CWE-476

{
  "affected": [],
  "aliases": [
    "CVE-2024-46769"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-18T08:15:04Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: intel: Add check devm_kasprintf() returned value\n\nintel_spi_populate_chip() use devm_kasprintf() to set pdata-\u003ename.\nThis can return a NULL pointer on failure but this returned value\nis not checked.",
  "id": "GHSA-6g6v-3rwx-w42j",
  "modified": "2024-09-30T15:30:44Z",
  "published": "2024-09-18T09:30:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46769"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2920294686ec23211637998f3ec386dfd3d784a6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6e68abdc5d674f9f4185bf1e1956368d05df4838"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-7225"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-03-22T16:59:00Z",
    "severity": "HIGH"
  },
  "details": "The find_nearest_line function in addr2line in GNU Binutils 2.28 does not handle the case where the main file name and the directory name are both empty, triggering a NULL pointer dereference and an invalid write, and leading to a program crash.",
  "id": "GHSA-6g78-2pwj-3gvj",
  "modified": "2022-05-14T03:52:22Z",
  "published": "2022-05-14T03:52:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7225"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/201801-01"
    },
    {
      "type": "WEB",
      "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=20891"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/97275"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-49908"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-21T18:15:13Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add null check for \u0027afb\u0027 in amdgpu_dm_update_cursor (v2)\n\nThis commit adds a null check for the \u0027afb\u0027 variable in the\namdgpu_dm_update_cursor function. Previously, \u0027afb\u0027 was assumed to be\nnull at line 8388, but was used later in the code without a null check.\nThis could potentially lead to a null pointer dereference.\n\nChanges since v1:\n- Moved the null check for \u0027afb\u0027 to the line where \u0027afb\u0027 is used. (Alex)\n\nFixes the below:\ndrivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm.c:8433 amdgpu_dm_update_cursor()\n\terror: we previously assumed \u0027afb\u0027 could be null (see line 8388)",
  "id": "GHSA-6g7j-p2cm-w265",
  "modified": "2024-10-24T06:30:29Z",
  "published": "2024-10-21T18:30:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49908"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0fe20258b4989b9112b5e9470df33a0939403fd4"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a742168b6a39ead257da53bcbe472384d6e14a1b"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-41843"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-09-30T05:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in Xpdf 4.04. There is a crash in convertToType0 in fofi/FoFiType1C.cc, a different vulnerability than CVE-2022-38928.",
  "id": "GHSA-6g92-8cgq-877w",
  "modified": "2022-10-04T00:00:19Z",
  "published": "2022-10-01T00:00:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41843"
    },
    {
      "type": "WEB",
      "url": "https://forum.xpdfreader.com/viewtopic.php?f=1\u0026t=42344"
    },
    {
      "type": "WEB",
      "url": "https://forum.xpdfreader.com/viewtopic.php?f=3\u0026t=42325\u0026sid=7b08ba9a518a99ce3c5ff40e53fc6421"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-19209"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-11-12T19:29:00Z",
    "severity": "MODERATE"
  },
  "details": "Netwide Assembler (NASM) 2.14rc15 has a NULL pointer dereference in the function find_label in asm/labels.c that will lead to a DoS attack.",
  "id": "GHSA-6gcr-47jj-9vwp",
  "modified": "2022-05-14T01:49:43Z",
  "published": "2022-05-14T01:49:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19209"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=1115797"
    },
    {
      "type": "WEB",
      "url": "https://repo.or.cz/nasm.git/commitdiff/e996d28c70d45008085322b442b44a9224308548"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-52938"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-27T17:15:43Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: Don\u0027t attempt to resume the ports before they exist\n\nThis will fix null pointer dereference that was caused by\nthe driver attempting to resume ports that were not yet\nregistered.",
  "id": "GHSA-6gh5-4fvc-rw6c",
  "modified": "2025-04-15T15:30:46Z",
  "published": "2025-03-27T18:31:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52938"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f82060da749c611ed427523b6d1605d87338aac1"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fdd11d7136fd070b3a74d6d8799d9eac28a57fc5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-35076"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-06-14T10:15:00Z",
    "severity": "HIGH"
  },
