A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.5.1 iOS 14.7.1 and iPadOS 14.7.1 watchOS 7.6.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.


A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.6.2 tvOS 15.2 macOS Monterey 12.1 Security Update 2021-008 Catalina iOS 15.2 and iPadOS 15.2 watchOS 8.3. A malicious application may be able to execute arbitrary code with kernel privileges.

memory corruption
arbitrary code execution
dos


A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 15.1 and iPadOS 15.1 macOS Monterey 12.0.1 iOS 14.8.1 and iPadOS 14.8.1 Security Update 2021-007 Catalina macOS Big Sur 11.6.1. A malicious application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 15.0.2 and iPadOS 15.0.2 macOS Monterey 12.0.1 iOS 14.8.1 and iPadOS 14.8.1 tvOS 15.1 watchOS 8.1 macOS Big Sur 11.6.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..


A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3 macOS Big Sur 11.6.3 macOS Monterey 12.2. A malicious application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..


Multiple memory corruption issues were addressed with improved state management. This issue is fixed in iOS 13.4 and iPadOS 13.4 macOS Catalina 10.15.4 tvOS 13.4 watchOS 6.2. A malicious application may be able to execute arbitrary code with kernel privileges.


A logic issue existed resulting in memory corruption. This was addressed with improved state management. This issue is fixed in iOS 13.5 and iPadOS 13.5 macOS Catalina 10.15.5 tvOS 13.4.5 watchOS 6.2.5. A malicious application may be able to execute arbitrary code with kernel privileges.


Multiple memory corruption issues were addressed with improved state management. This issue is fixed in iOS 13.6 and iPadOS 13.6 macOS Catalina 10.15.6 tvOS 13.4.8 watchOS 6.2.8. A malicious application may be able to execute arbitrary code with system privileges.


A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 13.5 and iPadOS 13.5 macOS Catalina 10.15.5 tvOS 13.4.5 watchOS 6.2.5. A malicious application may be able to execute arbitrary code with kernel privileges.


Certain IBM Aspera applications are vulnerable to arbitrary memory corruption based on the product configuration which could allow an attacker with intimate knowledge of the system to execute arbitrary code or perform a denial-of-service (DoS) through the http fallback service. IBM X-Force ID: 180901.


mso.dll as used by Microsoft PowerPoint 2000 through 2003 allows user-assisted attackers to execute arbitrary commands via a malformed shape container in a PPT file that leads to memory corruption as exploited by Trojan.PPDropper.B a different issue than CVE-2006-1540 and CVE-2006-3493.

memory corruption
arbitrary command execution


Off-by-one error in the cmd_smart function in the smart self test in hw/ide/core.c in QEMU before 2.0 allows local users to have unspecified impact via a SMART EXECUTE OFFLINE command that triggers a buffer underflow and memory corruption.


Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memory corruption vulnerabilities and an arbitrary command injection vulnerability that can be exploited by remote unauthenticated attackers.


Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2 tvOS 13.2 Safari 13.0.3 iTunes for Windows 12.10.2 iCloud for Windows 11.0 iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.


Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 13.3 iCloud for Windows 10.9 iOS 13.3 and iPadOS 13.3 Safari 13.0.4 iTunes 12.10.3 for Windows iCloud for Windows 7.16. Processing maliciously crafted web content may lead to arbitrary code execution.


Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2 tvOS 13.2 watchOS 6.1 Safari 13.0.3 iTunes for Windows 12.10.2. Processing maliciously crafted web content may lead to arbitrary code execution.


Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.1 and iPadOS 13.1 tvOS 13 Safari 13.0.1 iTunes for Windows 12.10.1 iCloud for Windows 10.7 iCloud for Windows 7.14. Processing maliciously crafted web content may lead to arbitrary code execution.


Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2 tvOS 13.2 watchOS 6.1 Safari 13.0.3 iTunes for Windows 12.10.2 iCloud for Windows 11.0 iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.


Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in Safari 13.0.1 iOS 13.1 and iPadOS 13.1 iCloud for Windows 10.7 iCloud for Windows 7.14 tvOS 13 watchOS 6 iTunes 12.10.1 for Windows. Processing maliciously crafted web content may lead to arbitrary code execution.


Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2 tvOS 13.2 Safari 13.0.3 iTunes for Windows 12.10.2 iCloud for Windows 11.0. Processing maliciously crafted web content may lead to arbitrary code execution.


Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 13.3 watchOS 6.1.1 iCloud for Windows 10.9 iOS 13.3 and iPadOS 13.3 Safari 13.0.4 iTunes 12.10.3 for Windows iCloud for Windows 7.16. Processing maliciously crafted web content may lead to arbitrary code execution.


A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15 iOS 13.1 and iPadOS 13.1 tvOS 13 macOS Catalina 10.15.1 Security Update 2019-001 and Security Update 2019-006 watchOS 6. Processing a maliciously crafted audio file may lead to arbitrary code execution.


HMailServer 5.3.x and prior: Memory Corruption which could cause DOS


A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 14.4.1 and iPadOS 14.4.1 Safari 14.0.3 (v. 14610.4.3.1.7 and 15610.4.3.1.7) watchOS 7.3.2 macOS Big Sur 11.2.3. Processing maliciously crafted web content may lead to arbitrary code execution.


A memory corruption issue was addressed with improved validation. This issue is fixed in Security Update 2021-002 Catalina Security Update 2021-003 Mojave iOS 14.5 and iPadOS 14.5 watchOS 7.4 tvOS 14.5 macOS Big Sur 11.3. A malicious application may be able to read restricted memory.


A memory corruption issue was addressed with improved validation. This issue is fixed in Security Update 2021-002 Catalina Security Update 2021-003 Mojave iOS 14.5 and iPadOS 14.5 watchOS 7.4 tvOS 14.5 macOS Big Sur 11.3. An application may be able to read restricted memory.


A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space


Description: A memory corruption issue in the processing of ICC profiles was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.6.2 tvOS 15.2 macOS Monterey 12.1 Security Update 2021-008 Catalina iOS 15.2 and iPadOS 15.2 watchOS 8.3. Processing a maliciously crafted image may lead to arbitrary code execution.


A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.6 watchOS 8 tvOS 15 iOS 14.8 and iPadOS 14.8 iOS 15 and iPadOS 15. Processing a maliciously crafted image may lead to arbitrary code execution.


Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 14.8 and iPadOS 14.8 watchOS 8 Safari 15 tvOS 15 iOS 15 and iPadOS 15 iTunes 12.12 for Windows. Processing maliciously crafted web content may lead to arbitrary code execution.


A memory corruption issue in the ASN.1 decoder was addressed by removing the vulnerable code. This issue is fixed in tvOS 14.6 Security Update 2021-004 Mojave iOS 14.6 and iPadOS 14.6 iOS 12.5.4 Security Update 2021-003 Catalina macOS Big Sur 11.4 watchOS 7.5. Processing a maliciously crafted certificate may lead to arbitrary code execution.


Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 14.6 iOS 14.6 and iPadOS 14.6 Safari 14.1.1 macOS Big Sur 11.4 watchOS 7.5. Processing maliciously crafted web content may lead to arbitrary code execution.


A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4 Security Update 2021-003 Catalina Security Update 2021-004 Mojave iOS 14.6 and iPadOS 14.6. Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution.


A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 7.4.1 iOS 14.5.1 and iPadOS 14.5.1 tvOS 14.6 iOS 12.5.3 macOS Big Sur 11.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..


A memory corruption issue existed in the processing of ICC profiles. This issue was addressed with improved input validation. This issue is fixed in iOS 15.1 and iPadOS 15.1 macOS Monterey 12.0.1 iOS 14.8.1 and iPadOS 14.8.1 tvOS 15.1 watchOS 8.1 Security Update 2021-007 Catalina macOS Big Sur 11.6.1. Processing a maliciously crafted image may lead to arbitrary code execution.


Description: A memory corruption issue in the processing of ICC profiles was addressed with improved input validation. This issue is fixed in macOS Monterey 12.1 watchOS 8.3 iOS 15.2 and iPadOS 15.2 tvOS 15.2. Processing a maliciously crafted image may lead to arbitrary code execution.


A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 8.5 iOS 15.4 and iPadOS 15.4 macOS Big Sur 11.6.5 macOS Monterey 12.3. Opening a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution.


Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that an attacker connected to the device Wi-Fi SSID can exploit a memory corruption issue and execute remote code on the device. This device acts as an Endoscope camera that allows its users to use it in various industrial systems and settings car garages and also in some cases in the medical clinics to get access to areas that are difficult for a human being to reach. Any breach of this system can allow an attacker to get access to video feed and pictures viewed by that user and might allow them to get a foot hold in air gapped networks especially in case of nation critical infrastructure/industries. The firmware contains binary uvc_stream that is the UDP daemon which is responsible for handling all the UDP requests that the device receives. The client application sends a UDP request to change the Wi-Fi name which contains the following format: \SETCMD0001+0001+2 byte length of wifiname+Wifiname. This request is handled by \control_Dev_thread\ function which at address \0x00409AE0\ compares the incoming request and determines if the 10th byte is 01 and if it is then it redirects to 0x0040A74C which calls the function \setwifiname\. The function \setwifiname\ uses a memcpy function but uses the length of the payload obtained by using strlen function as the third parameter which is the number of bytes to copy and this allows an attacker to overflow the function and control the $PC value.


Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that an attacker connected to the device Wi-Fi SSID can exploit a memory corruption issue and execute remote code on the device. This device acts as an Endoscope camera that allows its users to use it in various industrial systems and settings car garages and also in some cases in the medical clinics to get access to areas that are difficult for a human being to reach. Any breach of this system can allow an attacker to get access to video feed and pictures viewed by that user and might allow them to get a foot hold in air gapped networks especially in case of nation critical infrastructure/industries. The firmware contains binary uvc_stream that is the UDP daemon which is responsible for handling all the UDP requests that the device receives. The client application sends a UDP request to change the Wi-Fi name which contains the following format: \SETCMD0001+0002+2 byte length of wifipassword+Wifipassword. This request is handled by \control_Dev_thread\ function which at address \0x00409AE4\ compares the incoming request and determines if the 10th byte is 02 and if it is then it redirects to 0x0040A7D8 which calls the function \setwifipassword\. The function \setwifipassword\ uses a memcpy function but uses the length of the payload obtained by using strlen function as the third parameter which is the number of bytes to copy and this allows an attacker to overflow the function and control the $PC value.


A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 13.5 and iPadOS 13.5 tvOS 13.4.5 watchOS 6.2.5 Safari 13.1.1 iTunes 12.10.7 for Windows iCloud for Windows 11.2 iCloud for Windows 7.19. Processing maliciously crafted web content may lead to arbitrary code execution.


A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 13.5 and iPadOS 13.5 tvOS 13.4.5 watchOS 6.2.5 Safari 13.1.1 iTunes 12.10.7 for Windows iCloud for Windows 11.2 iCloud for Windows 7.19. Processing maliciously crafted web content may lead to arbitrary code execution.


Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1 tvOS 14.0 macOS Big Sur 11.1 Security Update 2020-001 Catalina Security Update 2020-007 Mojave watchOS 7.0 iOS 14.0 and iPadOS 14.0. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory.


A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 13.5 and iPadOS 13.5 macOS Catalina 10.15.5 tvOS 13.4.5 watchOS 6.2.5. An application may be able to cause unexpected system termination or write kernel memory.


A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1 watchOS 7.1 iOS 12.4.9 watchOS 6.2.9 Security Update 2020-006 High Sierra Security Update 2020-006 Mojave iOS 14.2 and iPadOS 14.2 watchOS 5.3.9 macOS Catalina 10.15.7 Supplemental Update macOS Catalina 10.15.7 Update. Processing a maliciously crafted font may lead to arbitrary code execution.


A memory corruption issue existed in the processing of font files. This issue was addressed with improved input validation. This issue is fixed in iOS 14.0 and iPadOS 14.0 macOS Big Sur 11.1 Security Update 2020-001 Catalina Security Update 2020-007 Mojave macOS Big Sur 11.0.1 watchOS 7.0 tvOS 14.0. Processing a maliciously crafted font file may lead to arbitrary code execution.


A memory corruption issue existed in the processing of font files. This issue was addressed with improved input validation. This issue is fixed in tvOS 14.3 iOS 14.3 and iPadOS 14.3 macOS Big Sur 11.1 Security Update 2020-001 Catalina Security Update 2020-007 Mojave watchOS 7.2. Processing a maliciously crafted font file may lead to arbitrary code execution.


A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 13.6 and iPadOS 13.6 iCloud for Windows 7.20 watchOS 6.2.8 tvOS 13.4.8 macOS Catalina 10.15.6 Security Update 2020-004 Mojave Security Update 2020-004 High Sierra. Processing a maliciously crafted image may lead to arbitrary code execution.


A memory corruption issue existed in the processing of font files. This issue was addressed with improved input validation. This issue is fixed in watchOS 7.2 macOS Big Sur 11.1 Security Update 2020-001 Catalina Security Update 2020-007 Mojave iOS 14.3 and iPadOS 14.3 tvOS 14.3. Processing a maliciously crafted font file may lead to arbitrary code execution.


Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1 tvOS 13.3.1 Safari 13.0.5 iTunes for Windows 12.10.4 iCloud for Windows 11.0 iCloud for Windows 7.17. Processing maliciously crafted web content may lead to arbitrary code execution.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4 tvOS 13.4 watchOS 6.2 Safari 13.1 iTunes for Windows 12.10.5 iCloud for Windows 10.9.3 iCloud for Windows 7.18. Processing maliciously crafted web content may lead to arbitrary code execution.


In Poppler 0.59.0 memory corruption occurs in a call to Object::streamGetChar in Object.h after a repeating series of Gfx::display Gfx::go Gfx::execOp Gfx::opShowText and Gfx::doShowText calls (aka a Gfx.cc infinite loop).


The DoAlert function in the (1) TLS and (2) DTLS implementations in wolfSSL CyaSSL before 2.9.4 allows remote attackers to have unspecified impact and vectors which trigger memory corruption or an out-of-bounds read.


By carefully crafting promise resolutions it was possible to cause an out-of-bounds read off the end of an array resized during script execution. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.6 Firefox < 74 Firefox < ESR68.6 and Firefox ESR < 68.6.


A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3 macOS Mojave 10.14.3 tvOS 12.1.2. A malicious application may cause unexpected changes in memory shared between processes.


A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3 macOS Mojave 10.14.3 tvOS 12.1.2 watchOS 5.1.3. A malicious application may be able to break out of its sandbox.


A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 12.2 macOS Mojave 10.14.4. A local user may be able to read kernel memory.


A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 12.2 macOS Mojave 10.14.4 tvOS 12.2 watchOS 5.2. A malicious application may be able to elevate privileges.


A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 12.2 macOS Mojave 10.14.4 tvOS 12.2 watchOS 5.2. A malicious application may be able to determine kernel memory layout.


A memory initialization issue was addressed with improved memory handling. This issue affected versions prior to macOS Mojave 10.14.1.


A memory initialization issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1 macOS Mojave 10.14.2 tvOS 12.1.1 watchOS 5.1.2.


A memory initialization issue was addressed with improved memory handling. This issue affected versions prior to macOS Mojave 10.14.


A memory initialization issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1 macOS Mojave 10.14.1 tvOS 12.1 watchOS 5.1.


A memory initialization issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.5. A local user may be able to read kernel memory.


A memory initialization issue was addressed with improved memory handling. This issue is fixed in macOS Mojave 10.14.5. An application may be able to execute arbitrary code with system privileges.

memory initialization issue
arbitrary code execution


A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 13.6 and iPadOS 13.6 macOS Catalina 10.15.6 tvOS 13.4.8 watchOS 6.2.8. An application may be able to execute arbitrary code with kernel privileges.

memory initialization issue
arbitrary code execution
dos


A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 14.4 and iPadOS 14.4. An attacker in a privileged position may be able to perform a denial of service attack.

memory initialization issue
denial of service
dos


A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 14.0 and iPadOS 14.0. A local user may be able to read kernel memory.


A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1 macOS Catalina 10.15.3 tvOS 13.3.1 watchOS 6.1.2. An application may be able to read restricted memory.


A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4 macOS Catalina 10.15.4 tvOS 13.4 watchOS 6.2. An application may be able to read restricted memory.


In Wireshark 3.2.0 to 3.2.1 3.0.0 to 3.0.8 and 2.6.0 to 2.6.14 the LTE RRC dissector could leak memory. This was addressed in epan/dissectors/packet-lte-rrc.c by adjusting certain append operations.


In ImageMagick before 7.0.8-25 a memory leak exists in WriteDIBImage in coders/dib.c.


In ImageMagick before 7.0.8-25 a memory leak exists in ReadSIXELImage in coders/sixel.c.


In GraphicsMagick 1.3.26 a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c.


In all android releases(Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel while processing fastboot flash command memory leak or unexpected behavior may occur due to processing of unintialized data buffers.


A memory leak was discovered in the backport of fixes for CVE-2018-16864 in Red Hat Enterprise Linux. Function dispatch_message_real() in journald-server.c does not free the memory allocated by set_iovec_field_free() to store the `_CMDLINE=` entry. A local attacker may use this flaw to make systemd-journald crash. This issue only affects versions shipped with Red Hat Enterprise since v219-62.2.


go7007_snd_init in drivers/media/usb/go7007/snd-go7007.c in the Linux kernel before 5.6 does not call snd_card_free for a failure path which causes a memory leak aka CID-9453264ef586.


An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command a memory leak may occur.


xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.


An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There are memory leaks in metx_New in isomedia/box_code_base.c and abst_Read in isomedia/box_code_adobe.c.


An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a memory leak in dinf_New() in isomedia/box_code_base.c.


In ImageMagick before 7.0.8-25 a memory leak exists in WritePSDChannel in coders/psd.c.


Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have an out of bound read vulnerability. Successful exploitation could lead to memory leak.


In Live555 0.95 a setup packet can cause a memory leak leading to DoS because when there are multiple instances of a single field (username realm nonce uri or response) only the last instance can ever be freed.


In SWFTools a memory leak was found in wav2swf.


A memory leak vulnerability was found in Privoxy when handling errors.


A memory leak vulnerability was found in Privoxy before 3.0.29 in the show-status CGI handler when no action files are configured.


