Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2023-3195: Out-of-bounds Write (CWE-787)
value: A stack-based buffer overflow issue was found in ImageMagick's coders/tiff.c. This flaw allows an attacker to trick the user into opening a specially crafted malicious tiff file, causing an application to crash, resulting in a denial of service.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2023-06-16T20:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: Other
Files changed: ChangeLog, coders/tiff.c
Commit date: 2021-10-19 14:54:10 -0400
Commit message: fix stack overflow when parsing malicious tiff image

Diff: diff --git a/ChangeLog b/ChangeLog
index 4cf399afad55..c2477c457cdd 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -4,10 +4,12 @@
 2021-10-11  7.1.0-11  <quetzlzacatenango@image...>
   * fix connected component abort trap (reference
     https://github.com/ImageMagick/ImageMagick/issues/4372).
   * fix possible unitialized values (reference
     https://github.com/ImageMagick/ImageMagick/issues/4379).
+  * fix stack overflow when parsing malicious tiff image file (report from
+    Muhammad Aldo Firmansyah).
 
 2021-10-10  7.1.0-10  <quetzlzacatenango@image...>
   * Release ImageMagick version 7.1.0-10 GIT revision 19236:07ebe6b6e:20211010
 
 2021-10-03  7.1.0-10  <quetzlzacatenango@image...>
diff --git a/coders/tiff.c b/coders/tiff.c
index 3d59f0e6972d..81f50082fd17 100644
--- a/coders/tiff.c
+++ b/coders/tiff.c
@@ -1999,10 +1999,15 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
           ThrowTIFFException(CoderError,"ImageIsNotTiled");
         number_pixels=(MagickSizeType) columns*rows;
         if (HeapOverflowSanityCheck(rows,sizeof(*tile_pixels)) != MagickFalse)
           ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
         extent=MagickMax(rows*TIFFTileRowSize(tiff),TIFFTileSize(tiff));
+#if defined(TIFF_VERSION_BIG)
+        extent+=image->columns*sizeof(uint64);
+#else
+        extent+=image->columns*sizeof(uint32);
+#endif
         tile_pixels=(unsigned char *) AcquireQuantumMemory(extent,
           sizeof(*tile_pixels));
         if (tile_pixels == (unsigned char *) NULL)
           ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
         (void) memset(tile_pixels,0,extent*sizeof(*tile_pixels));

Fixed code:   * fix stack overflow when parsing malicious tiff image file (report from
    Muhammad Aldo Firmansyah).
#if defined(TIFF_VERSION_BIG)
        extent+=image->columns*sizeof(uint64);
#else
        extent+=image->columns*sizeof(uint32);
#endif
CVE-2023-3745: Out-of-bounds Write (CWE-787)
value: A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel() function in quantum-private.h. This issue may allow a local attacker to trick the user into opening a specially crafted file, triggering an out-of-bounds read error and allowing an application to crash, resulting in a denial of service.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2023-07-24T16:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: Other
Files changed: ChangeLog, coders/tiff.c
Commit date: 2020-03-02 16:14:33 -0500
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1857

Diff: diff --git a/ChangeLog b/ChangeLog
index 2ac6ed68dda8..d530316c4696 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -2,10 +2,12 @@
   * Release ImageMagick version 7.0.10-0, GIT revision 17...
 
 2020-03-01  7.0.10-0 Cristy  <quetzlzacatenango@image...>
   * Label text no longer gets cut-off (reference
     https://imagemagick.org/discourse-server/viewtopic.php?f=1&t=37621).
+  * Prevent heap overflow (reference
+     https://github.com/ImageMagick/ImageMagick/issues/1857).
 
 2020-02-29  7.0.9-27 Cristy  <quetzlzacatenango@image...>
   * Release ImageMagick version 7.0.9-27, GIT revision 17006:49d81b672:20200229
 
 2020-02-24  7.0.9-27 Cristy  <quetzlzacatenango@image...>
diff --git a/coders/tiff.c b/coders/tiff.c
index 022008e3e324..0c8c596aec9d 100644
--- a/coders/tiff.c
+++ b/coders/tiff.c
@@ -1939,10 +1939,12 @@ RestoreMSCWarning
 
         /*
           Convert stripped TIFF image.
         */
         extent=TIFFStripSize(tiff)+sizeof(uint32);
+        if (photometric == PHOTOMETRIC_YCBCR)
+          extent<<=1;
         strip_pixels=(unsigned char *) AcquireQuantumMemory(extent,
           sizeof(*strip_pixels));
         if (strip_pixels == (unsigned char *) NULL)
           ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
         (void) memset(strip_pixels,0,extent*sizeof(*strip_pixels));

Fixed code:   * Prevent heap overflow (reference
     https://github.com/ImageMagick/ImageMagick/issues/1857).
        if (photometric == PHOTOMETRIC_YCBCR)
          extent<<=1;
CVE-2023-3745: Out-of-bounds Write (CWE-787)
value: A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel() function in quantum-private.h. This issue may allow a local attacker to trick the user into opening a specially crafted file, triggering an out-of-bounds read error and allowing an application to crash, resulting in a denial of service.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2023-07-24T16:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/tiff.c
Commit date: 2020-03-02 17:07:56 -0500
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1857

