Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2020-11932: Insertion of Sensitive Information into Log File (CWE-532)
value: It was discovered that the Subiquity installer for Ubuntu Server logged the LUKS full disk encryption password if one was entered.
CWE description: Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
CVSS v3 base score: 2.3
Published: 2020-05-13T01:15Z
Repository: https://github.com/CanonicalLtd/subiquity
Language: Python
Files changed: subiquity/models/filesystem.py
Commit date: 2020-05-12 16:53:38 +1200
Commit message: write the dm_crypt key to a keyfile, not curtin config

Diff: diff --git a/subiquity/models/filesystem.py b/subiquity/models/filesystem.py
index 7f74de17..27b40d6d 100644
--- a/subiquity/models/filesystem.py
+++ b/subiquity/models/filesystem.py
@@ -22,10 +22,11 @@ import itertools
 import logging
 import math
 import os
 import pathlib
 import platform
+import tempfile
 
 from curtin import storage_config
 from curtin.util import human2bytes
 
 from probert.storage import StorageInfo
@@ -1177,10 +1178,20 @@ LUKS_OVERHEAD = 16*(2**20)
 @fsobj("dm_crypt")
 class DM_Crypt:
     volume = attributes.ref(backlink="_constructed_device")  # _Formattable
     key = attr.ib(metadata={'redact': True})
 
+    def serialize_key(self):
+        if self.key:
+            f = tempfile.NamedTemporaryFile(
+                prefix='luks-key-', mode='w', delete=False)
+            f.write(self.key)
+            f.close()
+            return {'keyfile': f.name}
+        else:
+            return {}
+
     dm_name = attr.ib(default=None)
     preserve = attr.ib(default=False)
 
     _constructed_device = attributes.backlink()
 

Fixed code: import tempfile
    def serialize_key(self):
        if self.key:
            f = tempfile.NamedTemporaryFile(
                prefix='luks-key-', mode='w', delete=False)
            f.write(self.key)
            f.close()
            return {'keyfile': f.name}
        else:
            return {}
CVE-2018-6758: Out-of-bounds Write (CWE-787)
value: The uwsgi_expand_path function in core/utils.c in Unbit uWSGI through 2.0.15 has a stack-based buffer overflow via a large directory length.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2018-02-06T18:29Z
Repository: https://github.com/unbit/uwsgi
Language: C
Files changed: core/utils.c
Commit date: 2018-02-06 16:02:09 +0100
Commit message: improve uwsgi_expand_path() to sanitize input, avoiding stack corruption and potential security issue

Diff: diff --git a/core/utils.c b/core/utils.c
index b4c98dfd..fd886932 100644
--- a/core/utils.c
+++ b/core/utils.c
@@ -3672,22 +3672,27 @@ void uwsgi_write_pidfile_explicit(char *pidfile_name, pid_t pid) {
 		uwsgi_log("could not write pidfile.\n");
 	}
 }
 
 char *uwsgi_expand_path(char *dir, int dir_len, char *ptr) {
-	char src[PATH_MAX + 1];
-	memcpy(src, dir, dir_len);
-	src[dir_len] = 0;
+	if (dir_len > PATH_MAX)
+	{
+		uwsgi_log("invalid path size: %d (max %d)\n", dir_len, PATH_MAX);
+		return NULL;
+	}
+	char *src = uwsgi_concat2n(dir, dir_len, "", 0);
 	char *dst = ptr;
 	if (!dst)
 		dst = uwsgi_malloc(PATH_MAX + 1);
 	if (!realpath(src, dst)) {
 		uwsgi_error_realpath(src);
 		if (!ptr)
 			free(dst);
+		free(src);
 		return NULL;
 	}
+	free(src);
 	return dst;
 }
 
 
 void uwsgi_set_cpu_affinity() {

Vulnerable code: 	char src[PATH_MAX + 1];
	memcpy(src, dir, dir_len);
	src[dir_len] = 0;
Fixed code: 	if (dir_len > PATH_MAX)
	{
		uwsgi_log("invalid path size: %d (max %d)\n", dir_len, PATH_MAX);
		return NULL;
	}
	char *src = uwsgi_concat2n(dir, dir_len, "", 0);
		free(src);
	free(src);
CVE-2022-33127: Insufficient Information (NVD-CWE-noinfo)
value: The function that calls the diff tool in Diffy 3.4.1 does not properly handle double quotes in a filename when run in a windows environment. This allows attackers to execute arbitrary commands via a crafted string.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2022-06-23T17:15Z
Repository: https://github.com/samg/diffy
Language: Ruby
Files changed: lib/diffy/diff.rb
Commit date: 2022-06-10 13:54:25 -0700
Commit message: Remove windows specific exec.  Open2.capture3 should work on all
platforms.

Diff: diff --git a/lib/diffy/diff.rb b/lib/diffy/diff.rb
index 4e737c4..6115fc6 100644
--- a/lib/diffy/diff.rb
+++ b/lib/diffy/diff.rb
@@ -47,17 +47,11 @@ module Diffy
             [tempfile(string1), tempfile(string2)]
           when 'files'
             [string1, string2]
           end
 
-        if WINDOWS
-          # don't use open3 on windows
-          cmd = sprintf '"%s" %s %s', diff_bin, diff_options.join(' '), @paths.map { |s| %("#{s}") }.join(' ')
-          diff = `#{cmd}`
-        else
-          diff = Open3.popen3(diff_bin, *(diff_options + @paths)) { |i, o, e| o.read }
-        end
+        diff, stderr, process_status = Open3.capture3(diff_bin, *(diff_options + @paths))
         diff.force_encoding('ASCII-8BIT') if diff.respond_to?(:valid_encoding?) && !diff.valid_encoding?
         if diff =~ /\A\s*\Z/ && !options[:allow_empty_diff]
           diff = case options[:source]
           when 'strings' then string1
           when 'files' then File.read(string1)