A memory leak vulnerability was found in Linux kernel in llcp_sock_connect


A memory leak vulnerability exists in Cisco IOS before 15.2(1)T due to a memory leak in the HTTP PROXY Server process (aka CSCtu52820) when configured with Cisco ISR Web Security with Cisco ScanSafe and User Authenticaiton NTLM configured.


A memory leak vulnerability was found in the function parseSWF_DOACTION in util/parser.c in Ming 0.4.8 which allows attackers to cause a denial of service via a crafted file.

memory leak vulnerability
denial of service


A memory leak vulnerability in sim-organizer.c of AlienVault Ossim v5 causes a denial of service (DOS) via a system crash triggered by the occurrence of a large number of alarm events.

memory leak vulnerability
denial of service
dos


In ImageMagick 7.0.6-2 a memory leak vulnerability was found in the function ReadOneJNGImage in coders/png.c which allows attackers to cause a denial of service.


In ImageMagick 7.0.6-2 a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c which allows attackers to cause a denial of service.


In ImageMagick 7.0.6-6 a memory exhaustion vulnerability was found in the function format8BIM which allows attackers to cause a denial of service.


In ImageMagick 7.0.6-2 a memory leak vulnerability was found in the function ReadMVGImage in coders/mvg.c which allows attackers to cause a denial of service related to the function ReadSVGImage in svg.c.


In ImageMagick 7.0.6-6 a memory exhaustion vulnerability was found in the function ReadTIFFImage which allows attackers to cause a denial of service.


In ImageMagick 7.0.6-2 a memory exhaustion vulnerability was found in the function ReadPSDImage in coders/psd.c which allows attackers to cause a denial of service.


In ImageMagick 7.0.6-6 a memory leak vulnerability was found in the function formatIPTC in coders/meta.c which allows attackers to cause a denial of service (WriteMETAImage memory consumption) via a crafted file.


In ImageMagick 7.0.6-6 a memory leak vulnerability was found in the function WritePCXImage in coders/pcx.c which allows attackers to cause a denial of service via a crafted file.


In ImageMagick 7.0.6-6 a memory leak vulnerability was found in the function WriteOneJNGImage in coders/png.c which allows attackers to cause a denial of service (WriteJNGImage memory consumption) via a crafted file.


In ImageMagick 7.0.6-8 a memory leak vulnerability was found in the function ReadMIFFImage in coders/miff.c which allows attackers to cause a denial of service (memory consumption in NewLinkedList in MagickCore/linked-list.c) via a crafted file.


In ImageMagick 7.0.6-5 a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c which allows attackers to cause a denial of service via a crafted file.


In LibTIFF 4.0.7 a memory leak vulnerability was found in the function TIFFReadDirEntryLong8Array in tif_dirread.c which allows attackers to cause a denial of service via a crafted file.


In Poppler 0.54.0 a memory leak vulnerability was found in the function gmalloc in gmem.cc which allows attackers to cause a denial of service via a crafted file.


In Poppler 0.54.0 a memory leak vulnerability was found in the function Object::initArray in Object.cc which allows attackers to cause a denial of service via a crafted file.


In LibTIFF 4.0.7 a memory leak vulnerability was found in the function OJPEGReadHeaderInfoSecTablesQTable in tif_ojpeg.c which allows attackers to cause a denial of service via a crafted file.


A memory leak vulnerability in the of Juniper Networks Junos OS allows an attacker to cause a Denial of Service (DoS) to the device by sending specific commands from a peered BGP host and having those BGP states delivered to the vulnerable device. This issue affects: Juniper Networks Junos OS: 18.1 versions prior to 18.1R2-S4 18.1R3-S1; 18.1X75 all versions. Versions before 18.1R1 are not affected.


In all android releases (Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel during wlan association driver allocates memory. In case the mem allocation fails driver does a mem free though the memory was not allocated.


In all Android releases from CAF using the Linux kernel some regions of memory were not protected during boot.


In all android releases (Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel while processing the function for writing device values into flash uninitialized memory can be written to flash.


In all android releases (Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel while processing the WLAN driver command ioctl a temporary buffer used to construct the reply message may be freed twice.


In the Linux kernel before 5.3.4 fib6_rule_lookup in net/ipv6/ip6_fib.c mishandles the RT6_LOOKUP_F_DST_NOREF flag in a reference-count decision leading to (for example) a crash that was identified by syzkaller aka CID-7b09c2d052db.


Cisco AnyConnect Secure Mobility Client before 4.2.05015 and 4.3.x before 4.3.02039 mishandles pathnames which allows local users to gain privileges via a crafted INF file aka Bug ID CSCuz92464.


Missing access control in Nextcloud Deck 1.0.4 caused an insecure direct object reference allowing an attacker to view all attachments.


In onSetSampleX of SkSwizzler.cpp there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-118143775.


In ImageMagick 7.0.5-7 Q16 a crafted file could trigger an assertion failure in the ResetImageProfileIterator function in MagickCore/profile.c because of missing checks in the ReadDDSImage function in coders/dds.c.


Due to missing input validation SAP Financial Consolidation before versions 10.0 and 10.1 enables an attacker to use crafted input to interfere with the structure of the surrounding query leading to XPath Injection.


RSA Netwitness Platform versions prior to 11.2.1.1 and RSA Security Analytics versions prior to 10.6.6.1 are vulnerable to a Command Injection vulnerability due to missing input validation in the product. A remote unauthenticated malicious user could exploit this vulnerability to execute arbitrary commands on the server.


A missing input validation in HDCP LDFW prior to SMR Nov-2021 Release 1 allows attackers to overwrite TZASC allowing TEE compromise.


A missing input validation in Samsung Flow Windows application prior to Version 4.8.5.0 allows attackers to overwrite abtraty file in the Windows known folders.


A missing input validation before memory copy in TIMA trustlet prior to SMR Jan-2022 Release 1 allows attackers to copy data from arbitrary memory.


A missing input validation in Nextcloud Server before 20.0.2 19.0.5 18.0.11 allows users to store unlimited data in workflow rules causing load and potential DDoS on later interactions and usage with those rules.


In all Qualcomm products with Android releases from CAF using the Linux kernel validation of buffer lengths was missing in Keymaster.


A missing permission check in Jenkins Avatar Plugin 1.2 and earlier allows attackers with Overall/Read access to change the avatar of any user of Jenkins.


A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.


A missing permission check in Jenkins Global Post Script Plugin in allowed users with Overall/Read access to list the scripts available to the plugin stored on the Jenkins master file system.


A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.


A missing permission check in Jenkins Google Kubernetes Engine Plugin 0.7.0 and earlier allowed attackers with Overall/Read permission to obtain limited information about the scope of a credential with an attacker-specified credentials ID.


A missing permission check in Jenkins jenkins-reviewbot Plugin in the ReviewboardDescriptor#doTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.


A missing permission check in Jenkins XebiaLabs XL Deploy Plugin in the Credential#doValidateUserNamePassword form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.


A missing permission check in Jenkins Rundeck Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.


A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited information about the content of SCM repositories referenced by global libraries.


A missing permission check in Jenkins Kmap Plugin in KmapJenkinsBuilder.DescriptorImpl form validation methods allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.


A missing permission check in Jenkins Dynatrace Application Monitoring Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.


A missing permission check in Jenkins Relution Enterprise Appstore Publisher Plugin 1.24 and earlier allows attackers to have Jenkins initiate an HTTP connection to an attacker-specified server.


A missing permission check in Jenkins Project Inheritance Plugin 2.0.0 and earlier allowed attackers with Overall/Read permission to trigger project generation from templates.


A missing permission check in Jenkins iceScrum Plugin 1.1.5 and earlier allowed attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.


A missing permission check in Jenkins Libvirt Slaves Plugin in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.


A missing permission check in Jenkins Artifactory Plugin 3.2.3 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.


A missing permission check in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier in various 'doFillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.


A missing permission check in Jenkins Oracle Cloud Infrastructure Compute Classic Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.


A missing permission check in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials.


A

missing

permission

check

in

Jenkins

Audit

to

Database

Plugin

in

the

DbAuditPublisherDescriptorImpl#doTestJdbcConnection

form

validation

method

allows

attackers

with

Overall/Read

permission

to

initiate

a

connection

to

an

attacker-specified

server.


A

missing

permission

check

in

Jenkins

Chef

Sinatra

Plugin

in

the

ChefBuilderConfiguration.DescriptorImpl#doTestConnection

form

validation

method

allows

attackers

with

Overall/Read

permission

to

initiate

a

connection

to

an

attacker-specified

server.


A missing permission check in Jenkins Fortify on Demand Uploader Plugin 3.0.10 and earlier allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.


A missing permission check in Jenkins Gearman Plugin in the GearmanPluginConfig#doTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.


A

missing

permission

check

in

Jenkins

Nomad

Plugin

in

the

NomadCloud.DescriptorImpl#doTestConnection

form

validation

method

allows

attackers

with

Overall/Read

permission

to

initiate

a

connection

to

an

attacker-specified

server.


A missing permission check in Jenkins Zephyr Enterprise Test Management Plugin in the ZeeDescriptor#doTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.


