The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.15.15 does not always initialize the crc32c checksum driver which allows attackers to cause a denial of service (ext4_xattr_inode_hash NULL pointer dereference and system crash) via a crafted ext4 image.


Linux kernel before version 4.16-rc7 is vulnerable to a null pointer dereference in dccp_write_xmit() function in net/dccp/output.c in that allows a local user to cause a denial of service by a number of certain crafted system calls.

denial of service
null pointer dereference


The netfilter subsystem in the Linux kernel through 4.15.7 mishandles the case of a rule blob that contains a jump but lacks a user-defined chain which allows local users to cause a denial of service (NULL pointer dereference) by leveraging the CAP_NET_RAW or CAP_NET_ADMIN capability related to arpt_do_table in net/ipv4/netfilter/arp_tables.c ipt_do_table in net/ipv4/netfilter/ip_tables.c and ip6t_do_table in net/ipv6/netfilter/ip6_tables.c.


The Squid Software Foundation Squid HTTP Caching Proxy version prior to version 4.0.23 contains a NULL Pointer Dereference vulnerability in HTTP Response X-Forwarded-For header processing that can result in Denial of Service to all clients of the proxy. This attack appear to be exploitable via Remote HTTP server responding with an X-Forwarded-For header to certain types of HTTP request. This vulnerability appears to have been fixed in 4.0.23 and later.


A NULL Pointer Dereference of CWE-476 exists in quassel version 0.12.4 in the quasselcore void CoreAuthHandler::handle(const Login &msg) coreauthhandler.cpp line 235 that allows an attacker to cause a denial of service.


The Linux kernel before 4.15-rc8 was found to be vulnerable to a NULL pointer dereference bug in the __netlink_ns_capable() function in the net/netlink/af_netlink.c file. A local attacker could exploit this when a net namespace with a netnsid is assigned to cause a kernel panic and a denial of service.


A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.


dwg_obj_block_control_get_block_headers in dwg_api.c in GNU LibreDWG 0.5.1048 allows remote attackers to cause a denial of service (NULL pointer dereference and SEGV) via a crafted dwg file.


An

issue

was

discovered

in

MIT

Kerberos

(aka

through

The

pre-defined

function

\strlen\

is

getting

a

\NULL\

string

as

a

parameter

value

in

in

the

Key

Distribution

Center

(KDC)

which

allows

remote

authenticated

users

to

cause

a

denial

of

service

(NULL

pointer

dereference)

via

a

modified

kadmin

client.


A NULL Pointer Dereference issue was discovered in Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. The application does not check for a NULL value allowing for an attacker to perform a denial of service attack.


MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer dereference) or bypass a DN container check by supplying tagged data that is internal to the database module.


An issue was discovered in certain Apple products. iOS before 11.3 is affected. The issue involves the \Telephony\ component. It allows remote attackers to cause a denial of service (NULL pointer dereference and reboot) via a Class 0 SMS message.


An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. An HTTP POST request with a specially crafted \Host\ header field may cause a NULL pointer dereference and thus cause a denial of service as demonstrated by the lack of a trailing '' character in an IPv6 address.


An issue was discovered in WAVM before 2018-09-16. The run function in Programs/wavm/wavm.cpp does not check whether there is Emscripten memory to store the command-line arguments passed by the input WebAssembly file's main function which allows attackers to cause a denial of service (application crash by NULL pointer dereference) or possibly have unspecified other impact by crafting certain WebAssembly files.


blocking_request.cgi on ASUS GT-AC5300 devices through 3.0.0.4.384_32738 allows remote attackers to cause a denial of service (NULL pointer dereference and device crash) via a request that lacks a timestap parameter.


In FreeBSD before 11.2-STABLE(r338987) 11.2-RELEASE-p4 and 11.1-RELEASE-p15 due to insufficient memory checking in the freebsd4_getfsstat system call a NULL pointer dereference can occur. Unprivileged authenticated local users may be able to cause a denial of service.


An issue was discovered in GNU patch through 2.7.6. There is a segmentation fault associated with a NULL pointer dereference leading to a denial of service in the intuit_diff_type function in pch.c aka a \mangled rename\ issue.


An issue was discovered in Xen 4.8.x through 4.10.x allowing x86 PVH guest OS users to cause a denial of service (NULL pointer dereference and hypervisor crash) by leveraging the mishandling of configurations that lack a Local APIC.


In libgraphite2 in graphite2 1.3.11 a NULL pointer dereference vulnerability was found in Segment.cpp during a dumbRendering operation which may allow attackers to cause a denial of service or possibly have unspecified other impact via a crafted .ttf file.


The

assign_file_positions_for_non_load_sections

function

in

elf.c

in

the

Binary

File

Descriptor

(BFD)

library

(aka

libbfd)

as

distributed

in

GNU

Binutils

allows

remote

attackers

to

cause

a

denial

of

service

(NULL

pointer

dereference

and

application

crash)

via

an

ELF

file

with

a

RELRO

segment

that

lacks

a

matching

LOAD

segment

as

demonstrated

by

objcopy.


An issue was discovered in xpdf 4.00. A NULL pointer dereference in readCodestream allows an attacker to cause denial of service via a JPX image with zero components.


The swap_std_reloc_in function in aoutx.h in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.30 allows remote attackers to cause a denial of service (aout_32_swap_std_reloc_out NULL pointer dereference and application crash) via a crafted ELF file as demonstrated by objcopy.


In the tun subsystem in the Linux kernel before 4.13.14 dev_get_valid_name is not called before register_netdevice. This allows local users to cause a denial of service (NULL pointer dereference and panic) via an ioctl(TUNSETIFF) call with a dev name containing a / character. This is similar to CVE-2013-4343.


asm/labels.c in Netwide Assembler (NASM) is prone to NULL Pointer Dereference which allows the attacker to cause a denial of service via a crafted file.


The gf_dash_segmenter_probe_input function in GPAC v0.8 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.


A NULL pointer dereference flaw was found in the SCSI emulation support of QEMU in versions before 6.0.0. This flaw allows a privileged guest user to crash the QEMU process on the host resulting in a denial of service. The highest threat from this vulnerability is to system availability.


smtpd/lka_filter.c in OpenSMTPD before 6.8.0p1 in certain configurations allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted pattern of client activity because the filter state machine does not properly maintain the I/O channel between the SMTP engine and the filters layer.


A NULL pointer dereference flaw was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0. This issue occurs while handling the 'Information Transfer' command. This flaw allows a privileged guest user to crash the QEMU process on the host resulting in a denial of service. The highest threat from this vulnerability is to system availability.


A NULL pointer dereference flaw was found in the megasas-gen2 SCSI host bus adapter emulation of QEMU in versions before and including 6.0. This issue occurs in the megasas_command_cancelled() callback function while dropping a SCSI request. This flaw allows a privileged guest user to crash the QEMU process on the host resulting in a denial of service. The highest threat from this vulnerability is to system availability.


An issue was discovered in gpac before 1.0.1. A NULL pointer dereference exists in the function dump_isom_sdp located in filedump.c. It allows an attacker to cause Denial of Service.


An issue was discovered in Bento4 through v1.6.0-637. A NULL pointer dereference exists in the function AP4_StszAtom::GetSampleSize() located in Ap4StszAtom.cpp. It allows an attacker to cause Denial of Service.


An issue was discovered in cpp-peglib through v0.1.12. A NULL pointer dereference exists in the peg::AstOptimizer::optimize() located in peglib.h. It allows an attacker to cause Denial of Service.


An issue was discovered in gpac through 20200801. A NULL pointer dereference exists in the function nhmldump_send_header located in write_nhml.c. It allows an attacker to cause Denial of Service.


In OSSEC-HIDS 2.7 through 3.5.0 the server component responsible for log analysis (ossec-analysisd) is vulnerable to a denial of service (NULL pointer dereference) via crafted messages written directly to the analysisd UNIX domain socket by a local user.


An issue was discovered in function latm_write_packet in libavformat/latmenc.c in Ffmpeg 4.2.1 allows attackers to cause a Denial of Service or other unspecified impacts due to a Null pointer dereference.


A Null pointer dereference vulnerability exits in MP4Box - GPAC version 0.8.0-rev177-g51a8ef874-master via the gf_isom_get_track_id function which causes a denial of service.


Null Pointer Dereference. in xObjectBindingFromExpression at moddable/xs/sources/xsSyntaxical.c:3419 in Moddable SDK before OS200908 causes a denial of service (SEGV).


A NULL pointer dereference was found in OpenLDAP server and was fixed in openldap 2.4.55 during a request for renaming RDNs. An unauthenticated attacker could remotely crash the slapd process by sending a specially crafted request causing a Denial of Service.


