Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2019-13306: Out-of-bounds Write (CWE-787)
value: ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of off-by-one errors.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2019-07-05T01:15Z
Repository: https://github.com/ImageMagick/ImageMagick6
Language: C
Files changed: coders/pnm.c
Commit date: 2019-06-21 20:16:54 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1612

Diff: diff --git a/coders/pnm.c b/coders/pnm.c
index 56f6063438..7f818a869d 100644
--- a/coders/pnm.c
+++ b/coders/pnm.c
@@ -1830,11 +1830,11 @@ static MagickBooleanType WritePNMImage(const ImageInfo *image_info,Image *image)
                 count=(ssize_t) FormatLocaleString(buffer,MaxTextExtent,"%u ",
                   ScaleQuantumToLong(index));
             extent=(size_t) count;
             (void) strncpy((char *) q,buffer,extent);
             q+=extent;
-            if ((q-pixels+extent+1) >= sizeof(pixels))
+            if ((q-pixels+extent+2) >= sizeof(pixels))
               {
                 *q++='\n';
                 (void) WriteBlob(image,q-pixels,pixels);
                 q=pixels;
               }
@@ -1905,11 +1905,11 @@ static MagickBooleanType WritePNMImage(const ImageInfo *image_info,Image *image)
                   ScaleQuantumToLong(GetPixelGreen(p)),
                   ScaleQuantumToLong(GetPixelBlue(p)));
             extent=(size_t) count;
             (void) strncpy((char *) q,buffer,extent);
             q+=extent;
-            if ((q-pixels+extent+1) >= sizeof(pixels))
+            if ((q-pixels+extent+2) >= sizeof(pixels))
               {
                 *q++='\n';
                 (void) WriteBlob(image,q-pixels,pixels);
                 q=pixels;
               }

Vulnerable code:             if ((q-pixels+extent+1) >= sizeof(pixels))
            if ((q-pixels+extent+1) >= sizeof(pixels))
Fixed code:             if ((q-pixels+extent+2) >= sizeof(pixels))
            if ((q-pixels+extent+2) >= sizeof(pixels))
CVE-2019-13307: Out-of-bounds Write (CWE-787)
value: ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling rows.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2019-07-05T01:15Z
Repository: https://github.com/ImageMagick/ImageMagick6
Language: C
Files changed: magick/statistic.c
Commit date: 2019-06-22 08:23:29 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1615

Diff: diff --git a/magick/statistic.c b/magick/statistic.c
index 7a07c52825..2cf7830a39 100644
--- a/magick/statistic.c
+++ b/magick/statistic.c
@@ -161,22 +161,21 @@ static MagickPixelPacket **AcquirePixelThreadSet(const Image *images)
     i,
     j;
 
   size_t
     columns,
-    number_threads;
+    rows;
 
-  number_threads=(size_t) GetMagickResourceLimit(ThreadResource);
-  pixels=(MagickPixelPacket **) AcquireQuantumMemory(number_threads,
-    sizeof(*pixels));
+  rows=MagickMax(GetImageListLength(images),
+    (size_t) GetMagickResourceLimit(ThreadResource));
+  pixels=(MagickPixelPacket **) AcquireQuantumMemory(rows,sizeof(*pixels));
   if (pixels == (MagickPixelPacket **) NULL)
     return((MagickPixelPacket **) NULL);
-  (void) memset(pixels,0,number_threads*sizeof(*pixels));
   columns=images->columns;
   for (next=images; next != (Image *) NULL; next=next->next)
     columns=MagickMax(next->columns,columns);
-  for (i=0; i < (ssize_t) number_threads; i++)
+  for (i=0; i < (ssize_t) rows; i++)
   {
     pixels[i]=(MagickPixelPacket *) AcquireQuantumMemory(columns,
       sizeof(**pixels));
     if (pixels[i] == (MagickPixelPacket *) NULL)
       return(DestroyPixelThreadSet(pixels));

Vulnerable code:     number_threads;
  number_threads=(size_t) GetMagickResourceLimit(ThreadResource);
  pixels=(MagickPixelPacket **) AcquireQuantumMemory(number_threads,
    sizeof(*pixels));
  (void) memset(pixels,0,number_threads*sizeof(*pixels));
  for (i=0; i < (ssize_t) number_threads; i++)
Fixed code:     rows;
  rows=MagickMax(GetImageListLength(images),
    (size_t) GetMagickResourceLimit(ThreadResource));
  pixels=(MagickPixelPacket **) AcquireQuantumMemory(rows,sizeof(*pixels));
  for (i=0; i < (ssize_t) rows; i++)
CVE-2019-13309: Missing Release of Memory after Effective Lifetime (CWE-401)
value: ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of mishandling the NoSuchImage error in CLIListOperatorImages in MagickWand/operation.c.
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CVSS v3 base score: 6.5
Published: 2019-07-05T01:15Z
Repository: https://github.com/ImageMagick/ImageMagick6
Language: C
Files changed: wand/mogrify.c
Commit date: 2019-06-23 11:47:36 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1616