Diff: diff --git a/coders/tiff.c b/coders/tiff.c
index 0c8c596aec9d..294af0a27aea 100644
--- a/coders/tiff.c
+++ b/coders/tiff.c
@@ -1816,11 +1816,12 @@ RestoreMSCWarning
     if (TIFFIsTiled(tiff) != MagickFalse)
       method=ReadTileMethod;
     if (image->compression == JPEGCompression)
       method=GetJPEGMethod(image,tiff,photometric,bits_per_sample,
         samples_per_pixel);
-    if (photometric == PHOTOMETRIC_LOGLUV)
+    if ((photometric == PHOTOMETRIC_LOGLUV) ||
+        (photometric == PHOTOMETRIC_YCBCR))
       method=ReadGenericMethod;
     quantum_info->endian=LSBEndian;
     quantum_type=RGBQuantum;
     if (TIFFScanlineSize(tiff) <= 0)
       ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
@@ -1939,12 +1940,10 @@ RestoreMSCWarning
 
         /*
           Convert stripped TIFF image.
         */
         extent=TIFFStripSize(tiff)+sizeof(uint32);
-        if (photometric == PHOTOMETRIC_YCBCR)
-          extent<<=1;
         strip_pixels=(unsigned char *) AcquireQuantumMemory(extent,
           sizeof(*strip_pixels));
         if (strip_pixels == (unsigned char *) NULL)
           ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
         (void) memset(strip_pixels,0,extent*sizeof(*strip_pixels));

Vulnerable code:     if (photometric == PHOTOMETRIC_LOGLUV)
        if (photometric == PHOTOMETRIC_YCBCR)
          extent<<=1;
Fixed code:     if ((photometric == PHOTOMETRIC_LOGLUV) ||
        (photometric == PHOTOMETRIC_YCBCR))
CVE-2023-5341: Use After Free (CWE-416)
value: A heap use-after-free flaw was found in coders/bmp.c in ImageMagick.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 5.5
Published: 2023-11-19T10:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/bmp.c
Commit date: 2023-09-24 07:28:19 -0400
Commit message: check for BMP file size, poc provided by Hardik Shah of Vehere (Dawn Treaders team)

Diff: diff --git a/coders/bmp.c b/coders/bmp.c
index 94ec6628fdfe..7e36d4f481b9 100644
--- a/coders/bmp.c
+++ b/coders/bmp.c
@@ -693,10 +693,13 @@ static Image *ReadBMPImage(const ImageInfo *image_info,ExceptionInfo *exception)
             (bmp_info.size != 64))
           ThrowReaderException(CorruptImageError,"ImproperImageHeader");
       }
     if (bmp_info.size > 124)
       ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+    if ((bmp_info.file_size != 0) &&
+        ((MagickSizeType) bmp_info.file_size > GetBlobSize(image)))
+      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
     if (bmp_info.offset_bits < bmp_info.size)
       ThrowReaderException(CorruptImageError,"ImproperImageHeader");
     bmp_info.offset_bits=MagickMax(14+bmp_info.size,bmp_info.offset_bits);
     profile_data=0;
     profile_size=0;

Fixed code:     if ((bmp_info.file_size != 0) &&
        ((MagickSizeType) bmp_info.file_size > GetBlobSize(image)))
      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
CVE-2020-15150: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: There is a vulnerability in Paginator (Elixir/Hex package) which makes it susceptible to Remote Code Execution (RCE) attacks via input parameters to the paginate() function. This will potentially affect all current users of Paginator prior to version 1.0.0. The vulnerability has been patched in version 1.0.0 and all users should upgrade to this version immediately. Note that this patched version uses a dependency that requires an Elixir version >=1.5.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 9.8
Published: 2020-09-01T17:15Z
Repository: https://github.com/duffelhq/paginator
Language: Unknown
Commit date: 2020-08-17 19:08:18 +0100
Commit message: Merge pull request from GHSA-w98m-2xqg-9cvj

Fix unsafe binary to term
CVE-2021-23440: Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)
value: This affects the package set-value before <2.0.1, >=3.0.0 <4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.
CWE description: The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
CVSS v3 base score: 9.8
Published: 2021-09-12T13:15Z
Repository: https://github.com/jonschlinkert/set-value
Language: JSON
Files changed: package.json
Commit date: 2021-09-12 03:36:46 -0400
Commit message: 4.0.1

Fixes https://github.com/jonschlinkert/set-value/pull/33 thanks to @ready-research.

Diff: diff --git a/package.json b/package.json
index a9b264e..3865c1f 100644
--- a/package.json
+++ b/package.json
@@ -1,8 +1,8 @@
 {
   "name": "set-value",
-  "version": "4.0.0",
+  "version": "4.0.1",
   "description": "Set nested properties on an object using dot notation.",
   "license": "MIT",
   "repository": "jonschlinkert/set-value",
   "homepage": "https://github.com/jonschlinkert/set-value",
   "bugs": "https://github.com/jonschlinkert/set-value/issues",
@@ -120,6 +120,6 @@
       "setvalue",
       "split-string",
       "update"
     ]
   }
-}
\ No newline at end of file
+}

Vulnerable code:   "version": "4.0.0",
}
Fixed code:   "version": "4.0.1",
}
CVE-2020-36402: Out-of-bounds Write (CWE-787)
value: Solidity 0.7.5 has a stack-use-after-return issue in smtutil::CHCSmtLib2Interface::querySolver. NOTE: c39a5e2b7a3fabbf687f53a2823fc087be6c1a7e is cited in the OSV "fixed" field but does not have a code change.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2021-07-01T03:15Z
Repository: https://github.com/ethereum/solidity
Language: Other
Files changed: docs/ir/ir-breaking-changes.rst
Commit date: 2020-12-07 11:24:13 +0100
Commit message: Fix accidental repetition in ir breaking changes docs.