An issue was discovered in libxls before and including 1.6.1 when reading Microsoft Excel files. A NULL pointer dereference vulnerability exists when parsing XLS cells in libxls/xls2csv.c:199. It could allow a remote attacker to cause a denial of service via crafted XLS file.


A

pointer

dereference

vulnerability

in

compose_group_nonknockout_nonblend_isolated_allmask_common()

in

base/gxblend.c

of

Artifex

Software

GhostScript

allows

a

remote

attacker

to

cause

a

denial

of

service

via

a

crafted

PDF

file.

This

is

fixed

in


A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.35 in _bfd_elf_get_symbol_version_string as demonstrated in nm-new that can cause a denial of service via a crafted file.


In uftpd before 2.12 handle_CWD in ftpcmd.c mishandled the path provided by the user causing a NULL pointer dereference and denial of service as demonstrated by a CWD /.. command.


Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to a denial of service attack against the TR-069 service. An unauthenticated remote attacker can stop the service due to a NULL pointer dereference in the TR-069 service. This condition is triggered due to mishandling of the HTTP Authentication field.


Appweb before 7.2.2 and 8.x before 8.1.0 when built with CGI support mishandles an HTTP request with a Range header that lacks an exact range. This may result in a NULL pointer dereference and cause a denial of service.


An issue was discovered in Xen through 4.14.x. When a Xenstore watch fires the xenstore client that registered the watch will receive a Xenstore message containing the path of the modified Xenstore entry that triggered the watch and the tag that was specified when registering the watch. Any communication with xenstored is done via Xenstore messages consisting of a message header and the payload. The payload length is limited to 4096 bytes. Any request to xenstored resulting in a response with a payload longer than 4096 bytes will result in an error. When registering a watch the payload length limit applies to the combined length of the watched path and the specified tag. Because watches for a specific path are also triggered for all nodes below that path the payload of a watch event message can be longer than the payload needed to register the watch. A malicious guest that registers a watch using a very large tag (i.e. with a registration operation payload length close to the 4096 byte limit) can cause the generation of watch events with a payload length larger than 4096 bytes by writing to Xenstore entries below the watched path. This will result in an error condition in xenstored. This error can result in a NULL pointer dereference leading to a crash of xenstored. A malicious guest administrator can cause xenstored to crash leading to a denial of service. Following a xenstored crash domains may continue to run but management operations will be impossible. Only C xenstored is affected oxenstored is not affected.


Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the \signature_algorithms_cert\ TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d 1.1.1e and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).


The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL's s_server s_client and verify tools have support for the \-crl_download\ option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w).


A NULL pointer dereference vulnerability in Palo Alto Networks PAN-OS allows an authenticated administrator to send a request that causes the rasmgr daemon to crash. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode. This issue affects: PAN-OS 9.1 versions earlier than 9.1.2.


An issue was discovered in HDF5 through 1.12.0. A NULL pointer dereference exists in the function H5AC_unpin_entry() located in H5AC.c. It allows an attacker to cause Denial of Service.


A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. This flaw occurs while importing the Commercial IP Security Option (CIPSO) protocol's category bitmap into the SELinux extensible bitmap via the' ebitmap_netlbl_import' routine. While processing the CIPSO restricted bitmap tag in the 'cipso_v4_parsetag_rbm' routine it sets the security attribute to indicate that the category bitmap is present even if it has not been allocated. This issue leads to a NULL pointer dereference issue while importing the same category bitmap into SELinux. This flaw allows a remote network user to crash the system kernel resulting in a denial of service.


A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0 and fixed in libvirt 6.0.0 for fetching a storage pool based on its target path. In more detail this flaw affects storage pools created without a target path such as network-based pools like gluster and RBD. Unprivileged users with a read-only connection could abuse this flaw to crash the libvirt daemon resulting in a potential denial of service.


An issue was discovered in HDF5 through 1.12.0. A NULL pointer dereference exists in the function H5F_get_nrefs() located in H5Fquery.c. It allows an attacker to cause Denial of Service.


A vulnerability in the EGG archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.102.0 - 0.102.3 could allow an unauthenticated remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a null pointer dereference. An attacker could exploit this vulnerability by sending a crafted EGG file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash resulting in a denial of service condition.


Cherokee 0.4.27 to 1.2.104 is affected by a denial of service due to a NULL pointer dereferences. A remote unauthenticated attacker can crash the server by sending an HTTP request to protected resources using a malformed Authorization header that is mishandled during a cherokee_buffer_add call within cherokee_validator_parse_basic or cherokee_validator_parse_digest.


Portable UPnP SDK (aka libupnp) 1.12.1 and earlier allows remote attackers to cause a denial of service (crash) via a crafted SSDP message due to a NULL pointer dereference in the functions FindServiceControlURLPath and FindServiceEventURLPath in genlib/service_table/service_table.c.


Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers leading to a Denial of Service


Artifex

Software

Inc.

MuJS

before

allows

context-dependent

attackers

to

conduct

\denial

of

service

(application

crash)\

attacks

by

using

the

\malformed

labeled

break/continue

in

JavaScript\

approach

related

to

a

\NULL

pointer

dereference\

issue

affecting

the

jscompile.c

component.


The TIFFFetchNormalTag function in LibTiff 4.0.6 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by setting the tags TIFF_SETGET_C16ASCII or TIFF_SETGET_C32_ASCII to values that access 0-byte arrays. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9297.


The dumpBuffer function in read.c in the listswf tool in libming 0.4.7 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted SWF file.


The _parse_pat function in the mpegts parser in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file.


ext/wddx/wddx.c in PHP before 5.6.28 and 7.x before 7.0.13 allows remote attackers to cause a denial of service (NULL pointer dereference) via crafted serialized data in a wddxPacket XML document as demonstrated by a PDORow string.


A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null pointer check for the variable folders.PackPositions in function CInArchive::ReadAndDecodePackedStreams in CPP/7zip/Archive/7z/7zIn.cpp as used in the 7z.so library and in 7z applications will cause a crash and a denial of service when decoding malformed 7z files.


coders/tiff.c in ImageMagick before 7.0.3.7 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted image.


security/keys/big_key.c in the Linux kernel before 4.8.7 mishandles unsuccessful crypto registration in conjunction with successful key-type registration which allows local users to cause a denial of service (NULL pointer dereference and panic) or possibly have unspecified other impact via a crafted application that uses the big_key data type.


The git_oid_nfmt function in commit.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a cat-file command with a crafted object file.


The bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted BMP image a different vulnerability than CVE-2016-8694 and CVE-2016-8695.


The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer 1.900.5 allows remote attackers to cause a denial of service (NULL pointer dereference) by calling the imginfo command with a crafted BMP image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8690.


The v9fs_iov_vunmarshal function in fsdev/9p-iov-marshal.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) by sending an empty string parameter to a 9P operation.


The get_vlc2 function in get_bits.h in Libav 11.9 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted mp3 file. NOTE: this issue exists due to an incomplete fix for CVE-2016-8675.


The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer before 1.900.9 allows remote attackers to cause a denial of service (NULL pointer dereference) by calling the imginfo command with a crafted BMP image.


The bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted BMP image a different vulnerability than CVE-2016-8694 and CVE-2016-8696.


The jp2_colr_destroy function in libjasper/jp2/jp2_cod.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (NULL pointer dereference).


The jpc_dec_tilefini function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file.


The bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted BMP image a different vulnerability than CVE-2016-8695 and CVE-2016-8696.


The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer before 1.900.5 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted BMP image in an imginfo command.


The get_vlc2 function in get_bits.h in Libav before 11.9 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted mp3 file possibly related to startcode sequences during m4v detection.


convert.c in OpenJPEG before 2.1.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors involving the variable s.


The php_wddx_pop_element function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via an invalid base64 binary value as demonstrated by a wddx_deserialize call that mishandles a binary element in a wddxPacket XML document.


The graphic acceleration functions in VMware Tools 9.x and 10.x before 10.0.9 on OS X allow local users to gain privileges or cause a denial of service (NULL pointer dereference) via unspecified vectors a different vulnerability than CVE-2016-7080.


An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue involves the \CoreGraphics\ component. It allows attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted font.


The graphic acceleration functions in VMware Tools 9.x and 10.x before 10.0.9 on OS X allow local users to gain privileges or cause a denial of service (NULL pointer dereference) via unspecified vectors a different vulnerability than CVE-2016-7079.


fs/fcntl.c in the \aufs 3.2.x+setfl-debian\ patch in the linux-image package 3.2.0-4 (kernel 3.2.81-1) in Debian wheezy mishandles F_SETFL fcntl calls on directories which allows local users to cause a denial of service (NULL pointer dereference and system crash) via standard filesystem operations as demonstrated by scp from an AUFS filesystem.


ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via a malformed wddxPacket XML document that is mishandled in a wddx_deserialize call as demonstrated by a tag that lacks a < (less than) character.


An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the \CoreStorage\ component. It allows local users to cause a denial of service (NULL pointer dereference) via unspecified vectors.


The virtqueue_map_desc function in hw/virtio/virtio.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via a large I/O descriptor buffer length value.


An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the \AppleGraphicsPowerManagement\ component. It allows local users to cause a denial of service (NULL pointer dereference) via unspecified vectors.


The ff_put_pixels8_xy2_mmx function in rnd_template.c in Libav 11.7 allows remote attackers to cause a denial of service (invalid memory access and crash) via a crafted mp3 file. NOTE: this issue was originally reported as involving a NULL pointer dereference.


The put_no_rnd_pixels8_xy2_mmx function in x86/rnd_template.c in libav 11.7 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted MP3 file.


An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the \Bluetooth\ component. It allows attackers to cause a denial of service (NULL pointer dereference) via a crafted app.


ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via an invalid wddxPacket XML document that is mishandled in a wddx_deserialize call as demonstrated by a stray element inside a boolean element leading to incorrect pop processing.


An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the \CoreCapture\ component. It allows local users to cause a denial of service (NULL pointer dereference) via unspecified vectors.


crypto/x509/x509_vfy.c in OpenSSL 1.0.2i allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) by triggering a CRL operation.


sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message as demonstrated by Honggfuzz related to kex.c and packet.c.


The jpc_tsfb_synthesize function in jpc_tsfb.c in JasPer before 1.900.9 allows remote attackers to cause a denial of service (NULL pointer dereference) via vectors involving an empty sequence.


The jp2_colr_destroy function in jp2_cod.c in JasPer before 1.900.13 allows remote attackers to cause a denial of service (NULL pointer dereference) by leveraging incorrect cleanup of JP2 box data on error. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8887.


The php_wddx_pop_element function in ext/wddx/wddx.c in PHP 7.0.x before 7.0.15 and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an inapplicable class name in a wddxPacket XML document leading to mishandling in a wddx_deserialize call.


The Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via an empty packet line.


NULL pointer dereference vulnerabilities in the imagetopnm function in convert.c sycc444_to_rgb function in color.c color_esycc_to_rgb function in color.c and sycc422_to_rgb function in color.c in OpenJPEG before 2.2.0 allow remote attackers to cause a denial of service (application crash) via crafted j2k files.


crypto/mcryptd.c in the Linux kernel before 4.8.15 allows local users to cause a denial of service (NULL pointer dereference and system crash) by using an AF_ALG socket with an incompatible algorithm as demonstrated by mcryptd(md5).


libyara/lexer.l in YARA 3.5.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted rule that is mishandled in the yy_get_next_buffer function.


The pdf14_pop_transparency_group function in base/gdevp14.c in the PDF Transparency module in Artifex Software Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file.


regexp.c in Artifex Software Inc. MuJS allows attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to regular expression compilation.


The gs_makewordimagedevice function in base/gsdevmem.c in Artifex Software Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file that is mishandled in the PDF Transparency module.


The archive_wstring_append_from_mbs function in archive_string.c in libarchive 3.2.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted archive file.


epan/dissectors/packet-ncp2222.inc in the NDS dissector in Wireshark 1.12.x before 1.12.13 does not properly maintain a ptvc data structure which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted packet.


drivers/infiniband/ulp/srpt/ib_srpt.c in the Linux kernel before 4.5.1 allows local users to cause a denial of service (NULL pointer dereference and system crash) by using an ABORT_TASK command to abort a device write operation.


The exif_process_user_comment function in ext/exif/exif.c in PHP before 5.5.38 5.6.x before 5.6.24 and 7.x before 7.0.9 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted JPEG image.


OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (NULL pointer dereference and panic) via a sysctl call with a path starting with 10 9.


fs/pnode.c in the Linux kernel before 4.5.4 does not properly traverse a mount propagation tree in a certain case involving a slave mount which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a crafted series of mount system calls.


The onReadyRead function in core/coreauthhandler.cpp in Quassel before 0.12.4 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via invalid handshake data.


The _xrealloc function in xlsp_xmalloc.c in OpenSLP 2.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a large number of crafted packets which triggers a memory allocation failure.


For the NVIDIA Quadro NVS and GeForce products there is a Remote Desktop denial of service. A successful exploit of a vulnerable system will result in a kernel null pointer dereference causing a blue screen crash.


An issue was discovered in certain Apple products. macOS before 10.12.1 is affected. The issue involves the \AppleSMC\ component. It allows local users to gain privileges or cause a denial of service (NULL pointer dereference) via unspecified vectors.


The tipc_nl_publ_dump function in net/tipc/socket.c in the Linux kernel through 4.6 does not verify socket existence which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a dumpit operation.


os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a crafted request involving writing a client request body to a temporary file.


The msm_ipc_router_close function in net/ipc_router/ipc_router_socket.c in the ipc_router component for the Linux kernel 3.x as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products allow attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact by triggering failure of an accept system call for an AF_MSM_IPC socket.


The print_frame_inst_bytes function in libdwarf before 20160923 allows remote attackers to cause a denial of service (NULL pointer dereference) via an object file with empty bss-like sections.


The p2m_teardown function in arch/arm/p2m.c in Xen 4.4.x through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (NULL pointer dereference and host OS crash) by creating concurrent domains and holding references to them related to VMID exhaustion.


The _dwarf_calculate_info_section_end_ptr function in libdwarf before 20160923 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.


The create_fullest_file_path function in libdwarf before 20160923 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted dwarf file.


libreswan before 3.18 allows remote attackers to cause a denial of service (NULL pointer dereference and pluto daemon restart).


A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime which could let a remote malicious user cause a Denial of Service.


The _dwarf_load_section function in libdwarf before 20160923 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.


dwarf_macro5.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (NULL pointer dereference) via a debugging information entry using DWARF5 and without a DW_AT_name.


Cisco IOS XE 3.15S and 3.16S on cBR-8 Converged Broadband Router devices allows remote authenticated users to cause a denial of service (NULL pointer dereference and card restart) via a crafted SNMP request aka Bug ID CSCuu68862.


The Stream Control Transmission Protocol (SCTP) module in FreeBSD 9.3 before p33 10.1 before p26 and 10.2 before p9 when the kernel is configured for IPv6 allows remote attackers to cause a denial of service (assertion failure or NULL pointer dereference and kernel panic) via a crafted ICMPv6 packet.


The SillMap::readFace function in FeatureMap.cpp in Libgraphite in Graphite 2 1.2.4 as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1 mishandles a return value which allows remote attackers to cause a denial of service (missing initialization NULL pointer dereference and application crash) via a crafted Graphite smart font.


The snd_seq_ioctl_remove_events function in sound/core/seq/seq_clientmgr.c in the Linux kernel before 4.4.1 does not verify FIFO assignment before proceeding with FIFO clearing which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a crafted ioctl call.


The is_rndis function in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 does not properly validate USB configuration descriptor objects which allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors involving a remote NDIS control message packet.


The powermate_probe function in drivers/input/misc/powermate.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.


The treo_attach function in drivers/usb/serial/visor.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by inserting a USB device that lacks a (1) bulk-in or (2) interrupt-in endpoint.


GraphicsMagick 1.3.23 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted SVG file related to the (1) DrawImage function in magick/render.c (2) SVGStartElement function in coders/svg.c and (3) TraceArcPath function in magick/render.c.


The gtco_probe function in drivers/input/tablet/gtco.c in the Linux kernel through 4.5.2 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.


The ohci_bus_start function in the USB OHCI emulation support (hw/usb/hcd-ohci.c) in QEMU allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors related to multiple eof_timers.


The req_check_access function in the mod_authz_svn module in the httpd server in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via a crafted header in a (1) MOVE or (2) COPY request involving an authorization check.


The ati_remote2_probe function in drivers/input/misc/ati_remote2.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.


A NULL pointer dereference vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in a denial of service vulnerability. A malicious server can send a packet starting with a NULL byte triggering the vulnerability.


The iowarrior_probe function in drivers/usb/misc/iowarrior.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.


The create_fixed_stream_quirk function in sound/usb/quirks.c in the snd-usb-audio driver in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference or double free and system crash) via a crafted endpoints value in a USB device descriptor.


A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in a null pointer dereference. A malicious server or an attacker who intercepts the network traffic can send invalid data to trigger this vulnerability and cause a crash.


The trace_writeback_dirty_page implementation in include/trace/events/writeback.h in the Linux kernel before 4.4 improperly interacts with mm/migrate.c which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by triggering a certain page move.