Diff: diff --git a/wand/mogrify.c b/wand/mogrify.c
index d641914f7cc..fca494d2cca 100644
--- a/wand/mogrify.c
+++ b/wand/mogrify.c
@@ -7921,10 +7921,12 @@ WandExport MagickBooleanType MogrifyImageList(ImageInfo *image_info,
                 MagickFalse,option);
             difference_image=CompareImageChannels(image,reconstruct_image,
               channel,metric,&distortion,exception);
             if (difference_image == (Image *) NULL)
               break;
+            reconstruct_image=DestroyImage(reconstruct_image);
+            image=DestroyImage(image);
             if (*images != (Image *) NULL)
               *images=DestroyImageList(*images);
             *images=difference_image;
             break;
           }
@@ -8263,10 +8265,11 @@ WandExport MagickBooleanType MogrifyImageList(ImageInfo *image_info,
               else
                 {
                    q=GetImageFromList(*images,index-1);
                    if (q == (Image *) NULL)
                      {
+                       p=DestroyImage(p);
                        (void) ThrowMagickException(exception,GetMagickModule(),
                          OptionError,"NoSuchImage","`%s'",argv[i+1]);
                        status=MagickFalse;
                        break;
                      }

Fixed code:             reconstruct_image=DestroyImage(reconstruct_image);
            image=DestroyImage(image);
                       p=DestroyImage(p);
CVE-2019-13310: Missing Release of Memory after Effective Lifetime (CWE-401)
value: ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of an error in MagickWand/mogrify.c.
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CVSS v3 base score: 6.5
Published: 2019-07-05T01:15Z
Repository: https://github.com/ImageMagick/ImageMagick6
Language: C
Files changed: wand/mogrify.c
Commit date: 2019-06-23 11:47:36 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1616

Diff: diff --git a/wand/mogrify.c b/wand/mogrify.c
index d641914f7cc..fca494d2cca 100644
--- a/wand/mogrify.c
+++ b/wand/mogrify.c
@@ -7921,10 +7921,12 @@ WandExport MagickBooleanType MogrifyImageList(ImageInfo *image_info,
                 MagickFalse,option);
             difference_image=CompareImageChannels(image,reconstruct_image,
               channel,metric,&distortion,exception);
             if (difference_image == (Image *) NULL)
               break;
+            reconstruct_image=DestroyImage(reconstruct_image);
+            image=DestroyImage(image);
             if (*images != (Image *) NULL)
               *images=DestroyImageList(*images);
             *images=difference_image;
             break;
           }
@@ -8263,10 +8265,11 @@ WandExport MagickBooleanType MogrifyImageList(ImageInfo *image_info,
               else
                 {
                    q=GetImageFromList(*images,index-1);
                    if (q == (Image *) NULL)
                      {
+                       p=DestroyImage(p);
                        (void) ThrowMagickException(exception,GetMagickModule(),
                          OptionError,"NoSuchImage","`%s'",argv[i+1]);
                        status=MagickFalse;
                        break;
                      }

Fixed code:             reconstruct_image=DestroyImage(reconstruct_image);
            image=DestroyImage(image);
                       p=DestroyImage(p);
CVE-2019-14980: Use After Free (CWE-416)
value: In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in the UnmapBlob function that allows an attacker to cause a denial of service by sending a crafted file.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 6.5
Published: 2019-08-12T23:15Z
Repository: https://github.com/ImageMagick/ImageMagick6
Language: C
Files changed: magick/blob.c
Commit date: 2019-04-22 12:42:50 -0400
Commit message: https://github.com/ImageMagick/ImageMagick6/issues/43

Diff: diff --git a/magick/blob.c b/magick/blob.c
index 520a727de96..cdc69320397 100644
--- a/magick/blob.c
+++ b/magick/blob.c
@@ -698,10 +698,11 @@ MagickExport unsigned char *DetachBlob(BlobInfo *blob_info)
   if (blob_info->debug != MagickFalse)
     (void) LogMagickEvent(TraceEvent,GetMagickModule(),"...");
   if (blob_info->mapped != MagickFalse)
     {
       (void) UnmapBlob(blob_info->data,blob_info->length);
+      blob_info->data=NULL;
       RelinquishMagickResource(MapResource,blob_info->length);
     }
   blob_info->mapped=MagickFalse;
   blob_info->length=0;
   blob_info->offset=0;

Fixed code:       blob_info->data=NULL;
CVE-2019-14981: Divide By Zero (CWE-369)
value: In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in the MeanShiftImage function. It allows an attacker to cause a denial of service by sending a crafted file.
CWE description: The product divides a value by zero.
CVSS v3 base score: 6.5
Published: 2019-08-12T23:15Z
Repository: https://github.com/ImageMagick/ImageMagick6
Language: C
Files changed: magick/feature.c
Commit date: 2019-04-18 19:55:44 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1552

Diff: diff --git a/magick/feature.c b/magick/feature.c
index db33743d2fa..434c5c5c164 100644
--- a/magick/feature.c
+++ b/magick/feature.c
@@ -2311,11 +2311,11 @@ MagickExport Image *MeanShiftImage(const Image *image,const size_t width,
                     count++;
                   }
               }
           }
         }
-        gamma=1.0/count;
+        gamma=PerceptibleReciprocal(count);
         mean_location.x=gamma*sum_location.x;
         mean_location.y=gamma*sum_location.y;
         mean_pixel.red=gamma*sum_pixel.red;
         mean_pixel.green=gamma*sum_pixel.green;
         mean_pixel.blue=gamma*sum_pixel.blue;

Vulnerable code:         gamma=1.0/count;
Fixed code:         gamma=PerceptibleReciprocal(count);
CVE-2019-15141: Out-of-bounds Read (CWE-125)
value: WriteTIFFImage in coders/tiff.c in ImageMagick 7.0.8-43 Q16 allows attackers to cause a denial-of-service (application crash resulting from a heap-based buffer over-read) via a crafted TIFF image file, related to TIFFRewriteDirectory, TIFFWriteDirectory, TIFFWriteDirectorySec, and TIFFWriteDirectoryTagColormap in tif_dirwrite.c of LibTIFF. NOTE: this occurs because of an incomplete fix for CVE-2019-11597.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2019-08-18T19:15Z
Repository: https://github.com/ImageMagick/ImageMagick6
Language: C
Files changed: coders/tiff.c
Commit date: 2019-04-28 09:26:55 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1560

