Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2021-3751: Out-of-bounds Write (CWE-787)
value: libmobi is vulnerable to Out-of-bounds Write
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2021-09-15T07:15Z
Repository: https://github.com/bfabiszewski/libmobi
Language: C
Files changed: src/buffer.c
Commit date: 2021-09-09 14:21:58 +0800
Commit message: fix oob write bug inside libmobi

Diff: diff --git a/src/buffer.c b/src/buffer.c
index 95d2e62..6dfca83 100644
--- a/src/buffer.c
+++ b/src/buffer.c
@@ -508,12 +508,12 @@ void mobi_buffer_move(MOBIBuffer *buf, const int offset, const size_t len) {
             buf->error = MOBI_BUFFER_END;
             return;
         }
         source += aoffset;
     } else {
-        if (buf->offset < aoffset) {
-            debug_print("%s", "End of buffer\n");
+        if ( (buf->offset < aoffset) || (buf->offset + len > buf->maxlen) ) {
+            debug_print("%s", "Beyond start/end of buffer\n");
             buf->error = MOBI_BUFFER_END;
             return;
         }
         source -= aoffset;
     }

Vulnerable code:         if (buf->offset < aoffset) {
            debug_print("%s", "End of buffer\n");
Fixed code:         if ( (buf->offset < aoffset) || (buf->offset + len > buf->maxlen) ) {
            debug_print("%s", "Beyond start/end of buffer\n");
CVE-2021-3888: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: libmobi is vulnerable to Use of Out-of-range Pointer Offset
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 8.1
Published: 2021-10-19T13:15Z
Repository: https://github.com/bfabiszewski/libmobi
Language: C
Files changed: src/read.c
Commit date: 2021-09-18 22:15:54 +0200
Commit message: Fix potential out-of-buffer read while parsing corrupt file, closes #38

Diff: diff --git a/src/read.c b/src/read.c
index 0d2d9e4..666987f 100644
--- a/src/read.c
+++ b/src/read.c
@@ -750,10 +750,14 @@ MOBI_RET mobi_parse_huffdic(const MOBIData *m, MOBIHuffCdic *huffcdic) {
             debug_print("%s", "CDIC parsing failed\n");
             return ret;
         }
         curr = curr->next;
     }
+    if (huffcdic->index_count != huffcdic->index_read) {
+        debug_print("CDIC: wrong read index count: %zu, total: %zu\n", huffcdic->index_read, huffcdic->index_count);
+        return MOBI_DATA_CORRUPT;
+    }
     return MOBI_SUCCESS;
 }
 
 /**
  @brief Parse FDST record into MOBIRawml structure (MOBIFdst member)

Fixed code:     if (huffcdic->index_count != huffcdic->index_read) {
        debug_print("CDIC: wrong read index count: %zu, total: %zu\n", huffcdic->index_read, huffcdic->index_count);
        return MOBI_DATA_CORRUPT;
    }
CVE-2022-29788: NULL Pointer Dereference (CWE-476)
value: libmobi before v0.10 contains a NULL pointer dereference via the component mobi_buffer_getpointer. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted mobi file.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 6.5
Published: 2022-06-02T14:15Z
Repository: https://github.com/bfabiszewski/libmobi
Language: Other
Files changed: ChangeLog, src/index.c
Commit date: 2022-04-23 17:12:04 +0200
Commit message: Fix issue with corrupt files with tagvalues_count = 0 that caused null pointer dereference

Diff: diff --git a/ChangeLog b/ChangeLog
index eda42fb..a834fe2 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,6 @@
+2022-04-23: Fix issue with corrupt files with tagvalues_count = 0 that caused heap buffer over-read
 2022-04-23: Fix issues when mobi_buffer_getpointer returns null. With corrupt data this could lead to out-of-bounds read
 2022-04-13: Add packaging status [skip ci]
 2022-04-10: Make random generation return proper error codes
 2022-04-10: Rewrite randombytes for libmobi
 2022-04-07: Add libsodium randombytes.c
diff --git a/src/index.c b/src/index.c
index b2aaec4..14fbc26 100644
--- a/src/index.c
+++ b/src/index.c
@@ -1055,11 +1055,11 @@ MOBI_RET mobi_trie_insert_infl(MOBITrie **root, const MOBIIndx *indx, size_t i)
     MOBIIndexEntry e = indx->entries[i];
     char *inflected = e.label;
     for (size_t j = 0; j < e.tags_count; j++) {
         MOBIIndexTag t = e.tags[j];
         if (t.tagid == INDX_TAGARR_INFL_PARTS_V1) {
-            for (size_t k = 0; k < t.tagvalues_count - 1; k += 2) {
+            for (size_t k = 0; k + 1 < t.tagvalues_count; k += 2) {
                 uint32_t len = t.tagvalues[k];
                 uint32_t offset = t.tagvalues[k + 1];
                 char *base = mobi_get_cncx_string_flat(indx->cncx_record, offset, len);
                 if (base == NULL) {
                     return MOBI_MALLOC_FAILED;