Vulnerable code:         if WINDOWS
          # don't use open3 on windows
          cmd = sprintf '"%s" %s %s', diff_bin, diff_options.join(' '), @paths.map { |s| %("#{s}") }.join(' ')
          diff = `#{cmd}`
        else
          diff = Open3.popen3(diff_bin, *(diff_options + @paths)) { |i, o, e| o.read }
        end
Fixed code:         diff, stderr, process_status = Open3.capture3(diff_bin, *(diff_options + @paths))
CVE-2021-4288: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in OpenMRS openmrs-module-referenceapplication up to 2.11.x. It has been rated as problematic. This issue affects some unknown processing of the file omod/src/main/webapp/pages/userApp.gsp. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2.12.0 is able to address this issue. The name of the patch is 35f81901a4cb925747a9615b8706f5079d2196a1. It is recommended to upgrade the affected component. The identifier VDB-216881 was assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-27T13:15Z
Repository: https://github.com/openmrs/openmrs-module-referenceapplication
Language: Other
Files changed: omod/src/main/webapp/pages/userApp.gsp
Commit date: 2021-06-23 19:44:22 -0500
Commit message: RA-1424: escapeJs vulnerable to XSS (#92)


Diff: diff --git a/omod/src/main/webapp/pages/userApp.gsp b/omod/src/main/webapp/pages/userApp.gsp
index 3e12e35..f811f82 100644
--- a/omod/src/main/webapp/pages/userApp.gsp
+++ b/omod/src/main/webapp/pages/userApp.gsp
@@ -41,11 +41,11 @@
         <label for="appId-field">
             <span class="title">
                 ${ui.message("referenceapplication.app.appId.label")} (${ ui.message("coreapps.formValidation.messages.requiredField.label") })
             </span>
         </label>
-        <input class="form-control form-control-sm form-control-lg form-control-md required" id="appId-field" type="text" name="appId" value="${userApp.appId ? ui.escapeJs(ui.escapeHtml(userApp.appId)) : ""}" size="80" placeholder="${ ui.message("referenceapplication.app.definition.placeholder") }" />
+        <input class="form-control form-control-sm form-control-lg form-control-md required" id="appId-field" type="text" name="appId" value="${userApp.appId ? ui.encodeJavaScript(ui.escapeHtml(userApp.appId)) : ""}" size="80" placeholder="${ ui.message("referenceapplication.app.definition.placeholder") }" />
         <%}%>
     </p>
     <p>
         <label for="json-field">
             <span class="title">

Vulnerable code:         <input class="form-control form-control-sm form-control-lg form-control-md required" id="appId-field" type="text" name="appId" value="${userApp.appId ? ui.escapeJs(ui.escapeHtml(userApp.appId)) : ""}" size="80" placeholder="${ ui.message("referenceapplication.app.definition.placeholder") }" />
Fixed code:         <input class="form-control form-control-sm form-control-lg form-control-md required" id="appId-field" type="text" name="appId" value="${userApp.appId ? ui.encodeJavaScript(ui.escapeHtml(userApp.appId)) : ""}" size="80" placeholder="${ ui.message("referenceapplication.app.definition.placeholder") }" />
CVE-2021-4289: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability classified as problematic was found in OpenMRS openmrs-module-referenceapplication up to 2.11.x. Affected by this vulnerability is the function post of the file omod/src/main/java/org/openmrs/module/referenceapplication/page/controller/UserAppPageController.java of the component User App Page. The manipulation of the argument AppId leads to cross site scripting. The attack can be launched remotely. Upgrading to version 2.12.0 is able to address this issue. The name of the patch is 0410c091d46eed3c132fe0fcafe5964182659f74. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216883.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-27T13:15Z
Repository: https://github.com/openmrs/openmrs-module-referenceapplication
Language: Unknown
Commit date: 2021-04-22 11:38:21 -0500
Commit message: Merge pull request #89 from The-Lady/EMPT110

RA-1875: EMPT110 Fixed XSS Vulnerability in AppId field on User App Page
CVE-2018-14650: Incorrect Permission Assignment for Critical Resource (CWE-732)
value: It was discovered that sos-collector does not properly set the default permissions of newly created files, making all files created by the tool readable by any local user. A local attacker may use this flaw by waiting for a legit user to run sos-collector and steal the collected data in the /var/tmp directory.
CWE description: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CVSS v3 base score: 5
Published: 2018-09-27T20:29Z
Repository: https://github.com/sosreport/sos-collector
Language: Python
Files changed: soscollector/sos_collector.py
Commit date: 2018-09-25 12:05:59 -0400
Commit message: [sos_collector] Set umask for all files created

Sets a umask of 0077 for all files created by sos-collector. This
ensures collected sosrpeorts are not world readable and maintains the
original permissions of the sos archives.

Signed-off-by: Jake Hunsaker <jhunsake@redhat.com>

Diff: diff --git a/soscollector/sos_collector.py b/soscollector/sos_collector.py
index 874022b..f1d4716 100644
--- a/soscollector/sos_collector.py
+++ b/soscollector/sos_collector.py
@@ -39,10 +39,11 @@ from soscollector import __version__
 
 class SosCollector():
     '''Main sos-collector class'''
 
     def __init__(self, config):
+        os.umask(0077)
         self.config = config
         self.threads = []
         self.workers = []
         self.client_list = []
         self.node_list = []

Fixed code:         os.umask(0077)
CVE-2024-22212: Missing Authentication for Critical Function (CWE-306)
value: Nextcloud Global Site Selector is a tool which allows you to run multiple small Nextcloud instances and redirect users to the right server. A problem in the password verification method allows an attacker to authenticate as another user. It is recommended that the Nextcloud Global Site Selector is upgraded to version 1.4.1, 2.1.2, 2.3.4 or 2.4.5. There are no known workarounds for this issue.
CWE description: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CVSS v3 base score: 9.8
Published: 2024-01-18T19:15Z
Repository: https://github.com/nextcloud/globalsiteselector
Language: Unknown
Commit date: 2023-11-23 09:21:07 -0100
Commit message: Merge pull request #138 from nextcloud/fix/noid/auth-saml

auth check on slave
CVE-2019-14462: Out-of-bounds Read (CWE-125)
value: An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_COILS case, aka VD-1302.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.1
Published: 2019-07-31T23:15Z
Repository: https://github.com/stephane/libmodbus
Language: C
Files changed: src/modbus.c
Commit date: 2019-07-29 12:31:02 +0200
Commit message: Fix VD-1301 and VD-1302 vulnerabilities

This patch was contributed by Maor Vermucht and Or Peles from
VDOO Connected Trust.