Diff: diff --git a/coders/tiff.c b/coders/tiff.c
index 10ca0a67eb4..a95f78bf1c7 100644
--- a/coders/tiff.c
+++ b/coders/tiff.c
@@ -4077,23 +4077,25 @@ RestoreMSCWarning
     }
     quantum_info=DestroyQuantumInfo(quantum_info);
     if (image->colorspace == LabColorspace)
       DecodeLabImage(image,&image->exception);
     DestroyTIFFInfo(&tiff_info);
-    if (image->exception.severity > ErrorException)
-      break;
 DisableMSCWarning(4127)
     if (0 && (image_info->verbose != MagickFalse))
 RestoreMSCWarning
       TIFFPrintDirectory(tiff,stdout,MagickFalse);
-    (void) TIFFWriteDirectory(tiff);
+    if (TIFFWriteDirectory(tiff) == 0)
+      {
+        status=MagickFalse;
+        break;
+      }
     image=SyncNextImageInList(image);
     if (image == (Image *) NULL)
       break;
     status=SetImageProgress(image,SaveImagesTag,scene++,imageListLength);
     if (status == MagickFalse)
       break;
   } while (image_info->adjoin != MagickFalse);
   TIFFClose(tiff);
-  return(image->exception.severity > ErrorException ? MagickFalse : MagickTrue);
+  return(status);
 }
 #endif

Vulnerable code:     if (image->exception.severity > ErrorException)
      break;
    (void) TIFFWriteDirectory(tiff);
  return(image->exception.severity > ErrorException ? MagickFalse : MagickTrue);
Fixed code:     if (TIFFWriteDirectory(tiff) == 0)
      {
        status=MagickFalse;
        break;
      }
  return(status);
CVE-2021-3574: Missing Release of Memory after Effective Lifetime (CWE-401)
value: A vulnerability was found in ImageMagick-7.0.11-5, where executing a crafted file with the convert command, ASAN detects memory leaks.
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CVSS v3 base score: 3.3
Published: 2022-08-26T16:15Z
Repository: https://github.com/ImageMagick/ImageMagick6
Language: C
Files changed: coders/tiff.c
Commit date: 2021-04-13 21:41:34 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/3540

Diff: diff --git a/coders/tiff.c b/coders/tiff.c
index 8311beab1f6..d8fbad1ebcf 100644
--- a/coders/tiff.c
+++ b/coders/tiff.c
@@ -1243,10 +1243,15 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
         ((bits_per_sample <= 0) || (bits_per_sample > 32)))
       {
         TIFFClose(tiff);
         ThrowReaderException(CorruptImageError,"UnsupportedBitsPerPixel");
       }
+    if (samples_per_pixel > MaxPixelChannels)
+      {
+        TIFFClose(tiff);
+        ThrowReaderException(CorruptImageError,"MaximumChannelsExceeded");
+      }
     if (sample_format == SAMPLEFORMAT_IEEEFP)
       (void) SetImageProperty(image,"quantum:format","floating-point");
     switch (photometric)
     {
       case PHOTOMETRIC_MINISBLACK:
@@ -1615,15 +1620,10 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
                 }
           }
       }
     if (image->matte != MagickFalse)
       (void) SetImageAlphaChannel(image,OpaqueAlphaChannel);
-    if (samples_per_pixel > MaxPixelChannels)
-      {
-        TIFFClose(tiff);
-        ThrowReaderException(CorruptImageError,"MaximumChannelsExceeded");
-      }
     method=ReadGenericMethod;
     rows_per_strip=(uint32) image->rows;
     if (TIFFGetField(tiff,TIFFTAG_ROWSPERSTRIP,&rows_per_strip) == 1)
       {
         char

Vulnerable code:     if (samples_per_pixel > MaxPixelChannels)
      {
        TIFFClose(tiff);
        ThrowReaderException(CorruptImageError,"MaximumChannelsExceeded");
      }
Fixed code:     if (samples_per_pixel > MaxPixelChannels)
      {
        TIFFClose(tiff);
        ThrowReaderException(CorruptImageError,"MaximumChannelsExceeded");
      }
CVE-2022-1115: Out-of-bounds Write (CWE-787)
value: A heap-buffer-overflow flaw was found in ImageMagick’s PushShortPixel() function of quantum-private.h file. This vulnerability is triggered when an attacker passes a specially crafted TIFF image file to ImageMagick for conversion, potentially leading to a denial of service.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2022-08-29T15:15Z
Repository: https://github.com/ImageMagick/ImageMagick6
Language: C
Files changed: coders/tiff.c
Commit date: 2022-03-22 20:11:27 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/4974

Diff: diff --git a/coders/tiff.c b/coders/tiff.c
index 8fd1451c8bb..b8d7b88b83b 100644
--- a/coders/tiff.c
+++ b/coders/tiff.c
@@ -1892,11 +1892,11 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
             (TIFFGetField(tiff,TIFFTAG_TILELENGTH,&rows) != 1))
           ThrowTIFFException(CoderError,"ImageIsNotTiled");
         number_pixels=(MagickSizeType) columns*rows;
         if (HeapOverflowSanityCheck(rows,sizeof(*tile_pixels)) != MagickFalse)
           ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
-        extent=MagickMax(rows*TIFFTileRowSize(tiff),TIFFTileSize(tiff));
+        extent=4*MagickMax(rows*TIFFTileRowSize(tiff),TIFFTileSize(tiff));
 #if defined(TIFF_VERSION_BIG)
         extent+=image->columns*sizeof(uint64);
 #else
         extent+=image->columns*sizeof(uint32);
 #endif