Diff: diff --git a/docs/ir/ir-breaking-changes.rst b/docs/ir/ir-breaking-changes.rst
index ec6126beb..0d8521c52 100644
--- a/docs/ir/ir-breaking-changes.rst
+++ b/docs/ir/ir-breaking-changes.rst
@@ -44,11 +44,11 @@ The order used to be:
 
 New order:
  - All state variables are zero-initialized at the beginning.
  - Evaluate base constructor arguments from most derived to most base contract.
  - For every contract in order from most base to most derived in the linearized hierarchy execute:
-     1. State variables are assigned value their initial values, if present at declaration.
+     1. State variables are assigned their initial values, if present at declaration.
      2. Constructor, if present.
 
 This causes differences in some contracts, for example:
 ::
     // SPDX-License-Identifier: GPL-3.0

Vulnerable code:      1. State variables are assigned value their initial values, if present at declaration.
Fixed code:      1. State variables are assigned their initial values, if present at declaration.
CVE-2019-25066: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: A vulnerability has been found in ajenti 2.1.31 and classified as critical. This vulnerability affects unknown code of the component API. The manipulation leads to privilege escalation. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.1.32 is able to address this issue. The name of the patch is 7aa146b724e0e20cfee2c71ca78fafbf53a8767c. It is recommended to upgrade the affected component.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 8.8
Published: 2022-06-09T17:15Z
Repository: https://github.com/ajenti/ajenti
Language: Python
Files changed: ajenti-core/aj/auth.py
Commit date: 2019-10-05 07:06:48 -0700
Commit message: fixed shell injection in os auth provider

Diff: diff --git a/ajenti-core/aj/auth.py b/ajenti-core/aj/auth.py
index 9b3c832e..8429ac96 100644
--- a/ajenti-core/aj/auth.py
+++ b/ajenti-core/aj/auth.py
@@ -3,10 +3,11 @@ import logging
 import pexpect
 import pwd
 import subprocess
 import syslog
 from jadi import component, service, interface
+from six import PY3
 
 import aj
 from aj.api.http import BaseHttpHandler
 from aj.security.verifier import ClientCertificateVerificator
 from aj.util import public
@@ -97,12 +98,18 @@ class OSAuthenticationProvider(AuthenticationProvider):
     name = 'OS users'
     allows_sudo_elevation = True
 
     def authenticate(self, username, password):
         child = None
+
+        if PY3:
+            from shlex import quote
+        else:
+            from pipes import quote
+
         try:
-            child = pexpect.spawn('/bin/sh', ['-c', '/bin/su -c "/bin/echo SUCCESS" - %s' % username], timeout=5)
+            child = pexpect.spawn('/bin/sh', ['-c', '/bin/su -c "/bin/echo SUCCESS" - %s' % quote(username)], timeout=5)
             child.expect('.*:')
             child.sendline(password)
             result = child.expect(['su: .*', 'SUCCESS'])
         except Exception as err:
             if child and child.isalive():

Vulnerable code:             child = pexpect.spawn('/bin/sh', ['-c', '/bin/su -c "/bin/echo SUCCESS" - %s' % username], timeout=5)
Fixed code: from six import PY3

        if PY3:
            from shlex import quote
        else:
            from pipes import quote

            child = pexpect.spawn('/bin/sh', ['-c', '/bin/su -c "/bin/echo SUCCESS" - %s' % quote(username)], timeout=5)
CVE-2022-28044: Out-of-bounds Write (CWE-787)
value: Irzip v0.640 was discovered to contain a heap memory corruption via the component lrzip.c:initialise_control.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2022-04-15T14:15Z
Repository: https://github.com/ckolivas/lrzip
Language: C
Files changed: lrzip.c, main.c
Commit date: 2022-02-25 22:35:20 +1100
Commit message: Fix control->suffix being deallocated as heap memory as reported by Pietro Borrello.

Diff: diff --git a/lrzip.c b/lrzip.c
index 0133c90..3d96128 100644
--- a/lrzip.c
+++ b/lrzip.c
@@ -1336,11 +1336,11 @@ bool initialise_control(rzip_control *control)
 	memset(control, 0, sizeof(rzip_control));
 	control->msgout = stderr;
 	control->msgerr = stderr;
 	register_outputfile(control, control->msgout);
 	control->flags = FLAG_SHOW_PROGRESS | FLAG_KEEP_FILES | FLAG_THRESHOLD;
-	control->suffix = ".lrz";
+	control->suffix = strdup(".lrz");
 	control->compression_level = 7;
 	control->ramsize = get_ram(control);
 	if (unlikely(control->ramsize == -1))
 		return false;
 	/* for testing single CPU */
diff --git a/main.c b/main.c
index 4519a63..fd980ff 100644
--- a/main.c
+++ b/main.c
@@ -456,11 +456,12 @@ int main(int argc, char *argv[])
 			if (control->outdir)
 				failure("Cannot have -o and -O together\n");
 			if (unlikely(STDOUT))
 				failure("Cannot specify an output filename when outputting to stdout\n");
 			control->outname = optarg;
-			control->suffix = "";
+			dealloc(control->suffix);
+			control->suffix = strdup("");
 			break;
 		case 'O':
 			if (control->outname)	/* can't mix -o and -O */
 				failure("Cannot have options -o and -O together\n");
 			if (unlikely(STDOUT))
@@ -491,11 +492,12 @@ int main(int argc, char *argv[])
 		case 'S':
 			if (control->outname)
 				failure("Specified output filename already, can't specify an extension.\n");
 			if (unlikely(STDOUT))
 				failure("Cannot specify a filename suffix when outputting to stdout\n");
-			control->suffix = optarg;
+			dealloc(control->suffix);
+			control->suffix = strdup(optarg);
 			break;
 		case 't':
 			if (control->outname)
 				failure("Cannot specify an output file name when just testing.\n");
 			if (compat)