The wacom_probe function in drivers/input/tablet/wacom_sys.c in the Linux kernel before 3.17 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.


The validate_as_request function in kdc_util.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.13.6 and 1.4.x before 1.14.3 when restrict_anonymous_to_tgt is enabled uses an incorrect client data structure which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an S4U2Self request.


The acm_probe function in drivers/usb/class/cdc-acm.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a USB device without both a control and a data endpoint descriptor.


The

function

in

in

the

LDAP

KDB

module

in

kadmind

in

MIT

Kerberos

(aka

through

and

through

mishandles

the

DB

argument

which

allows

remote

authenticated

users

to

cause

a

denial

of

service

(NULL

pointer

dereference

and

daemon

crash)

via

a

crafted

request

to

modify

a

principal.


The digi_port_init function in drivers/usb/serial/digi_acceleport.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.


The mct_u232_msr_to_state function in drivers/usb/serial/mct_u232.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted USB device without two interrupt-in endpoint descriptors.


drivers/usb/serial/cypress_m8.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a USB device without both an interrupt-in and an interrupt-out endpoint descriptor related to the cypress_generic_port_probe and cypress_open functions.


arm-wt-22k/lib_src/eas_mdls.c in mediaserver in Android 4.x before 4.4.4 5.0.x before 5.0.2 5.1.x before 5.1.1 and 6.x before 2016-09-01 allows remote attackers to cause a denial of service (NULL pointer dereference and device hang or reboot) via a crafted media file aka internal bug 29770686.


Warrior Kings: Battles 1.23 and earlier allows remote attackers to cause a denial of service (server crash) via a partial join packet that triggers a NULL pointer dereference.


Multiple vulnerabilities in the OpenSSL ASN.1 parser as used in Novell iManager 2.0.2 allows remote attackers to cause a denial of service (NULL pointer dereference) via crafted packets as demonstrated by \OpenSSL ASN.1 brute forcer.\ NOTE: this issue might overlap CVE-2004-0079 CVE-2004-0081 or CVE-2004-0112.


mod_ssl in Apache 2.0 up to 2.0.55 when configured with an SSL vhost with access control and a custom error 400 error page allows remote attackers to cause a denial of service (application crash) via a non-SSL request to an SSL port which triggers a NULL pointer dereference.


The huft_build function in inflate.c in the zlib routines in the Linux kernel before 2.6.12.5 returns the wrong value which allows remote attackers to cause a denial of service (kernel crash) via a certain compressed file that leads to a null pointer dereference a different vulnerability than CVE-2005-2458.


The (1) to_char and (2) to_date function in IBM DB2 8.1 allows local users to cause a denial of service (application crash) via an empty string in the second parameter which causes a null pointer dereference.


webs.c in GoAhead WebServer before 2.1.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an HTTP POST request that contains a Content-Length header but no body data.


The RPC component in Windows 2000 Windows NT 4.0 and Windows XP allows remote attackers to cause a denial of service (disabled RPC service) via a malformed packet to the RPC Endpoint Mapper at TCP port 135 which triggers a null pointer dereference.


Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.2 allows remote attackers to affect availability via unknown vectors. NOTE: the previous information was obtained from the January 2009 CPU. Oracle has not commented on reliable researcher claims that this issue is a denial of service in observiced.exe via malformed private Protocol data that triggers a NULL pointer dereference.


The Local ZIM Server in Zilab Chat and Instant Messaging (ZIM) Server 2.0 and 2.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via crafted requests without required parameters.


The ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0 and Adobe AIR before 1.5 does not validate character elements during retrieval from the dictionary data structure which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF file.


cupsd in CUPS 1.3.9 and earlier allows local users and possibly remote attackers to cause a denial of service (daemon crash) by adding a large number of RSS Subscriptions which triggers a NULL pointer dereference. NOTE: this issue can be triggered remotely by leveraging CVE-2008-5184.


smtp.c in the c-client library in University of Washington IMAP Toolkit 2007b allows remote SMTP servers to cause a denial of service (NULL pointer dereference and application crash) by responding to the QUIT command with a close of the TCP connection instead of the expected 221 response code.


The IPv4 Forwarding feature in Sun Solaris 10 and OpenSolaris snv_47 through snv_82 with certain patches installed allows remote attackers to cause a denial of service (panic) via unknown vectors that trigger a NULL pointer dereference.


The DebugDiag ActiveX control in CrashHangExt.dll possibly 1.0 in Microsoft Debug Diagnostic Tool allows remote attackers to cause a denial of service (NULL pointer dereference and Internet Explorer 6.0 crash) via a large negative integer argument to the GetEntryPointForThread method. NOTE: this issue might only be exploitable in limited environments or non-default browser settings.


The user interface event dispatcher in Mozilla Firefox 3.0.3 on Windows XP SP2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a series of keypress click onkeydown onkeyup onmousedown and onmouseup events. NOTE: it was later reported that Firefox 3.0.2 on Mac OS X 10.5 is also affected.


Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64 and Adobe AIR before 2.0.2.12610 allows remote web servers to cause a denial of service (NULL pointer dereference and browser crash) by returning a different response when an HTTP request is sent a second time as demonstrated by two responses that provide SWF files with different SWF version numbers.


The CGI modules in the server in Trend Micro OfficeScan 8.0 SP1 before build 2439 and 8.0 SP1 Patch 1 before build 3087 allow remote attackers to cause a denial of service (NULL pointer dereference and child process crash) via crafted HTTP headers related to the \error handling mechanism.\


Unspecified vulnerability in the UFS module in Sun Solaris 8 through 10 and OpenSolaris allows local users to cause a denial of service (NULL pointer dereference and kernel panic) via unknown vectors related to the Solaris Access Control List (ACL) implementation.


strongSwan 4.2.6 and earlier allows remote attackers to cause a denial of service (daemon crash) via an IKE_SA_INIT message with a large number of NULL values in a Key Exchange payload which triggers a NULL pointer dereference for the return value of the mpz_export function in the GNU Multiprecision Library (GMP).


World in Conflict (WIC) 1.008 and earlier allows remote attackers to cause a denial of service (access violation and crash) via a zero-byte data block to TCP port 48000 which triggers a NULL pointer dereference.


The HTTP/XML-RPC service in Crysis 1.21 (game version 1.1.1.6156) and earlier allows remote attackers to cause a denial of service (crash) via a long HTTP request which triggers a NULL pointer dereference.


mm/shmem.c in the Linux kernel before 2.6.28-rc8 when strict overcommit is enabled and CONFIG_SECURITY is disabled does not properly handle the export of shmemfs objects by knfsd which allows attackers to cause a denial of service (NULL pointer dereference and knfsd crash) or possibly have unspecified other impact via unknown vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-1643.


neon 0.28.0 through 0.28.2 allows remote servers to cause a denial of service (NULL pointer dereference and crash) via vectors related to Digest authentication Digest domain parameter support and the parse_domain function.


The decryption function in Flagship Industries Ventrilo 3.0.2 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) by sending a type 0 packet with an invalid version followed by another packet to TCP port 3784.


The content layout component in Mozilla Firefox 3.0 and 3.0.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted but well-formed web page that contains \a simple set of legitimate HTML tags.\


net/sctp/socket.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel before 2.6.26.4 does not verify that the SCTP-AUTH extension is enabled before proceeding with SCTP-AUTH API functions which allows attackers to cause a denial of service (NULL pointer dereference and panic) via vectors that result in calls to (1) sctp_setsockopt_auth_chunk (2) sctp_setsockopt_hmac_ident (3) sctp_setsockopt_auth_key (4) sctp_setsockopt_active_key (5) sctp_setsockopt_del_key (6) sctp_getsockopt_maxburst (7) sctp_getsockopt_active_key (8) sctp_getsockopt_peer_auth_chunks or (9) sctp_getsockopt_local_auth_chunks.


libclamav in ClamAV before 0.94 allows attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors related to an out-of-memory condition.


Skulltag before 0.97d2-RC6 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) by sending a \command 29\ packet when the player is not in the game.


Unreal Tournament 2004 (UT2004) 3369 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a certain sequence of malformed packets.


SWAT 4 1.1 and earlier allows remote attackers to cause a denial of service (daemon crash) via a (1) VERIFYCONTENT or (2) GAMECONFIG command sent to the server before user session initialization which triggers a NULL pointer dereference; or (3) a GAMESPYRESPONSE command followed by a long RS string.


Unreal Tournament 3 1.3beta4 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a UDP packet in which the value of a certain size field is greater than the total packet length aka attack 2 in ut3mendo.c.