Vulnerable code:         extent=MagickMax(rows*TIFFTileRowSize(tiff),TIFFTileSize(tiff));
Fixed code:         extent=4*MagickMax(rows*TIFFTileRowSize(tiff),TIFFTileSize(tiff));
CVE-2022-28463: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 7.8
Published: 2022-05-08T23:15Z
Repository: https://github.com/ImageMagick/ImageMagick6
Language: C
Files changed: coders/cin.c
Commit date: 2022-03-26 09:27:36 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/4988

Diff: diff --git a/coders/cin.c b/coders/cin.c
index 854b59758a9..13e3cfe75be 100644
--- a/coders/cin.c
+++ b/coders/cin.c
@@ -449,10 +449,12 @@ static Image *ReadCINImage(const ImageInfo *image_info,ExceptionInfo *exception)
     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   memset(&cin,0,sizeof(cin));
   image->endian=(magick[0] == 0x80) && (magick[1] == 0x2a) &&
     (magick[2] == 0x5f) && (magick[3] == 0xd7) ? MSBEndian : LSBEndian;
   cin.file.image_offset=ReadBlobLong(image);
+  if (cin.file.image_offset < 712)
+    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   offset+=4;
   cin.file.generic_length=ReadBlobLong(image);
   offset+=4;
   cin.file.industry_length=ReadBlobLong(image);
   offset+=4;

Fixed code:   if (cin.file.image_offset < 712)
    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
CVE-2022-3213: Out-of-bounds Write (CWE-787)
value: A heap buffer overflow issue was found in ImageMagick. When an application processes a malformed TIFF file, it could lead to undefined behavior or a crash causing a denial of service.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2022-09-19T18:15Z
Repository: https://github.com/ImageMagick/ImageMagick6
Language: C
Files changed: coders/tiff.c
Commit date: 2022-08-27 08:40:55 -0400
Commit message: squash heap-buffer-overflow, PoC TIFF from Hardik

Diff: diff --git a/coders/tiff.c b/coders/tiff.c
index 3165ab92556..05549f9e528 100644
--- a/coders/tiff.c
+++ b/coders/tiff.c
@@ -1796,11 +1796,11 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
           *strip_pixels;
 
         /*
           Convert stripped TIFF image.
         */
-        extent=4*(samples_per_pixel+1)*TIFFStripSize(tiff);
+        extent=4*((image->depth+7)/8)*(samples_per_pixel+1)*TIFFStripSize(tiff);
         strip_pixels=(unsigned char *) AcquireQuantumMemory(extent,
           sizeof(*strip_pixels));
         if (strip_pixels == (unsigned char *) NULL)
           ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
         (void) memset(strip_pixels,0,extent*sizeof(*strip_pixels));

Vulnerable code:         extent=4*(samples_per_pixel+1)*TIFFStripSize(tiff);
Fixed code:         extent=4*((image->depth+7)/8)*(samples_per_pixel+1)*TIFFStripSize(tiff);
CVE-2022-32546: Integer Overflow or Wraparound (CWE-190)
value: A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned long' at coders/pcl.c, when crafted or untrusted input is processed. This leads to a negative impact to application availability or other problems related to undefined behavior.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 7.8
Published: 2022-06-16T18:15Z
Repository: https://github.com/ImageMagick/ImageMagick6
Language: C
Files changed: coders/pcl.c
Commit date: 2022-03-24 11:38:59 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/pull/4986

Diff: diff --git a/coders/pcl.c b/coders/pcl.c
index 5e57086e45f..a7456dae6cb 100644
--- a/coders/pcl.c
+++ b/coders/pcl.c
@@ -293,12 +293,12 @@ static Image *ReadPCLImage(const ImageInfo *image_info,ExceptionInfo *exception)
     if (count != 4)
       continue;
     /*
       Set PCL render geometry.
     */
-    width=(size_t) floor(bounds.x2-bounds.x1+0.5);
-    height=(size_t) floor(bounds.y2-bounds.y1+0.5);
+    width=(size_t) CastDoubleToLong(floor(bounds.x2-bounds.x1+0.5));
+    height=(size_t) CastDoubleToLong(floor(bounds.y2-bounds.y1+0.5));
     if (width > page.width)
       page.width=width;
     if (height > page.height)
       page.height=height;
   }

Vulnerable code:     width=(size_t) floor(bounds.x2-bounds.x1+0.5);
    height=(size_t) floor(bounds.y2-bounds.y1+0.5);
Fixed code:     width=(size_t) CastDoubleToLong(floor(bounds.x2-bounds.x1+0.5));
    height=(size_t) CastDoubleToLong(floor(bounds.y2-bounds.y1+0.5));
CVE-2022-32547: Incorrect Type Conversion or Cast (CWE-704)
value: In ImageMagick, there is load of misaligned address for type 'double', which requires 8 byte alignment and for type 'float', which requires 4 byte alignment at MagickCore/property.c. Whenever crafted or untrusted input is processed by ImageMagick, this causes a negative impact to application availability or other problems related to undefined behavior.
CWE description: The product does not correctly convert an object, resource, or structure from one type to a different type.
CVSS v3 base score: 7.8
Published: 2022-06-16T18:15Z
Repository: https://github.com/ImageMagick/ImageMagick6
Language: C
Files changed: magick/property.c
Commit date: 2022-04-09 08:40:54 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/pull/5034