Vulnerable code: 	control->suffix = ".lrz";
			control->suffix = "";
			control->suffix = optarg;
Fixed code: 	control->suffix = strdup(".lrz");
			dealloc(control->suffix);
			control->suffix = strdup("");
			dealloc(control->suffix);
			control->suffix = strdup(optarg);
CVE-2011-0469: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: Code injection in openSUSE when running some source services used in the open build service 2.1 before March 11 2011.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 9.8
Published: 2017-08-17T16:29Z
Repository: https://github.com/openSUSE/open-build-service
Language: Other
Files changed: src/backend/bs_srcserver
Commit date: 2011-03-14 11:27:26 +0100
Commit message: [backend] verify file names return by source service (do not allow files with new lines #679151)

Diff: diff --git a/src/backend/bs_srcserver b/src/backend/bs_srcserver
index 3e3da245..40e83805 100755
--- a/src/backend/bs_srcserver
+++ b/src/backend/bs_srcserver
@@ -201,10 +201,11 @@ sub runservice {
     for my $pfile (ls($odir)) {
       unless ($pfile =~ /^_service[_:]/) {
 	unlink($lockfile);
 	die("ERROR: bs_service returned a non-_service file\n");
       }
+      BSVerify::verify_filename($pfile);
       $files->{$pfile} = addfile($projid, $packid, "$odir/$pfile", $pfile);
     }
   } else {
     $error ||= 'error';
     $error =~ s/\n$//s;

Fixed code:       BSVerify::verify_filename($pfile);
CVE-2014-0594: Cross-Site Request Forgery (CSRF) (CWE-352)
value: In the Open Build Service (OBS) before version 2.4.6 the CSRF protection is incorrectly disabled in the web interface, allowing for requests without the user's consent.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2018-06-08T17:29Z
Repository: https://github.com/openSUSE/open-build-service
Language: Ruby
Files changed: src/api/app/controllers/webui/webui_controller.rb, src/api/config/application.rb
Commit date: 2014-03-27 13:01:18 +0100
Commit message: [webui] Reintroduce CSRF protection for the webui. AUA!

Diff: diff --git a/src/api/app/controllers/webui/webui_controller.rb b/src/api/app/controllers/webui/webui_controller.rb
index c07ec652bc..0256d5eb23 100644
--- a/src/api/app/controllers/webui/webui_controller.rb
+++ b/src/api/app/controllers/webui/webui_controller.rb
@@ -11,10 +11,19 @@ class Webui::WebuiController < ActionController::Base
   before_filter :set_return_to, :reset_activexml, :authenticate
   before_filter :check_user
   before_filter :require_configuration
   after_filter :clean_cache
 
+  protect_from_forgery
+
+  # We execute both strategies here. The default rails strategy (resetting the session)
+  # and throwing an exception if the session is handled elswhere (e.g. proxy_auth_mode: :on)
+  def handle_unverified_request
+    super
+    raise ActionController::InvalidAuthenticityToken
+  end
+
   # :notice and :alert are default, we add :success and :error
   add_flash_types :success, :error
 
   # FIXME: This belongs into the user controller my dear.
   # Also it would be better, but also more complicated, to just raise
diff --git a/src/api/config/application.rb b/src/api/config/application.rb
index b818c5b172..d2ccacb305 100644
--- a/src/api/config/application.rb
+++ b/src/api/config/application.rb
@@ -103,10 +103,11 @@ module OBSApi
 
     config.action_dispatch.rescue_responses.merge!('ActiveXML::Transport::UnauthorizedError' => 401)
     config.action_dispatch.rescue_responses.merge!('ActiveXML::Transport::ConnectionError' => 503)
     config.action_dispatch.rescue_responses.merge!('ActiveXML::Transport::Error' => 500)
     config.action_dispatch.rescue_responses.merge!('Timeout::Error' => 408)
+    config.action_dispatch.rescue_responses.merge!('ActionController::InvalidAuthenticityToken' => 403)
 
     # avoid a warning
     I18n.enforce_available_locales = true
 
     # we're not threadsafe

Fixed code:   protect_from_forgery

  # We execute both strategies here. The default rails strategy (resetting the session)
  # and throwing an exception if the session is handled elswhere (e.g. proxy_auth_mode: :on)
  def handle_unverified_request
    super
    raise ActionController::InvalidAuthenticityToken
  end

    config.action_dispatch.rescue_responses.merge!('ActionController::InvalidAuthenticityToken' => 403)
CVE-2015-0796: Improper Link Resolution Before File Access ('Link Following') (CWE-59)
value: In open buildservice 2.6 before 2.6.3, 2.5 before 2.5.7 and 2.4 before 2.4.8 the source service patch application could generate non-standard files like symlinks or device nodes, which could allow buildservice users to break of confinement or cause denial of service attacks on the source service.
CWE description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVSS v3 base score: 7.8
Published: 2018-03-02T20:29Z
Repository: https://github.com/openSUSE/open-build-service
Language: Other
Files changed: src/backend/bs_srcserver
Commit date: 2015-08-10 13:05:34 +0200
Commit message: [backend] sanity check the result of the external patch command

Simple files only, please.