The rt6_fill_node function in net/ipv6/route.c in Linux kernel 2.6.26-rc4 2.6.26.2 and possibly other 2.6.26 versions allows local users to cause a denial of service (kernel OOPS) via IPv6 requests when no IPv6 input device is in use which triggers a NULL pointer dereference.


A certain Fedora patch for the utrace subsystem in the Linux kernel before 2.6.26.5-28 on Fedora 8 and before 2.6.26.5-45 on Fedora 9 allows local users to cause a denial of service (NULL pointer dereference and system crash or hang) via a call to the utrace_control function.


retroclient.exe in EMC Dantz Retrospect Backup Client 7.5.116 allows remote attackers to cause a denial of service (daemon crash) via malformed packets to TCP port 497 which trigger a NULL pointer dereference.


Linux DC++ (linuxdcpp) before 0.707 allows remote attackers to cause a denial of service (crash) via \partial file list requests\ that trigger a NULL pointer dereference.


Unspecified vulnerability in the Oracle Internet Directory component in Oracle Application Server 9.0.4.3 10.1.2.3 and 10.1.4.2 has unknown impact and remote attack vectors. NOTE: the previous information was obtained from the Oracle July 2008 CPU. Oracle has not commented on reliable researcher claims that this issue is a denial of service (crash) via a malformed LDAP request that triggers a NULL pointer dereference.


The WordClient interface in Alt-N Technologies MDaemon 9.6.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted HTTP POST request. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


mDNSResponder in the Bonjour Namespace Provider in Apple Bonjour for Windows before 1.0.5 allows attackers to cause a denial of service (NULL pointer dereference and application crash) by resolving a crafted .local domain name that contains a long label.


Apple Safari 3.1.1 allows remote attackers to cause a denial of service (application crash) via a file:///%E2 link that triggers an out-of-bounds access possibly due to a NULL pointer dereference.


The Linux kernel before 2.6.25.10 does not properly perform tty operations which allows local users to cause a denial of service (system crash) or possibly gain privileges via vectors involving NULL pointer dereference of function pointers in (1) hamradio/6pack.c (2) hamradio/mkiss.c (3) irda/irtty-sir.c (4) ppp_async.c (5) ppp_synctty.c (6) slip.c (7) wan/x25_asy.c and (8) wireless/strip.c in drivers/net/.


VicFTPS 5.0 allows remote attackers to cause a denial of service (crash) via a crafted LIST command which triggers a NULL pointer dereference. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Unspecified vulnerability in the vuidmice STREAMS modules in Sun Solaris 9 and 10 on x86 architectures allows local users to cause a denial of service (panic) via unspecified vectors that trigger a NULL pointer dereference in the vuid3ps2 module a different issue than CVE-2007-5319.


OpenBSD 4.2 allows local users to cause a denial of service (kernel panic) by calling the SIOCGIFRTLABEL IOCTL on an interface that does not have a route label which triggers a NULL pointer dereference when the return value from the rtlabel_id2name function is not checked.


Double-Take 5.0.0.2865 and earlier distributed under the HP StorageWorks Storage Mirroring name and other names allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a malformed packet as demonstrated by a packet of type (1) 0x2722 or (2) 0x272a.


SLnet.exe in SeattleLab SLNet RF Telnet Server 4.1.1.3758 and earlier allows user-assisted remote attackers to cause a denial of service (crash) via unspecified telnet options which triggers a NULL pointer dereference. NOTE: the crash is not user-assisted when the server is running in debug mode.


The SIP channel driver in Asterisk Open Source 1.4.x before 1.4.17 Business Edition before C.1.0-beta8 AsteriskNOW before beta7 Appliance Developer Kit before Asterisk 1.4 revision 95946 and Appliance s800i 1.0.x before 1.0.3.4 allows remote attackers to cause a denial of service (daemon crash) via a BYE message with an Also (Also transfer) header which triggers a NULL pointer dereference.


telnetd.exe in Pragma TelnetServer 7.0.4.589 allows remote attackers to cause a denial of service (process crash and resource exhaustion) via a crafted TELOPT PRAGMA LOGON telnet option which triggers a NULL pointer dereference.


The administration web interface in NetWin SurgeFTP 2.3a2 and earlier allows remote attackers to cause a denial of service (daemon crash) via a large integer in the Content-Length HTTP header which triggers a NULL pointer dereference when memory allocation fails.


The IMAP service (MEIMAPS.exe) in MailEnable Professional Edition and Enterprise Edition 3.13 and earlier allows remote attackers to cause a denial of service (crash) via (1) SEARCH and (2) APPEND commands without required arguments which triggers a NULL pointer dereference.


OpenSSL 0.9.8f and 0.9.8g allows remote attackers to cause a denial of service (crash) via a TLS handshake that omits the Server Key Exchange message and uses \particular cipher suites \ which triggers a NULL pointer dereference.


The Perforce service (p4s.exe) in Perforce Server 2007.3/143793 and earlier allows remote attackers to cause a denial of service (daemon crash) via a missing parameter to the (1) dm-FaultFile (2) dm-LazyCheck (3) dm-ResolvedFile (4) dm-OpenFile (5) crypto and possibly unspecified other commands which triggers a NULL pointer dereference.


NMMediaServer.exe in Nero MediaHome 3.3.3.0 and earlier as used in Nero 8.3.2.1 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a long HTTP request to TCP port 54444 a different vector than CVE-2007-2322.


IBM solidDB 06.00.1018 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a packet with an 0x11 value in a certain \type\ field.


The PXE Server (pxesrv.exe) in Acronis Snap Deploy 2.0.0.1076 and earlier allows remote attackers to cause a denial of service (crash) via an incomplete TFTP request which triggers a NULL pointer dereference.


The RemotelyAnywhere.exe service in the Remotely Anywhere Server and Workstation 8.0.668 and earlier allows remote attackers to cause a denial of service (crash) via an invalid Accept-Charset header which triggers a NULL pointer dereference. NOTE: the service is automatically restarted.


Trend Micro OfficeScan Corporate Edition 8.0 Patch 2 build 1189 and earlier and 7.3 Patch 3 build 1314 and earlier allows remote attackers to cause a denial of service (process consumption) via (1) an HTTP request without a Content-Length header or (2) invalid characters in unspecified CGI arguments which triggers a NULL pointer dereference.


ovalarmsrv in HP OpenView Network Node Manager (OV NNM) 7.51 7.53 and possibly other versions allows remote attackers to cause a denial of service (crash) via certain requests that specify a large number of sub-arguments which triggers a NULL pointer dereference due to memory allocation failure.


Acronis True Image Windows Agent 1.0.0.54 and earlier included in Acronis True Image Enterprise Server 9.5.0.8072 and the other True Image packages allows remote attackers to cause a denial of service (crash) via a malformed packet to port 9876 which triggers a NULL pointer dereference.


The irc_msg_who function in msgs.c in the IRC protocol plugin in libpurple 2.8.0 through 2.9.0 in Pidgin before 2.10.0 does not properly validate characters in nicknames which allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted nickname that is not properly handled in a WHO response.


The key_replace_session_keyring function in security/keys/process_keys.c in the Linux kernel before 2.6.39.1 does not initialize a certain structure member which allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via a KEYCTL_SESSION_TO_PARENT argument to the keyctl function a different vulnerability than CVE-2010-2960.


The WebSockets implementation in Google Chrome before 14.0.835.163 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors.


A certain Red Hat patch to the __br_deliver function in net/bridge/br_forward.c in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging connectivity to a network interface that uses an Ethernet bridge device.


A certain Red Hat patch to the sctp_sock_migrate function in net/sctp/socket.c in the Linux kernel before 2.6.21 as used in Red Hat Enterprise Linux (RHEL) 5 allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) via a crafted SCTP packet.


reqresp_parser.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.4.2 does not initialize certain strings which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a malformed Contact header.


reqresp_parser.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.4.3 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a SIP packet with a Contact header that lacks a < (less than) character.


The qdisc_notify function in net/sched/sch_api.c in the Linux kernel before 2.6.35 does not prevent tc_fill_qdisc function calls referencing builtin (aka CQ_F_BUILTIN) Qdisc structures which allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via a crafted call.


The hfs_find_init function in the Linux kernel 2.6 allows local users to cause a denial of service (NULL pointer dereference and Oops) by mounting an HFS file system with a malformed MDB extent record.


The index_get_ids function in index.c in imapd in Cyrus IMAP Server before 2.4.11 when server-side threading is enabled allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted References header in an e-mail message.


The add_conversation function in conversations.c in EtherApe before 0.9.12 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an RPC packet related to the get_rpc function in decode_proto.c.


Openswan 2.6.29 through 2.6.35 allows remote attackers to cause a denial of service (NULL pointer dereference and pluto IKE daemon crash) via an ISAKMP message with an invalid KEY_LENGTH attribute which is not properly handled by the error handling function.


