Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2022-0691: Authorization Bypass Through User-Controlled Key (CWE-639)
value: Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9.
CWE description: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CVSS v3 base score: 9.8
Published: 2022-02-21T09:15Z
Repository: https://github.com/unshiftio/url-parse
Language: JavaScript
Files changed: index.js, test/test.js
Commit date: 2022-02-20 08:56:24 +0100
Commit message: [fix] Strip all control characters from the beginning of the URL

Diff: diff --git a/index.js b/index.js
index c5a2a11..aa71e5d 100644
--- a/index.js
+++ b/index.js
@@ -4,11 +4,11 @@ var required = require('requires-port')
   , qs = require('querystringify')
   , CRHTLF = /[\n\r\t]/g
   , slashes = /^[A-Za-z][A-Za-z0-9+-.]*:\/\//
   , protocolre = /^([a-z][a-z0-9.+-]*:)?(\/\/)?([\\/]+)?([\S\s]*)/i
   , windowsDriveLetter = /^[a-zA-Z]:/
-  , whitespace = /^[ \f\n\r\t\v\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]+/;
+  , whitespace = /^[\x00-\x20\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]+/;
 
 /**
  * Trim a given string.
  *
  * @param {String} str String to trim.
diff --git a/test/test.js b/test/test.js
index ab2c6c3..f85ebb6 100644
--- a/test/test.js
+++ b/test/test.js
@@ -45,12 +45,18 @@ describe('url-parse', function () {
   describe('trimLeft', function () {
     it('is a function', function () {
       assume(parse.trimLeft).is.a('function');
     });
 
-    it('removes whitespace on the left', function () {
-      assume(parse.trimLeft('  lol')).equals('lol');
+    it('removes control characters on the left', function () {
+      var i = 0;
+      var prefix = ''
+
+      for (; i < 33; i++) {
+        prefix = String.fromCharCode(i);
+        assume(parse.trimLeft(prefix + prefix +'lol')).equals('lol');
+      }
     });
 
     it('calls toString on a given value', function () {
       //
       // When users pass in `window.location` it's not an actual string

Vulnerable code:   , whitespace = /^[ \f\n\r\t\v\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]+/;
    it('removes whitespace on the left', function () {
      assume(parse.trimLeft('  lol')).equals('lol');
Fixed code:   , whitespace = /^[\x00-\x20\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]+/;
    it('removes control characters on the left', function () {
      var i = 0;
      var prefix = ''

      for (; i < 33; i++) {
        prefix = String.fromCharCode(i);
        assume(parse.trimLeft(prefix + prefix +'lol')).equals('lol');
      }
CVE-2013-7223: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Multiple cross-site request forgery (CSRF) vulnerabilities in Fat Free CRM before 0.12.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to the lack of a protect_from_forgery line in app/controllers/application_controller.rb.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Published: 2014-01-02T14:59Z
Repository: https://github.com/fatfreecrm/fat_free_crm
Language: Ruby
Files changed: app/controllers/application_controller.rb
Commit date: 2013-12-27 10:20:11 +0800
Commit message: Ensure requests are protected.

Diff: diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index f64d6a6d9..7d4f33087 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -3,10 +3,12 @@
 # Fat Free CRM is freely distributable under the terms of MIT license.
 # See MIT-LICENSE file or http://www.opensource.org/licenses/mit-license.php
 #------------------------------------------------------------------------------
 class ApplicationController < ActionController::Base
 
+  protect_from_forgery
+
   before_filter :set_context
   before_filter :clear_setting_cache
   before_filter "hook(:app_before_filter, self)"
   after_filter  "hook(:app_after_filter,  self)"
 

Fixed code:   protect_from_forgery
CVE-2014-5441: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in app/views/layouts/application.html.haml in Fat Free CRM before 0.13.3 allow remote attackers to inject arbitrary web script or HTML via the (1) username, (2) first name, or (3) last name in a (a) create or (b) edit user action.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-09-12T14:55Z
Repository: https://github.com/fatfreecrm/fat_free_crm
Language: Other
Files changed: app/views/layouts/application.html.haml
Commit date: 2014-08-26 10:54:45 +0800
Commit message: json_escape user input

Diff: diff --git a/app/views/layouts/application.html.haml b/app/views/layouts/application.html.haml
index 2625a92c5..1b8d8c038 100755
--- a/app/views/layouts/application.html.haml
+++ b/app/views/layouts/application.html.haml
@@ -25,11 +25,11 @@
 
     - if current_user.present?
       :javascript
         #{yield :javascript}
         var _ffcrm_users = [
-        #{User.all.map{|u| "\"#{u.full_name} (@#{u.username})\"" }.join(",\n")}
+        #{User.all.map{|u| "\"#{j u.full_name} (@#{j u.username})\"" }.join(",\n")}
         ];
 
     <link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">
     <link rel="icon" href="/favicon.ico" type="image/x-icon">
 

Vulnerable code:         #{User.all.map{|u| "\"#{u.full_name} (@#{u.username})\"" }.join(",\n")}
Fixed code:         #{User.all.map{|u| "\"#{j u.full_name} (@#{j u.username})\"" }.join(",\n")}
CVE-2018-20975: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Fat Free CRM before 0.18.1 has XSS in the tags_helper in app/helpers/tags_helper.rb.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-08-20T13:15Z
Repository: https://github.com/fatfreecrm/fat_free_crm
Language: Ruby
Files changed: app/helpers/tags_helper.rb
Commit date: 2018-10-27 10:22:06 +0800
Commit message: Context-sensitive XSS bugfix.

