CWE-476

{
  "affected": [],
  "aliases": [
    "CVE-2018-18829"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-10-30T06:29:00Z",
    "severity": "MODERATE"
  },
  "details": "There exists a NULL pointer dereference in ff_vc1_parse_frame_header_adv in vc1.c in Libav 12.3, which allows attackers to cause a denial-of-service through a crafted aac file.",
  "id": "GHSA-3pfq-8m56-48p7",
  "modified": "2022-05-14T01:52:47Z",
  "published": "2022-05-14T01:52:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18829"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.libav.org/show_bug.cgi?id=1136"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-19722"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-07-13T22:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An unhandled memory allocation failure in Core/Ap4Atom.cpp of Bento 1.5.1-628 causes a direct copy to NULL pointer dereference, leading to a denial of service (DOS).",
  "id": "GHSA-3ph9-c37g-wmx3",
  "modified": "2022-05-24T19:08:05Z",
  "published": "2022-05-24T19:08:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-19722"
    },
    {
      "type": "WEB",
      "url": "https://github.com/axiomatic-systems/Bento4/issues/418"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-52344"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-08T03:15:08Z",
    "severity": "MODERATE"
  },
  "details": "In modem-ps-nas-ngmm, there is a possible undefined behavior due to incorrect error handling. This could lead to remote information disclosure no additional execution privileges needed",
  "id": "GHSA-3pjh-4p3m-3gfm",
  "modified": "2024-11-09T00:30:41Z",
  "published": "2024-04-08T03:30:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52344"
    },
    {
      "type": "WEB",
      "url": "https://www.unisoc.com/en_us/secy/announcementDetail/1777143682512781313"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-53220"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-15T15:15:48Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: az6007: Fix null-ptr-deref in az6007_i2c_xfer()\n\nIn az6007_i2c_xfer, msg is controlled by user. When msg[i].buf\nis null and msg[i].len is zero, former checks on msg[i].buf would be\npassed. Malicious data finally reach az6007_i2c_xfer. If accessing\nmsg[i].buf[0] without sanity check, null ptr deref would happen.\nWe add check on msg[i].len to prevent crash.\n\nSimilar commit:\ncommit 0ed554fd769a\n(\"media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()\")",
  "id": "GHSA-3ppg-6j84-f79c",
  "modified": "2025-12-03T15:30:27Z",
  "published": "2025-09-15T15:31:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53220"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1047f9343011f2cedc73c64829686206a7e9fc3f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5b1ea100ad3695025969dc4693f307877fb688d6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6ab7ea4e17d6a605d05308adf8f3408924770cba"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/991c77fe18c6f374bbf83376f8c42550aa565662"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a1110f19d4940e4185251d072cbb0ff51486a1e7"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a9def3e9718a4dc756f48db147d42ec41a966240"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/adcb73f8ce9aec48b1f85223f401c1574015d8d2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c6763fefa267f6e62595a6ac1f57815d99fc90b7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-19720"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-07-13T22:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An unhandled memory allocation failure in Core/AP4IkmsAtom.cpp of Bento 1.5.1-628 causes a NULL pointer dereference, leading to a denial of service (DOS).",
  "id": "GHSA-3pvm-rcw8-28wj",
  "modified": "2022-05-24T19:08:05Z",
  "published": "2022-05-24T19:08:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-19720"
    },
    {
      "type": "WEB",
      "url": "https://github.com/axiomatic-systems/Bento4/issues/413"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-39709"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-05T18:15:48Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: venus: protect against spurious interrupts during probe\n\nMake sure the interrupt handler is initialized before the interrupt is\nregistered.\n\nIf the IRQ is registered before hfi_create(), it\u0027s possible that an\ninterrupt fires before the handler setup is complete, leading to a NULL\ndereference.\n\nThis error condition has been observed during system boot on Rb3Gen2.",
  "id": "GHSA-3px4-cc65-vwjj",
  "modified": "2026-05-12T15:31:04Z",
  "published": "2025-09-05T18:31:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-39709"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/18c2b2bd982b8546312c9a7895515672169f28e0"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3200144a2fa4209dc084a19941b9b203b43580f0"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/37cc0ac889b018097c217c5929fd6dc2aed636a1"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/639eb587f977c02423f4762467055b23902b4131"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/88cf63c2599761c48dec8f618d57dccf8f6f4b53"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9db6a78bc5e418e0064e2248c8f3b9b9e8418646"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e796028b4835af00d9a38ebbb208ec3a6634702a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f54be97bc69b1096198b6717c150dec69f2a1b4d"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-56535"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-27T14:15:33Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: coex: check NULL return of kmalloc in btc_fw_set_monreg()\n\nkmalloc may fail, return value might be NULL and will cause\nNULL pointer dereference. Add check NULL return of kmalloc in\nbtc_fw_set_monreg().",
  "id": "GHSA-3px9-r72j-9hxj",
  "modified": "2025-01-08T18:30:47Z",
