Common Weakness Enumeration
CWE-416
AllowedUse After Free
Abstraction: Variant · Status: Stable
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
9874 vulnerabilities reference this CWE, most recent first.
GHSA-H333-V9MV-M6G4
Vulnerability from github – Published: 2022-04-09 00:00 – Updated: 2022-04-15 00:00
VLAI
Details
libsixel 1.8.6 suffers from a Heap Use After Free vulnerability in in libsixel/src/dither.c:388.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2022-27046"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-08T15:15:00Z",
"severity": "HIGH"
},
"details": "libsixel 1.8.6 suffers from a Heap Use After Free vulnerability in in libsixel/src/dither.c:388.",
"id": "GHSA-h333-v9mv-m6g4",
"modified": "2022-04-15T00:00:56Z",
"published": "2022-04-09T00:00:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27046"
},
{
"type": "WEB",
"url": "https://github.com/saitoha/libsixel/issues/157"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-H39W-24RM-7GMR
Vulnerability from github – Published: 2025-09-11 18:35 – Updated: 2025-11-25 21:32
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
drm/hisilicon/hibmc: fix irq_request()'s irq name variable is local
The local variable is passed in request_irq (), and there will be use after free problem, which will make request_irq failed. Using the global irq name instead of it to fix.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-39785"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-11T17:15:44Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/hisilicon/hibmc: fix irq_request()\u0027s irq name variable is local\n\nThe local variable is passed in request_irq (), and there will be use\nafter free problem, which will make request_irq failed. Using the global\nirq name instead of it to fix.",
"id": "GHSA-h39w-24rm-7gmr",
"modified": "2025-11-25T21:32:05Z",
"published": "2025-09-11T18:35:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-39785"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/06d261a085a11600f5b577bb56a65fb2c3e57d0a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8bed4ec42a4e0dc8113172696ff076d1eb6d8bcb"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-H3C6-R6P2-GR6C
Vulnerability from github – Published: 2023-11-08 03:30 – Updated: 2023-11-15 15:30
VLAI
Details
Use-After-Free (UAF) vulnerability in the dubai module. Successful exploitation of this vulnerability will affect availability.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2023-46769"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-08T03:15:07Z",
"severity": "HIGH"
},
"details": "Use-After-Free (UAF) vulnerability in the dubai module. Successful exploitation of this vulnerability will affect availability.",
"id": "GHSA-h3c6-r6p2-gr6c",
"modified": "2023-11-15T15:30:21Z",
"published": "2023-11-08T03:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46769"
},
{
"type": "WEB",
"url": "https://consumer.huawei.com/en/support/bulletin/2023/11"
},
{
"type": "WEB",
"url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-202311-0000001729189597"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-H3FM-22X3-7PHJ
Vulnerability from github – Published: 2022-05-24 17:04 – Updated: 2022-05-24 17:04
VLAI
Details
Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
{
"affected": [],
"aliases": [
"CVE-2019-16452"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-12-19T15:15:00Z",
"severity": "HIGH"
},
"details": "Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .",
"id": "GHSA-h3fm-22x3-7phj",
"modified": "2022-05-24T17:04:42Z",
"published": "2022-05-24T17:04:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16452"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/acrobat/apsb19-55.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-H3FW-QCC5-7H9G
Vulnerability from github – Published: 2022-05-14 00:52 – Updated: 2022-05-14 00:52
VLAI
Details
Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2018-16046"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-01-18T17:29:00Z",
"severity": "HIGH"
},
"details": "Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.",
"id": "GHSA-h3fw-qcc5-7h9g",
"modified": "2022-05-14T00:52:31Z",
"published": "2022-05-14T00:52:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16046"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/acrobat/apsb18-41.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/106164"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-H3H3-JQ7C-XGPC
Vulnerability from github – Published: 2024-06-19 15:30 – Updated: 2025-09-17 18:31
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
Patch series "mm: follow_pte() improvements and acrn follow_pte() fixes".
Patch #1 fixes a bunch of issues I spotted in the acrn driver. It compiles, that's all I know. I'll appreciate some review and testing from acrn folks.
Patch #2+#3 improve follow_pte(), passing a VMA instead of the MM, adding more sanity checks, and improving the documentation. Gave it a quick test on x86-64 using VM_PAT that ends up using follow_pte().
This patch (of 3):
We currently miss handling various cases, resulting in a dangerous follow_pte() (previously follow_pfn()) usage.
(1) We're not checking PTE write permissions.
Maybe we should simply always require pte_write() like we do for pin_user_pages_fast(FOLL_WRITE)? Hard to tell, so let's check for ACRN_MEM_ACCESS_WRITE for now.
(2) We're not rejecting refcounted pages.
As we are not using MMU notifiers, messing with refcounted pages is dangerous and can result in use-after-free. Let's make sure to reject them.
(3) We are only looking at the first PTE of a bigger range.