Diff: diff --git a/app/helpers/tags_helper.rb b/app/helpers/tags_helper.rb
index 266060c6e..397977682 100755
--- a/app/helpers/tags_helper.rb
+++ b/app/helpers/tags_helper.rb
@@ -15,11 +15,11 @@ module TagsHelper
       if query.empty?
         query = hashtag
       elsif !query.include?(hashtag)
         query += " #{hashtag}"
       end
-      out << link_to_function(tag, "crm.search_tagged('#{query}', '#{model.class.to_s.tableize}')", title: tag)
+      out << link_to_function(tag, "crm.search_tagged('#{escape_javascript(query)}', '#{model.class.to_s.tableize}')", title: tag)
     end
   end
 
   def tags_for_dashboard(model)
     content_tag(:ul) do

Vulnerable code:       out << link_to_function(tag, "crm.search_tagged('#{query}', '#{model.class.to_s.tableize}')", title: tag)
Fixed code:       out << link_to_function(tag, "crm.search_tagged('#{escape_javascript(query)}', '#{model.class.to_s.tableize}')", title: tag)
CVE-2022-39281: Insufficient Information (NVD-CWE-noinfo)
value: fat_free_crm is a an open source, Ruby on Rails customer relationship management platform (CRM). In versions prior to 0.20.1 an authenticated user can perform a remote Denial of Service attack against Fat Free CRM via bucket access. The vulnerability has been patched in commit `c85a254` and will be available in release `0.20.1`. Users are advised to upgrade or to manually apply patch `c85a254`. There are no known workarounds for this issue.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 6.5
Published: 2022-10-08T01:15Z
Repository: https://github.com/fatfreecrm/fat_free_crm
Language: Unknown
Commit date: 2022-10-07 09:05:26 +0800
Commit message: Merge pull request from GHSA-p75c-5x3h-cxcg

CVE-2022-39281 mitigations
CVE-2015-10005: Inefficient Regular Expression Complexity (CWE-1333)
value: A vulnerability was found in markdown-it up to 2.x. It has been classified as problematic. Affected is an unknown function of the file lib/common/html_re.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 3.0.0 is able to address this issue. The name of the patch is 89c8620157d6e38f9872811620d25138fc9d1b0d. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216852.
CWE description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CVSS v3 base score: 7.5
Published: 2022-12-27T09:15Z
Repository: https://github.com/markdown-it/markdown-it
Language: JavaScript
Files changed: lib/common/html_re.js
Commit date: 2015-01-04 02:25:34 +0300
Commit message: cdata regexp fix

Diff: diff --git a/lib/common/html_re.js b/lib/common/html_re.js
index bb9d3b1..518dee1 100644
--- a/lib/common/html_re.js
+++ b/lib/common/html_re.js
@@ -44,11 +44,11 @@ var close_tag   = /<\/[A-Za-z][A-Za-z0-9]*\s*>/;
 // That's less strict than http://www.w3.org/TR/html5/syntax.html#comments
 // but we do the rest of check in "inline" rule.
 var comment     = /<!--[\s\S]*?-->/;
 var processing  = /<[?].*?[?]>/;
 var declaration = /<![A-Z]+\s+[^>]*>/;
-var cdata       = /<!\[CDATA\[([^\]]+|\][^\]]|\]\][^>])*\]\]>/;
+var cdata       = /<!\[CDATA\[[\s\S]*?\]\]>/;
 
 var HTML_TAG_RE = replace(/^(?:open_tag|close_tag|comment|processing|declaration|cdata)/)
   ('open_tag', open_tag)
   ('close_tag', close_tag)
   ('comment', comment)

Vulnerable code: var cdata       = /<!\[CDATA\[([^\]]+|\][^\]]|\]\][^>])*\]\]>/;
Fixed code: var cdata       = /<!\[CDATA\[[\s\S]*?\]\]>/;
CVE-2020-36659: Improper Certificate Validation (CWE-295)
value: In Apache::Session::Browseable before 1.3.6, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used. NOTE: this can, for example, be fixed in conjunction with the CVE-2020-16093 fix.
CWE description: The product does not validate, or incorrectly validates, a certificate.
CVSS v3 base score: 8.1
Published: 2023-01-27T05:15Z
Repository: https://github.com/LemonLDAPNG/Apache-Session-Browseable
Language: Perl
Files changed: lib/Apache/Session/Browseable/Store/LDAP.pm
Commit date: 2020-07-30 10:33:27 +0200
Commit message: Add ldapVerify option for SSL cert validation

Diff: diff --git a/lib/Apache/Session/Browseable/Store/LDAP.pm b/lib/Apache/Session/Browseable/Store/LDAP.pm
index 252e8ed..1c5e271 100644
--- a/lib/Apache/Session/Browseable/Store/LDAP.pm
+++ b/lib/Apache/Session/Browseable/Store/LDAP.pm
@@ -152,14 +152,22 @@ sub ldap {
             $useTls = 0;
         }
         push @servers, $server;
     }
 
+    # Compatibility
+    my $caFile = $self->{args}->{ldapCAFile} || $self->{args}->{caFile};
+    my $caPath = $self->{args}->{ldapCAPath} || $self->{args}->{caPath};
+
     # Connect
     my $ldap = Net::LDAP->new(
         \@servers,
         onerror => undef,
+        verify => $self->{args}->{ldapVerify} || "require",
+	( $caFile ? ( cafile => $caFile ) : () ),
+	( $caPath ? ( capath => $caPath ) : () ),
+
         (
             $self->{args}->{ldapRaw} ? ( raw => $self->{args}->{ldapRaw} )
             : ()
         ),
         (
@@ -167,14 +175,16 @@ sub ldap {
             : ()
         ),
     ) or die( 'Unable to connect to ' . join( ' ', @servers ) );
 
