instances_free() due to a copy of unresolved extensions in lys_restr_dup(). Applications that use libyang to parse untrusted input yang files may crash.


A NULL pointer dereference was discovered in wasm::Module::getFunctionOrNull in wasm/wasm.cpp in Binaryen 1.38.22. A crafted input can cause segmentation faults leading to denial-of-service as demonstrated by wasm-opt.