We only lookup a single PTE, but memmap->len may span a larger area. Let's loop over all involved PTEs and make sure the PFN range is actually contiguous. Reject everything else: it couldn't have worked either way, and rather made use access PFNs we shouldn't be accessing.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2024-38610"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-19T14:15:20Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()\n\nPatch series \"mm: follow_pte() improvements and acrn follow_pte() fixes\".\n\nPatch #1 fixes a bunch of issues I spotted in the acrn driver. It\ncompiles, that\u0027s all I know. I\u0027ll appreciate some review and testing from\nacrn folks.\n\nPatch #2+#3 improve follow_pte(), passing a VMA instead of the MM, adding\nmore sanity checks, and improving the documentation. Gave it a quick test\non x86-64 using VM_PAT that ends up using follow_pte().\n\n\nThis patch (of 3):\n\nWe currently miss handling various cases, resulting in a dangerous\nfollow_pte() (previously follow_pfn()) usage.\n\n(1) We\u0027re not checking PTE write permissions.\n\nMaybe we should simply always require pte_write() like we do for\npin_user_pages_fast(FOLL_WRITE)? Hard to tell, so let\u0027s check for\nACRN_MEM_ACCESS_WRITE for now.\n\n(2) We\u0027re not rejecting refcounted pages.\n\nAs we are not using MMU notifiers, messing with refcounted pages is\ndangerous and can result in use-after-free. Let\u0027s make sure to reject them.\n\n(3) We are only looking at the first PTE of a bigger range.\n\nWe only lookup a single PTE, but memmap-\u003elen may span a larger area.\nLet\u0027s loop over all involved PTEs and make sure the PFN range is\nactually contiguous. Reject everything else: it couldn\u0027t have worked\neither way, and rather made use access PFNs we shouldn\u0027t be accessing.",
"id": "GHSA-h3h3-jq7c-xgpc",
"modified": "2025-09-17T18:31:13Z",
"published": "2024-06-19T15:30:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38610"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2c8d6e24930b8ef7d4a81787627c559ae0e0d3bb"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3d6586008f7b638f91f3332602592caa8b00b559"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4c4ba3cf3a15ccfbaf787d0296fa42cdb00da9b4"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5c6705aa47b5b78d7ad36fea832bb69caa5bf49a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/afeb0e69627695f759fc73c39c1640dbf8649b32"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e873f36ec890bece26ecce850e969917bceebbb6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-H3J8-WX8R-29J6
Vulnerability from github – Published: 2023-07-31 18:30 – Updated: 2024-09-13 21:31
VLAI
Details
A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their privileges on the system.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2023-4004"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-31T17:15:10Z",
"severity": "HIGH"
},
"details": "A use-after-free flaw was found in the Linux kernel\u0027s netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their privileges on the system.",
"id": "GHSA-h3j8-wx8r-29j6",
"modified": "2024-09-13T21:31:19Z",
"published": "2023-07-31T18:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4004"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2023/dsa-5492"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2023/dsa-5480"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20231027-0001"
},
{
"type": "WEB",
"url": "https://patchwork.ozlabs.org/project/netfilter-devel/patch/20230719190824.21196-1-fw@strlen.de"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2225275"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-4004"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7434"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7431"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7417"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7411"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7389"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7382"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:5627"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:5548"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:5255"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:5244"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:5221"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:5093"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:5091"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:5069"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:4967"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:4962"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:4961"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/175072/Kernel-Live-Patch-Security-Notice-LSN-0098-1.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-H3MP-J53V-44VX
Vulnerability from github – Published: 2022-12-22 21:30 – Updated: 2025-04-15 15:30
VLAI
Details
If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while references to it lived on in a BaseShape. This could lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2022-45406"
],
"database_specific": {
"cwe_ids": [
"CWE-416",
"CWE-787"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-22T20:15:00Z",
"severity": "CRITICAL"
},
"details": "If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while references to it lived on in a BaseShape. This could lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR \u003c 102.5, Thunderbird \u003c 102.5, and Firefox \u003c 107.",
"id": "GHSA-h3mp-j53v-44vx",
"modified": "2025-04-15T15:30:35Z",
"published": "2022-12-22T21:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45406"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1791975"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2022-47"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2022-48"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2022-49"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-H3Q9-MRW5-M795
Vulnerability from github – Published: 2025-11-04 03:30 – Updated: 2026-06-30 03:35
VLAI
Details
A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 26.1, iOS 26.1 and iPadOS 26.1, Safari 26.1, visionOS 26.1. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-43438"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-04T02:15:49Z",
"severity": "MODERATE"
},
"details": "A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 26.1, iOS 26.1 and iPadOS 26.1, Safari 26.1, visionOS 26.1. Processing maliciously crafted web content may lead to an unexpected Safari crash.",
"id": "GHSA-h3q9-mrw5-m795",
"modified": "2026-06-30T03:35:22Z",
"published": "2025-11-04T03:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43438"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/125640"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/125639"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/125638"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/125634"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/125633"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/125632"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-43438.json"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448784"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-43438"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:23743"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:23742"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:23591"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:23583"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:23452"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:23451"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:23434"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:23433"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:23110"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:22790"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:22789"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-H3R6-368V-W6XC
Vulnerability from github – Published: 2021-12-28 00:00 – Updated: 2025-11-03 21:30
VLAI
{
"affected": [],
"aliases": [
"CVE-2021-4173"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-27T13:15:00Z",
"severity": "HIGH"
},
"details": "vim is vulnerable to Use After Free",
"id": "GHSA-h3r6-368v-w6xc",
"modified": "2025-11-03T21:30:36Z",
"published": "2021-12-28T00:00:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4173"
},
{
"type": "WEB",
"url": "https://github.com/vim/vim/commit/9c23f9bb5fe435b28245ba8ac65aa0ca6b902c04"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/a1b236b9-89fb-4ccf-9689-ba11b471e766"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00023.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2EY2VFBU3YGGWI5BW4XKT3F37MYGEQUD"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3FH2J57GDA2WMBS6J56F6QQRA6BXQQFZ"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2EY2VFBU3YGGWI5BW4XKT3F37MYGEQUD"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3FH2J57GDA2WMBS6J56F6QQRA6BXQQFZ"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202208-32"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT213183"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT213256"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT213343"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2022/Jul/14"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2022/Mar/29"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2022/May/35"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2022/01/15/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Architecture and Design
Strategy: Language Selection
Choose a language that provides automatic memory management.
Mitigation
Implementation
Strategy: Attack Surface Reduction
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
No CAPEC attack patterns related to this CWE.