     # Start TLS if needed
+
     if ($useTls) {
         my %h = split( /[&=]/, $tlsParam );
-        $h{cafile} = $self->{args}->{caFile} if ( $self->{args}->{caFile} );
-        $h{capath} = $self->{args}->{caPath} if ( $self->{args}->{caPath} );
+        $h{verify} = $self->{args}->{ldapVerify} || "require";
+        $h{cafile} = $caFile if ( $caFile );
+        $h{capath} = $caPath if ( $caPath );
         my $start_tls = $ldap->start_tls(%h);
         if ( $start_tls->code ) {
             $self->logError($start_tls);
             return;
         }

Vulnerable code:         $h{cafile} = $self->{args}->{caFile} if ( $self->{args}->{caFile} );
        $h{capath} = $self->{args}->{caPath} if ( $self->{args}->{caPath} );
Fixed code:     # Compatibility
    my $caFile = $self->{args}->{ldapCAFile} || $self->{args}->{caFile};
    my $caPath = $self->{args}->{ldapCAPath} || $self->{args}->{caPath};

        verify => $self->{args}->{ldapVerify} || "require",
	( $caFile ? ( cafile => $caFile ) : () ),
	( $caPath ? ( capath => $caPath ) : () ),


        $h{verify} = $self->{args}->{ldapVerify} || "require";
        $h{cafile} = $caFile if ( $caFile );
        $h{capath} = $caPath if ( $caPath );
CVE-2023-36321: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: Connected Vehicle Systems Alliance (COVESA) up to v2.18.8 was discovered to contain a buffer overflow via the component /shared/dlt_common.c.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 7.5
Published: 2023-10-17T23:15Z
Repository: https://github.com/michael-methner/dlt-daemon
Language: C
Files changed: src/shared/dlt_common.c
Commit date: 2023-01-27 10:51:07 +0100
Commit message: Check for negative index in dlt_file_message

Fixes #436

Signed-off-by: Michael Methner <mmethner@de.adit-jv.com>

Diff: diff --git a/src/shared/dlt_common.c b/src/shared/dlt_common.c
index 6737251..97766f7 100644
--- a/src/shared/dlt_common.c
+++ b/src/shared/dlt_common.c
@@ -1716,11 +1716,11 @@ DltReturnValue dlt_file_message(DltFile *file, int index, int verbose)
 
     if (file == NULL)
         return DLT_RETURN_WRONG_PARAMETER;
 
     /* check if message is in range */
-    if (index >= file->counter) {
+    if (index < 0 || index >= file->counter) {
         dlt_vlog(LOG_WARNING, "Message %d out of range!\r\n", index);
         return DLT_RETURN_WRONG_PARAMETER;
     }
 
     /* seek to position in file */

Vulnerable code:     if (index >= file->counter) {
Fixed code:     if (index < 0 || index >= file->counter) {
CVE-2020-28840: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: Buffer Overflow vulnerability in jpgfile.c in Matthias-Wandel jhead version 3.04, allows local attackers to execute arbitrary code and cause a denial of service (DoS).
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 7.8
Published: 2023-08-11T14:15Z
Repository: https://github.com/Matthias-Wandel/jhead
Language: C
Files changed: jpgfile.c
Commit date: 2020-10-23 10:05:36 -0300
Commit message: A 'fix' to satisfy pednatic debian fuzzers.  This one read ONE byte past allocated.

Diff: diff --git a/jpgfile.c b/jpgfile.c
index 3bf757f..45d97dc 100644
--- a/jpgfile.c
+++ b/jpgfile.c
@@ -46,11 +46,11 @@ static void process_COM (const uchar * Data, int length)
     if (length > MAX_COMMENT_SIZE) length = MAX_COMMENT_SIZE; // Truncate if it won't fit in our structure.
 
     for (a=2;a<length;a++){
         ch = Data[a];
 
-        if (ch == '\r' && Data[a+1] == '\n') continue; // Remove cr followed by lf.
+        if (ch == '\r' && a < length-1 && Data[a+1] == '\n') continue; // Remove cr followed by lf.
 
         if (ch >= 32 || ch == '\n' || ch == '\t'){
             Comment[nch++] = (char)ch;
         }else{
             Comment[nch++] = '?';

Vulnerable code:         if (ch == '\r' && Data[a+1] == '\n') continue; // Remove cr followed by lf.
Fixed code:         if (ch == '\r' && a < length-1 && Data[a+1] == '\n') continue; // Remove cr followed by lf.
CVE-2022-28550: Out-of-bounds Write (CWE-787)
value: Matthias-Wandel/jhead jhead 3.06 is vulnerable to Buffer Overflow via shellescape(), jhead.c, jhead. jhead copies strings to a stack buffer when it detects a &i or &o. However, jhead does not check the boundary of the stack buffer. As a result, there will be a stack buffer overflow problem when multiple `&i` or `&o` are given.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2023-06-13T20:15Z
Repository: https://github.com/Matthias-Wandel/jhead
Language: Unknown
Commit date: 2023-06-06 11:31:25 -0300
Commit message: Merge branch 'master' of git+ssh://192.168.0.20/home/serv/jhead
CVE-2020-12742: Improper Input Validation (CWE-20)
value: The iubenda-cookie-law-solution plugin before 2.3.5 for WordPress does not restrict URL sanitization to http protocols.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 6.1
Published: 2020-05-13T13:15Z
Repository: https://github.com/iubenda/iubenda-cookie-class
Language: PHP
Files changed: test.php
Commit date: 2020-05-12 11:35:16 +0200
Commit message: fix pecl security bug onto the test script

Diff: diff --git a/test.php b/test.php
index 63d6c98..1e6e832 100644
--- a/test.php
+++ b/test.php
@@ -47,11 +47,13 @@ ini_set( 'max_execution_time', 300 );
 					</form>
 				</div>
 