Diff: diff --git a/src/modbus.c b/src/modbus.c
index 03d8da2..9bb5052 100644
--- a/src/modbus.c
+++ b/src/modbus.c
@@ -837,13 +837,14 @@ int modbus_reply(modbus_t *ctx, const uint8_t *req,
         }
     }
         break;
     case MODBUS_FC_WRITE_MULTIPLE_COILS: {
         int nb = (req[offset + 3] << 8) + req[offset + 4];
+        int nb_bits = req[offset + 5];
         int mapping_address = address - mb_mapping->start_bits;
 
-        if (nb < 1 || MODBUS_MAX_WRITE_BITS < nb) {
+        if (nb < 1 || MODBUS_MAX_WRITE_BITS < nb || nb_bits * 8 < nb) {
             /* May be the indication has been truncated on reading because of
              * invalid address (eg. nb is 0 but the request contains values to
              * write) so it's necessary to flush. */
             rsp_length = response_exception(
                 ctx, &sft, MODBUS_EXCEPTION_ILLEGAL_DATA_VALUE, rsp, TRUE,
@@ -868,13 +869,14 @@ int modbus_reply(modbus_t *ctx, const uint8_t *req,
         }
     }
         break;
     case MODBUS_FC_WRITE_MULTIPLE_REGISTERS: {
         int nb = (req[offset + 3] << 8) + req[offset + 4];
+        int nb_bytes = req[offset + 5];
         int mapping_address = address - mb_mapping->start_registers;
 
-        if (nb < 1 || MODBUS_MAX_WRITE_REGISTERS < nb) {
+        if (nb < 1 || MODBUS_MAX_WRITE_REGISTERS < nb || nb_bytes * 8 < nb) {
             rsp_length = response_exception(
                 ctx, &sft, MODBUS_EXCEPTION_ILLEGAL_DATA_VALUE, rsp, TRUE,
                 "Illegal number of values %d in write_registers (max %d)\n",
                 nb, MODBUS_MAX_WRITE_REGISTERS);
         } else if (mapping_address < 0 ||

Vulnerable code:         if (nb < 1 || MODBUS_MAX_WRITE_BITS < nb) {
        if (nb < 1 || MODBUS_MAX_WRITE_REGISTERS < nb) {
Fixed code:         int nb_bits = req[offset + 5];
        if (nb < 1 || MODBUS_MAX_WRITE_BITS < nb || nb_bits * 8 < nb) {
        int nb_bytes = req[offset + 5];
        if (nb < 1 || MODBUS_MAX_WRITE_REGISTERS < nb || nb_bytes * 8 < nb) {
CVE-2019-14463: Out-of-bounds Read (CWE-125)
value: An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_REGISTERS case, aka VD-1301.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.1
Published: 2019-07-31T23:15Z
Repository: https://github.com/stephane/libmodbus
Language: C
Files changed: src/modbus.c
Commit date: 2019-07-29 12:31:02 +0200
Commit message: Fix VD-1301 and VD-1302 vulnerabilities

This patch was contributed by Maor Vermucht and Or Peles from
VDOO Connected Trust.

Diff: diff --git a/src/modbus.c b/src/modbus.c
index 03d8da2..9bb5052 100644
--- a/src/modbus.c
+++ b/src/modbus.c
@@ -837,13 +837,14 @@ int modbus_reply(modbus_t *ctx, const uint8_t *req,
         }
     }
         break;
     case MODBUS_FC_WRITE_MULTIPLE_COILS: {
         int nb = (req[offset + 3] << 8) + req[offset + 4];
+        int nb_bits = req[offset + 5];
         int mapping_address = address - mb_mapping->start_bits;
 
-        if (nb < 1 || MODBUS_MAX_WRITE_BITS < nb) {
+        if (nb < 1 || MODBUS_MAX_WRITE_BITS < nb || nb_bits * 8 < nb) {
             /* May be the indication has been truncated on reading because of
              * invalid address (eg. nb is 0 but the request contains values to
              * write) so it's necessary to flush. */
             rsp_length = response_exception(
                 ctx, &sft, MODBUS_EXCEPTION_ILLEGAL_DATA_VALUE, rsp, TRUE,
@@ -868,13 +869,14 @@ int modbus_reply(modbus_t *ctx, const uint8_t *req,
         }
     }
         break;
     case MODBUS_FC_WRITE_MULTIPLE_REGISTERS: {
         int nb = (req[offset + 3] << 8) + req[offset + 4];
+        int nb_bytes = req[offset + 5];
         int mapping_address = address - mb_mapping->start_registers;
 
-        if (nb < 1 || MODBUS_MAX_WRITE_REGISTERS < nb) {
+        if (nb < 1 || MODBUS_MAX_WRITE_REGISTERS < nb || nb_bytes * 8 < nb) {
             rsp_length = response_exception(
                 ctx, &sft, MODBUS_EXCEPTION_ILLEGAL_DATA_VALUE, rsp, TRUE,
                 "Illegal number of values %d in write_registers (max %d)\n",
                 nb, MODBUS_MAX_WRITE_REGISTERS);
         } else if (mapping_address < 0 ||