Vulnerable code:             for (size_t k = 0; k < t.tagvalues_count - 1; k += 2) {
Fixed code: 2022-04-23: Fix issue with corrupt files with tagvalues_count = 0 that caused heap buffer over-read
            for (size_t k = 0; k + 1 < t.tagvalues_count; k += 2) {
CVE-2023-4913: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in GitHub repository cecilapp/cecil prior to 7.47.1.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-09-12T15:15Z
Repository: https://github.com/cecilapp/cecil
Language: PHP
Files changed: resources/server/router.php
Commit date: 2023-09-12 16:00:03 +0200
Commit message: Fix security issues (#1782)


Diff: diff --git a/resources/server/router.php b/resources/server/router.php
index 3b43f13e..f8b0cfeb 100644
--- a/resources/server/router.php
+++ b/resources/server/router.php
@@ -23,11 +23,11 @@ define('SERVER_TMP_DIR', '.cecil');
 define('DIRECTORY_INDEX', '/index.html');
 define('ERROR_404', '/404.html');
 $isIndex = null;
 $mediaSubtypeText = ['javascript', 'xml', 'json', 'ld+json', 'csv'];
 
-$path = urldecode(parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH));
+$path = htmlspecialchars(urldecode(parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH)));
 
 // watcher (called by 'livereload.js')
 if ($path == '/watcher') {
     header("Content-Type: text/event-stream\n\n");
     header('Cache-Control: no-cache');
@@ -48,11 +48,11 @@ if ((empty(pathinfo($path, PATHINFO_EXTENSION)) || $path[-1] == '/') && file_exi
 
 // file absolute path
 $filename = $_SERVER['DOCUMENT_ROOT'] . $path;
 
 // HTTP response: 404
-if (!file_exists($filename) || is_dir($filename)) {
+if ((realpath($filename) === false || strpos(realpath($filename), realpath($_SERVER['DOCUMENT_ROOT'])) !== 0) || !file_exists($filename) || is_dir($filename)) {
     http_response_code(404);
     // favicon.ico
     if ($path == '/favicon.ico') {
         header('Content-Type: image/vnd.microsoft.icon');
 

Vulnerable code: $path = urldecode(parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH));
if (!file_exists($filename) || is_dir($filename)) {
Fixed code: $path = htmlspecialchars(urldecode(parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH)));
if ((realpath($filename) === false || strpos(realpath($filename), realpath($_SERVER['DOCUMENT_ROOT'])) !== 0) || !file_exists($filename) || is_dir($filename)) {
CVE-2023-4914: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Relative Path Traversal in GitHub repository cecilapp/cecil prior to 7.47.1.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2023-09-12T15:15Z
Repository: https://github.com/cecilapp/cecil
Language: PHP
Files changed: resources/server/router.php
Commit date: 2023-09-12 16:00:03 +0200
Commit message: Fix security issues (#1782)


Diff: diff --git a/resources/server/router.php b/resources/server/router.php
index 3b43f13e..f8b0cfeb 100644
--- a/resources/server/router.php
+++ b/resources/server/router.php
@@ -23,11 +23,11 @@ define('SERVER_TMP_DIR', '.cecil');
 define('DIRECTORY_INDEX', '/index.html');
 define('ERROR_404', '/404.html');
 $isIndex = null;
 $mediaSubtypeText = ['javascript', 'xml', 'json', 'ld+json', 'csv'];
 
-$path = urldecode(parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH));
+$path = htmlspecialchars(urldecode(parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH)));
 
 // watcher (called by 'livereload.js')
 if ($path == '/watcher') {
     header("Content-Type: text/event-stream\n\n");
     header('Cache-Control: no-cache');
@@ -48,11 +48,11 @@ if ((empty(pathinfo($path, PATHINFO_EXTENSION)) || $path[-1] == '/') && file_exi
 