 				<?php
 				if ( ! empty( $_POST['url'] ) )
-					$url = filter_var( $_POST['url'], FILTER_SANITIZE_URL );
+          if (substr($_POST['url'], 0, 4) == "http") {
+					   $url = filter_var( $_POST['url'], FILTER_SANITIZE_URL );
+          }
 				else
 					$url = '';
 
 				if ( $url ) {
 

Vulnerable code: 					$url = filter_var( $_POST['url'], FILTER_SANITIZE_URL );
Fixed code:           if (substr($_POST['url'], 0, 4) == "http") {
					   $url = filter_var( $_POST['url'], FILTER_SANITIZE_URL );
          }
CVE-2020-11082: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2020-05-28T21:15Z
Repository: https://github.com/kaminari/kaminari
Language: Ruby
Files changed: kaminari-core/lib/kaminari/helpers/tags.rb
Commit date: 2020-04-21 22:02:59 +0100
Commit message: Blacklist "original_script_name" get param

Diff: diff --git a/kaminari-core/lib/kaminari/helpers/tags.rb b/kaminari-core/lib/kaminari/helpers/tags.rb
index 076bd43..702e66e 100644
--- a/kaminari-core/lib/kaminari/helpers/tags.rb
+++ b/kaminari-core/lib/kaminari/helpers/tags.rb
@@ -1,10 +1,10 @@
 # frozen_string_literal: true
 
 module Kaminari
   module Helpers
-    PARAM_KEY_EXCEPT_LIST = [:authenticity_token, :commit, :utf8, :_method, :script_name].freeze
+    PARAM_KEY_EXCEPT_LIST = [:authenticity_token, :commit, :utf8, :_method, :script_name, :original_script_name].freeze
 
     # A tag stands for an HTML tag inside the paginator.
     # Basically, a tag has its own partial template file, so every tag can be
     # rendered into String using its partial template.
     #

Vulnerable code:     PARAM_KEY_EXCEPT_LIST = [:authenticity_token, :commit, :utf8, :_method, :script_name].freeze
Fixed code:     PARAM_KEY_EXCEPT_LIST = [:authenticity_token, :commit, :utf8, :_method, :script_name, :original_script_name].freeze
CVE-2022-1883: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: SQL Injection in GitHub repository camptocamp/terraboard prior to 2.2.0.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 8.8
Published: 2022-05-25T09:15Z
Repository: https://github.com/camptocamp/terraboard
Language: Go
Files changed: db/db.go
Commit date: 2022-05-25 09:16:14 +0200
Commit message: fix(db): possible sql injection on /search endpoint

Diff: diff --git a/db/db.go b/db/db.go
index 88e5390..bc9e1b6 100644
--- a/db/db.go
+++ b/db/db.go
@@ -368,15 +368,17 @@ func (db *Database) SearchAttribute(query url.Values) (results []types.SearchRes
 		where = append(where, "attributes.value LIKE ?")
 		params = append(params, fmt.Sprintf("%%%s%%", v))
 	}
 
 	if v := query.Get("tf_version"); string(v) != "" {
-		where = append(where, fmt.Sprintf("states.tf_version LIKE '%s'", fmt.Sprintf("%%%s%%", v)))
+		where = append(where, "states.tf_version LIKE ?")
+		params = append(params, fmt.Sprintf("%%%s%%", v))
 	}
 
 	if v := query.Get("lineage_value"); string(v) != "" {
-		where = append(where, fmt.Sprintf("lineages.value LIKE '%s'", fmt.Sprintf("%%%s%%", v)))
+		where = append(where, "lineages.value LIKE ?")
+		params = append(params, fmt.Sprintf("%%%s%%", v))
 	}
 
 	if len(where) > 0 {
 		sqlQuery += " WHERE " + strings.Join(where, " AND ")
 	}

Vulnerable code: 		where = append(where, fmt.Sprintf("states.tf_version LIKE '%s'", fmt.Sprintf("%%%s%%", v)))
		where = append(where, fmt.Sprintf("lineages.value LIKE '%s'", fmt.Sprintf("%%%s%%", v)))
Fixed code: 		where = append(where, "states.tf_version LIKE ?")
		params = append(params, fmt.Sprintf("%%%s%%", v))
		where = append(where, "lineages.value LIKE ?")
		params = append(params, fmt.Sprintf("%%%s%%", v))
CVE-2024-39909: Insufficient Information (NVD-CWE-noinfo)
value: KubeClarity is a tool for detection and management of Software Bill Of Materials (SBOM) and vulnerabilities of container images and filesystems. A time/boolean SQL Injection is present in the following resource `/api/applicationResources` via the following parameter `packageID`. As it can be seen in backend/pkg/database/id_view.go, while building the SQL Query the `fmt.Sprintf` function is used to build the query string without the input having first been subjected to any validation. This vulnerability is fixed in 2.23.1.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-07-12T15:15Z
Repository: https://github.com/openclarity/kubeclarity
Language: Go
Files changed: backend/pkg/database/id_view.go
Commit date: 2024-07-11 19:33:34 +0200
Commit message: Merge pull request from GHSA-5248-h45p-9pgw