The apparmor_setprocattr function in security/apparmor/lsm.c in the Linux kernel before 3.0 does not properly handle invalid parameters which allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact by writing to a /proc/#####/attr/current file.


in

Google

Chrome

before

does

not

properly

handle

a

malformed

ftp

URL

in

the

SRC

attribute

of

a

VIDEO

element

which

allows

remote

attackers

to

cause

a

denial

of

service

(NULL

pointer

dereference

and

application

crash)

via

a

crafted

web

page.


win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 R2 and R2 SP1 and Windows 7 Gold and SP1 does not properly validate user-mode input which allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via a crafted application aka \Win32k Null Pointer De-reference Vulnerability.\


The inet service in HP OpenView Storage Data Protector 6.00 through 6.20 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request containing crafted parameters.


The counterToCSSValue function in CSSComputedStyleDeclaration.cpp in the Cascading Style Sheets (CSS) implementation in WebCore in WebKit before r82222 as used in Google Chrome before 11.0.696.43 and other products does not properly handle access to the (1) counterIncrement and (2) counterReset attributes of CSSStyleDeclaration data provided by a getComputedStyle method call which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted JavaScript code.


The lookup_lockout_policy function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8 through 1.8.4 and 1.9 through 1.9.1 when the db2 (aka Berkeley DB) or LDAP back end is used allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger certain process_as_req errors.


The napi_reuse_skb function in net/core/dev.c in the Generic Receive Offload (GRO) implementation in the Linux kernel before 2.6.38 does not reset the values of certain structure members which might allow remote attackers to cause a denial of service (NULL pointer dereference) via a malformed VLAN frame.


epan/dissectors/packet-ntlmssp.c in the NTLMSSP dissector in Wireshark before 1.4.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted .pcap file.


The process_tgs_req function in do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.9 through 1.9.2 allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted TGS request that triggers an error other than the KRB5_KDB_NOENTRY error.


The mod_dav_svn module for the Apache HTTP Server as distributed in Apache Subversion before 1.6.17 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request for a baselined WebDAV resource as exploited in the wild in May 2011.


libymsg.c in the Yahoo! protocol plugin in libpurple in Pidgin 2.6.0 through 2.7.10 allows (1) remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a malformed YMSG notification packet and allows (2) remote Yahoo! servers to cause a denial of service (NULL pointer dereference and application crash) via a malformed YMSG SMS message.


Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted Diameter dictionary file.


net/dns_resolver/dns_key.c in the Linux kernel before 2.6.38 allows remote DNS servers to cause a denial of service (NULL pointer dereference and OOPS) by not providing a valid response to a DNS query as demonstrated by an erroneous grand.centrall.org query which triggers improper handling of error data within a DNS resolver key.


The bytes_repr_len function in Wireshark 1.4.5 uses an incorrect pointer argument which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via arbitrary TCP traffic.


The cifs_close function in fs/cifs/file.c in the Linux kernel before 2.6.39 allows local users to cause a denial of service (NULL pointer dereference and BUG) or possibly have unspecified other impact by setting the O_DIRECT flag during an attempt to open a file on a CIFS filesystem.


The raw_release function in net/can/raw.c in the Linux kernel before 2.6.39-rc6 does not properly validate a socket data structure which allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted release operation.


The bcm_release function in net/can/bcm.c in the Linux kernel before 2.6.39-rc6 does not properly validate a socket data structure which allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted release operation.


The dccp_rcv_state_process function in net/dccp/input.c in the Datagram Congestion Control Protocol (DCCP) implementation in the Linux kernel before 2.6.38 does not properly handle packets for a CLOSED endpoint which allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by sending a DCCP-Close packet followed by a DCCP-Reset packet.


IBM solidDB 4.5.x before 4.5.182 6.0.x before 6.0.1069 6.1.x and 6.3.x before 6.3 FP8 (aka 6.3.49) and 6.5.x before 6.5 FP4 (aka 6.5.0.4) does not properly handle the (1) rpc_test_svc_readwrite and (2) rpc_test_svc_done commands which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted command.


nbd-server.c in Network Block Device (nbd-server) 2.9.21 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by causing a negotiation failure as demonstrated by specifying a name for a non-existent export.


The kdb_ldap plugin in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.9 through 1.9.1 when the LDAP back end is used allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a kinit operation with incorrect string case for the realm related to the is_principal_in_realm krb5_set_error_message krb5_ldap_get_principal and process_as_req functions.


tcptls.c in the TCP/TLS server in Asterisk Open Source 1.6.1.x before 1.6.1.23 1.6.2.x before 1.6.2.17.1 and 1.8.x before 1.8.3.1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) by establishing many short TCP sessions to services that use a certain TLS API.


The br_mdb_ip_get function in net/bridge/br_multicast.c in the Linux kernel before 2.6.35-rc5 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an IGMP packet related to lack of a multicast table.


FTPService.exe in Blackmoon FTP 3.1 Build 1735 and Build 1736 (3.1.7.1736) and possibly other versions before 3.1.8.1737 allows remote attackers to cause a denial of service (crash) via a large number of PORT commands with long arguments which triggers a NULL pointer dereference. NOTE: some of these details are obtained from third party information.


Perl 5.10.x allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) by leveraging an ability to inject arguments into a (1) getpeername (2) readdir (3) closedir (4) getsockname (5) rewinddir (6) tell or (7) telldir function call.


The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.9 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a malformed request packet that does not trigger a response packet.


The grapheme_extract function in the Internationalization extension (Intl) for ICU for PHP 5.3.5 allows context-dependent attackers to cause a denial of service (crash) via an invalid size argument which triggers a NULL pointer dereference.


The _zip_name_locate function in zip_name_locate.c in the Zip extension in PHP before 5.3.6 does not properly handle a ZIPARCHIVE::FL_UNCHANGED argument which might allow context-dependent attackers to cause a denial of service (NULL pointer dereference) via an empty ZIP archive that is processed with a (1) locateName or (2) statName operation.


PHP 5.3.8 does not always check the return value of the zend_strndup function which might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted input to an application that performs strndup operations on untrusted string data as demonstrated by the define function in zend_builtin_functions.c and unspecified functions in ext/soap/php_sdl.c ext/standard/syslog.c ext/standard/browscap.c ext/oci8/oci8.c ext/com_dotnet/com_typeinfo.c and main/php_open_temporary_file.c.


The NFS implementation in Linux kernel before 2.6.31-rc6 calls certain functions without properly initializing certain data which allows local users to cause a denial of service (NULL pointer dereference and O_DIRECT oops) as demonstrated using diotest4 from LTP.


The user_update function in security/keys/user_defined.c in the Linux kernel 2.6 allows local users to cause a denial of service (NULL pointer dereference and kernel oops) via vectors related to a user-defined key and \updating a negative key into a fully instantiated key.\


The create_pit_timer function in arch/x86/kvm/i8254.c in KVM 83 and possibly other versions does not properly handle when Programmable Interval Timer (PIT) interrupt requests (IRQs) when a virtual interrupt controller (irqchip) is not available which allows local users to cause a denial of service (NULL pointer dereference) by starting a timer.


crypto/ghash-generic.c in the Linux kernel before 3.1 allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact by triggering a failed or missing ghash_setkey function call followed by a (1) ghash_update function call or (2) ghash_final function call as demonstrated by a write operation on an AF_ALG socket.


Siemens Automation License Manager (ALM) 4.0 through 5.1+SP1+Upd1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via crafted content in a (1) get_target_ocx_param or (2) send_target_ocx_param command.


The dissect_infiniband_common function in epan/dissectors/packet-infiniband.c in the Infiniband dissector in Wireshark 1.4.0 through 1.4.9 and 1.6.x before 1.6.3 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a malformed packet.


The logging functionality in dhcpd in ISC DHCP before 4.2.3-P2 when using Dynamic DNS (DDNS) and issuing IPv6 addresses does not properly handle the DHCPv6 lease structure which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via crafted packets related to a lease-status update.


The pidgin_conv_chat_rename_user function in gtkconv.c in Pidgin before 2.10.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) by changing a nickname while in an XMPP chat room.


The handle_request_info function in channels/chan_sip.c in Asterisk Open Source 1.6.2.x before 1.6.2.21 and 1.8.x before 1.8.7.2 when automon is enabled allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted sequence of SIP requests.


The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21 when the mod_setenvif module is enabled does not restrict the size of values of environment variables which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive in conjunction with a crafted HTTP request header related to (1) the \len +=\ statement and (2) the apr_pcalloc function call a different vulnerability than CVE-2011-3607.