 // file absolute path
 $filename = $_SERVER['DOCUMENT_ROOT'] . $path;
 
 // HTTP response: 404
-if (!file_exists($filename) || is_dir($filename)) {
+if ((realpath($filename) === false || strpos(realpath($filename), realpath($_SERVER['DOCUMENT_ROOT'])) !== 0) || !file_exists($filename) || is_dir($filename)) {
     http_response_code(404);
     // favicon.ico
     if ($path == '/favicon.ico') {
         header('Content-Type: image/vnd.microsoft.icon');
 

Vulnerable code: $path = urldecode(parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH));
if (!file_exists($filename) || is_dir($filename)) {
Fixed code: $path = htmlspecialchars(urldecode(parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH)));
if ((realpath($filename) === false || strpos(realpath($filename), realpath($_SERVER['DOCUMENT_ROOT'])) !== 0) || !file_exists($filename) || is_dir($filename)) {
CVE-2021-31571: Integer Overflow or Wraparound (CWE-190)
value: The kernel in Amazon Web Services FreeRTOS before 10.4.3 has an integer overflow in queue.c for queue creation.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 9.8
Published: 2021-04-22T18:15Z
Repository: https://github.com/FreeRTOS/FreeRTOS-Kernel
Language: C
Files changed: queue.c
Commit date: 2020-12-07 11:48:51 -0800
Commit message: add assert for addition overflow on queue creation (#225)


Diff: diff --git a/queue.c b/queue.c
index d2e27e55a..b01dfd11f 100644
--- a/queue.c
+++ b/queue.c
@@ -395,10 +395,13 @@ BaseType_t xQueueGenericReset( QueueHandle_t xQueue,
         xQueueSizeInBytes = ( size_t ) ( uxQueueLength * uxItemSize ); /*lint !e961 MISRA exception as the casts are only redundant for some ports. */
 
         /* Check for multiplication overflow. */
         configASSERT( ( uxItemSize == 0 ) || ( uxQueueLength == ( xQueueSizeInBytes / uxItemSize ) ) );
 
+        /* Check for addition overflow. */
+        configASSERT( ( sizeof( Queue_t ) + xQueueSizeInBytes ) >  xQueueSizeInBytes );
+
         /* Allocate the queue and storage area.  Justification for MISRA
          * deviation as follows:  pvPortMalloc() always ensures returned memory
          * blocks are aligned per the requirements of the MCU stack.  In this case
          * pvPortMalloc() must return a pointer that is guaranteed to meet the
          * alignment requirements of the Queue_t structure - which in this case

Fixed code:         /* Check for addition overflow. */
        configASSERT( ( sizeof( Queue_t ) + xQueueSizeInBytes ) >  xQueueSizeInBytes );
CVE-2020-11004: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: SQL Injection was discovered in Admidio before version 3.3.13. The main cookie parameter is concatenated into a SQL query without any input validation/sanitization, thus an attacker without logging in, can send a GET request with arbitrary SQL queries appended to the cookie parameter and execute SQL queries. The vulnerability impacts the confidentiality of the system. This has been patched in version 3.3.13.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 7.5
Published: 2020-04-24T21:15Z
Repository: https://github.com/Admidio/admidio
Language: PHP
Files changed: adm_program/system/classes/TableAccess.php
Commit date: 2020-04-12 21:29:04 +0200
Commit message: Unauthenticated Blind SQL injection #908

Diff: diff --git a/adm_program/system/classes/TableAccess.php b/adm_program/system/classes/TableAccess.php
index a9a76e640..9d0420936 100644
--- a/adm_program/system/classes/TableAccess.php
+++ b/adm_program/system/classes/TableAccess.php
@@ -442,15 +442,15 @@ class TableAccess
         $sqlWhereCondition = '';
 
         // add every array element as a sql condition to the condition string
         foreach ($columnArray as $columnName => $columnValue)
         {
-            $sqlWhereCondition .= ' AND ' . $columnName . ' = \'' . $columnValue . '\' ';
+            $sqlWhereCondition .= ' AND ' . $columnName . ' = ? ';
         }
 
         // call method to read data out of database
-        $returnCode = $this->readData($sqlWhereCondition);
+        $returnCode = $this->readData($sqlWhereCondition, array_values($columnArray));
 
         // save the array fields in the object
         if (!$returnCode)
         {
             foreach ($columnArray as $columnName => $columnValue)