Diff: diff --git a/src/backend/bs_srcserver b/src/backend/bs_srcserver
index 1a93608aac..223611c1bc 100755
--- a/src/backend/bs_srcserver
+++ b/src/backend/bs_srcserver
@@ -1977,14 +1977,32 @@ sub applylink {
       # exec('/usr/bin/patch', '--no-backup-if-mismatch', '--unified-reject-files', '--global-reject-file=.rejects', '-g', '0', '-f');
       exec('/usr/bin/patch', '--no-backup-if-mismatch', '-g', '0', '-f');
       die("/usr/bin/patch: $!\n");
     }
     waitpid($pid, 0) == $pid || die("waitpid $pid: $!\n");
-    if ($?) {
-      $failed = "could not apply patch '$pn'";
-      last;
+    $failed = "could not apply patch '$pn'" if $?;
+    # clean up patch fallout...
+    for my $f (ls($tmpdir)) {
+      my @s = lstat("$tmpdir/$f");
+      die("$tmpdir/$f: $!\n") unless @s;
+      if (-l _ || ! -f _) {
+        unlink("$tmpdir/$f");
+	$failed = "patch created a non-file";
+	next;
+      }
+      eval {
+	die("cannot create a link from a patch") if $f eq '_link';
+	BSVerify::verify_filename($f) unless $f eq '.log';
+      };
+      if ($@) {
+        unlink("$tmpdir/$f");
+	$failed = "patch created an illegal file";
+	next;
+      }
+      chmod(($s[2] & 077) | 0600, "$tmpdir/$f") if ($s[2] & 07700) != 0600;
     }
+    last if $failed;
   }
   if ($failed) {
     local *F;
     # add result as last line
     open(F, '>>', "$tmpdir/.log") || die("$tmpdir/.log: $!\n");

Vulnerable code:     if ($?) {
      $failed = "could not apply patch '$pn'";
      last;
Fixed code:     $failed = "could not apply patch '$pn'" if $?;
    # clean up patch fallout...
    for my $f (ls($tmpdir)) {
      my @s = lstat("$tmpdir/$f");
      die("$tmpdir/$f: $!\n") unless @s;
      if (-l _ || ! -f _) {
        unlink("$tmpdir/$f");
	$failed = "patch created a non-file";
	next;
      }
      eval {
	die("cannot create a link from a patch") if $f eq '_link';
	BSVerify::verify_filename($f) unless $f eq '.log';
      };
      if ($@) {
        unlink("$tmpdir/$f");
	$failed = "patch created an illegal file";
	next;
      }
      chmod(($s[2] & 077) | 0600, "$tmpdir/$f") if ($s[2] & 07700) != 0600;
    last if $failed;
CVE-2017-5188: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: The bs_worker code in open build service before 20170320 followed relative symlinks, allowing reading of files outside of the package source directory during build, allowing leakage of private information.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 7.5
Published: 2018-03-01T20:29Z
Repository: https://github.com/openSUSE/open-build-service
Language: Perl
Files changed: src/backend/BSHTTP.pm
Commit date: 2017-03-17 10:58:51 +0100
Commit message: [backend] only allow plain files in cpio_sender

No devices, sockets, directories, symlinks please...

Diff: diff --git a/src/backend/BSHTTP.pm b/src/backend/BSHTTP.pm
index d91de76b0a..928b88a992 100644
--- a/src/backend/BSHTTP.pm
+++ b/src/backend/BSHTTP.pm
@@ -446,17 +446,28 @@ sub cpio_sender {
     }
     if (exists $file->{'filename'}) {
       my $filename = $file->{'filename'};
       if (ref($filename)) {
 	*F = $filename;
-      } elsif (!open(F, '<', $filename)) {
-	$errors->{'data'} .= "$file->{'name'}: $filename: $!\n";
-	next;
+      } else {
+	@s = lstat($filename);
+	if (!@s) {
+	  $errors->{'data'} .= "$file->{'name'}: $filename: $!\n";
+	  next;
+	}
+	if (-l _ || ! -f _) {
+	  $errors->{'data'} .= "$file->{'name'}: $filename: not a plain file\n";
+	  next;
+	}
+	if (!open(F, '<', $filename)) {
+	  $errors->{'data'} .= "$file->{'name'}: $filename: $!\n";
+	  next;
+	}
       }
       @s = stat(F);
       if (!@s) {
-	$errors->{'data'} .= "$file->{'name'}: stat: $!\n";
+	$errors->{'data'} .= "$file->{'name'}: fstat: $!\n";
 	close F unless ref $filename;
 	next;
       }
       if (ref($filename)) {
 	my $off = sysseek(F, 0, Fcntl::SEEK_CUR) || 0;

Vulnerable code:       } elsif (!open(F, '<', $filename)) {
	$errors->{'data'} .= "$file->{'name'}: $filename: $!\n";
	next;
	$errors->{'data'} .= "$file->{'name'}: stat: $!\n";
Fixed code:       } else {
	@s = lstat($filename);
	if (!@s) {
	  $errors->{'data'} .= "$file->{'name'}: $filename: $!\n";
	  next;
	}
	if (-l _ || ! -f _) {
	  $errors->{'data'} .= "$file->{'name'}: $filename: not a plain file\n";
	  next;
	}
	if (!open(F, '<', $filename)) {
	  $errors->{'data'} .= "$file->{'name'}: $filename: $!\n";
	  next;
	}
	$errors->{'data'} .= "$file->{'name'}: fstat: $!\n";
CVE-2017-5188: Improper Link Resolution Before File Access ('Link Following') (CWE-59)
value: The bs_worker code in open build service before 20170320 followed relative symlinks, allowing reading of files outside of the package source directory during build, allowing leakage of private information.
CWE description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVSS v3 base score: 7.5
Published: 2018-03-01T20:29Z
Repository: https://github.com/openSUSE/open-build-service
Language: Perl
Files changed: src/backend/BSHTTP.pm
Commit date: 2017-03-17 10:58:51 +0100
Commit message: [backend] only allow plain files in cpio_sender

No devices, sockets, directories, symlinks please...