Diff: diff --git a/backend/pkg/database/id_view.go b/backend/pkg/database/id_view.go
index fa7dbc7..e71274d 100644
--- a/backend/pkg/database/id_view.go
+++ b/backend/pkg/database/id_view.go
@@ -74,12 +74,12 @@ func (i *IDsViewHandler) GetIDs(params GetIDsParams, idsShouldMatch bool) ([]str
 	filterIDColumnName := getIDViewColumnNameByIDType(params.FilterIDType)
 
 	if idsShouldMatch {
 		for _, id := range params.FilterIDs {
 			// for each OR filter we need to verify that lookup id column is not null to avoid failing during Find
-			tx.Or(fmt.Sprintf("%s = '%s' AND %s is not null", filterIDColumnName, id,
-				lookupIDColumnName))
+			tx.Or("? = ? AND ? is not null", filterIDColumnName, id,
+				lookupIDColumnName)
 		}
 	} else {
 		for _, id := range params.FilterIDs {
 			tx.Not(filterIDColumnName+" = ?", id)
 		}

Vulnerable code: 			tx.Or(fmt.Sprintf("%s = '%s' AND %s is not null", filterIDColumnName, id,
				lookupIDColumnName))
Fixed code: 			tx.Or("? = ? AND ? is not null", filterIDColumnName, id,
				lookupIDColumnName)
CVE-2021-32673: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: reg-keygen-git-hash-plugin is a reg-suit plugin to detect the snapshot key to be compare with using Git commit hash. reg-keygen-git-hash-plugin through and including 0.10.15 allow remote attackers to execute of arbitrary commands. Upgrade to version 0.10.16 or later to resolve this issue.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2021-06-08T17:15Z
Repository: https://github.com/reg-viz/reg-suit
Language: Unknown
Commit date: 2021-06-08 11:18:59 +0900
Commit message: Merge pull request from GHSA-49q3-8867-5wmp

fix: Escape shell string
CVE-2020-15117: Improper Check for Unusual or Exceptional Conditions (CWE-754)
value: In Synergy before version 1.12.0, a Synergy server can be crashed by receiving a kMsgHelloBack packet with a client name length set to 0xffffffff (4294967295) if the servers memory is less than 4 GB. It was verified that this issue does not cause a crash through the exception handler if the available memory of the Server is more than 4GB.
CWE description: The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
CVSS v3 base score: 6.5
Published: 2020-07-15T18:15Z
Repository: https://github.com/symless/synergy-core
Language: Unknown
Commit date: 2020-07-14 13:14:40 +0100
Commit message: Merge pull request from GHSA-chfm-333q-gfpp

Attempts to fis DoS to servers with less then 4GB memory
CVE-2022-4066: Improper Resource Shutdown or Release (CWE-404)
value: A vulnerability was found in davidmoreno onion. It has been rated as problematic. Affected by this issue is the function onion_response_flush of the file src/onion/response.c of the component Log Handler. The manipulation leads to allocation of resources. The name of the patch is de8ea938342b36c28024fd8393ebc27b8442a161. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-214028.
CWE description: The product does not release or incorrectly releases a resource before it is made available for re-use.
CVSS v3 base score: 8.2
Published: 2022-11-19T19:15Z
Repository: https://github.com/davidmoreno/onion
Language: Unknown
Commit date: 2022-09-05 22:06:52 +0200
Commit message: Merge pull request #308 from kulkom/master

Fix a potential log spamming and DOS attack
CVE-2020-36826: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in AwesomestCode LiveBot. It has been classified as problematic. Affected is the function parseSend of the file js/parseMessage.js. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. Upgrading to version 0.1 is able to address this issue. The name of the patch is 57505527f838d1e46e8f93d567ba552a30185bfa. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-257784.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2024-03-25T07:15Z
Repository: https://github.com/AwesomestCode/LiveBot
Language: JavaScript
Files changed: js/parseMessage.js
Commit date: 2020-06-19 18:05:04 -0400
Commit message: Fixed a serious vulnerability

There was a serious remote code execution vulnerability that allowed anybody to execute commands on the machine of everybody they came into contact with, who was using Livebot. The 'hacker' would not have to use livebot to run this attack.

The exact vulnerabilty will not be spread to anybody for the time being

Diff: diff --git a/js/parseMessage.js b/js/parseMessage.js
index 69008e5..bc6882a 100644
--- a/js/parseMessage.js
+++ b/js/parseMessage.js
@@ -12,14 +12,17 @@ let parseSend = (text) => {
 
     return text;
 }
 
 let parseMessage = (text, msg = null, embed = false) => {
-    // Remove html in the message
-    let textContent = text.replace(/(<)([^>]+)(>)/gm, '&lt;$2&gt;');
+    // Remove html < and > in the message
+    let textContent = text
+                        .replace(/</g, '&lt;')
+                        .replace(/>/g, '&gt;');
 
     // General message parsing
+    // Match links
     textContent = textContent.replace(/https?:\/\/.+?(\/(.+?(\?.+?((?= )|$)))|(?= )|$)/mg, '<a href="$&" rel="noreferrer noopener" title="$&" target="_blank">$&</a>');
 
     // Add html tags for markup
     textContent = textContent.replace(/\*\*(.*?)\*\*/gm, '<strong>$1</strong>');
     textContent = textContent.replace(/__(.*?)__/gm, '<u>$1</u>');

Vulnerable code:     // Remove html in the message
    let textContent = text.replace(/(<)([^>]+)(>)/gm, '&lt;$2&gt;');
Fixed code:     // Remove html < and > in the message
    let textContent = text
                        .replace(/</g, '&lt;')
                        .replace(/>/g, '&gt;');
    // Match links
CVE-2016-1000108: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2019-12-10T15:15Z
Repository: https://github.com/klacke/yaws
Language: Other
Files changed: src/yaws_cgi.erl
Commit date: 2016-07-25 12:49:02 +0200
Commit message: Security flaw http://httpoxy.org/ fixed
A security flaw with HTTP_PROXY fixed. When we now construct the
cgi env variables, we just skip the Proxy header.
Reported by dominic@varspool.com