Vulnerable code:         if (nb < 1 || MODBUS_MAX_WRITE_BITS < nb) {
        if (nb < 1 || MODBUS_MAX_WRITE_REGISTERS < nb) {
Fixed code:         int nb_bits = req[offset + 5];
        if (nb < 1 || MODBUS_MAX_WRITE_BITS < nb || nb_bits * 8 < nb) {
        int nb_bytes = req[offset + 5];
        if (nb < 1 || MODBUS_MAX_WRITE_REGISTERS < nb || nb_bytes * 8 < nb) {
CVE-2022-0367: Out-of-bounds Write (CWE-787)
value: A heap-based buffer overflow flaw was found in libmodbus in function modbus_reply() in src/modbus.c.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2022-08-29T15:15Z
Repository: https://github.com/stephane/libmodbus
Language: C
Files changed: src/modbus.c
Commit date: 2022-01-08 20:00:53 +0100
Commit message: modbus_reply: fix copy & paste error in sanity check (fixes #614)

While handling MODBUS_FC_WRITE_AND_READ_REGISTERS, both address offsets
must be checked, i.e. the read and the write address must be within the
mapping range.

At the moment, only the read address was considered, it looks like a
simple copy and paste error, so let's fix it.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

Diff: diff --git a/src/modbus.c b/src/modbus.c
index 99f333b..e13bd0d 100644
--- a/src/modbus.c
+++ b/src/modbus.c
@@ -959,11 +959,11 @@ int modbus_reply(modbus_t *ctx, const uint8_t *req,
                 ctx, &sft, MODBUS_EXCEPTION_ILLEGAL_DATA_VALUE, rsp, TRUE,
                 "Illegal nb of values (W%d, R%d) in write_and_read_registers (max W%d, R%d)\n",
                 nb_write, nb, MODBUS_MAX_WR_WRITE_REGISTERS, MODBUS_MAX_WR_READ_REGISTERS);
         } else if (mapping_address < 0 ||
                    (mapping_address + nb) > mb_mapping->nb_registers ||
-                   mapping_address < 0 ||
+                   mapping_address_write < 0 ||
                    (mapping_address_write + nb_write) > mb_mapping->nb_registers) {
             rsp_length = response_exception(
                 ctx, &sft, MODBUS_EXCEPTION_ILLEGAL_DATA_ADDRESS, rsp, FALSE,
                 "Illegal data read address 0x%0X or write address 0x%0X write_and_read_registers\n",
                 mapping_address < 0 ? address : address + nb,

Vulnerable code:                    mapping_address < 0 ||
Fixed code:                    mapping_address_write < 0 ||
CVE-2022-31106: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: Underscore.deep is a collection of Underscore mixins that operate on nested objects. Versions of `underscore.deep` prior to version 0.5.3 are vulnerable to a prototype pollution vulnerability. An attacker can craft a malicious payload and pass it to `deepFromFlat`, which would pollute any future Objects created. Any users that have `deepFromFlat` or `deepPick` (due to its dependency on `deepFromFlat`) in their code should upgrade to version 0.5.3 as soon as possible. Users unable to upgrade may mitigate this issue by modifying `deepFromFlat` to prevent specific keywords which will prevent this from happening.
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 9.8
Published: 2022-06-28T18:15Z
Repository: https://github.com/Clever/underscore.deep
Language: Unknown
Commit date: 2022-06-27 18:00:25 -0700
Commit message: Merge pull request from GHSA-8j79-hfj5-f2xm

0.5.3
CVE-2024-31744: Insufficient Information (NVD-CWE-noinfo)
value: In Jasper 4.2.2, the jpc_streamlist_remove function in src/libjasper/jpc/jpc_dec.c:2407 has an assertion failure vulnerability, allowing attackers to cause a denial of service attack through a specific image file.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-19T13:15Z
Repository: https://github.com/jasper-software/jasper
Language: C
Files changed: src/libjasper/jpc/jpc_dec.c
Commit date: 2024-03-29 07:57:29 -0700
Commit message: Fixes #381.

Added a missing check to the jpc_dec_process_sod function of the JPC codec.
Added another image to the test set.

Diff: diff --git a/data/test/bad/318.jpc b/data/test/bad/318.jpc
new file mode 100644
index 00000000..8446ccb3
Binary files /dev/null and b/data/test/bad/318.jpc differ
diff --git a/src/libjasper/jpc/jpc_dec.c b/src/libjasper/jpc/jpc_dec.c
index e76aa400..125a29ba 100644
--- a/src/libjasper/jpc/jpc_dec.c
+++ b/src/libjasper/jpc/jpc_dec.c
@@ -609,11 +609,13 @@ static int jpc_dec_process_sod(jpc_dec_t *dec, jpc_ms_t *ms)
 
 	/* Are packet headers stored in the main header or tile-part header? */
 	if (dec->pkthdrstreams) {
 		/* Get the stream containing the packet header data for this
 		  tile-part. */
-		if (!(tile->pkthdrstream = jpc_streamlist_remove(dec->pkthdrstreams, 0))) {
+		if (jpc_streamlist_numstreams(dec->pkthdrstreams) != 0 &&
+		  !(tile->pkthdrstream = jpc_streamlist_remove(dec->pkthdrstreams,
+		  0))) {
 			return -1;
 		}
 	}
 
 	if (tile->pptstab) {

Vulnerable code: 		if (!(tile->pkthdrstream = jpc_streamlist_remove(dec->pkthdrstreams, 0))) {
Fixed code: 		if (jpc_streamlist_numstreams(dec->pkthdrstreams) != 0 &&
		  !(tile->pkthdrstream = jpc_streamlist_remove(dec->pkthdrstreams,
		  0))) {
CVE-2019-16768: Generation of Error Message Containing Sensitive Information (CWE-209)
value: In affected versions of Sylius, exception messages from internal exceptions (like database exception) are wrapped by \Symfony\Component\Security\Core\Exception\AuthenticationServiceException and propagated through the system to UI. Therefore, some internal system information may leak and be visible to the customer. A validation message with the exception details will be presented to the user when one will try to log into the shop. This has been patched in versions 1.3.14, 1.4.10, 1.5.7, and 1.6.3.
CWE description: The product generates an error message that includes sensitive information about its environment, users, or associated data.
CVSS v3 base score: 4.3
Published: 2019-12-05T20:15Z
Repository: https://github.com/Sylius/Sylius
Language: Markdown
Files changed: CHANGELOG-1.3.md
Commit date: 2019-12-04 13:59:26 +0100
Commit message: Generate changelog for v1.3.14