  "published": "2024-12-27T15:31:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56535"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/051577414271961f3f4c3bff87b427924b486219"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/64db1a42d98307001a48cec1b3e68ce9f905e73d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/81df5ed446b448bdc327b7c7f0b50121fc1f4aa2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-50280"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-15T15:15:39Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\npnode: terminate at peers of source\n\nThe propagate_mnt() function handles mount propagation when creating\nmounts and propagates the source mount tree @source_mnt to all\napplicable nodes of the destination propagation mount tree headed by\n@dest_mnt.\n\nUnfortunately it contains a bug where it fails to terminate at peers of\n@source_mnt when looking up copies of the source mount that become\nmasters for copies of the source mount tree mounted on top of slaves in\nthe destination propagation tree causing a NULL dereference.\n\nOnce the mechanics of the bug are understood it\u0027s easy to trigger.\nBecause of unprivileged user namespaces it is available to unprivileged\nusers.\n\nWhile fixing this bug we\u0027ve gotten confused multiple times due to\nunclear terminology or missing concepts. So let\u0027s start this with some\nclarifications:\n\n* The terms \"master\" or \"peer\" denote a shared mount. A shared mount\n  belongs to a peer group.\n\n* A peer group is a set of shared mounts that propagate to each other.\n  They are identified by a peer group id. The peer group id is available\n  in @shared_mnt-\u003emnt_group_id.\n  Shared mounts within the same peer group have the same peer group id.\n  The peers in a peer group can be reached via @shared_mnt-\u003emnt_share.\n\n* The terms \"slave mount\" or \"dependent mount\" denote a mount that\n  receives propagation from a peer in a peer group. IOW, shared mounts\n  may have slave mounts and slave mounts have shared mounts as their\n  master. Slave mounts of a given peer in a peer group are listed on\n  that peers slave list available at @shared_mnt-\u003emnt_slave_list.\n\n* The term \"master mount\" denotes a mount in a peer group. IOW, it\n  denotes a shared mount or a peer mount in a peer group. The term\n  \"master mount\" - or \"master\" for short - is mostly used when talking\n  in the context of slave mounts that receive propagation from a master\n  mount. A master mount of a slave identifies the closest peer group a\n  slave mount receives propagation from. The master mount of a slave can\n  be identified via @slave_mount-\u003emnt_master. Different slaves may point\n  to different masters in the same peer group.\n\n* Multiple peers in a peer group can have non-empty -\u003emnt_slave_lists.\n  Non-empty -\u003emnt_slave_lists of peers don\u0027t intersect. Consequently, to\n  ensure all slave mounts of a peer group are visited the\n  -\u003emnt_slave_lists of all peers in a peer group have to be walked.\n\n* Slave mounts point to a peer in the closest peer group they receive\n  propagation from via @slave_mnt-\u003emnt_master (see above). Together with\n  these peers they form a propagation group (see below). The closest\n  peer group can thus be identified through the peer group id\n  @slave_mnt-\u003emnt_master-\u003emnt_group_id of the peer/master that a slave\n  mount receives propagation from.\n\n* A shared-slave mount is a slave mount to a peer group pg1 while also\n  a peer in another peer group pg2. IOW, a peer group may receive\n  propagation from another peer group.\n\n  If a peer group pg1 is a slave to another peer group pg2 then all\n  peers in peer group pg1 point to the same peer in peer group pg2 via\n  -\u003emnt_master. IOW, all peers in peer group pg1 appear on the same\n  -\u003emnt_slave_list. IOW, they cannot be slaves to different peer groups.\n\n* A pure slave mount is a slave mount that is a slave to a peer group\n  but is not a peer in another peer group.\n\n* A propagation group denotes the set of mounts consisting of a single\n  peer group pg1 and all slave mounts and shared-slave mounts that point\n  to a peer in that peer group via -\u003emnt_master. IOW, all slave mounts\n  such that @slave_mnt-\u003emnt_master-\u003emnt_group_id is equal to\n  @shared_mnt-\u003emnt_group_id.\n\n  The concept of a propagation group makes it easier to talk about a\n  single propagation level in a propagation tree.\n\n  For example, in propagate_mnt() the immediate peers of @dest_mnt and\n  all slaves of @dest_mnt\u0027s peer group form a propagation group pr\n---truncated---",
  "id": "GHSA-3pxv-j5r5-v5qh",
  "modified": "2025-12-04T15:30:30Z",
  "published": "2025-09-15T15:31:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-50280"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/11933cf1d91d57da9e5c53822a540bbdc2656c16"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2dae4211b579ce98985876a73a78466e285238ff"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/784a4f995ee24460aa72e00b085612fad57ebce5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7f57df69de7f05302fad584eb8e3f34de39e0311"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b591b2919d018ef91b4a9571edca94105bcad3df"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c24cc476acd8bccb5af54849aac5e779d8223bf5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cad0d17fb2b0540180ab59e2cd48ad348cc1ee4c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cc997490be65da0af8c75a6244fc80bb66c53ce0"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e7c9f10c44a8919cd8bbd51b228c84d0caf7d518"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-24783"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-05T23:15:07Z",
    "severity": "MODERATE"
  },
  "details": "Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates.",
  "id": "GHSA-3q2c-pvp5-3cqp",
  "modified": "2024-11-05T18:31:58Z",
  "published": "2024-03-06T00:31:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24783"
    },
    {
      "type": "WEB",
      "url": "https://go.dev/cl/569339"
    },
    {
      "type": "WEB",
      "url": "https://go.dev/issue/65390"
    },
    {
      "type": "WEB",
      "url": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2024-2598"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20240329-0005"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2024/03/08/4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-1078"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-04-21T23:15:00Z",
    "severity": "MODERATE"
  },
  "details": "NVIDIA Windows GPU Display Driver for Windows, all versions, contains a vulnerability in the kernel driver (nvlddmkm.sys) where a NULL pointer dereference may lead to system crash.",
  "id": "GHSA-3q2j-jxjj-f39g",
  "modified": "2022-05-24T17:48:16Z",
  "published": "2022-05-24T17:48:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-1078"
    },
    {
      "type": "WEB",
      "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5172"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}