Diff: diff --git a/src/backend/BSHTTP.pm b/src/backend/BSHTTP.pm
index d91de76b0a..928b88a992 100644
--- a/src/backend/BSHTTP.pm
+++ b/src/backend/BSHTTP.pm
@@ -446,17 +446,28 @@ sub cpio_sender {
     }
     if (exists $file->{'filename'}) {
       my $filename = $file->{'filename'};
       if (ref($filename)) {
 	*F = $filename;
-      } elsif (!open(F, '<', $filename)) {
-	$errors->{'data'} .= "$file->{'name'}: $filename: $!\n";
-	next;
+      } else {
+	@s = lstat($filename);
+	if (!@s) {
+	  $errors->{'data'} .= "$file->{'name'}: $filename: $!\n";
+	  next;
+	}
+	if (-l _ || ! -f _) {
+	  $errors->{'data'} .= "$file->{'name'}: $filename: not a plain file\n";
+	  next;
+	}
+	if (!open(F, '<', $filename)) {
+	  $errors->{'data'} .= "$file->{'name'}: $filename: $!\n";
+	  next;
+	}
       }
       @s = stat(F);
       if (!@s) {
-	$errors->{'data'} .= "$file->{'name'}: stat: $!\n";
+	$errors->{'data'} .= "$file->{'name'}: fstat: $!\n";
 	close F unless ref $filename;
 	next;
       }
       if (ref($filename)) {
 	my $off = sysseek(F, 0, Fcntl::SEEK_CUR) || 0;

Vulnerable code:       } elsif (!open(F, '<', $filename)) {
	$errors->{'data'} .= "$file->{'name'}: $filename: $!\n";
	next;
	$errors->{'data'} .= "$file->{'name'}: stat: $!\n";
Fixed code:       } else {
	@s = lstat($filename);
	if (!@s) {
	  $errors->{'data'} .= "$file->{'name'}: $filename: $!\n";
	  next;
	}
	if (-l _ || ! -f _) {
	  $errors->{'data'} .= "$file->{'name'}: $filename: not a plain file\n";
	  next;
	}
	if (!open(F, '<', $filename)) {
	  $errors->{'data'} .= "$file->{'name'}: $filename: $!\n";
	  next;
	}
	$errors->{'data'} .= "$file->{'name'}: fstat: $!\n";
CVE-2016-5104: Improper Access Control (CWE-284)
value: The socket_create function in common/socket.c in libimobiledevice and libusbmuxd allows remote attackers to bypass intended access restrictions and communicate with services on iOS devices by connecting to an IPv4 TCP socket.
CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVSS v3 base score: 5.3
Published: 2016-06-13T14:59Z
Repository: https://github.com/libimobiledevice/libimobiledevice
Language: C
Files changed: common/socket.c
Commit date: 2015-12-29 22:27:17 +0100
Commit message: common: [security fix] Make sure sockets only listen locally

Diff: diff --git a/common/socket.c b/common/socket.c
index b276864..e2968a6 100644
--- a/common/socket.c
+++ b/common/socket.c
@@ -170,11 +170,11 @@ int socket_create(uint16_t port)
 		return -1;
 	}
 
 	memset((void *) &saddr, 0, sizeof(saddr));
 	saddr.sin_family = AF_INET;
-	saddr.sin_addr.s_addr = htonl(INADDR_ANY);
+	saddr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
 	saddr.sin_port = htons(port);
 
 	if (0 > bind(sfd, (struct sockaddr *) &saddr, sizeof(saddr))) {
 		perror("bind()");
 		socket_close(sfd);
@@ -327,11 +327,11 @@ int socket_accept(int fd, uint16_t port)
 	int result;
 	struct sockaddr_in addr;
 
 	memset(&addr, 0, sizeof(addr));
 	addr.sin_family = AF_INET;
-	addr.sin_addr.s_addr = htonl(INADDR_ANY);
+	addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
 	addr.sin_port = htons(port);
 
 	addr_len = sizeof(addr);
 	result = accept(fd, (struct sockaddr*)&addr, &addr_len);
 