WMDrive.sys 3.4.181.224 in WinMount 3.5.1018 allows local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted 0x87342000 IOCTL request to the WMDriver device.


The tty_open function in drivers/tty/tty_io.c in the Linux kernel before 3.1.1 mishandles a driver-lookup failure which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via crafted access to a device file under the /dev/pts directory.


MySQL 5.5.8 when running on Windows allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted packet to TCP port 3306.


danim.dll in Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (application crash) by accessing the Data property of a DirectAnimation DAUserData object before it is initialized which triggers a NULL pointer dereference.


A flaw was found in jasper before 2.0.25. A null pointer dereference in jp2_decode in jp2_dec.c may lead to program crash and denial of service.


A flaw was found in the Linux kernel. A null pointer dereference in bond_ipsec_add_sa() may lead to local denial of service.


A flaw was found in GlusterFS in versions prior to 3.10. A null pointer dereference in send_brick_req function in glusterfsd/src/gf_attach.c may be used to cause denial of service.


The FTP server in Perforce Server 2008.1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a certain MKD command.


NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) where a NULL pointer dereference in the kernel created within user mode code may lead to a denial of service in the form of a system crash.


libming 0.4.8 has a NULL pointer dereference in the getInt function of the decompile.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted swf file.


libming 0.4.8 has a NULL pointer dereference in the getString function of the decompile.c file related to decompileSTRINGCONCAT. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted swf file.


CoreTelephony in Apple iOS before 8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and device restart) via a Class 0 SMS message.


Calendar in Apple iOS before 9.3.3 allows remote attackers to cause a denial of service (NULL pointer dereference and device restart) via a crafted invitation.


IOAcceleratorFamily in Apple iOS before 9.3.3 tvOS before 9.2.2 and watchOS before 2.2.2 allows local users to gain privileges or cause a denial of service (NULL pointer dereference) via unspecified vectors.


IOHIDFamily in Apple iOS before 9.3.3 OS X before 10.11.6 tvOS before 9.2.2 and watchOS before 2.2.2 allows local users to gain privileges or cause a denial of service (NULL pointer dereference) via unspecified vectors.


IOAcceleratorFamily in Apple iOS before 9.3.2 OS X before 10.11.5 and tvOS before 9.2.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted app.


ImageIO in Apple iOS before 9.3.2 OS X before 10.11.5 tvOS before 9.2.1 and watchOS before 2.2.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted image.


AppleRAID in Apple Mac OS X 10.3.9 and 10.4 through 10.4.10 allows attackers to cause a denial of service (crash) via a crafted striped disk image which triggers a NULL pointer dereference when it is mounted.


Networking in Apple Mac OS X 10.6.2 through 10.6.4 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted PIM packet.


Finder in Apple Mac OS X 10.5.2 through 10.5.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors involving a search for a remote disk on the local network.


IOThunderboltFamily in Apple OS X before 10.11.2 allows local users to cause a denial of service (NULL pointer dereference) via an unspecified userclient type.


Audio in Apple OS X before 10.11.6 allows local users to cause a denial of service (NULL pointer dereference) via unspecified vectors.


Audio in Apple OS X before 10.11.5 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted app.


IOFireWireFamily in Apple OS X before 10.11.4 allows local users to cause a denial of service (NULL pointer dereference) via unspecified vectors.


ntpd in NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (NULL pointer dereference) via a ntpdc reslist command.


ntpd in NTP before 4.2.8p9 when the trap service is enabled allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted packet.


The Intel Graphics Driver component in Apple OS X before 10.11.2 allows local users to gain privileges or cause a denial of service (NULL pointer dereference) via unspecified vectors.


Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (application crash) by accessing the URL property of a TriEditDocument.TriEditDocument object before it has been initialized which triggers a NULL pointer dereference.


The IPv6 implementation in the kernel in Apple Mac OS X before 10.6.8 allows local users to cause a denial of service (NULL pointer dereference and reboot) via vectors involving socket options.


There is a NULL pointer dereference in media/libcedarc/vdecoder of Allwinner R818 SoC Android Q SDK V1.0 which could cause a media crash (denial of service).


There is a NULL Pointer Dereference vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to Denial of Service Attacks.


There is a NULL pointer dereference in the caseless_hash function in gxps-archive.c in libgxps 0.2.5. A crafted input will lead to a remote denial of service attack.


There is a NULL pointer dereference at function sixel_helper_set_additional_message (status.c) in libsixel 1.8.2 that will cause a denial of service.


There is a NULL pointer dereference at ext/testcase.c (function testcase_read) in libsolvext.a in libsolv through 0.7.2 that will cause a denial of service.


There is a NULL pointer dereference at ext/testcase.c (function testcase_str2dep_complex) in libsolvext.a in libsolv through 0.7.2 that will cause a denial of service.


There is a NULL pointer dereference at liblas::SpatialReference::GetGTIF() (spatialreference.cpp) in libLAS 1.8.1 that will cause a denial of service.


There is a NULL pointer dereference in function imagetobmp of convertbmp.c:980 of OpenJPEG 2.1.2. image->comps0.data is not assigned a value after initialization(NULL). Impact is Denial of Service.


FFmpeg 4.2 is affected by null pointer dereference passed as argument to libavformat/aviobuf.c which could cause a Denial of Service.


An issue has been found in function DCTStream::getChar in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to a NULL pointer dereference (invalid read of size 1) .


The kernel in Apple OS X before 10.10 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted filename on an HFS filesystem.


The kernel in Apple iOS before 9.3.3 OS X before 10.11.6 tvOS before 9.2.2 and watchOS before 2.2.2 allows local users to cause a denial of service (NULL pointer dereference) via unspecified vectors.


In LibSass 3.5.5 a NULL Pointer Dereference in the function Sass::Selector_List::populate_extends in SharedPtr.hpp (used by ast.cpp and ast_selectors.cpp) may cause a Denial of Service (application crash) via a crafted sass input file.


In

LibSass

a

Pointer

Dereference

in

the

function

Sass::Eval::operator()(Sass::Supports_Operator*)

in

eval.cpp

may

cause

a

Denial

of

Service

(application

crash)

via

a

crafted

sass

input

file.


The

Linux

kernel

before

version

is

vulnerable

to

a

pointer

dereference

in

drivers/tty/serial/8250/8250_core.c:serial8250_isa_init_ports()

that

allows

local

users

to

cause

a

denial

of

service

by

using

the

pointer

which

uninitialized.


Apple Mac OS X 10.5.2 allows user-assisted attackers to cause a denial of service (crash) via a crafted Universal Disc Format (UDF) disk image which triggers a NULL pointer dereference.


The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via a LOCK on an activity URL.


The mod_dav_svn Apache HTTPD server module in Subversion 1.6.0 through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an anonymous LOCK for a URL that does not exist.


The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a PROPFIND request for an activity URL.


The mod_dav_svn module for the Apache HTTP Server as distributed in Apache Subversion before 1.6.16 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request that contains a lock token.


In Netwide Assembler (NASM) 2.14rc0 there is an illegal address access in the function paste_tokens() in preproc.c aka a NULL pointer dereference. It will lead to remote denial of service.


Apple OS X before 10.10 allows remote attackers to cause a denial of service (NULL pointer dereference) via crafted ASN.1 data.


Null pointer dereference in the FPGA kernel driver for Intel(R) Quartus(R) Prime Pro Edition before version 19.3 may allow an authenticated user to potentially enable denial of service via local access.


NULL pointer dereference in Google TensorFlow before 1.12.2 could cause a denial of service via an invalid GIF file.


Null pointer dereference in subsystem for Intel(R) AMT before versions 15.0.35 may allow an authenticated user to potentially enable denial of service via network access.


NULL Pointer Dereference in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability allows attackers to cause a denial of service (application crash).


NULL Pointer Dereference in the id3v2AddAudioDuration function in libmp3lame/id3tag.c in LAME 3.99.5 allows attackers to perform Denial of Service by triggering a NULL first argument.


Null Pointer Dereference in the IdentifyImage function in MagickCore/identify.c in ImageMagick through 7.0.6-10 allows an attacker to perform denial of service by sending a crafted image file.


NULL Pointer Dereference in PowerTCP WebServer for ActiveX 1.9.2 and earlier allows remote attackers to cause a denial of service (application crash) via a crafted HTTP request.


NULL pointer dereference in the _fields_add function in fields.c in libbibcore.a in bibutils through 6.2 allows remote attackers to cause a denial of service (application crash) as demonstrated by end2xml.


u'Null pointer dereference in HP OfficeJet Pro 8210 jbig2 filter due to lack of check of PDF font array leads to denial of service' in IPS PDF releases prior to IPS System 2020.2


Adobe Reader and Acrobat 9.x before 9.3 and 8.x before 8.2 on Windows and Mac OS X might allow attackers to cause a denial of service (NULL pointer dereference) via unspecified vectors.


Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to cause a denial of service (NULL pointer dereference) via unspecified vectors.


A security issue was found in htmldoc v1.9.12 and before. A NULL pointer dereference in the function image_load_jpeg() in image.cxx may result in denial of service.


AFP Server in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon restart) via crafted reconnect authentication packets.


TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a NULL value in a 0x82730010 DeviceIoControl request to \\\\.\\Viragtlt.


TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a NULL value in a 0x82730020 DeviceIoControl request to \\\\.\\Viragtlt.


TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a NULL value in a 0x82730008 DeviceIoControl request to \\\\.\\Viragtlt.


Improper validation of the ChassisID TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series version 1.1 allows attackers to cause a denial of service due to a NULL pointer dereference via a crafted lldp packet.


All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by null pointer dereference vulnerability which may allows an attacker to cause a denial of service via appviahttp service.


NVIDIA Virtual GPU Manager contains a vulnerability in the kernel module (nvidia.ko) where a null pointer dereference may occur which may lead to denial of service.


Unknown vulnerability in Sun Solaris 8.0 allows local users to cause a denial of service (kernel panic) via a program that uses /dev/poll triggering a NULL pointer dereference.


Unspecified vulnerability in the chtbl_lookup function in hash.c for WzdFTPD 8.0 and earlier allows remote attackers to cause a denial of service via a crafted FTP command probably due to a NULL pointer dereference.


Unknown vulnerability in the (1) GIOP dissector (2) WBXML or (3) CAMEL dissector in Ethereal 0.8.20 through 0.10.11 allows remote attackers to cause a denial of service (application crash) via certain packets that cause a null pointer dereference.


It was found in FreeBSD 8.0 6.3 and 4.9 and OpenBSD 4.6 that a null pointer dereference in ftpd/popen.c may lead to remote denial of service of the ftpd service.


The web server in Certec atvise webMI2ADS (aka webMI) before 2.0.2 does not properly check return values from functions which allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted HTTP request.


In ytnef 1.9.2 the MAPIPrint function in lib/ytnef.c allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file.


Microsoft Silverlight 5 before 5.1.20513.0 does not properly initialize arrays which allows remote attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference) via a crafted Silverlight application aka \Null Pointer Vulnerability.\

denial of service
null pointer dereference
arbitrary code execution


Null pointer dereference was found in upx PackLinuxElf::canUnpack() in p_lx_elf.cpp in version UPX 4.0.0. That allow attackers to execute arbitrary code and cause a denial of service via a crafted file.


IOAcceleratorFamily in Apple iOS before 8.1.3 Apple OS X before 10.10.2 and Apple TV before 7.0.3 does not properly handle resource lists and IOService userclient types which allows attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference) via a crafted app.


IOKit in IOAcceleratorFamily in Apple OS X before 10.9.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via an application that provides crafted API arguments.


IOHIDFamily in Apple iOS before 8.1.3 Apple OS X before 10.10.2 and Apple TV before 7.0.3 does not properly initialize event queues which allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.


Mozilla Firefox 3.6.3 on Windows XP SP3 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via JavaScript code that performs certain string concatenation and substring operations a different vulnerability than CVE-2009-1571.


The CFCharacterSetInitInlineBuffer method in CoreFoundation.dll in Apple Safari 3.2.3 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via a \high-bit character\ in a URL fragment for an unspecified protocol.


The d_delete function in fs/ecryptfs/inode.c in eCryptfs in the Linux kernel 2.6.31 allows local users to cause a denial of service (kernel OOPS) and possibly execute arbitrary code via unspecified vectors that cause a \negative dentry\ and trigger a NULL pointer dereference as demonstrated via a Mutt temporary directory in an eCryptfs mount.


The

function

in

in

liboggplay

as

used

in

Mozilla

Firefox

before

attempts

to

reuse

an

earlier

frame

data

structure

upon

encountering

a

decoding

error

for

the

first

frame

which

allows

remote

attackers

to

cause

a

denial

of

service

(NULL

pointer

dereference

and

application

crash)

or

possibly

execute

arbitrary

code

via

a

crafted

.ogg

video

file.


bitlbee-libpurple before 3.5.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) and possibly execute arbitrary code via a file transfer request for a contact that is not in the contact list. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-10189.


The handle_regservice_request function in mDNSResponder before 625.41.2 allows remote attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference) via unspecified vectors.


IOKit SCSI in Apple iOS before 9.2 OS X before 10.11.2 tvOS before 9.1 and watchOS before 2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via an app that provides an unspecified userclient type.


The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not properly handle character bitmaps it cannot read which allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) and possibly execute arbitrary code via a crafted BDF font file.


The FireWire driver in IOFireWireFamily in Apple OS X before 10.10.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.


The make_http_soap_request function in ext/soap/php_http.c in PHP before 5.4.44 5.5.x before 5.5.28 and 5.6.x before 5.6.12 does not properly retrieve keys which allows remote attackers to cause a denial of service (NULL pointer dereference type confusion and application crash) or possibly execute arbitrary code via crafted serialized data representing a numerically indexed _cookies array related to the SoapClient::__call method in ext/soap/soap.c.


Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x and Adobe AIR before 3.3.0.3610 allows attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference) via unspecified vectors.


BitlBee before 3.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) and possibly execute arbitrary code via a file transfer request for a contact that is not in the contact list.


An issue was discovered in certain Apple products. macOS before 10.12.1 is affected. The issue involves the \Thunderbolt\ component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.


PostgreSQL before 9.1.23 9.2.x before 9.2.18 9.3.x before 9.3.14 9.4.x before 9.4.9 and 9.5.x before 9.5.4 allow remote authenticated users to cause a denial of service (NULL pointer dereference and server crash) obtain sensitive memory information or possibly execute arbitrary code via (1) a CASE expression within the test value subexpression of another CASE or (2) inlining of an SQL function that implements the equality operator used for a CASE expression involving values of different types.


The

method

in

Apple

iOS

before

OS

X

before

tvOS

before

and

watchOS

before

allows

attackers

to

execute

arbitrary

code

in

a

privileged

context

or

cause

a

denial

of

service

(NULL

pointer

dereference)

via

a

crafted

app.


The

AppleGraphicsControlClient::checkArguments

method

in

AppleGraphicsControl

in

Apple

OS

X

before

allows

attackers

to

execute

arbitrary

code

in

a

privileged

context

or

cause

a

denial

of

service

(NULL

pointer

dereference)

via

a

crafted

app.


The cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or execute arbitrary code via a crafted file.


xine-lib 1.1.12 and other 1.1.15 and earlier versions relies on an untrusted input value to determine the memory allocation and does not check the result for (1) the MATROSKA_ID_TR_CODECPRIVATE track entry element processed by demux_matroska.c; and (2) PROP_TAG (3) MDPR_TAG and (4) CONT_TAG chunks processed by the real_parse_headers function in demux_real.c; which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) or possibly execute arbitrary code via a crafted value.


tun in IP Tunnel in Solaris 10 and OpenSolaris snv_01 through snv_76 allows local users to cause a denial of service (panic) and possibly execute arbitrary code via a crafted SIOCGTUNPARAM IOCTL request which triggers a NULL pointer dereference.


The SuiteLink Service (aka slssvc.exe) in WonderWare SuiteLink before 2.0 Patch 01 as used in WonderWare InTouch 8.0 allows remote attackers to cause a denial of service (NULL pointer dereference and service shutdown) and possibly execute arbitrary code via a large length value in a Registration packet to TCP port 5413 which causes a memory allocation failure.


Apple iCal 3.0.1 on Mac OS X allows remote CalDAV servers and user-assisted remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via a .ics file containing (1) a large 16-bit integer on a TRIGGER line or (2) a large integer in a COUNT field on an RRULE line.


KDC in MIT Kerberos 5 (krb5kdc) does not set a global variable for some krb4 message types which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted messages that trigger a NULL pointer dereference or double-free.


librsvg before 2.34.1 uses the node name to identify the type of node which allows context-dependent attackers to cause a denial of service (NULL pointer dereference) and possibly execute arbitrary code via a SVG file with a node with the element name starting with \fe \ which is misidentified as a RsvgFilterPrimitive.


The avpriv_dv_produce_packet function in libavcodec in FFmpeg 0.7.x before 0.7.12 and 0.8.x before 0.8.11 and in Libav 0.5.x before 0.5.9 0.6.x before 0.6.6 0.7.x before 0.7.5 and 0.8.x before 0.8.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) and possibly execute arbitrary code via a crafted DV file.