A

missing

permission

check

in

Jenkins

FTP

publisher

Plugin

in

the

FTPPublisher.DescriptorImpl#doLoginCheck

method

allows

attackers

with

Overall/Read

permission

to

initiate

a

connection

to

an

attacker-specified

server.


A

missing

permission

check

in

Jenkins

openid

Plugin

in

the

OpenIdSsoSecurityRealm.DescriptorImpl#doValidate

form

validation

method

allows

attackers

with

Overall/Read

permission

to

initiate

a

connection

to

an

attacker-specified

server.


A

missing

permission

check

in

Jenkins

SOASTA

CloudTest

Plugin

in

the

CloudTestServer.DescriptorImpl#doValidate

form

validation

method

allows

attackers

with

Overall/Read

permission

to

initiate

a

connection

to

an

attacker-specified

server.


A

missing

permission

check

in

Jenkins

VMware

Lab

Manager

Slaves

Plugin

in

the

LabManager.DescriptorImpl#doTestConnection

form

validation

method

allows

attackers

with

Overall/Read

permission

to

initiate

a

connection

to

an

attacker-specified

server.


A missing permission check in Jenkins Support Core Plugin 2.63 and earlier allows attackers with Overall/Read permission to delete support bundles.


A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.


A missing permission check in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers with Overall/Read permission to have Jenkins evaluate a computationally expensive regular expression.


A missing permission check in Jenkins RapidDeploy Plugin 4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified web server.


A missing permission check in Jenkins requests-plugin Plugin 2.2.6 and earlier allows attackers with Overall/Read permission to view the list of pending requests.


A missing permission check in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL capturing credentials stored in Jenkins.


A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to enumerate credentials ID of credentials stored in Jenkins.


A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Overall/Read permission to enumerate credentials ID of credentials stored in Jenkins.


A missing permission check was found in The CLI in JBoss Operations Network before 2.3.1 does not properly check permissions which allows JBoss ON users to perform management tasks and configuration changes with the privileges of the administrator user.


A missing permission check in Jenkins RocketChat Notifier Plugin 1.4.10 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.


A missing permission check in Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.


A missing permission check in Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.


A missing permission check in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers with Item/Read permission to change the owners and item-specific permissions of a job.


A missing permission check in Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.


A missing permission check in Jenkins SWAMP Plugin 1.2.6 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified web server using attacker-specified credentials.


A missing permission check in Jenkins Conjur Secrets Plugin 1.0.11 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.


A missing permission check in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers with Overall/Read permission to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse an XML response.


A missing permission check in Jenkins autonomiq Plugin 1.15 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.


A missing permission check in Jenkins SCP publisher Plugin 1.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials.


A missing permission check in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.


A missing permission check in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.


A missing permission check in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.


A missing permission check in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token.


A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.


A missing permission check in Jenkins Publish Over SSH Plugin 1.22 and earlier allows attackers with Overall/Read access to connect to an attacker-specified SSH server using attacker-specified credentials.


A missing permission check in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname.


A missing permission check in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins.


A missing permission check in the review handling of openSUSE Open Build Service before 2.9.3 allowed all authenticated users to modify sources in projects where they do not have write permissions.


A missing permission check in Jenkins Blue Ocean Plugin 1.23.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.


A missing permission check in Jenkins Perfecto Plugin 1.17 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified credentials.


A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.


A missing permission check in Jenkins Fortify on Demand Plugin 6.0.0 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.


A missing permission check in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified username and password.


A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.


A missing permission check in Jenkins Liquibase Runner Plugin 1.4.7 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.


A missing permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to list global pod template names.


A missing permission check in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method.


A missing permission check in Jenkins AWS Global Configuration Plugin 1.5 and earlier allows attackers with Overall/Read permission to replace the global AWS configuration.


A missing permission check in Jenkins Health Advisor by CloudBees Plugin 3.0 and earlier allows attackers with Overall/Read permission to send a fixed email to an attacker-specific recipient.


A missing permission check in Jenkins P4 Plugin 1.10.10 and earlier allows attackers with Overall/Read permission to trigger builds.


A missing permission check in Jenkins Mac Plugin 1.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials.


A missing permission check in Jenkins Azure Key Vault Plugin 2.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.


A missing permission check in Jenkins Amazon EC2 Plugin 1.50.1 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.


A missing permission check in Jenkins database Plugin 1.6 and earlier allows attackers with Overall/Read access to Jenkins to connect to an attacker-specified database server using attacker-specified credentials.


A missing permission check in Jenkins MongoDB Plugin 1.3 and earlier allows attackers with Overall/Read permission to gain access to some metadata of any arbitrary files on the Jenkins controller.


A missing permission check in Jenkins Active Directory Plugin 2.19 and earlier allows attackers with Overall/Read permission to access the domain health check diagnostic page.


A missing permission check in Jenkins Fortify on Demand Plugin 5.0.1 and earlier allows attackers with Overall/Read permission to connect to the globally configured Fortify on Demand endpoint using attacker-specified credentials IDs.


A missing permission check in Jenkins Mercurial Plugin 2.11 and earlier allows attackers with Overall/Read permission to obtain a list of names of configured Mercurial installations.


A missing permission check in Jenkins ElasTest Plugin 1.2.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.


The affected product is vulnerable to a missing permission validation on system backup restore which could lead to account take over and unapproved settings change.


Cisco Wireless LAN Controller (WLC) devices with software 4.x 5.x 6.0 and 7.0 before 7.0.220.4 when CPU-based ACLs are enabled allow remote attackers to read or modify the configuration via unspecified vectors aka Bug ID CSCtu56709.


An access issue was addressed with improved access restrictions. This issue is fixed in macOS Catalina 10.15.5. A malicious application may be able to modify protected parts of the file system.


In multiple managed switches by WAGO in different versions the webserver cookies of the web based UI contain user credentials.


In multiple managed switches by WAGO in different versions an attacker may trick a legitimate user to click a link to inject possible malicious code into the Web-Based Management.


In multiple managed switches by WAGO in different versions without authorization and with specially crafted packets it is possible to create users.


In multiple managed switches by WAGO in different versions special crafted requests can lead to cookies being transferred to third parties.


In multiple managed switches by WAGO in different versions the activated directory listing provides an attacker with the index of the resources located inside the directory.


In multiple managed switches by WAGO in different versions it is possible to read out the password hashes of all Web-based Management users.


Microsoft SQL Server 7 2000 and MSDE allows local users to gain privileges by hijacking a named pipe during the authentication of another user aka the \Named Pipe Hijacking\ vulnerability.


Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in PHP component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to execute arbitrary SQL command via unspecified vectors.

improper neutralization of special element


Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in thumbnail component in Synology Photo Station before 6.8.14-3500 allows remote attackers users to execute arbitrary SQL commands via unspecified vectors.


Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in cgi component in Synology Media Server before 1.8.1-2876 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.


Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote authenticated admin user to execute operating system commands with the privileges of the apache user.


Improper neutralization of special elements used in an OS command in SYNO.Core.Network.PPPoE in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote authenticated users to execute arbitrary code via realname parameter.


Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS.


In MIELE XGW 3000 ZigBee Gateway before 2.4.0 a malicious website visited by an authenticated admin user or a malicious mail is allowed to make arbitrary changes in the \admin panel\ because there is no CSRF protection.


In wolfSSL before 5.2.0 a TLS 1.3 server cannot properly enforce a requirement for mutual authentication. A client can simply omit the certificate_verify message from the handshake and never present a certificate.


An issue was found in Git before v2.24.1 v2.23.1 v2.22.2 v2.21.1 v2.20.2 v2.19.3 v2.18.2 v2.17.3 v2.16.6 v2.15.4 and v2.14.6. When running Git in the Windows Subsystem for Linux (also known as \WSL\) while accessing a working directory on a regular Windows drive none of the NTFS protections were active.


In all Android releases from CAF using the Linux kernel a KGSL ioctl was not validating all of its parameters.


A vulnerability in the development shell (devshell) authentication for Cisco Aironet Series Access Points (APs) running the Cisco AP-COS operating system could allow an authenticated local attacker to access the development shell without proper authentication which allows for root access to the underlying Linux OS. The attacker would need valid device credentials. The vulnerability exists because the software improperly validates user-supplied input at the CLI authentication prompt for development shell access. An attacker could exploit this vulnerability by authenticating to the device and entering crafted input at the CLI. A successful exploit could allow the attacker to access the AP development shell without proper authentication which allows for root access to the underlying Linux OS. Software versions prior to 8.3.150.0 8.5.135.0 and 8.8.100.0 are affected.


augustine node module suffers from a Path Traversal vulnerability due to lack of validation of url which allows a malicious user to read content of any file with known path.


stattic node module suffers from a Path Traversal vulnerability due to lack of validation of path which allows a malicious user to read content of any file with known path.


mcstatic node module suffers from a Path Traversal vulnerability due to lack of validation of filePath which allows a malicious user to read content of any file with known path.


public node module suffers from a Path Traversal vulnerability due to lack of validation of filePath which allows a malicious user to read content of any file with known path.


serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded.


hekto node module suffers from a Path Traversal vulnerability due to lack of validation of file which allows a malicious user to read content of any file with known path.


simplehttpserver node module suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names.

lack of file name validation
cross site scripting


Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However in some cases it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).