Diff: diff --git a/src/yaws_cgi.erl b/src/yaws_cgi.erl
index 6e628f7..42a29af 100644
--- a/src/yaws_cgi.erl
+++ b/src/yaws_cgi.erl
@@ -366,15 +366,25 @@ build_env(Arg, Scriptfilename, Pathinfo, ExtraEnv, SC) ->
             {"HTTP_IF_MODIFIED_SINCE", H#headers.if_modified_since},
             {"HTTP_IF_MATCH", H#headers.if_match},
             {"HTTP_IF_NONE_MATCH", H#headers.if_none_match},
             {"HTTP_IF_UNMODIFIED_SINCE", H#headers.if_unmodified_since},
             {"HTTP_COOKIE", flatten_val(make_cookie_val(H#headers.cookie))}
-           ]++lists:map(fun({http_header,_,Var,_,Val})->{tohttp(Var),Val} end,
-                        H#headers.other)
+           ]++ other_headers(H#headers.other)
           )) ++
         Extra_CGI_Vars.
 
+other_headers(Headers) ->
+    lists:zf(fun({http_header,_,Var,_,Val}) ->
+                     case tohttp(Var) of
+                         "HTTP_PROXY" ->
+                             %% See http://httpoxy.org/
+                             false;
+                         HTTP ->
+                             {true, {HTTP,Val}}
+                     end
+             end, Headers).
+
 tohttp(X) ->
     "HTTP_"++lists:map(fun tohttp_c/1, yaws:to_list(X)).
 
 
 tohttp_c($-) ->

Vulnerable code:            ]++lists:map(fun({http_header,_,Var,_,Val})->{tohttp(Var),Val} end,
                        H#headers.other)
Fixed code:            ]++ other_headers(H#headers.other)
other_headers(Headers) ->
    lists:zf(fun({http_header,_,Var,_,Val}) ->
                     case tohttp(Var) of
                         "HTTP_PROXY" ->
                             %% See http://httpoxy.org/
                             false;
                         HTTP ->
                             {true, {HTTP,Val}}
                     end
             end, Headers).
CVE-2015-1590: Permissions, Privileges, and Access Controls (CWE-264)
value: The kamcmd administrative utility and default configuration in kamailio before 4.3.0 use /tmp/kamailio_ctl.
CWE description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
CVSS v3 base score: 7.8
Published: 2017-09-07T14:29Z
Repository: https://github.com/kamailio/kamailio
Language: Unknown
Commit date: 2015-04-16 11:58:23 +0200
Commit message: Merge pull request #89 from linuxmaniac/vseva/defaults

set defaults of fifo and ctl to /var/run/kamailio

Closes: #48
Closes: #89
CVE-2016-2385: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Heap-based buffer overflow in the encode_msg function in encode_msg.c in the SEAS module in Kamailio (formerly OpenSER and SER) before 4.3.5 allows remote attackers to cause a denial of service (memory corruption and process crash) or possibly execute arbitrary code via a large SIP packet.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 9.8
Published: 2016-04-11T15:59Z
Repository: https://github.com/kamailio/kamailio
Language: C
Files changed: modules/seas/encode_msg.c
Commit date: 2016-02-12 18:04:19 +0100
Commit message: seas: safety check for target buffer size before copying message in encode_msg()

- avoid buffer overflow for large SIP messages
- reported by Stelios Tsampas

Diff: diff --git a/modules/seas/encode_msg.c b/modules/seas/encode_msg.c
index 06d31a32e7..e56b5fba89 100644
--- a/modules/seas/encode_msg.c
+++ b/modules/seas/encode_msg.c
@@ -156,10 +156,11 @@ int encode_msg(struct sip_msg *msg,char *payload,int len)
    char *myerror=NULL;
    ptrdiff_t diff;
 
    if(len < MAX_ENCODED_MSG + MAX_MESSAGE_LEN)
       return -1;
+
    if(parse_headers(msg,HDR_EOH_F,0)<0){
       myerror="in parse_headers";
       goto error;
    }
    memset(payload,0,len);
@@ -264,10 +265,15 @@ int encode_msg(struct sip_msg *msg,char *payload,int len)
    /*now we copy the headers-meta-section after the msg-headers-meta-section*/
    /*memcpy(&payload[k],payload2,j);*/
    /*j+=k;*/
    /*pkg_free(payload2);*/
    /*now we copy the actual message after the headers-meta-section*/
+
+	if(len < j + msg->len + 1) {
+   	   LM_ERR("not enough space to encode sip message\n");
+   	   return -1;
+	}
    memcpy(&payload[j],msg->buf,msg->len);
    LM_DBG("msglen = %d,msg starts at %d\n",msg->len,j);
    j=htons(j);
    /*now we copy at the beginning, the index to where the actual message starts*/
    memcpy(&payload[MSG_START_IDX],&j,2);

Fixed code: 

	if(len < j + msg->len + 1) {
   	   LM_ERR("not enough space to encode sip message\n");
   	   return -1;
	}
CVE-2018-8828: Off-by-one Error (CWE-193)
value: A Buffer Overflow issue was discovered in Kamailio before 4.4.7, 5.0.x before 5.0.6, and 5.1.x before 5.1.2. A specially crafted REGISTER message with a malformed branch or From tag triggers an off-by-one heap-based buffer overflow in the tmx_check_pretran function in modules/tmx/tmx_pretran.c.
CWE description: A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
CVSS v3 base score: 9.8
Published: 2018-03-20T20:29Z
Repository: https://github.com/kamailio/kamailio
Language: C
Files changed: src/modules/tmx/tmx_pretran.c
Commit date: 2018-02-10 22:05:42 +0100
Commit message: tmx: allocate space to store ending 0 for branch value