Diff: diff --git a/magick/property.c b/magick/property.c
index 2d80493dd29..bfc689466df 100644
--- a/magick/property.c
+++ b/magick/property.c
@@ -1524,16 +1524,18 @@ static MagickBooleanType GetEXIFProperty(const Image *image,
                 ReadPropertySignedLong(endian,p1+4));
               break;
             }
             case EXIF_FMT_SINGLE:
             {
-              EXIFMultipleValues(4,"%f",(double) *(float *) p1);
+              EXIFMultipleValues(4,"%.20g",(double)
+                ReadPropertySignedLong(endian,p1));
               break;
             }
             case EXIF_FMT_DOUBLE:
             {
-              EXIFMultipleValues(8,"%f",*(double *) p1);
+              EXIFMultipleValues(8,"%.20g",(double)
+                ReadPropertySignedLong(endian,p1));
               break;
             }
             case EXIF_FMT_STRING:
             default:
             {

Vulnerable code:               EXIFMultipleValues(4,"%f",(double) *(float *) p1);
              EXIFMultipleValues(8,"%f",*(double *) p1);
Fixed code:               EXIFMultipleValues(4,"%.20g",(double)
                ReadPropertySignedLong(endian,p1));
              EXIFMultipleValues(8,"%.20g",(double)
                ReadPropertySignedLong(endian,p1));
CVE-2023-1906: Out-of-bounds Write (CWE-787)
value: A heap-based buffer overflow issue was discovered in ImageMagick's ImportMultiSpectralQuantum() function in MagickCore/quantum-import.c. An attacker could pass specially crafted file to convert, triggering an out-of-bounds read error, allowing an application to crash, resulting in a denial of service.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2023-04-12T22:15Z
Repository: https://github.com/ImageMagick/ImageMagick6
Language: C
Files changed: coders/tiff.c
Commit date: 2023-04-01 07:32:01 -0400
Commit message: possible heap buffer overflow (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-35q2-86c7-9247)

Diff: diff --git a/coders/tiff.c b/coders/tiff.c
index d238b1226b5..5372b30135e 100644
--- a/coders/tiff.c
+++ b/coders/tiff.c
@@ -1809,12 +1809,12 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
           *strip_pixels;
 
         /*
           Convert stripped TIFF image.
         */
-        extent=4*MagickMax(image->columns*(samples_per_pixel+extra_samples)*
-          (image->depth+7)/8,TIFFStripSize(tiff));
+        extent=MagickMax(sizeof(uint32),(samples_per_pixel+extra_samples)*
+          (image->depth+7)/8)*image->columns*rows_per_strip;
         strip_pixels=(unsigned char *) AcquireQuantumMemory(extent,
           sizeof(*strip_pixels));
         if (strip_pixels == (unsigned char *) NULL)
           ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
         (void) memset(strip_pixels,0,extent*sizeof(*strip_pixels));

Vulnerable code:         extent=4*MagickMax(image->columns*(samples_per_pixel+extra_samples)*
          (image->depth+7)/8,TIFFStripSize(tiff));
Fixed code:         extent=MagickMax(sizeof(uint32),(samples_per_pixel+extra_samples)*
          (image->depth+7)/8)*image->columns*rows_per_strip;
CVE-2023-3195: Out-of-bounds Write (CWE-787)
value: A stack-based buffer overflow issue was found in ImageMagick's coders/tiff.c. This flaw allows an attacker to trick the user into opening a specially crafted malicious tiff file, causing an application to crash, resulting in a denial of service.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2023-06-16T20:15Z
Repository: https://github.com/ImageMagick/ImageMagick6
Language: Other
Files changed: ChangeLog, coders/tiff.c
Commit date: 2021-10-19 14:53:41 -0400
Commit message: fix stack overflow when parsing malicious tiff image

Diff: diff --git a/ChangeLog b/ChangeLog
index 3566ccfcb85..1687a04ca6b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -4,10 +4,12 @@
 2021-10-11  6.9.12-26  <quetzlzacatenango@image...>
   * fix connected component abort trap (reference
     https://github.com/ImageMagick/ImageMagick/issues/4372).
   * fix possible unitialized values (reference
     https://github.com/ImageMagick/ImageMagick/issues/4379).
+  * fix stack overflow when parsing malicious tiff image file (report from
+    Muhammad Aldo Firmansyah).
 
 2021-10-10  6.9.12-25  <quetzlzacatenango@image...>
   * Release ImageMagick version 6.9.12-25 GIT revision 16849:2c96ab5d0:20211010
 
 2021-10-03  6.9.12-25  <quetzlzacatenango@image...>
diff --git a/coders/tiff.c b/coders/tiff.c
index 43432cd1db5..8c89fd9e109 100644
--- a/coders/tiff.c
+++ b/coders/tiff.c
@@ -1890,10 +1890,15 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
           ThrowTIFFException(CoderError,"ImageIsNotTiled");
         number_pixels=(MagickSizeType) columns*rows;
         if (HeapOverflowSanityCheck(rows,sizeof(*tile_pixels)) != MagickFalse)
           ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
         extent=MagickMax(rows*TIFFTileRowSize(tiff),TIFFTileSize(tiff));
+#if defined(TIFF_VERSION_BIG)
+        extent+=image->columns*sizeof(uint64);
+#else
+        extent+=image->columns*sizeof(uint32);
+#endif
         tile_pixels=(unsigned char *) AcquireQuantumMemory(extent,
           sizeof(*tile_pixels));
         if (tile_pixels == (unsigned char *) NULL)
           ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
         (void) memset(tile_pixels,0,extent*sizeof(*tile_pixels));