An issue was discovered in Mattermost Mobile Apps before 1.26.0. Local logging is not blocked for sensitive information (e.g. server addresses or message content).


In all Android releases from CAF using the Linux kernel access control to SMEM memory was not enabled.


In all Android releases from CAF using the Linux kernel stack protection was not enabled for secure applications.


Adobe Acrobat and Reader versions 2020.006.20042 and earlier 2017.011.30166 and earlier 2017.011.30166 and earlier and 2015.006.30518 and earlier have a null pointer vulnerability. Successful exploitation could lead to application denial-of-service.


In LibreCAD 2.2.0 a NULL pointer dereference in the HATCH handling of libdxfrw allows an attacker to crash the application using a crafted DXF document.


In ImageMagick 7.0.7 a NULL pointer dereference vulnerability was found in the function BenchmarkOpenCLDevices in MagickCore/opencl.c because a memory allocation result is not checked.


In ImageMagick 7.0.7 a NULL pointer dereference vulnerability was found in the function saveBinaryCLProgram in magick/opencl.c because a program-lookup result is not checked related to CacheOpenCLKernel.


In Deark before 1.5.8 a specially crafted input file can cause a NULL pointer dereference in the dbuf_write function (src/deark-dbuf.c).


In ImageMagick before 7.0.8-8 a NULL pointer dereference exists in the GetMagickProperty function in MagickCore/property.c.


In ImageMagick before 7.0.8-8 a NULL pointer dereference exists in the CheckEventLogging function in MagickCore/log.c.


In UrBackup 2.2.6 an attacker can send a malformed request to the client over the network and trigger a fileservplugin/CClientThread.cpp CClientThread::GetFileHashAndMetadata NULL pointer dereference leading to shutting down the client application.


In Dovecot before 2.3.9.2 an attacker can crash a push-notification driver with a crafted email when push notifications are used because of a NULL Pointer Dereference. The email must use a group address as either the sender or the recipient.


In

Wireshark

to

the

ROS

dissector

could

crash

with

a

pointer

dereference.

This

was

addressed

in

by

validating

an

OID.


In HDF5 1.10.1 there is a NULL pointer dereference in the function H5O_pline_decode in the H5Opline.c file in libhdf5.a. For example h5dump would crash when someone opens a crafted hdf5 file.


Ming (aka libming) 0.4.8 has a NULL pointer dereference in the function getString() in the decompile.c file in libutil.a.


Ming (aka libming) 0.4.8 has z NULL pointer dereference in the function decompileGETURL2() in decompile.c.


In all android releases(Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel Null pointer dereference vulnerability may occur due to missing NULL assignment in NAT module of freed pointer.


In all Qualcomm products with Android releases from CAF using the Linux kernel disabling asserts can potentially cause a NULL pointer dereference during an out-of-memory condition.


slock allows attackers to bypass the screen lock via vectors involving an invalid password hash which triggers a NULL pointer dereference and crash.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9615 MDM9625 MDM9635M and SD 810 improper input validation can cause a null pointer dereference in USB bootloader find_ep() function.


poppler 0.54.0 as used in Evince and other products has a NULL pointer dereference in the JPXStream::readUByte function in JPXStream.cc. For example the perf_test utility will crash (segmentation fault) when parsing an invalid PDF file.


Under certain conditions a malicious user provoking a Null Pointer dereference can prevent legitimate users from accessing the SAP Internet Graphics Server 7.20 7.20EXT 7.45 7.49 7.53 and its services.


A component of the HarmonyOS has a NULL Pointer Dereference vulnerability. Local attackers may exploit this vulnerability to cause kernel crash.


A component of the HarmonyOS has a NULL Pointer Dereference vulnerability. Local attackers may exploit this vulnerability to cause System functions which are unavailable.


A component of the HarmonyOS has a NULL Pointer Dereference vulnerability. Local attackers may exploit this vulnerability to cause nearby process crash.


An error within the \LibRaw::unpack()\ function (src/libraw_cxx.cpp) in LibRaw versions prior to 0.18.7 can be exploited to trigger a NULL pointer dereference.


An error within the \leaf_hdr_load_raw()\ function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.8 can be exploited to trigger a NULL pointer dereference.


An error within the \nikon_coolscan_load_raw()\ function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.9 can be exploited to trigger a NULL pointer dereference.


An error within the \tar_directory_for_file()\ function (gsf-infile-tar.c) in GNOME Structured File Library before 1.14.41 can be exploited to trigger a Null pointer dereference and subsequently cause a crash via a crafted TAR file.


A flaw was found in OpenEXR's Multipart input file functionality. A crafted multi-part input file with no actual parts can trigger a NULL pointer dereference. The highest threat from this vulnerability is to system availability.


In GNU Libextractor 1.4 there is a NULL Pointer Dereference in flac_metadata in flac_extractor.c.


In GNU Libextractor 1.4 there is a NULL Pointer Dereference in the EXTRACTOR_nsf_extract_method function of plugins/nsf_extractor.c.


NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a NULL pointer dereference may lead to a system crash.


Improper handling of a repeating VRAT chunk in qcpfformat.dll allows attackers to cause a Null pointer dereference and crash in RealNetworks RealPlayer 18.1.5.705 through a crafted .QCP media file.


DjVuLibre 3.5.27 has a NULL pointer dereference in the function DJVU::filter_fv at IW44EncodeCodec.cpp.


Bento4 1.5.1-628 has a NULL pointer dereference in AP4_ByteStream::ReadUI32 in Core/Ap4ByteStream.cpp when called from the AP4_TrunAtom class.


has

a

pointer

dereference

in

in

related

to

in

as

demonstrated

by


has

a

pointer

dereference

in

in

related

to

in

as

demonstrated

by

or


samurai 1.2 has a NULL pointer dereference in writefile() in util.c via a crafted build file.


samurai 1.2 has a NULL pointer dereference in printstatus() function in build.c via a crafted build file.


GraphicsMagick 1.3.26 has a NULL pointer dereference vulnerability in the function SVGStartElement in coders/svg.c.


GraphicsMagick 1.3.26 has a NULL pointer dereference in the WritePCLImage() function in coders/pcl.c during writes of monochrome images.


GraphicsMagick 1.3.26 has a NULL pointer dereference in the WriteMAPImage() function in coders/map.c when processing a non-colormapped image a different vulnerability than CVE-2017-11638.


ImageMagick 7.0.7-0 has a NULL Pointer Dereference in TIFFIgnoreTags in coders/tiff.c.


LAME 3.99.5 has a NULL Pointer Dereference in the hip_decode_init function within libmp3lame/mpglib_interface.c via a malformed mpg file because of an incorrect calloc call.


SQLite 3.20.1 has a NULL pointer dereference in tableColumnList in shell.c because it fails to consider certain cases where `sqlite3_step(pStmt)==SQLITE_ROW` is false and a data structure is never initialized.


libming 0.4.8 has a NULL pointer dereference in the strlenext function of the decompile.c file a different vulnerability than CVE-2018-7874.


libming 0.4.8 has a NULL pointer dereference in the getName function of the decompile.c file a different vulnerability than CVE-2018-7872 and CVE-2018-9165.


libming 0.4.8 has a NULL pointer dereference in the pushdup function of the decompile.c file.


libming 0.4.8 has a NULL pointer dereference in the getInt function of the decompile.c file a different vulnerability than CVE-2018-9132.


libming 0.4.8 has a NULL pointer dereference in the newVar3 function of the decompile.c file a different vulnerability than CVE-2018-7866.


OpenJPEG 2.3.0 has a NULL pointer dereference for \red\ in the imagetopnm function of jp2/convert.c


LibTIFF 4.0.9 has a NULL pointer dereference in the jpeg_fdct_16x16 function in jfdctint.c.


libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.


The HwNearbyMain module has a NULL Pointer Dereference vulnerability.Successful exploitation of this vulnerability may cause a process to restart.


There is a NULL pointer dereference in the syscall open_exec function of Allwinner R818 SoC Android Q SDK V1.0 that could executable a malicious file to cause a system crash.


There is a NULL Pointer Dereference vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to kernel crash.


GPAC 1.0.1 is affected by a NULL pointer dereference in gf_utf8_wcslen. (gf_utf8_wcslen is a renamed Unicode utf8_wcslen function.)


GPAC 1.0.1 is affected by a NULL pointer dereference in gf_dump_vrml_field.isra ().


An issue has been found in libIEC61850 v1.3. It is a NULL pointer dereference in Ethernet_sendPacket in ethernet_bsd.c.


An issue has been found in libIEC61850 v1.3. It is a NULL pointer dereference in ClientDataSet_getValues in client/ied_connection.c.


An issue has been discovered in Bento4 1.5.1-624. A NULL pointer dereference can occur in AP4_DataBuffer::SetData in Core/Ap4DataBuffer.cpp.


In Libav 12.3 a NULL pointer dereference (RIP points to zero) issue in ff_mpa_synth_filter_float in libavcodec/mpegaudiodsp_template.c can cause a segmentation fault (application crash) via a crafted mov file.


pointer

dereferencing

can

happen

when

playing

the

clip

with

wrong

block

group

id

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Qualcomm

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


An issue was discovered in InspIRCd 2 before 2.0.28 and 3 before 3.3.0. The mysql module contains a NULL pointer dereference when built against mariadb-connector-c 3.0.5 or newer. When combined with the sqlauth or sqloper modules this vulnerability can be used for remote crashing of an InspIRCd server by any user able to connect to a server.