Vulnerable code:             $sqlWhereCondition .= ' AND ' . $columnName . ' = \'' . $columnValue . '\' ';
        $returnCode = $this->readData($sqlWhereCondition);
Fixed code:             $sqlWhereCondition .= ' AND ' . $columnName . ' = ? ';
        $returnCode = $this->readData($sqlWhereCondition, array_values($columnArray));
CVE-2021-43810: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Admidio is a free open source user management system for websites of organizations and groups. A cross-site scripting vulnerability is present in Admidio prior to version 4.0.12. The Reflected XSS vulnerability occurs because redirect.php does not properly validate the value of the url parameter. Through this vulnerability, an attacker is capable to execute malicious scripts. This issue is patched in version 4.0.12.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-12-07T22:15Z
Repository: https://github.com/Admidio/admidio
Language: Unknown
Commit date: 2021-12-06 18:23:42 +0100
Commit message: Merge pull request from GHSA-3qgf-qgc3-42hh

Improve check of urls
CVE-2014-1459: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: SQL injection vulnerability in dg-admin/index.php in doorGets CMS 5.2 and earlier allows remote authenticated administrators to execute arbitrary SQL commands via the _position_down_id parameter.  NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Published: 2014-02-11T17:55Z
Repository: https://github.com/doorgets/doorGets
Language: Unknown
Commit date: 2014-01-15 18:33:12 +0100
Commit message: Patch sérurity

Diff: diff --git a/setup/data/doorgets.zip b/setup/data/doorgets.zip
index cea1f35..ba08c97 100644
Binary files a/setup/data/doorgets.zip and b/setup/data/doorgets.zip differ
CVE-2020-26262: Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441)
value: Coturn is free open source implementation of TURN and STUN Server. Coturn before version 4.5.2 by default does not allow peers to connect and relay packets to loopback addresses in the range of `127.x.x.x`. However, it was observed that when sending a `CONNECT` request with the `XOR-PEER-ADDRESS` value of `0.0.0.0`, a successful response was received and subsequently, `CONNECTIONBIND` also received a successful response. Coturn then is able to relay packets to the loopback interface. Additionally, when coturn is listening on IPv6, which is default, the loopback interface can also be reached by making use of either `[::1]` or `[::]` as the peer address. By using the address `0.0.0.0` as the peer address, a malicious user will be able to relay packets to the loopback interface, unless `--denied-peer-ip=0.0.0.0` (or similar) has been specified. Since the default configuration implies that loopback peers are not allowed, coturn administrators may choose to not set the `denied-peer-ip` setting. The issue patched in version 4.5.2. As a workaround the addresses in the address block `0.0.0.0/8`, `[::1]` and `[::]` should be denied by default unless `--allow-loopback-peers` has been specified.
CWE description: The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.
CVSS v3 base score: 7.2
Published: 2021-01-13T19:15Z
Repository: https://github.com/coturn/coturn
Language: Unknown
Commit date: 2021-01-10 20:59:14 +0100
Commit message: Merge branch 'advisory-fix-1' CVE-2020-26262
CVE-2020-26262: Incorrect Calculation (CWE-682)
value: Coturn is free open source implementation of TURN and STUN Server. Coturn before version 4.5.2 by default does not allow peers to connect and relay packets to loopback addresses in the range of `127.x.x.x`. However, it was observed that when sending a `CONNECT` request with the `XOR-PEER-ADDRESS` value of `0.0.0.0`, a successful response was received and subsequently, `CONNECTIONBIND` also received a successful response. Coturn then is able to relay packets to the loopback interface. Additionally, when coturn is listening on IPv6, which is default, the loopback interface can also be reached by making use of either `[::1]` or `[::]` as the peer address. By using the address `0.0.0.0` as the peer address, a malicious user will be able to relay packets to the loopback interface, unless `--denied-peer-ip=0.0.0.0` (or similar) has been specified. Since the default configuration implies that loopback peers are not allowed, coturn administrators may choose to not set the `denied-peer-ip` setting. The issue patched in version 4.5.2. As a workaround the addresses in the address block `0.0.0.0/8`, `[::1]` and `[::]` should be denied by default unless `--allow-loopback-peers` has been specified.
CWE description: The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.
CVSS v3 base score: 7.2
Published: 2021-01-13T19:15Z
Repository: https://github.com/coturn/coturn
Language: Unknown
Commit date: 2021-01-10 20:59:14 +0100
Commit message: Merge branch 'advisory-fix-1' CVE-2020-26262
CVE-2015-5381: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-05-23T04:29Z
Repository: https://github.com/roundcube/roundcubemail
Language: Other
Files changed: CHANGELOG, program/include/rcmail.php
Commit date: 2015-05-30 17:37:06 +0200
Commit message: Fix XSS vulnerability in _mbox argument handling (#1490417)