Fixed code:   * fix stack overflow when parsing malicious tiff image file (report from
    Muhammad Aldo Firmansyah).
#if defined(TIFF_VERSION_BIG)
        extent+=image->columns*sizeof(uint64);
#else
        extent+=image->columns*sizeof(uint32);
#endif
CVE-2023-3745: Out-of-bounds Write (CWE-787)
value: A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel() function in quantum-private.h. This issue may allow a local attacker to trick the user into opening a specially crafted file, triggering an out-of-bounds read error and allowing an application to crash, resulting in a denial of service.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2023-07-24T16:15Z
Repository: https://github.com/ImageMagick/ImageMagick6
Language: Other
Files changed: ChangeLog, coders/tiff.c
Commit date: 2020-03-02 16:13:39 -0500
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1857

Diff: diff --git a/ChangeLog b/ChangeLog
index 7bf9b5caa62..dfda7e3c797 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -2,10 +2,12 @@
   * Release ImageMagick version 6.9.11-0, GIT revision 15..
 
 2020-03-01  6.9.11-0 Cristy  <quetzlzacatenango@image...>
   * Label text no longer gets cut-off (reference
     https://imagemagick.org/discourse-server/viewtopic.php?f=1&t=37621).
+  * Prevent heap overflow (reference
+    https://github.com/ImageMagick/ImageMagick/issues/1857).
 
 2020-02-29  6.9.10-97 Cristy  <quetzlzacatenango@image...>
   * Release ImageMagick version 6.9.10-97, GIT revision 15453:0537c847b:20200229
 
 2020-02-24  6.9.10-97 Cristy  <quetzlzacatenango@image...>
diff --git a/coders/tiff.c b/coders/tiff.c
index 16868b322cb..0256a6c1e2d 100644
--- a/coders/tiff.c
+++ b/coders/tiff.c
@@ -1832,10 +1832,12 @@ RestoreMSCWarning
 
         /*
           Convert stripped TIFF image.
         */
         extent=TIFFStripSize(tiff)+sizeof(uint32);
+        if (photometric == PHOTOMETRIC_YCBCR)
+          extent<<=1;
         strip_pixels=(unsigned char *) AcquireQuantumMemory(extent,
           sizeof(*strip_pixels));
         if (strip_pixels == (unsigned char *) NULL)
           ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
         (void) memset(strip_pixels,0,extent*sizeof(*strip_pixels));

Fixed code:   * Prevent heap overflow (reference
    https://github.com/ImageMagick/ImageMagick/issues/1857).
        if (photometric == PHOTOMETRIC_YCBCR)
          extent<<=1;
CVE-2023-3745: Out-of-bounds Write (CWE-787)
value: A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel() function in quantum-private.h. This issue may allow a local attacker to trick the user into opening a specially crafted file, triggering an out-of-bounds read error and allowing an application to crash, resulting in a denial of service.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2023-07-24T16:15Z
Repository: https://github.com/ImageMagick/ImageMagick6
Language: C
Files changed: coders/tiff.c
Commit date: 2020-03-02 17:07:06 -0500
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1857

Diff: diff --git a/coders/tiff.c b/coders/tiff.c
index 0256a6c1e2d..15c9933641f 100644
--- a/coders/tiff.c
+++ b/coders/tiff.c
@@ -1699,11 +1699,12 @@ RestoreMSCWarning
         if (rows_per_strip > (uint32) image->rows)
           rows_per_strip=(uint32) image->rows;
       }
     if (TIFFIsTiled(tiff) != MagickFalse)
       method=ReadTileMethod;
-    if (photometric == PHOTOMETRIC_LOGLUV)
+    if ((photometric == PHOTOMETRIC_LOGLUV) ||
+        (photometric == PHOTOMETRIC_YCBCR))
       method=ReadGenericMethod;
     if (image->compression == JPEGCompression)
       method=GetJPEGMethod(image,tiff,photometric,bits_per_sample,
         samples_per_pixel);
     quantum_info->endian=LSBEndian;
@@ -1832,12 +1833,10 @@ RestoreMSCWarning
 
         /*
           Convert stripped TIFF image.
         */
         extent=TIFFStripSize(tiff)+sizeof(uint32);
-        if (photometric == PHOTOMETRIC_YCBCR)
-          extent<<=1;
         strip_pixels=(unsigned char *) AcquireQuantumMemory(extent,
           sizeof(*strip_pixels));
         if (strip_pixels == (unsigned char *) NULL)
           ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
         (void) memset(strip_pixels,0,extent*sizeof(*strip_pixels));

Vulnerable code:     if (photometric == PHOTOMETRIC_LOGLUV)
        if (photometric == PHOTOMETRIC_YCBCR)
          extent<<=1;
Fixed code:     if ((photometric == PHOTOMETRIC_LOGLUV) ||
        (photometric == PHOTOMETRIC_YCBCR))
CVE-2023-39978: Missing Release of Memory after Effective Lifetime (CWE-401)
value: ImageMagick before 6.9.12-91 allows attackers to cause a denial of service (memory consumption) in Magick::Draw.
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CVSS v3 base score: 3.3
Published: 2023-08-08T06:15Z
Repository: https://github.com/ImageMagick/ImageMagick6
Language: C
Files changed: magick/draw.c
Commit date: 2023-07-16 06:45:32 +0200
Commit message: Fixed memory leak.