An issue was discovered in Foxit Reader and PhantomPDF before 9.7. It has a NULL pointer dereference during the parsing of file data.


An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a NULL pointer dereference in the function gf_isom_dump() in isomedia/box_dump.c.


An

issue

was

discovered

in

There

is

a

pointer

dereference

in

in

when

called

from

in


An issue was discovered on Samsung mobile devices with N(7.x) O(8.0) and P(9.0) (Qualcomm chipsets) software. The ESECOMM Trustlet has a NULL pointer dereference. The Samsung ID is SVE-2019-13950 (May 2019).


An issue was discovered in Foxit PhantomPDF before 8.3.11. It has a NULL pointer dereference via FXSYS_wcslen in an Epub file.


An issue was discovered in Foxit Reader and PhantomPDF before 9.6. It has a NULL pointer dereference via FXSYS_wcslen in an Epub file.


An issue was discovered in ezXML 0.8.2 through 0.8.6. The function ezxml_str2utf8 while parsing a crafted XML file performs zero-length reallocation in ezxml.c leading to returning a NULL pointer (in some compilers). After this the function ezxml_parse_str does not check whether the s variable is not NULL in ezxml.c leading to a NULL pointer dereference and crash (segmentation fault).


An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a NULL pointer dereference in the function gf_odf_avc_cfg_write_bs() in odf/descriptors.c.


An issue was discovered in Foxit PhantomPDF Mac before 3.4. It has a NULL pointer dereference.


In the Linux kernel before 5.0.6 there is a NULL pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c related to put_links aka CID-23da9588037e.


An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a NULL pointer dereference in the function senc_Parse() in isomedia/box_code_drm.c.


An issue was discovered on Samsung mobile devices with N(7.x) O(8.0) and P(9.0) (Qualcomm chipsets) software. The Authnr Trustlet has a NULL pointer dereference. The Samsung ID is SVE-2019-13949 (May 2019).


An issue was discovered in GNU LibreDWG through 0.9.3. There is a NULL pointer dereference in the function dwg_encode_common_entity_handle_data in common_entity_handle_data.spec.


An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a NULL pointer dereference in the function ilst_item_Read() in isomedia/box_code_apple.c.


An

issue

was

discovered

in

There

is

a

pointer

dereference

in

in

when

called

from

AP4_EsDescriptor::GetDecoderConfigDescriptor

in


An issue was discovered in Foxit PhantomPDF before 8.3.12. It has a NULL pointer dereference during the parsing of file data.


An issue was discovered in Foxit PhantomPDF before 8.3.12. It has a NULL pointer dereference.


In the Lustre file system before 2.12.3 mdt_object_remote in the mdt module has a NULL pointer dereference and panic due to the lack of validation for specific fields of packets sent by a client.


An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a NULL pointer dereference in the function gf_isom_box_del() in isomedia/box_funcs.c.


An issue was discovered in Foxit Reader and PhantomPDF before 9.7. It has a NULL pointer dereference.


An issue was discovered in Foxit PhantomPDF Mac 3.3 and Foxit Reader for Mac before 3.3. It has a NULL pointer dereference.


An issue was discovered in GNU LibreDWG through 0.9.3. There is a NULL pointer dereference in the function dwg_encode_LWPOLYLINE in dwg.spec.


An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_decode while parsing a crafted XML file performs incorrect memory handling leading to NULL pointer dereference while running strlen() on a NULL pointer.


An issue was discovered in the DBI module before 1.643 for Perl. The hv_fetch() documentation requires checking for NULL and the code does that. But shortly thereafter it calls SvOK(profile) causing a NULL pointer dereference.


In libdoc through 2019-01-28 doc2text in catdoc.c has a NULL pointer dereference.


A

pointer

dereference

was

discovered

in

wasm::WasmBinaryBuilder::processFunctions()

in

wasm/wasm-binary.cpp

(when

calling

wasm::WasmBinaryBuilder::getFunctionIndexName)

in

Binaryen

A

crafted

input

can

cause

segmentation

faults

leading

to

denial-of-service

as

demonstrated

by

wasm-opt.


An issue was discovered in Envoy 1.12.0. Upon receipt of a malformed HTTP request without a Host header it sends an internally generated \Invalid request\ response. This internally generated response is dispatched through the configured encoder filter chain before being sent to the client. An encoder filter that invokes route manager APIs that access a request's Host header causes a NULL pointer dereference resulting in abnormal termination of the Envoy process.


An issue was discovered in Mooltipass Moolticute through v0.42.1 and v0.42.x-testing through v0.42.5-testing. There is a NULL pointer dereference in MPDevice_win.cpp.


An issue was discovered in res_pjsip_t38.c in Sangoma Asterisk through 13.x and Certified Asterisk through 13.21-x. If it receives a re-invite initiating T.38 faxing and has a port of 0 and no c line in the SDP a NULL pointer dereference and crash will occur. This is different from CVE-2019-18940.


Trend Micro Security (Consumer) 2020 (v16.x) is affected by a vulnerability in where null pointer dereference errors result in the crash of application which could potentially lead to possible unsigned code execution under certain circumstances.


fs/btrfs/volumes.c in the Linux kernel before 5.1 allows a btrfs_verify_dev_extents NULL pointer dereference via a crafted btrfs image because fs_devices->devices is mishandled within find_device aka CID-09ba3bc9dd15.


LibSass before 3.6.3 allows a NULL pointer dereference in Sass::Parser::parseCompoundSelector in parser_selectors.cpp.


MiniUPnP ngiflib 0.4 has a NULL pointer dereference in GifIndexToTrueColor in ngiflib.c via a file that lacks a palette.


3S-Smart CODESYS SP Realtime NT before V2.3.7.28 CODESYS Runtime Toolkit 32 bit full before V2.4.7.54 and CODESYS PLCWinNT before V2.4.7.54 allow a NULL pointer dereference.


btrfs_root_node in fs/btrfs/ctree.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because rcu_dereference(root->node) can be zero.


bitstr_tell at bitstr.c in ffjpeg through 2019-08-21 has a NULL pointer dereference related to jfif_encode.


flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. This can cause a NULL pointer dereference (or incorrect results).


ext4_empty_dir in fs/ext4/namei.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because ext4_read_dirblock(inode 0 DIRENT_HTREE) can be zero.


In text_to_glyphs in sushi-font-widget.c in gnome-font-viewer 3.34.0 there is a NULL pointer dereference while parsing a TTF font file that lacks a name section (due to a g_strconcat call that returns NULL).


The

library

in

npdf.dll

in

Nitro

Free

PDF

Reader

has

a

Pointer

Dereference

via

crafted

Unicode

content.


marc-q libwav through 2017-04-20 has a NULL pointer dereference in wav_content_read() at libwav.c.


An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can cause a NULL pointer dereference and ntpd crash in ntp_control.c related to ctl_getitem.


An issue was discovered in GNU Recutils 1.8. There is a NULL pointer dereference in the function rec_field_set_name() in the file rec-field.c in librec.a.


An issue was discovered in GNU Recutils 1.8. There is a NULL pointer dereference in the function rec_fex_size() in the file rec-fex.c of librec.a.


An issue was discovered in lib60870 2.1.1. LinkLayer_setAddress in link_layer/link_layer.c has a NULL pointer dereference.


An exploitable denial-of-service vulnerability exists in the session handling functionality of the NETGEAR N300 (WNR2000v5 with Firmware Version V1.0.0.70) HTTP server. An HTTP request with an empty User-Agent string sent to a page requiring authentication can cause a null pointer dereference resulting in the HTTP service crashing. An unauthenticated attacker can send a specially crafted HTTP request to trigger this vulnerability.


An issue was discovered in Foxit Reader and PhantomPDF before 9.4 on Windows. It is a NULL pointer dereference during PDF parsing.


An exploitable denial-of-service vulnerability exists in the Host Access Point Daemon (hostapd) on the NETGEAR N300 (WNR2000v5 with Firmware Version V1.0.0.70) wireless router. A SOAP request sent in an invalid sequence to the <WFAWLANConfig:1#PutMessage> service can cause a null pointer dereference resulting in the hostapd service crashing. An unauthenticated attacker can send a specially-crafted SOAP request to trigger this vulnerability.


Some Huawei smart phones have a null pointer dereference vulnerability. An attacker crafts specific packets and sends to the affected product to exploit this vulnerability. Successful exploitation may cause the affected phone to be abnormal.


3S-Smart Software Solutions GmbH CODESYS V3 OPC UA Server all versions 3.5.11.0 to 3.5.15.0 allows an attacker to send crafted requests from a trusted OPC UA client that cause a NULL pointer dereference which may trigger a denial-of-service condition.


An issue was discovered in FlightCrew v0.9.2 and earlier. A NULL pointer dereference occurs in GetRelativePathToNcx() or GetRelativePathsToXhtmlDocuments() when a NULL pointer is passed to xc::XMLUri::isValidURI(). This affects third-party software (not Sigil) that uses FlightCrew as a library.


An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a NULL pointer dereference in the SDL stdio_read function in file/SDL_rwops.c.