Diff: diff --git a/CHANGELOG-1.3.md b/CHANGELOG-1.3.md
index 7822c63833..2c330f4651 100644
--- a/CHANGELOG-1.3.md
+++ b/CHANGELOG-1.3.md
@@ -1,7 +1,24 @@
 # CHANGELOG FOR `1.3.X`
 
+## v1.3.14 (2019-12-03)
+
+### CVE-2019-16768: Internal exception message exposure in login action.
+
+#### Details
+
+Exception messages from internal exceptions (like database exception) are wrapped by 
+`\Symfony\Component\Security\Core\Exception\AuthenticationServiceException` and propagated through the system to UI. 
+Therefore, some internal system information may leak and be visible to the customer.
+
+A validation message with the exception details will be presented to the user when one will try to log into the shop.
+
+#### Workaround
+
+This release patches the reported vulnerability. The `src/Sylius/Bundle/UiBundle/Resources/views/Security/_login.html.twig` 
+file from Sylius should be overridden and `{{ messages.error(last_error.message) }}` changed to `{{ messages.error(last_error.messageKey) }}`.
+
 ## v1.3.13 (2019-05-29)
 
 #### Details
 
 - [#10228](https://github.com/Sylius/Sylius/issues/10228) Improve taxon UI ([@kulczy](https://github.com/kulczy), [@Zales0123](https://github.com/Zales0123))

Fixed code: ## v1.3.14 (2019-12-03)

### CVE-2019-16768: Internal exception message exposure in login action.

#### Details

Exception messages from internal exceptions (like database exception) are wrapped by 
`\Symfony\Component\Security\Core\Exception\AuthenticationServiceException` and propagated through the system to UI. 
Therefore, some internal system information may leak and be visible to the customer.

A validation message with the exception details will be presented to the user when one will try to log into the shop.

#### Workaround

This release patches the reported vulnerability. The `src/Sylius/Bundle/UiBundle/Resources/views/Security/_login.html.twig` 
file from Sylius should be overridden and `{{ messages.error(last_error.message) }}` changed to `{{ messages.error(last_error.messageKey) }}`.
CVE-2024-34349: Insufficient Information (NVD-CWE-noinfo)
value: Sylius is an open source eCommerce platform. Prior to 1.12.16 and 1.13.1, there is a possibility to execute javascript code in the Admin panel. In order to perform an XSS attack input a script into Name field in which of the resources: Taxons, Products, Product Options or Product Variants. The code will be executed while using an autocomplete field with one of the listed entities in the Admin Panel. Also for the taxons in the category tree on the product form.The issue is fixed in versions: 1.12.16, 1.13.1.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-14T15:38Z
Repository: https://github.com/Sylius/Sylius
Language: Unknown
Commit date: 2024-05-10 09:37:43 +0200
Commit message: bug #76 Fix potential xss in admin panel (mpysiak)

This PR was merged into the 1.12 branch.

Discussion
----------

| Q               | A
|-----------------|-----
| Branch?         | 1.12
| Bug fix?        | yes
| New feature?    | no
| BC breaks?      | no
| Deprecations?   | no
| Related tickets | n/a
| License         | MIT

Fixes potential xss in admin panel (Taxons and Products)

Commits
-------

d4812f9c14c7b2acc1f2f64cff363533e4c77b41 Fix potential xss in admin panel
29d18a39935e4d6e3d59bac5ebca798bfff00fe2 Use function from UIBundle
c11c424c1cd4918a71831152f69bc9b1915d542d Fix product-auto-complete
a17de6d1ed47155277732bcfab61fb491cac8cb6 Test adding new taxon
d25edf3ff097dbb704ecf4dc35b766526008516a Test adding new simple product
63c3cf7a12ff7e1471ef3af2e2141c474e42aa03 Test adding similar products
679e79352156f19e1747ab1d735070187b3788d7 Fixes after CR
CVE-2019-25078: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: A vulnerability classified as problematic was found in pacparser up to 1.3.x. Affected by this vulnerability is the function pacparser_find_proxy of the file src/pacparser.c. The manipulation of the argument url leads to buffer overflow. Attacking locally is a requirement. Upgrading to version 1.4.0 is able to address this issue. The name of the patch is 853e8f45607cb07b877ffd270c63dbcdd5201ad9. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-215443.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 7.8
Published: 2022-12-13T18:15Z
Repository: https://github.com/manugarg/pacparser
Language: C
Files changed: src/pacparser.c
Commit date: 2022-04-13 14:30:07 -0700
Commit message: Fix possible memory overwrite vulnerability. (#134)


Diff: diff --git a/src/pacparser.c b/src/pacparser.c
index c244bb4..40ca4f9 100644
--- a/src/pacparser.c
+++ b/src/pacparser.c
@@ -440,15 +440,15 @@ pacparser_find_proxy(const char *url, const char *host)
   // URL-encode "'" as we use single quotes to stick the URL into a temporary script.
   char *sanitized_url = str_replace(url, "'", "%27");
   // Hostname shouldn't have single quotes in them
   if (strchr(host, '\'')) {
     print_error("%s %s\n", error_prefix,
-		"Invalid hostname: hostname can't have single quotes.");
+      "Invalid hostname: hostname can't have single quotes.");
     return NULL;
   }
 