Diff: diff --git a/magick/draw.c b/magick/draw.c
index 40b6f4be65c..7bc5f603d3a 100644
--- a/magick/draw.c
+++ b/magick/draw.c
@@ -381,11 +381,10 @@ MagickExport DrawInfo *CloneDrawInfo(const ImageInfo *image_info,
       MagickTrue,&draw_info->clipping_mask->exception);
   if (draw_info->composite_mask != (Image *) NULL)
     clone_info->composite_mask=CloneImage(draw_info->composite_mask,0,0,
       MagickTrue,&draw_info->composite_mask->exception);
   clone_info->render=draw_info->render;
-  clone_info->image_info=CloneImageInfo(draw_info->image_info);
   clone_info->debug=draw_info->debug;
   return(clone_info);
 }
 
 /*

Vulnerable code:   clone_info->image_info=CloneImageInfo(draw_info->image_info);
CVE-2023-46404: Insufficient Information (NVD-CWE-noinfo)
value: PCRS <= 3.11 (d0de1e) “Questions” page and “Code editor” page are vulnerable to remote code execution (RCE) by escaping Python sandboxing.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.9
Published: 2023-11-03T16:15Z
Repository: https://bitbucket.org/utmandrew/pcrs
Language: Markdown
Files changed: CHANGELOG.md
Commit date: 2023-10-26 11:55:48 -0400
Commit message: Citing CVE

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 53dff1a8..686a254a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,10 +8,12 @@
 
 ## New Bugs
 
 - Python_TA reports are not currently provided since the configuration file provides cannot be parsed by the newest version of Python_TA.
 
+- A CVE (https://github.com/windecks/CVE-2023-46404/) was reported and has been partially mitigated. Changes in 3.11 use RestrictedPython, which has reduced functionality somewhat. A more complete fix requires sandboxing of the installation, which is recommended; a guide for doing so is in preparation.
+
 
 # 3.10 (2022-10-21)
 
 ## New Features
 

Fixed code: - A CVE (https://github.com/windecks/CVE-2023-46404/) was reported and has been partially mitigated. Changes in 3.11 use RestrictedPython, which has reduced functionality somewhat. A more complete fix requires sandboxing of the installation, which is recommended; a guide for doing so is in preparation.
CVE-2014-9273: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: lib/handle.c in Hivex before 1.3.11 allows local users to execute arbitrary code and gain privileges via a small hive files, which triggers an out-of-bounds read or write.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Published: 2014-12-08T16:59Z
Repository: https://github.com/libguestfs/hivex
Language: C
Files changed: lib/handle.c
Commit date: 2014-10-30 14:02:25 +0000
Commit message: handle: Check that pages do not extend beyond the end of the file.

Thanks: Mahmoud Al-Qudsi

Diff: diff --git a/lib/handle.c b/lib/handle.c
index a3cbcf7..3a8f09b 100644
--- a/lib/handle.c
+++ b/lib/handle.c
@@ -245,10 +245,17 @@ hivex_open (const char *filename, int flags)
                  "%s: page size %zu at 0x%zx, bad registry",
                  filename, page_size, off);
       goto error;
     }
 
+    if (off + page_size > h->size) {
+      SET_ERRNO (ENOTSUP,
+                 "%s: page size %zu at 0x%zx extends beyond end of file, bad registry",
+                 filename, page_size, off);
+      goto error;
+    }
+
     /* Read the blocks in this page. */
     size_t blkoff;
     struct ntreg_hbin_block *block;
     size_t seg_len;
     for (blkoff = off + 0x20;

Fixed code:     if (off + page_size > h->size) {
      SET_ERRNO (ENOTSUP,
                 "%s: page size %zu at 0x%zx extends beyond end of file, bad registry",
                 filename, page_size, off);
      goto error;
    }
CVE-2014-9273: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: lib/handle.c in Hivex before 1.3.11 allows local users to execute arbitrary code and gain privileges via a small hive files, which triggers an out-of-bounds read or write.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Published: 2014-12-08T16:59Z
Repository: https://github.com/libguestfs/hivex
Language: C
Files changed: lib/handle.c
Commit date: 2014-10-30 13:56:07 +0000
Commit message: handle: Refuse to open files < 8192 bytes in size.

These cannot be valid hives, since they don't contain a full header
page and at least a single page of data (in other words they couldn't
contain a root node).

Thanks: Mahmoud Al-Qudsi

Diff: diff --git a/lib/handle.c b/lib/handle.c
index 62a8644..a3cbcf7 100644
--- a/lib/handle.c
+++ b/lib/handle.c
@@ -102,10 +102,17 @@ hivex_open (const char *filename, int flags)
   if (fstat (h->fd, &statbuf) == -1)
     goto error;
 
   h->size = statbuf.st_size;
 
+  if (h->size < 0x2000) {
+    SET_ERRNO (EINVAL,
+               "%s: file is too small to be a Windows NT Registry hive file",
+               filename);
+    goto error;
+  }
+
   if (!h->writable) {
     h->addr = mmap (NULL, h->size, PROT_READ, MAP_SHARED, h->fd, 0);
     if (h->addr == MAP_FAILED)
       goto error;
 

Fixed code:   if (h->size < 0x2000) {
    SET_ERRNO (EINVAL,
               "%s: file is too small to be a Windows NT Registry hive file",
               filename);
    goto error;
  }
CVE-2016-2315: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, leading to a heap-based buffer overflow.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 9.8
Published: 2016-04-08T14:59Z
Repository: https://github.com/git/git
Language: C
Files changed: compat/nedmalloc/nedmalloc.c, fast-import.c, revision.c
Commit date: 2015-10-05 11:08:05 -0700
Commit message: prefer memcpy to strcpy

When we already know the length of a string (e.g., because
we just malloc'd to fit it), it's nicer to use memcpy than
strcpy, as it makes it more obvious that we are not going to
overflow the buffer (because the size we pass matches the
size in the allocation).