  "details": "Possible null pointer dereference due to improper validation of RRC connection reconfiguration message in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile",
  "id": "GHSA-6ghp-vvqp-vxv2",
  "modified": "2022-06-23T00:00:22Z",
  "published": "2022-06-15T00:00:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35076"
    },
    {
      "type": "WEB",
      "url": "https://www.qualcomm.com/company/product-security/bulletins/may-2022-bulletin"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.7.0"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/ellanetworks/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.8.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-34761"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-01T22:59:12Z",
    "nvd_published_at": "2026-04-02T20:16:25Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nElla Core panics when processing a NGAP handover failure message.\n\n## Impact\n\nIf an attacker can force a gNodeB to send NGAP handover failure messages to Ella Core, the process will crash, thereby disrupting service for all connected subscribers.\n\n## Fix \n\nImprove guards in NGAP handover handlers.",
  "id": "GHSA-6gm8-3g4h-w82m",
  "modified": "2026-04-06T17:32:47Z",
  "published": "2026-04-01T22:59:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ellanetworks/core/security/advisories/GHSA-6gm8-3g4h-w82m"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34761"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ellanetworks/core"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ellanetworks/core/releases/tag/v1.8.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Ella Core Panics Upon NGAP handover failure"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-65565"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-18T19:16:34Z",
    "severity": "HIGH"
  },
  "details": "A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.3-dev. After PFCP association is established, a PFCP Session Establishment Request that is missing the mandatory F-SEID (CPF-SEID) Information Element is not properly validated. The session establishment handler calls IE.FSEID() on a nil pointer, which triggers a panic and terminates the UPF process. An attacker who can send PFCP Session Establishment Request messages to the UPF\u0027s N4/PFCP endpoint can exploit this issue to repeatedly crash the UPF and disrupt user-plane services.",
  "id": "GHSA-6gpc-mjxq-hj23",
  "modified": "2025-12-19T18:31:12Z",
  "published": "2025-12-18T21:31:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65565"
    },
    {
      "type": "WEB",
      "url": "https://github.com/omec-project/upf/issues/957"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-49353"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-26T07:01:12Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/papr_scm: don\u0027t requests stats with \u00270\u0027 sized stats buffer\n\nSachin reported [1] that on a POWER-10 lpar he is seeing a kernel panic being\nreported with vPMEM when papr_scm probe is being called. The panic is of the\nform below and is observed only with following option disabled(profile) for the\nsaid LPAR \u0027Enable Performance Information Collection\u0027 in the HMC:\n\n Kernel attempted to write user page (1c) - exploit attempt? (uid: 0)\n BUG: Kernel NULL pointer dereference on write at 0x0000001c\n Faulting instruction address: 0xc008000001b90844\n Oops: Kernel access of bad area, sig: 11 [#1]\n\u003csnip\u003e\n NIP [c008000001b90844] drc_pmem_query_stats+0x5c/0x270 [papr_scm]\n LR [c008000001b92794] papr_scm_probe+0x2ac/0x6ec [papr_scm]\n Call Trace:\n       0xc00000000941bca0 (unreliable)\n       papr_scm_probe+0x2ac/0x6ec [papr_scm]\n       platform_probe+0x98/0x150\n       really_probe+0xfc/0x510\n       __driver_probe_device+0x17c/0x230\n\u003csnip\u003e\n ---[ end trace 0000000000000000 ]---\n Kernel panic - not syncing: Fatal exception\n\nOn investigation looks like this panic was caused due to a \u0027stat_buffer\u0027 of\nsize==0 being provided to drc_pmem_query_stats() to fetch all performance\nstats-ids of an NVDIMM. However drc_pmem_query_stats() shouldn\u0027t have been called\nsince the vPMEM NVDIMM doesn\u0027t support and performance stat-id\u0027s. This was caused\ndue to missing check for \u0027p-\u003estat_buffer_len\u0027 at the beginning of\npapr_scm_pmu_check_events() which indicates that the NVDIMM doesn\u0027t support\nperformance-stats.\n\nFix this by introducing the check for \u0027p-\u003estat_buffer_len\u0027 at the beginning of\npapr_scm_pmu_check_events().\n\n[1] https://lore.kernel.org/all/6B3A522A-6A5F-4CC9-B268-0C63AA6E07D3@linux.ibm.com",
  "id": "GHSA-6gv8-fgf9-gqgc",
  "modified": "2025-04-14T21:32:22Z",
  "published": "2025-04-14T21:32:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-49353"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/07bf9431b1590d1cd7a8d62075d0b50b073f0495"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e1295aab2ebcda1c1a9ed342baedc080e5c393e5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}