Vulnerable code: 	saddr.sin_addr.s_addr = htonl(INADDR_ANY);
	addr.sin_addr.s_addr = htonl(INADDR_ANY);
Fixed code: 	saddr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
	addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
CVE-2021-21237: Untrusted Search Path (CWE-426)
value: Git LFS is a command line extension for managing large files with Git. On Windows, if Git LFS operates on a malicious repository with a git.bat or git.exe file in the current directory, that program would be executed, permitting the attacker to execute arbitrary code. This does not affect Unix systems. This is the result of an incomplete fix for CVE-2020-27955. This issue occurs because on Windows, Go includes (and prefers) the current directory when the name of a command run does not contain a directory separator. Other than avoiding untrusted repositories or using a different operating system, there is no workaround. This is fixed in v2.13.2.
CWE description: The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
CVSS v3 base score: 7.8
Published: 2021-01-15T18:15Z
Repository: https://github.com/git-lfs/git-lfs
Language: Unknown
Commit date: 2021-01-13 18:00:18 +0000
Commit message: Merge pull request from GHSA-cx3w-xqmc-84g5

release: v2.13.2
CVE-2018-17568: Integer Overflow or Wraparound (CWE-190)
value: utils/ut_rpc.c in ViaBTC Exchange Server before 2018-08-21 has an integer overflow leading to memory corruption.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 9.8
Published: 2018-09-26T22:29Z
Repository: https://github.com/viabtc/viabtc_exchange_server
Language: Unknown
Commit date: 2018-08-21 14:50:19 +0800
Commit message: Merge pull request #131 from benjaminchodroff/master

fix memory corruption and other 32bit overflows
CVE-2018-17569: Integer Overflow or Wraparound (CWE-190)
value: network/nw_buf.c in ViaBTC Exchange Server before 2018-08-21 has an integer overflow leading to memory corruption.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 9.8
Published: 2018-09-26T22:29Z
Repository: https://github.com/viabtc/viabtc_exchange_server
Language: Unknown
Commit date: 2018-08-21 14:50:19 +0800
Commit message: Merge pull request #131 from benjaminchodroff/master

fix memory corruption and other 32bit overflows
CVE-2018-17570: Integer Overflow or Wraparound (CWE-190)
value: utils/ut_ws_svr.c in ViaBTC Exchange Server before 2018-08-21 has an integer overflow leading to memory corruption.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 9.8
Published: 2018-09-26T22:29Z
Repository: https://github.com/viabtc/viabtc_exchange_server
Language: Unknown
Commit date: 2018-08-21 14:50:19 +0800
Commit message: Merge pull request #131 from benjaminchodroff/master

fix memory corruption and other 32bit overflows
CVE-2015-10093: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in Mark User as Spammer Plugin 1.0.0/1.0.1 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function user_row_actions of the file plugin/plugin.php. The manipulation of the argument url leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 1.0.2 is able to address this issue. The identifier of the patch is e7059727274d2767c240c55c02c163eaa4ba6c62. It is recommended to upgrade the affected component. The identifier VDB-222325 was assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-03-06T07:15Z
Repository: https://github.com/korobochkin/mark-user-as-spammer
Language: PHP
Files changed: plugin/plugin.php
Commit date: 2015-04-23 00:37:30 +0300
Commit message: Prevent XSS with esc_url() in old WordPress versions and prepare for using URL as href attr. 4.2 pass URL to urlencode() and strip all "bad" symbols from URL.

Diff: diff --git a/plugin/plugin.php b/plugin/plugin.php
index 874143b..eefa647 100644
--- a/plugin/plugin.php
+++ b/plugin/plugin.php
@@ -101,12 +101,20 @@ class Mark_User_As_Spammer {
 			$url,
 			( $is_spammer ? 'mark_user_as_spammer_unban_' : 'mark_user_as_spammer_ban_' ) . $user_object->ID,
 			'mark_user_as_spammer_nonce'
 		);
 
+		$url = site_url( $url );
+
+		/*
+		 * Always use esc_url() before output link!
+		 * wp_nonce_url() already pass url to esc_html and script tags will be encoded but we need armor to protect URL from XSS
+		 */
+		$url = esc_url( $url );
+
 		$actions['spammer'] = '<a href="'
-			. site_url( $url )
+			. $url
 			. '" class="mark-user-as-spammer" title="' . (
 				$is_spammer ?
 					esc_attr_x ('Unban user. He will be able to log in on site.', 'Verb. Mark user (account) like non spammer account', 'mark_user_as_spammer')
 					:
 					esc_attr_x ('Ban user. He will not be able to log in on site and get an error that his account marked as spammer.', 'Verb. Mark user (account) like spammer account', 'mark_user_as_spammer')

Vulnerable code: 			. site_url( $url )
Fixed code: 		$url = site_url( $url );

		/*
		 * Always use esc_url() before output link!
		 * wp_nonce_url() already pass url to esc_html and script tags will be encoded but we need armor to protect URL from XSS
		 */
		$url = esc_url( $url );

			. $url
CVE-2021-3706: Incorrect Permission Assignment for Critical Resource (CWE-732)
value: adminlte is vulnerable to Sensitive Cookie Without 'HttpOnly' Flag
CWE description: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CVSS v3 base score: 7.5
Published: 2021-09-15T07:15Z
Repository: https://github.com/pi-hole/adminlte
Language: PHP
Files changed: scripts/pi-hole/php/password.php
Commit date: 2021-09-11 19:36:18 +0100
Commit message: set httponly to true when calling setcookie. the ini_set option above doesn't actually seem to do anything... (but not removing it just in case