- reported by Alfred Farrugia and Sandro Gauci

Diff: diff --git a/src/modules/tmx/tmx_pretran.c b/src/modules/tmx/tmx_pretran.c
index 494bdffe3e..67c4f7f4af 100644
--- a/src/modules/tmx/tmx_pretran.c
+++ b/src/modules/tmx/tmx_pretran.c
@@ -258,11 +258,11 @@ int tmx_check_pretran(sip_msg_t *msg)
 	dsize = scallid.len + scseqnum.len + scseqmet.len
 		+ sftag.len + 4;
 	if(likely(vbr!=NULL)) {
 		svbranch = vbr->value;
 		trim(&svbranch);
-		dsize += svbranch.len;
+		dsize += svbranch.len + 1;
 	}
 	if(dsize<256) dsize = 256;
 
 	tmx_pretran_unlink();
 

Vulnerable code: 		dsize += svbranch.len;
Fixed code: 		dsize += svbranch.len + 1;
CVE-2018-8828: Out-of-bounds Write (CWE-787)
value: A Buffer Overflow issue was discovered in Kamailio before 4.4.7, 5.0.x before 5.0.6, and 5.1.x before 5.1.2. A specially crafted REGISTER message with a malformed branch or From tag triggers an off-by-one heap-based buffer overflow in the tmx_check_pretran function in modules/tmx/tmx_pretran.c.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2018-03-20T20:29Z
Repository: https://github.com/kamailio/kamailio
Language: C
Files changed: src/modules/tmx/tmx_pretran.c
Commit date: 2018-02-10 22:05:42 +0100
Commit message: tmx: allocate space to store ending 0 for branch value

- reported by Alfred Farrugia and Sandro Gauci

Diff: diff --git a/src/modules/tmx/tmx_pretran.c b/src/modules/tmx/tmx_pretran.c
index 494bdffe3e..67c4f7f4af 100644
--- a/src/modules/tmx/tmx_pretran.c
+++ b/src/modules/tmx/tmx_pretran.c
@@ -258,11 +258,11 @@ int tmx_check_pretran(sip_msg_t *msg)
 	dsize = scallid.len + scseqnum.len + scseqmet.len
 		+ sftag.len + 4;
 	if(likely(vbr!=NULL)) {
 		svbranch = vbr->value;
 		trim(&svbranch);
-		dsize += svbranch.len;
+		dsize += svbranch.len + 1;
 	}
 	if(dsize<256) dsize = 256;
 
 	tmx_pretran_unlink();
 

Vulnerable code: 		dsize += svbranch.len;
Fixed code: 		dsize += svbranch.len + 1;
CVE-2021-21311: Server-Side Request Forgery (SSRF) (CWE-918)
value: Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected. This is fixed in version 4.7.9.
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 7.2
Published: 2021-02-11T21:15Z
Repository: https://github.com/vrana/adminer
Language: PHP
Files changed: adminer/drivers/clickhouse.inc.php, adminer/drivers/elastic.inc.php, changes.txt
Commit date: 2021-02-06 10:45:56 +0100
Commit message: Elasticsearch, ClickHouse: Do not print response if HTTP code is not 200

Thanks to Adam Crosser and Brian Sizemore

Diff: diff --git a/adminer/drivers/clickhouse.inc.php b/adminer/drivers/clickhouse.inc.php
index d72109d5..99c77ab8 100644
--- a/adminer/drivers/clickhouse.inc.php
+++ b/adminer/drivers/clickhouse.inc.php
@@ -20,11 +20,11 @@ if (isset($_GET["clickhouse"])) {
 			if ($file === false) {
 				$this->error = $php_errormsg;
 				return $file;
 			}
 			if (!preg_match('~^HTTP/[0-9.]+ 2~i', $http_response_header[0])) {
-				$this->error = $file;
+				$this->error = lang('Invalid credentials.') . " $http_response_header[0]";
 				return false;
 			}
 			$return = json_decode($file, true);
 			if ($return === null) {
 				if (!$this->isQuerySelectLike($query) && $file === '') {
diff --git a/adminer/drivers/elastic.inc.php b/adminer/drivers/elastic.inc.php
index a29252fe..f2abfad7 100644
--- a/adminer/drivers/elastic.inc.php
+++ b/adminer/drivers/elastic.inc.php
@@ -26,11 +26,11 @@ if (isset($_GET["elastic"])) {
 				if (!$file) {
 					$this->error = $php_errormsg;
 					return $file;
 				}
 				if (!preg_match('~^HTTP/[0-9.]+ 2~i', $http_response_header[0])) {
-					$this->error = $file;
+					$this->error = lang('Invalid credentials.') . " $http_response_header[0]";
 					return false;
 				}
 				$return = json_decode($file, true);
 				if ($return === null) {
 					$this->errno = json_last_error();
diff --git a/changes.txt b/changes.txt
index cb729dec..11f501af 100644
--- a/changes.txt
+++ b/changes.txt
@@ -1,6 +1,7 @@
 Adminer 4.7.9-dev:
+Elasticsearch, ClickHouse: Do not print response if HTTP code is not 200
 Re-enable PHP warnings (regression from 4.7.8)
 
 Adminer 4.7.8 (released 2020-12-06):
 Support PHP 8
 Disallow connecting to privileged ports (bug #769)