An issue was discovered in GPAC 0.7.1. There is a NULL pointer dereference in the function GetESD at isomedia/track.c in libgpac.a as demonstrated by MP4Box.


An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a NULL pointer dereference in the SDL2_image function IMG_LoadPCX_RW at IMG_pcx.c.


In Libreswan 3.27 an assertion failure can lead to a pluto IKE daemon restart. An attacker can trigger a NULL pointer dereference by initiating an IKEv2 IKE_SA_INIT exchange followed by a bogus INFORMATIONAL exchange instead of the normallly expected IKE_AUTH exchange. This affects send_v2N_spi_response_from_state() in programs/pluto/ikev2_send.c that will then trigger a NULL pointer dereference leading to a restart of libreswan.


An issue was discovered in GPAC 0.7.1. There is a NULL pointer dereference in the function gf_isom_get_original_format_type at isomedia/drm_sample.c in libgpac.a as demonstrated by MP4Box.


interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference.


BT process died and BT toggled due to null pointer dereference when invalid vendor pass through command sent from remote in Snapdragon Auto Snapdragon Consumer IOT Snapdragon Mobile Snapdragon Voice & Music in QCS405 QCS605 SD 636 SD 675 SD 730 SD 820A SD 835 SD 845 / SD 850 SD 855 SDM630 SDM660


An issue was discovered in Xpdf 4.01.01. There is a NULL pointer dereference in the function Gfx::opSetExtGState in Gfx.cc.


pointer

dereference

can

occur

while

parsing

invalid

chunks

while

playing

the

nonstandard

clip

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Qualcomm

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


An issue was discovered in Poppler 0.74.0. There is a NULL pointer dereference in the function SplashClip::clipAALine at splash/SplashClip.cc.


Null pointer dereference issue in kernel due to missing check related to LLC support in GPU in Snapdragon Auto Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Mobile Snapdragon Voice & Music in QCS605 SDM670 SDM710 SM6150 SM7150 SM8150


pointer

dereference

issue

can

happen

due

to

improper

validation

of

CSEQ

header

response

received

from

network

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Wearables

in

Nicobar

Rennell


pointer

dereference

can

happen

when

parsing

udta

atom

which

is

non-standard

and

having

invalid

depth

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Nicobar

Rennell

Saipan


pointer

dereference

can

occur

while

parsing

the

clip

which

is

nonstandard

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Nicobar

Rennell


An issue was discovered in GNU recutils 1.8. There is a NULL pointer dereference in the function rec_rset_get_props at rec-rset.c in librec.a leading to a crash.


The agroot() function in cgraph\\obj.c in libcgraph.a in Graphviz 2.39.20160612.1140 has a NULL pointer dereference as demonstrated by graphml2gv.


An issue was discovered in GNU recutils 1.8. There is a NULL pointer dereference in the function rec_field_name_equal_p at rec-field-name.c in librec.a leading to a crash.


An issue was discovered in the Linux kernel through 5.2.9. There is a NULL pointer dereference caused by a malicious USB device in the flexcop_usb_probe function in the drivers/media/usb/b2c2/flexcop-usb.c driver.


drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel through 5.2.8 has a NULL pointer dereference via an incomplete address in an endpoint descriptor.


An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB device in the sound/usb/line6/driver.c driver.


An issue was discovered in the Linux kernel before 5.0.9. There is a NULL pointer dereference for a pf data structure if alloc_disk fails in drivers/block/paride/pf.c.


An issue was discovered in the Linux kernel before 5.0.14. There is a NULL pointer dereference caused by a malicious USB device in the drivers/usb/misc/yurex.c driver.


An issue was discovered in the Linux kernel before 5.2.8. There is a NULL pointer dereference caused by a malicious USB device in the sound/usb/helper.c (motu_microbookii) driver.


An issue was discovered in the Linux kernel before 5.0.9. There is a NULL pointer dereference for a cd data structure if alloc_disk fails in drivers/block/paride/pf.c.


libMirage 3.2.2 in CDemu has a NULL pointer dereference in the NRG parser in parser.c.


An issue was discovered in the Linux kernel before 5.2.3. There is a NULL pointer dereference caused by a malicious USB device in the drivers/media/usb/zr364xx/zr364xx.c driver.


drivers/net/wireless/ath/ath6kl/usb.c in the Linux kernel through 5.2.9 has a NULL pointer dereference via an incomplete address in an endpoint descriptor.


An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB device in the drivers/usb/misc/sisusbvga/sisusb.c driver.


An issue was discovered in Binaryen 1.38.32. Two visitors in ir/ExpressionManipulator.cpp can lead to a NULL pointer dereference in wasm::LocalSet::finalize in wasm/wasm.cpp. A crafted input can cause segmentation faults leading to denial-of-service as demonstrated by wasm2js.


An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB device in the drivers/media/usb/siano/smsusb.c driver.


An issue was discovered in the Linux kernel before 5.1.17. There is a NULL pointer dereference caused by a malicious USB device in the sound/usb/line6/pcm.c driver.


An

issue

was

discovered

in

the

Linux

kernel

before

in

has

a

pointer

dereference

because

there

is

no

-ENOMEM

upon

an

failure.


In the __multadd function of the newlib libc library prior to versions 3.3.0 (see newlib/libc/stdlib/mprec.c) Balloc is used to allocate a big integer however no check is performed to verify if the allocation succeeded or not. This will trigger a null pointer dereference bug in case of a memory allocation failure.


In the __mdiff function of the newlib libc library all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c) Balloc is used to allocate big integers however no check is performed to verify if the allocation succeeded or not. The access to _wds and _sign will trigger a null pointer dereference bug in case of a memory allocation failure.


The _dtoa_r function of the newlib libc library prior to version 3.3.0 performs multiple memory allocations without checking their return value. This could result in NULL pointer dereference.


In the __lshift function of the newlib libc library all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c) Balloc is used to allocate a big integer however no check is performed to verify if the allocation succeeded or not. The access to b1 will trigger a null pointer dereference bug in case of a memory allocation failure.


pointer

dereference

issue

in

radio

interface

layer

due

to

lack

of

check

in

sapmodule

destructor

in

Snapdragon

Auto

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

in

Nicobar

Rennell

Saipan


In libnasm.a in Netwide Assembler (NASM) 2.14.xx asm/pragma.c allows a NULL pointer dereference in process_pragma search_pragma_list and nasm_set_limit when \%pragma limit\ is mishandled.


In the __i2b function of the newlib libc library all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c) Balloc is used to allocate a big integer however no check is performed to verify if the allocation succeeded or not. The access of _ x0 will trigger a null pointer dereference bug in case of a memory allocation failure.


In the __d2b function of the newlib libc library all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c) Balloc is used to allocate a big integer however no check is performed to verify if the allocation succeeded or not. Accessing _x will trigger a null pointer dereference bug in case of a memory allocation failure.


An issue was discovered in OpenCV before 4.1.1. There is a NULL pointer dereference in the function cv::XMLParser::parse at modules/core/src/persistence.cpp.


Possible null pointer dereference issue in location assistance data processing due to missing null check on resources before using it in Snapdragon Auto Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile in MDM9150 MDM9607 MDM9650 SDM660 SDM845 SM8150 SM8250 SXR2130


libopenmpt before 0.4.3 allows a crash due to a NULL pointer dereference when doing a portamento from an OPL instrument to an empty instrument note map slot.


An issue was discovered in Foxit PhantomPDF before 8.3.10. The application could be exposed to a NULL pointer dereference and crash when getting a PDF object from a document or parsing a certain portfolio that contains a null dictionary.


In the __multiply function of the newlib libc library all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c) Balloc is used to allocate a big integer however no check is performed to verify if the allocation succeeded or not. The access of _x0 will trigger a null pointer dereference bug in case of a memory allocation failure.


An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is a NULL pointer dereference in the function dwg_dxf_LTYPE at dwg.spec (later than CVE-2019-9779).


An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is a NULL pointer dereference in the function dwg_dxf_LEADER at dwg.spec.


In SQLite 3.27.2 interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference in fts5ChunkIterate in sqlite3.c. This is related to ext/fts5/fts5_hash.c and ext/fts5/fts5_index.c.


In the Linux kernel before 4.20.14 expand_downwards in mm/mmap.c lacks a check for the mmap minimum address which makes it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task.


pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.


In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6 the TCAP dissector could crash. This was addressed in epan/dissectors/asn1/tcap/tcap.cnf by avoiding NULL pointer dereferences.


An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is a NULL pointer dereference in the function Mat_VarFree() in mat.c.


An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is a NULL pointer dereference in the function dwg_dxf_LTYPE at dwg.spec (earlier than CVE-2019-9776).


An issue was discovered in LibOFX 0.9.14. There is a NULL pointer dereference in the function OFXApplication::startElement in the file lib/ofx_sgml.cpp as demonstrated by ofxdump.


An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is a NULL pointer dereference in the function bit_convert_TU at bits.c.


in

the

Linux

kernel

does

not

check

the

return

value

leading

to

a

pointer

dereference.


drivers/scsi/qla2xxx/qla_os.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value leading to a NULL pointer dereference.


drivers/net/fjes/fjes_main.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value leading to a NULL pointer dereference.


DISPUTED

in

the

Linux

kernel

does

not

check

the

return

value

leading

to

a

pointer

dereference.