-  script = (char*) malloc(32 + strlen(url) + strlen(host));
+  script = (char*) malloc(32 + strlen(sanitized_url) + strlen(host));
   script[0] = '\0';
   strcat(script, "findProxyForURL('");
   strcat(script, sanitized_url);
   strcat(script, "', '");
   strcat(script, host);

Vulnerable code: 		"Invalid hostname: hostname can't have single quotes.");
  script = (char*) malloc(32 + strlen(url) + strlen(host));
Fixed code:       "Invalid hostname: hostname can't have single quotes.");
  script = (char*) malloc(32 + strlen(sanitized_url) + strlen(host));
CVE-2023-52086: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: resumable.php (aka PHP backend for resumable.js) 0.1.4 before 3c6dbf5 allows arbitrary file upload anywhere in the filesystem via ../ in multipart/form-data content to upload.php. (File overwrite hasn't been possible with the code available in GitHub in recent years, however.)
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 8.1
Published: 2023-12-26T18:15Z
Repository: https://github.com/dilab/resumable.php
Language: Unknown
Commit date: 2023-12-17 11:05:25 +0800
Commit message: Merge pull request #39 from code-lts/security-fix

Fix remote arbitrary file upload in any directory of the file system
CVE-2020-36599: Improper Encoding or Escaping of Output (CWE-116)
value: lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the message_key value.
CWE description: The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CVSS v3 base score: 9.8
Published: 2022-08-18T23:15Z
Repository: https://github.com/omniauth/omniauth
Language: Ruby
Files changed: lib/omniauth/failure_endpoint.rb
Commit date: 2020-12-10 10:10:02 -0500
Commit message: Merge branch '2_0-indev' into fix-path-prefix-when-redirecting-on-failure
Diff: diff --cc lib/omniauth/failure_endpoint.rb
index 947a7fd,3d4e300..84de91e
--- a/lib/omniauth/failure_endpoint.rb
+++ b/lib/omniauth/failure_endpoint.rb
@@@ -25,22 -25,14 +25,23 @@@ module OmniAut
        raise(env['omniauth.error'] || OmniAuth::Error.new(env['omniauth.error.type']))
      end
  
      def redirect_to_failure
        message_key = env['omniauth.error.type']
-       new_path = "#{env['SCRIPT_NAME']}#{strategy_path_prefix}/failure?message=#{message_key}#{origin_query_param}#{strategy_name_query_param}"
 -      new_path = "#{env['SCRIPT_NAME']}#{OmniAuth.config.path_prefix}/failure?message=#{Rack::Utils.escape(message_key)}#{origin_query_param}#{strategy_name_query_param}"
++
++      new_path = "#{env['SCRIPT_NAME']}#{strategy_path_prefix}/failure?message=#{Rack::Utils.escape(message_key)}#{origin_query_param}#{strategy_name_query_param}"
        Rack::Response.new(['302 Moved'], 302, 'Location' => new_path).finish
      end
  
 +    def strategy_path_prefix
 +      if env['omniauth.error.strategy']
 +        env['omniauth.error.strategy'].path_prefix
 +      else
 +        OmniAuth.config.path_prefix
 +      end
 +    end
 +
      def strategy_name_query_param
        return '' unless env['omniauth.error.strategy']
  
        "&strategy=#{env['omniauth.error.strategy'].name}"
      end

Vulnerable code:        new_path = "#{env['SCRIPT_NAME']}#{strategy_path_prefix}/failure?message=#{message_key}#{origin_query_param}#{strategy_name_query_param}"
Fixed code: +
+      new_path = "#{env['SCRIPT_NAME']}#{strategy_path_prefix}/failure?message=#{Rack::Utils.escape(message_key)}#{origin_query_param}#{strategy_name_query_param}"
CVE-2018-8729: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2018-03-15T17:29Z
Repository: https://github.com/pojome/activity-log
Language: Other
Files changed: README.md, readme.txt
Commit date: 2018-03-08 15:25:37 +0200
Commit message: Update changelog

Diff: diff --git a/README.md b/README.md
index f84e9e0..3832b1b 100644
--- a/README.md
+++ b/README.md
@@ -105,10 +105,13 @@ Would you like to like to contribute to Activity Log? You are more than welcome
 
 * You can easily export logs with Activity Log. We also support exporting filtered results. Filter by the time the action took place, roles, users, options, action type, and more.
 
 ## Changelog ##
 
+### 2.4.1 ###
+* Fix : Escape title before saving to database
+
 ### 2.4.0 ###
 * New! Export your Activity Log data records to CSV ([#70](https://github.com/pojome/activity-log/issues/70))
 
 ### 2.3.6 ###
 * Fix! - Admin table filters
diff --git a/readme.txt b/readme.txt
index a240a67..596b5d5 100644
--- a/readme.txt
+++ b/readme.txt
@@ -103,10 +103,13 @@ Would you like to like to contribute to Activity Log? You are more than welcome
 
 * You can easily export logs with Activity Log. We also support exporting filtered results. Filter by the time the action took place, roles, users, options, action type, and more.
 
 == Changelog ==
 
+= 2.4.1 =
+* Fix : Escape title before saving to database
+
 = 2.4.0 =
 * New! Export your Activity Log data records to CSV ([#70](https://github.com/pojome/activity-log/issues/70))
 
 = 2.3.6 =
 * Fix! - Admin table filters

Fixed code: ### 2.4.1 ###
* Fix : Escape title before saving to database

= 2.4.1 =
* Fix : Escape title before saving to database
CVE-2015-5239: Loop with Unreachable Exit Condition ('Infinite Loop') (CWE-835)
value: Integer overflow in the VNC display driver in QEMU before 2.1.0 allows attachers to cause a denial of service (process crash) via a CLIENT_CUT_TEXT message, which triggers an infinite loop.
CWE description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CVSS v3 base score: 6.5
Published: 2020-01-23T20:15Z
Repository: https://github.com/qemu/qemu
Language: C
Files changed: ui/vnc.c
Commit date: 2014-07-01 13:26:40 +0200
Commit message: ui/vnc: limit client_cut_text msg payload size

currently a malicious client could define a payload
size of 2^32 - 1 bytes and send up to that size of
data to the vnc server. The server would allocated
that amount of memory which could easily create an
out of memory condition.