Vulnerable code: 				$this->error = $file;
					$this->error = $file;
Fixed code: 				$this->error = lang('Invalid credentials.') . " $http_response_header[0]";
					$this->error = lang('Invalid credentials.') . " $http_response_header[0]";
Elasticsearch, ClickHouse: Do not print response if HTTP code is not 200
CVE-2021-29625: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Adminer is open-source database management software. A cross-site scripting vulnerability in Adminer versions 4.6.1 to 4.8.0 affects users of MySQL, MariaDB, PgSQL and SQLite. XSS is in most cases prevented by strict CSP in all modern browsers. The only exception is when Adminer is using a `pdo_` extension to communicate with the database (it is used if the native extensions are not enabled). In browsers without CSP, Adminer versions 4.6.1 to 4.8.0 are affected. The vulnerability is patched in version 4.8.1. As workarounds, one can use a browser supporting strict CSP or enable the native PHP extensions (e.g. `mysqli`) or disable displaying PHP errors (`display_errors`).
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-05-19T22:15Z
Repository: https://github.com/vrana/adminer
Language: PHP
Files changed: adminer/include/editing.inc.php, changes.txt
Commit date: 2021-05-14 07:12:44 +0200
Commit message: Escape link in doc_link (bug #797)

Diff: diff --git a/adminer/include/editing.inc.php b/adminer/include/editing.inc.php
index 88d66d44..5556b014 100644
--- a/adminer/include/editing.inc.php
+++ b/adminer/include/editing.inc.php
@@ -540,11 +540,11 @@ function doc_link($paths, $text = "<sup>?</sup>") {
 	);
 	if (preg_match('~MariaDB~', $server_info)) {
 		$urls['sql'] = "https://mariadb.com/kb/en/library/";
 		$paths['sql'] = (isset($paths['mariadb']) ? $paths['mariadb'] : str_replace(".html", "/", $paths['sql']));
 	}
-	return ($paths[$jush] ? "<a href='$urls[$jush]$paths[$jush]'" . target_blank() . ">$text</a>" : "");
+	return ($paths[$jush] ? "<a href='" . h($urls[$jush] . $paths[$jush]) . "'" . target_blank() . ">$text</a>" : "");
 }
 
 /** Wrap gzencode() for usage in ob_start()
 * @param string
 * @return string
diff --git a/changes.txt b/changes.txt
index 9622f194..a9e45a5c 100644
--- a/changes.txt
+++ b/changes.txt
@@ -1,6 +1,7 @@
 Adminer 4.8.1-dev:
+Internet Explorer or PDO in Adminer 4.7.8-4.8.0: Fix XSS in doc_link (bug #797)
 Fix more PHP 8 warnings (bug #781)
 Avoid PHP warnings with PDO drivers (bug #786, regression from 4.7.8)
 MySQL: Allow moving views to other DB and renaming DB with views (bug #783)
 MariaDB: Do not treat sequences as views (PR #416)
 PostgreSQL: Support UPDATE OF triggers (bug #789)

Vulnerable code: 	return ($paths[$jush] ? "<a href='$urls[$jush]$paths[$jush]'" . target_blank() . ">$text</a>" : "");
Fixed code: 	return ($paths[$jush] ? "<a href='" . h($urls[$jush] . $paths[$jush]) . "'" . target_blank() . ">$text</a>" : "");
Internet Explorer or PDO in Adminer 4.7.8-4.8.0: Fix XSS in doc_link (bug #797)
CVE-2022-47021: NULL Pointer Dereference (CWE-476)
value: A null pointer dereference issue was discovered in functions op_get_data and op_open1 in opusfile.c in xiph opusfile 0.9 thru 0.12 allows attackers to cause denial of service or other unspecified impacts.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.8
Published: 2023-01-20T19:15Z
Repository: https://github.com/xiph/opusfile
Language: C
Files changed: src/opusfile.c
Commit date: 2022-09-07 13:44:38 -0700
Commit message: Propagate allocation failure from ogg_sync_buffer.

Instead of segfault, report OP_EFAULT if ogg_sync_buffer returns
a null pointer. This allows more graceful recovery by the caller
in the unlikely event of a fallible ogg_malloc call.

We do check the return value elsewhere in the code, so the new
checks make the code more consistent.

Thanks to https://github.com/xiph/opusfile/issues/36 for reporting.

Signed-off-by: Timothy B. Terriberry <tterribe@xiph.org>
Signed-off-by: Mark Harris <mark.hsj@gmail.com>

Diff: diff --git a/src/opusfile.c b/src/opusfile.c
index ca219b2..3c3c81e 100644
--- a/src/opusfile.c
+++ b/src/opusfile.c
@@ -146,10 +146,11 @@ int op_test(OpusHead *_head,
 static int op_get_data(OggOpusFile *_of,int _nbytes){
   unsigned char *buffer;
   int            nbytes;
   OP_ASSERT(_nbytes>0);
   buffer=(unsigned char *)ogg_sync_buffer(&_of->oy,_nbytes);
+  if(OP_UNLIKELY(buffer==NULL))return OP_EFAULT;
   nbytes=(int)(*_of->callbacks.read)(_of->stream,buffer,_nbytes);
   OP_ASSERT(nbytes<=_nbytes);
   if(OP_LIKELY(nbytes>0))ogg_sync_wrote(&_of->oy,nbytes);
   return nbytes;
 }
@@ -1525,10 +1526,11 @@ static int op_open1(OggOpusFile *_of,
      doesn't support seeking, so this is not a good mechanism to use for
      decoding entire files from RAM.*/
   if(_initial_bytes>0){
     char *buffer;
     buffer=ogg_sync_buffer(&_of->oy,(long)_initial_bytes);
+    if(OP_UNLIKELY(buffer==NULL))return OP_EFAULT;
     memcpy(buffer,_initial_data,_initial_bytes*sizeof(*buffer));
     ogg_sync_wrote(&_of->oy,(long)_initial_bytes);
   }
   /*Can we seek?
     Stevens suggests the seek test is portable.

Fixed code:   if(OP_UNLIKELY(buffer==NULL))return OP_EFAULT;
    if(OP_UNLIKELY(buffer==NULL))return OP_EFAULT;