NOTE:

The

security

community

disputes

this

issues

as

not

being

serious

enough

to

be

deserving

a

CVE

id.


ffjpeg before 2019-08-18 has a NULL pointer dereference in huffman_decode_step() at huffman.c.


MyHTML through 4.0.5 has a NULL pointer dereference in myhtml_tree_node_remove in tree.c.


RIOT 2019.07 contains a NULL pointer dereference in the MQTT-SN implementation (asymcute) potentially allowing an attacker to crash a network node running RIOT. This requires spoofing an MQTT server response. To do so the attacker needs to know the MQTT MsgID of a pending MQTT protocol message and the ephemeral port used by RIOT's MQTT implementation. Additionally the server IP address is required for spoofing the packet.


Symonics libmysofa 0.7 has a NULL pointer dereference in getHrtf in hrtf/reader.c.


Onigmo through 6.2.0 has a NULL pointer dereference in onig_error_code_to_str because of fetch_token in regparse.c.


DISPUTED

in

the

Linux

kernel

does

not

check

the

return

value

leading

to

a

pointer

dereference.

NOTE:

A

third-party

software

maintainer

states

that

the

work

queue

allocation

is

happening

during

device

initialization

which

for

a

graphics

card

occurs

during

boot.

It

is

not

attacker

controllable

and

OOM

at

that

time

is

highly

unlikely.


ffjpeg before 2019-08-18 has a NULL pointer dereference in idct2d8x8() at dct.c.


marc-q libwav through 2017-04-20 has a NULL pointer dereference in gain_file() at wav_gain.c.


Hydra through 0.1.8 has a NULL pointer dereference and daemon crash when processing POST requests that lack a Content-Length header. read.c request.c and util.c contribute to this. The process_header_end() function calls boa_atoi() which ultimately calls atoi() on a NULL pointer.


In FFmpeg before 4.2 avcodec_open2 in libavcodec/utils.c allows a NULL pointer dereference and possibly unspecified other impact when there is no valid close function pointer.


Catalog.cc in Xpdf 4.02 has a NULL pointer dereference because Catalog.pageLabels is initialized too late in the Catalog constructor.


On Xiaomi MIX 2 devices with the 4.4.78 kernel a NULL pointer dereference in the ioctl interface of the device file /dev/elliptic1 or /dev/elliptic0 causes a system crash via IOCTL 0x4008c575 (aka decimal 1074316661).


NTP through 4.2.8p12 has a NULL Pointer Dereference.


An issue was discovered in SoX 14.4.2. lsx_make_lpf in effect_i_dsp.c allows a NULL pointer dereference.


The av_reallocp_array function in libavutil/mem.c in FFmpeg before 2.0.1 has an unspecified impact and remote vectors related to a \wrong return code\ and a resultant NULL pointer dereference.


slim has NULL pointer dereference when using crypt() method from glibc 2.17


Passcode Lock in Apple iOS before 7.0.2 on iPhone devices allows physically proximate attackers to bypass an intended passcode requirement and dial arbitrary telephone numbers by making a series of taps of the emergency-call button to trigger a NULL pointer dereference.


Passcode Lock in Apple iOS before 7.0.3 on iPhone devices allows physically proximate attackers to bypass an intended passcode requirement and dial arbitrary telephone numbers by tapping the emergency-call button during a certain notification and camera-pane state to trigger a NULL pointer dereference.


The ff_er_frame_end function in libavcodec/error_resilience.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.1 does not properly verify that a frame is fully initialized which allows remote attackers to trigger a NULL pointer dereference via crafted picture data.


A NULL Pointer Dereference vulnerability in the messaging_ipc.dll component as used in Bitdefender Total Security Internet Security Antivirus Plus Endpoint Security Tools VPN Standalone allows an attacker to arbitrarily crash product processes and generate crashdump files. This issue affects: Bitdefender Total Security versions prior to 26.0.3.29. Bitdefender Internet Security versions prior to 26.0.3.29. Bitdefender Antivirus Plus versions prior to 26.0.3.29. Bitdefender Endpoint Security Tools versions prior to 7.2.2.92. Bitdefender VPN Standalone versions prior to 25.5.0.48.


A NULL pointer dereference issue was found in the block mirror layer of QEMU in versions prior to 6.2.0. The `self` pointer is dereferenced in mirror_wait_on_conflicts() without ensuring that it's not NULL. A malicious unprivileged user within the guest could use this flaw to crash the QEMU process on the host when writing data reaches the threshold of mirroring node.


Acrobat Reader DC versions 2021.005.20060 (and earlier) 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


There is a Null pointer dereference in Smartphones.Successful exploitation of this vulnerability may cause the kernel to break down.


Acrobat Pro DC versions 2021.005.20060 (and earlier) 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to disclose sensitive user memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


SAP CommonCryptoLib version 8.5.38 or lower is vulnerable to null pointer dereference vulnerability when an unauthenticated attacker sends crafted malicious data in the HTTP requests over the network this causes the SAP application to crash and has high impact on the availability of the SAP system.


An issue was discovered in Foxit PDF Editor before 11.0.1 and PDF Reader before 11.0.1 on macOS. It mishandles missing dictionary entries leading to a NULL pointer dereference aka CNVD-C-2021-95204.


In librt in the GNU C Library (aka glibc) through 2.34 sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data leading to a NULL pointer dereference. NOTE: this vulnerability was introduced as a side effect of the CVE-2021-33574 fix.


In Eclipse Mosquitto version 2.0.0 to 2.0.9 if an authenticated client that had connected with MQTT v5 sent a crafted CONNACK message to the broker a NULL pointer dereference would occur.


pointer

dereference

vulnerability

in

D-Link

BETA

BETA

BETA

BETA

and

in

the

sbin/httpd

binary.

The

crash

happens

at

the

`atoi'

operation

when

a

specific

network

package

are

sent

to

the

httpd

binary.


Pointer

Dereference

vulnerability

exists

in

D-Link

and

in

the

function

of

sbin/httpd

binary.

When

the

binary

handle

the

specific

HTTP

GET

request

the

strrchr

in

the

function

would

take

as

first

argument

and

incur

the

pointer

dereference

vulnerability.


Null Pointer Dereference vulnerability exists in TRENDnet TEW-755AP 1.11B03 TEW-755AP2KAC 1.11B03 TEW-821DAP2KAC 1.11B03 and TEW-825DAP 1.11B03 by sending the POST request to apply_cgi with an unknown action name.


LibreDWG v0.12.3 was discovered to contain a NULL pointer dereference via out_dxfb.c.


An issue was discovered in the fltk crate before 0.15.3 for Rust. There is a NULL pointer dereference during attempted use of a non-raster image for a window icon.


An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable NULL pointer dereference and crash in TLS when an unknown TLS alert code is received.


An issue was discovered in Storage Performance Development Kit (SPDK) before 20.01.01. If a PDU is sent to the iSCSI target with a zero length (but data is expected) the iSCSI target can crash with a NULL pointer dereference.


An issue was discovered in the fltk crate before 0.15.3 for Rust. There is a NULL pointer dereference during attempted use of a multi label type if the image is nonexistent.


Pointer

Dereference

vulnerability

exists

in

TRENDnet

and

by

sending

the

POST

request

to

via

a

action

without

a

key.


Adobe After Effects version 18.2 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Null Pointer Dereference vulnerability exists in D-Link DAP-2310 2.07.RC031 DAP-2330 1.07.RC028 DAP-2360 2.07.RC043 DAP-2553 3.06.RC027 DAP-2660 1.13.RC074 DAP-2690 3.16.RC100 DAP-2695 1.17.RC063 DAP-3320 1.01.RC014 and DAP-3662 1.01.RC022 in the upload_config function of sbin/httpd binary. When the binary handle the specific HTTP GET request the content in upload_file variable is NULL in the upload_config function then the strncasecmp would take NULL as first argument and incur the NULL pointer dereference vulnerability.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

An

attacker

can

trigger

a

pointer

dereference

in

the

implementation

of

This

is

because

of

missing

that

was

covered

under

a

`TODO`.

If

the

tensor

is

empty

then

would

cause

a

pointer

dereference

in

the

implementation

of

the

op.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

Calling

TF

operations

with

tensors

of

non-numeric

types

when

the

operations

expect

numeric

tensors

result

in

pointer

dereferences.

The

conversion

from

Python

array

to

C++

is

vulnerable

to

a

type

confusion.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

An

attacker

can

trigger

a

dereference

of

a

pointer

in

This

is

because

the

does

not

fully

validate

the

argument.

This

would

result

in

to

be

a

pointer

when

the

output

would

be

computed

to

have

or

negative

size.

Later

writes

to

the

output

tensor

would

then

cause

a

pointer

dereference.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

Calling

with

arguments

specifying

an

invalid

ragged

tensor

results

in

a

pointer

dereference.

The

implementation

of

`RaggedTensorToVariant`

does

not

validate

that

the

ragged

tensor

argument

is

non-empty.

Since

contains

no

elements

is

a

vector

thus

will

result

in

dereferencing

`nullptr`.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

An

attacker

can

trigger

a

pointer

dereference

in

the

implementation

of

This

is

because

the

has

incomplete

validation

of

the

input

parameters.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.