This also eliminates calls to strcpy, which make auditing
the code base harder.

Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

Diff: diff --git a/compat/nedmalloc/nedmalloc.c b/compat/nedmalloc/nedmalloc.c
index 609ebba125..a0a16eb1bb 100644
--- a/compat/nedmalloc/nedmalloc.c
+++ b/compat/nedmalloc/nedmalloc.c
@@ -955,12 +955,13 @@ void **nedpindependent_comalloc(nedpool *p, size_t elems, size_t *sizes, void **
  */
 char *strdup(const char *s1)
 {
 	char *s2 = 0;
 	if (s1) {
-		s2 = malloc(strlen(s1) + 1);
-		strcpy(s2, s1);
+		size_t len = strlen(s1) + 1;
+		s2 = malloc(len);
+		memcpy(s2, s1, len);
 	}
 	return s2;
 }
 #endif
 
diff --git a/fast-import.c b/fast-import.c
index 895c6b4a7e..cf6d8bc0ce 100644
--- a/fast-import.c
+++ b/fast-import.c
@@ -642,12 +642,13 @@ static void *pool_calloc(size_t count, size_t size)
 	return r;
 }
 
 static char *pool_strdup(const char *s)
 {
-	char *r = pool_alloc(strlen(s) + 1);
-	strcpy(r, s);
+	size_t len = strlen(s) + 1;
+	char *r = pool_alloc(len);
+	memcpy(r, s, len);
 	return r;
 }
 
 static void insert_mark(uintmax_t idnum, struct object_entry *oe)
 {
diff --git a/revision.c b/revision.c
index af2a18ed74..22364636d1 100644
--- a/revision.c
+++ b/revision.c
@@ -36,11 +36,11 @@ char *path_name(const struct name_path *path, const char *name)
 		if (p->elem_len)
 			len += p->elem_len + 1;
 	}
 	n = xmalloc(len);
 	m = n + len - (nlen + 1);
-	strcpy(m, name);
+	memcpy(m, name, nlen + 1);
 	for (p = path; p; p = p->up) {
 		if (p->elem_len) {
 			m -= p->elem_len + 1;
 			memcpy(m, p->elem, p->elem_len);
 			m[p->elem_len] = '/';

Vulnerable code: 		s2 = malloc(strlen(s1) + 1);
		strcpy(s2, s1);
	char *r = pool_alloc(strlen(s) + 1);
	strcpy(r, s);
	strcpy(m, name);
Fixed code: 		size_t len = strlen(s1) + 1;
		s2 = malloc(len);
		memcpy(s2, s1, len);
	size_t len = strlen(s) + 1;
	char *r = pool_alloc(len);
	memcpy(r, s, len);
	memcpy(m, name, nlen + 1);
CVE-2022-23521: Integer Overflow or Wraparound (CWE-190)
value: Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a `.gitattributes` file to the repository, which contains a set of file patterns and the attributes that should be set for paths matching this pattern. When parsing gitattributes, multiple integer overflows can occur when there is a huge number of path patterns, a huge number of attributes for a single pattern, or when the declared attribute names are huge. These overflows can be triggered via a crafted `.gitattributes` file that may be part of the commit history. Git silently splits lines longer than 2KB when parsing gitattributes from a file, but not when parsing them from the index. Consequentially, the failure mode depends on whether the file exists in the working tree, the index or both. This integer overflow can result in arbitrary heap reads and writes, which may result in remote code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. There are no known workarounds for this issue.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 9.8
Published: 2023-01-17T23:15Z
Repository: https://github.com/git/git
Language: Unknown
Commit date: 2023-01-16 12:11:58 -0800
Commit message: Sync with 2.39.1
CVE-2022-41903: Integer Overflow or Wraparound (CWE-190)
value: Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the padding operators, there is a integer overflow in `pretty.c::format_and_pad_commit()` where a `size_t` is stored improperly as an `int`, and then added as an offset to a `memcpy()`. This overflow can be triggered directly by a user running a command which invokes the commit formatting machinery (e.g., `git log --format=...`). It may also be triggered indirectly through git archive via the export-subst mechanism, which expands format specifiers inside of files within the repository during a git archive. This integer overflow can result in arbitrary heap writes, which may result in arbitrary code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. Users who are unable to upgrade should disable `git archive` in untrusted repositories. If you expose git archive via `git daemon`, disable it by running `git config --global daemon.uploadArch false`.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 9.8
Published: 2023-01-17T23:15Z
Repository: https://github.com/git/git
Language: Unknown
Commit date: 2023-01-16 12:11:58 -0800
Commit message: Sync with 2.39.1
CVE-2023-25652: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid using `git apply` with `--reject` when applying patches from an untrusted source. Use `git apply --stat` to inspect a patch before applying; avoid applying one that create a conflict where a link corresponding to the `*.rej` file exists.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2023-04-25T20:15Z
Repository: https://github.com/git/git
Language: Unknown
Commit date: 2023-04-17 21:15:41 +0200
Commit message: Merge branch 'js/apply-overwrite-rej-symlink-if-exists' into maint-2.30

Address CVE-2023-25652 by deleting any existing `.rej` symbolic links
instead of following them.

* js/apply-overwrite-rej-symlink-if-exists:
  apply --reject: overwrite existing `.rej` symlink if it exists

Signed-off-by: Johannes Schindelin <Johannes.Schindelin@gmx.de>