This patch limits the payload size to 1MB max.

Please note that client_cut_text messages are currently
silently ignored.

Signed-off-by: Peter Lieven <pl@kamp.de>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

Diff: diff --git a/ui/vnc.c b/ui/vnc.c
index 14a86c36ce..19ce988f55 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -2163,17 +2163,24 @@ static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
             return 6;
 
         pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
         break;
     case VNC_MSG_CLIENT_CUT_TEXT:
-        if (len == 1)
+        if (len == 1) {
             return 8;
-
+        }
         if (len == 8) {
             uint32_t dlen = read_u32(data, 4);
-            if (dlen > 0)
+            if (dlen > (1 << 20)) {
+                error_report("vnc: client_cut_text msg payload has %u bytes"
+                             " which exceeds our limit of 1MB.", dlen);
+                vnc_client_error(vs);
+                break;
+            }
+            if (dlen > 0) {
                 return 8 + dlen;
+            }
         }
 
         client_cut_text(vs, read_u32(data, 4), data + 8);
         break;
     case VNC_MSG_CLIENT_QEMU:

Vulnerable code:         if (len == 1)

            if (dlen > 0)
Fixed code:         if (len == 1) {
        }
            if (dlen > (1 << 20)) {
                error_report("vnc: client_cut_text msg payload has %u bytes"
                             " which exceeds our limit of 1MB.", dlen);
                vnc_client_error(vs);
                break;
            }
            if (dlen > 0) {
            }
CVE-2015-5745: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: Buffer overflow in the send_control_msg function in hw/char/virtio-serial-bus.c in QEMU before 2.4.0 allows guest users to cause a denial of service (QEMU process crash) via a crafted virtio control message.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 6.5
Published: 2020-01-23T20:15Z
Repository: https://github.com/qemu/qemu
Language: C
Files changed: hw/char/virtio-serial-bus.c
Commit date: 2015-07-27 11:24:48 +0300
Commit message: virtio-serial: fix ANY_LAYOUT

Don't assume a specific layout for control messages.
Required by virtio 1.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Amit Shah <amit.shah@redhat.com>
Reviewed-by: Jason Wang <jasowang@redhat.com>

Diff: diff --git a/hw/char/virtio-serial-bus.c b/hw/char/virtio-serial-bus.c
index 78c73e5abe..929e49c671 100644
--- a/hw/char/virtio-serial-bus.c
+++ b/hw/char/virtio-serial-bus.c
@@ -193,11 +193,12 @@ static size_t send_control_msg(VirtIOSerial *vser, void *buf, size_t len)
     }
     if (!virtqueue_pop(vq, &elem)) {
         return 0;
     }
 
-    memcpy(elem.in_sg[0].iov_base, buf, len);
+    /* TODO: detect a buffer that's too short, set NEEDS_RESET */
+    iov_from_buf(elem.in_sg, elem.in_num, 0, buf, len);
 
     virtqueue_push(vq, &elem, len);
     virtio_notify(VIRTIO_DEVICE(vser), vq);
     return len;
 }

Vulnerable code:     memcpy(elem.in_sg[0].iov_base, buf, len);
Fixed code:     /* TODO: detect a buffer that's too short, set NEEDS_RESET */
    iov_from_buf(elem.in_sg, elem.in_num, 0, buf, len);
CVE-2017-2630: Stack-based Buffer Overflow (CWE-121)
value: A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network Block Device (NBD) client support. The flaw could occur while processing server's response to a 'NBD_OPT_LIST' request. A malicious NBD server could use this issue to crash a remote NBD client resulting in DoS or potentially execute arbitrary code on client host with privileges of the QEMU process.
CWE description: A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
CVSS v3 base score: 8.8
Published: 2018-07-27T18:29Z
Repository: https://github.com/qemu/qemu
Language: C
Files changed: nbd/client.c
Commit date: 2017-03-14 14:41:19 +0100
Commit message: nbd/client: fix drop_sync [CVE-2017-2630]

Comparison symbol is misused. It may lead to memory corruption.
Introduced in commit 7d3123e.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20170203154757.36140-6-vsementsov@virtuozzo.com>
[eblake: add CVE details, update conditional]
Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Marc-AndrÃ© Lureau <marcandre.lureau@redhat.com>
Message-Id: <20170307151627.27212-1-eblake@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Diff: diff --git a/nbd/client.c b/nbd/client.c
index 5c9dee37fae..3dc2564cd0f 100644
--- a/nbd/client.c
+++ b/nbd/client.c
@@ -92,11 +92,11 @@ static ssize_t drop_sync(QIOChannel *ioc, size_t size)
 {
     ssize_t ret = 0;
     char small[1024];
     char *buffer;
 
-    buffer = sizeof(small) < size ? small : g_malloc(MIN(65536, size));
+    buffer = sizeof(small) >= size ? small : g_malloc(MIN(65536, size));
     while (size > 0) {
         ssize_t count = read_sync(ioc, buffer, MIN(65536, size));
 
         if (count <= 0) {
             goto cleanup;

Vulnerable code:     buffer = sizeof(small) < size ? small : g_malloc(MIN(65536, size));
Fixed code:     buffer = sizeof(small) >= size ? small : g_malloc(MIN(65536, size));
CVE-2017-8284: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: The disas_insn function in target/i386/translate.c in QEMU before 2.9.0, when TCG mode without hardware acceleration is used, does not limit the instruction size, which allows local users to gain privileges by creating a modified basic block that injects code into a setuid program, as demonstrated by procmail. NOTE: the vendor has stated "this bug does not violate any security guarantees QEMU makes.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 7
Published: 2017-04-26T14:59Z
Repository: https://github.com/qemu/qemu
Language: C
Files changed: target/i386/translate.c
Commit date: 2017-03-24 11:49:38 +0100
Commit message: tcg/i386: Check the size of instruction being translated