Signed-off-by: Adam Warner <me@adamwarner.co.uk>

Diff: diff --git a/scripts/pi-hole/php/password.php b/scripts/pi-hole/php/password.php
index 01e7efd6..91888a0b 100644
--- a/scripts/pi-hole/php/password.php
+++ b/scripts/pi-hole/php/password.php
@@ -48,11 +48,12 @@
         {
             if (hash_equals($pwhash, $_COOKIE["persistentlogin"]))
             {
                 $auth = true;
                 // Refresh cookie with new expiry
-                setcookie('persistentlogin', $pwhash, time()+60*60*24*7);
+                // setcookie( $name, $value, $expire, $path, $domain, $secure, $httponly )
+                setcookie('persistentlogin', $pwhash, time()+60*60*24*7, null, null, null, true );
             }
             else
             {
                 // Invalid cookie
                 $auth = false;
@@ -77,11 +78,12 @@
                 // Login successful, redirect the user to the homepage to discard the POST request
                 if ($_SERVER['REQUEST_METHOD'] === 'POST' && $_SERVER['QUERY_STRING'] === 'login') {
                     // Set persistent cookie if selected
                     if (isset($_POST['persistentlogin']))
                     {
-                        setcookie('persistentlogin', $pwhash, time()+60*60*24*7);
+                        // setcookie( $name, $value, $expire, $path, $domain, $secure, $httponly )
+                        setcookie('persistentlogin', $pwhash, time()+60*60*24*7, null, null, null, true );
                     }
                     header('Location: index.php');
                     exit();
                 }
 

Vulnerable code:                 setcookie('persistentlogin', $pwhash, time()+60*60*24*7);
                        setcookie('persistentlogin', $pwhash, time()+60*60*24*7);
Fixed code:                 // setcookie( $name, $value, $expire, $path, $domain, $secure, $httponly )
                setcookie('persistentlogin', $pwhash, time()+60*60*24*7, null, null, null, true );
                        // setcookie( $name, $value, $expire, $path, $domain, $secure, $httponly )
                        setcookie('persistentlogin', $pwhash, time()+60*60*24*7, null, null, null, true );
CVE-2021-3811: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: adminlte is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-09-17T07:15Z
Repository: https://github.com/pi-hole/adminlte
Language: Unknown
Commit date: 2021-09-11 21:08:34 +0200
Commit message: Merge pull request #1876 from pi-hole/tweak/xssprevention

Apply htmlentities in a couple of places to prevent xss
CVE-2021-3812: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: adminlte is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-09-17T07:15Z
Repository: https://github.com/pi-hole/adminlte
Language: Unknown
Commit date: 2021-09-11 21:08:34 +0200
Commit message: Merge pull request #1876 from pi-hole/tweak/xssprevention

Apply htmlentities in a couple of places to prevent xss
CVE-2020-15102: Missing Authorization (CWE-862)
value: In PrestaShop Dashboard Productions before version 2.1.0, there is improper authorization which enables an attacker to change the configuration. The problem is fixed in 2.1.0.
CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 6.5
Published: 2020-07-21T18:15Z
Repository: https://github.com/PrestaShop/dashproducts
Language: Unknown
Commit date: 2020-07-07 09:52:57 +0200
Commit message: Merge pull request from GHSA-6292-4qpg-hvfg

Make sure the user is able to change the configuration in the dashboard only if he has the right to do it
CVE-2024-28056: Insufficient Information (NVD-CWE-noinfo)
value: Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM roles associated with Amplify projects. When the Authentication component is removed from an Amplify project, a Condition property is removed but "Effect":"Allow" remains present, and consequently sts:AssumeRoleWithWebIdentity would be available to threat actors with no conditions. Thus, if Amplify CLI had been used to remove the Authentication component from a project built between August 2019 and January 2024, an "assume role" may have occurred, and may have been leveraged to obtain unauthorized access to an organization's AWS resources. NOTE: the problem could only occur if an authorized AWS user removed an Authentication component. (The vulnerability did not give a threat actor the ability to remove an Authentication component.) However, in realistic situations, an authorized AWS user may have removed an Authentication component, e.g., if the objective were to stop using built-in Cognito resources, or move to a completely different identity provider.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-15T18:15Z
Repository: https://github.com/aws-amplify/amplify-cli
Language: JSON
Files changed: packages/amplify-provider-awscloudformation/resources/update-idp-roles-cfn.json
Commit date: 2024-01-09 15:11:49 -0800
Commit message: fix: set policy effect deny when removing auth (#13523)


Diff: diff --git a/packages/amplify-provider-awscloudformation/resources/update-idp-roles-cfn.json b/packages/amplify-provider-awscloudformation/resources/update-idp-roles-cfn.json
index a17c761bc..ebe7d192d 100644
--- a/packages/amplify-provider-awscloudformation/resources/update-idp-roles-cfn.json
+++ b/packages/amplify-provider-awscloudformation/resources/update-idp-roles-cfn.json
@@ -45,10 +45,12 @@
               "        };",
               "        if (event.RequestType === 'Delete') {",
               "            try {",
               "                delete authParamsJson.Statement[0].Condition;",
               "                delete unauthParamsJson.Statement[0].Condition;",
+              "                authParamsJson.Statement[0].Effect = 'Deny'",
+              "                unauthParamsJson.Statement[0].Effect = 'Deny'",
               "                let authParams = {PolicyDocument: JSON.stringify(authParamsJson), RoleName: authRoleName};",
               "                let unauthParams = {PolicyDocument: JSON.stringify(unauthParamsJson), RoleName: unauthRoleName};",
               "                const iam = new IAMClient({region: event.ResourceProperties.region});",
               "                let res = await Promise.all([",
               "                    iam.send(new GetRoleCommand({RoleName: authParams.RoleName})),",

Fixed code:               "                authParamsJson.Statement[0].Effect = 'Deny'",
              "                unauthParamsJson.Statement[0].Effect = 'Deny'",