This fixes the bug: 'user-to-root privesc inside VM via bad translation
caching' reported by Jann Horn here:
https://bugs.chromium.org/p/project-zero/issues/detail?id=1122

Reviewed-by: Richard Henderson <rth@twiddle.net>
CC: Peter Maydell <peter.maydell@linaro.org>
CC: Paolo Bonzini <pbonzini@redhat.com>
Reported-by: Jann Horn <jannh@google.com>
Signed-off-by: Pranith Kumar <bobby.prani@gmail.com>
Message-Id: <20170323175851.14342-1-bobby.prani@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Diff: diff --git a/target/i386/translate.c b/target/i386/translate.c
index 72c1b03a2a6..1d1372fb436 100644
--- a/target/i386/translate.c
+++ b/target/i386/translate.c
@@ -4416,10 +4416,17 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s,
 #endif
     s->rip_offset = 0; /* for relative ip address */
     s->vex_l = 0;
     s->vex_v = 0;
  next_byte:
+    /* x86 has an upper limit of 15 bytes for an instruction. Since we
+     * do not want to decode and generate IR for an illegal
+     * instruction, the following check limits the instruction size to
+     * 25 bytes: 14 prefix + 1 opc + 6 (modrm+sib+ofs) + 4 imm */
+    if (s->pc - pc_start > 14) {
+        goto illegal_op;
+    }
     b = cpu_ldub_code(env, s->pc);
     s->pc++;
     /* Collect prefixes.  */
     switch (b) {
     case 0xf3:

Fixed code:     /* x86 has an upper limit of 15 bytes for an instruction. Since we
     * do not want to decode and generate IR for an illegal
     * instruction, the following check limits the instruction size to
     * 25 bytes: 14 prefix + 1 opc + 6 (modrm+sib+ofs) + 4 imm */
    if (s->pc - pc_start > 14) {
        goto illegal_op;
    }
CVE-2021-20257: Loop with Unreachable Exit Condition ('Infinite Loop') (CWE-835)
value: An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
CWE description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CVSS v3 base score: 6.5
Published: 2022-03-16T15:15Z
Repository: https://github.com/qemu/qemu
Language: C
Files changed: hw/net/e1000.c
Commit date: 2021-03-15 16:41:22 +0800
Commit message: e1000: fail early for evil descriptor

During procss_tx_desc(), driver can try to chain data descriptor with
legacy descriptor, when will lead underflow for the following
calculation in process_tx_desc() for bytes:

            if (tp->size + bytes > msh)
                bytes = msh - tp->size;

This will lead a infinite loop. So check and fail early if tp->size if
greater or equal to msh.

Reported-by: Alexander Bulekov <alxndr@bu.edu>
Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr>
Reported-by: Ruhr-University Bochum <bugs-syssec@rub.de>
Cc: Prasad J Pandit <ppandit@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Jason Wang <jasowang@redhat.com>

Diff: diff --git a/hw/net/e1000.c b/hw/net/e1000.c
index d8da2f6528b..4345d863e68 100644
--- a/hw/net/e1000.c
+++ b/hw/net/e1000.c
@@ -668,10 +668,13 @@ process_tx_desc(E1000State *s, struct e1000_tx_desc *dp)
     addr = le64_to_cpu(dp->buffer_addr);
     if (tp->cptse) {
         msh = tp->tso_props.hdr_len + tp->tso_props.mss;
         do {
             bytes = split_size;
+            if (tp->size >= msh) {
+                goto eop;
+            }
             if (tp->size + bytes > msh)
                 bytes = msh - tp->size;
 
             bytes = MIN(sizeof(tp->data) - tp->size, bytes);
             pci_dma_read(d, addr, tp->data + tp->size, bytes);
@@ -693,10 +696,11 @@ process_tx_desc(E1000State *s, struct e1000_tx_desc *dp)
         split_size = MIN(sizeof(tp->data) - tp->size, split_size);
         pci_dma_read(d, addr, tp->data + tp->size, split_size);
         tp->size += split_size;
     }
 
+eop:
     if (!(txd_lower & E1000_TXD_CMD_EOP))
         return;
     if (!(tp->cptse && tp->size < tp->tso_props.hdr_len)) {
         xmit_seg(s);
     }

Fixed code:             if (tp->size >= msh) {
                goto eop;
            }
eop:
CVE-2022-35414: Use of Uninitialized Resource (CWE-908)
value: softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_readx or io_writex crash. NOTE: a third party states that the Non-virtualization Use Case in the qemu.org reference applies here, i.e., "Bugs affecting the non-virtualization use case are not considered security bugs at this time.
CWE description: The product uses or accesses a resource that has not been initialized.
CVSS v3 base score: 8.8
Published: 2022-07-11T02:15Z
Repository: https://github.com/qemu/qemu
Language: C
Files changed: target/loongarch/cpu.c
Commit date: 2022-07-05 16:17:53 +0530
Commit message: target/loongarch: Clean up tlb when cpu reset

We should make sure that tlb is clean when cpu reset.

Signed-off-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20220705070950.2364243-1-gaosong@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Diff: diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index d2d4667a34ef..e21715592a81 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -477,10 +477,11 @@ static void loongarch_cpu_reset(DeviceState *dev)
         env->CSR_DMW[n] = FIELD_DP64(env->CSR_DMW[n], CSR_DMW, PLV3, 0);
     }
 
 #ifndef CONFIG_USER_ONLY
     env->pc = 0x1c000000;
+    memset(env->tlb, 0, sizeof(env->tlb));
 #endif
 
     restore_fp_status(env);
     cs->exception_index = -1;
 }

Fixed code:     memset(env->tlb, 0, sizeof(env->tlb));