Diff: diff --git a/CHANGELOG b/CHANGELOG
index c85849354..6090318a0 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -37,10 +37,11 @@ RELEASE 1.1.2
 - Fix attached file path unsetting in database_attachments plugin (#1490393)
 - Fix issues when using moduserprefs.sh without --user argument (#1490399)
 - Fix potential info disclosure issue by protecting directory access (#1490378)
 - Fix blank image in html_signature when saving identity changes (#1490412)
 - Installer: Use openssl_random_pseudo_bytes() (if available) to generate des_key (#1490402)
+- Fix XSS vulnerability in _mbox argument handling (#1490417)
 
 RELEASE 1.1.1
 -------------
 - ACL: Allow other plugins to adjust the list of permissions and groups to edit
 - Add possibility to print contact information (of a single contact)
diff --git a/program/include/rcmail.php b/program/include/rcmail.php
index e3e45e235..490e836d0 100644
--- a/program/include/rcmail.php
+++ b/program/include/rcmail.php
@@ -1820,11 +1820,11 @@ class rcmail extends rcube
             else if (stripos($err_str, 'quot') !== false && preg_match('/exceed|over/i', $err_str)) {
                 $error = 'erroroverquota';
             }
             else {
                 $error = 'servererrormsg';
-                $args  = array('msg' => $err_str);
+                $args  = array('msg' => rcube::Q($err_str));
             }
         }
         else if ($err_code < 0) {
             $error = 'storageerror';
         }

Vulnerable code:                 $args  = array('msg' => $err_str);
Fixed code: - Fix XSS vulnerability in _mbox argument handling (#1490417)
                $args  = array('msg' => rcube::Q($err_str));
CVE-2015-5382: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when uploading a vCard.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 6.5
Published: 2017-05-23T04:29Z
Repository: https://github.com/roundcube/roundcubemail
Language: Other
Files changed: CHANGELOG, program/steps/addressbook/photo.inc
Commit date: 2015-05-07 08:45:19 +0200
Commit message: Fix security issue in contact photo handling (#1490379)

Diff: diff --git a/CHANGELOG b/CHANGELOG
index 2486a72e2..9014509aa 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -22,10 +22,11 @@ CHANGELOG Roundcube Webmail
 - Fix bug where forced extwin page reload could exit from the extwin mode (#1490350)
 - Fix bug where some unrelated attachments in multipart/related message were not listed (#1490355)
 - Fix mouseup event handling when dragging a list record (#1490359)
 - Fix bug where preview_pane setting wasn't always saved into user preferences (#1490362)
 - Fix bug where messages count was not updated after message move/delete with skip_deleted=false (#1490372)
+- Fix security issue in contact photo handling (#1490379)
 
 RELEASE 1.1.1
 -------------
 - ACL: Allow other plugins to adjust the list of permissions and groups to edit
 - Add possibility to print contact information (of a single contact)
diff --git a/program/steps/addressbook/photo.inc b/program/steps/addressbook/photo.inc
index 962ca3126..0bc167e15 100644
--- a/program/steps/addressbook/photo.inc
+++ b/program/steps/addressbook/photo.inc
@@ -78,15 +78,10 @@ $data = $plugin['data'];
 // detect if photo data is an URL
 if (strlen($data) < 1024 && filter_var($data, FILTER_VALIDATE_URL)) {
     $RCMAIL->output->redirect($data);
 }
 
-// deliver alt image
-if (!$data && ($alt_img = rcube_utils::get_input_value('_alt', rcube_utils::INPUT_GPC)) && is_file($alt_img)) {
-    $data = file_get_contents($alt_img);
-}
-
 // cache for one day if requested by email
 if (!$cid && $email) {
     $RCMAIL->output->future_expire_header(86400);
 }
 

Vulnerable code: // deliver alt image
if (!$data && ($alt_img = rcube_utils::get_input_value('_alt', rcube_utils::INPUT_GPC)) && is_file($alt_img)) {
    $data = file_get_contents($alt_img);
}

Fixed code: - Fix security issue in contact photo handling (#1490379)
CVE-2024-34073: Insufficient Information (NVD-CWE-noinfo)
value: sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker. In affected versions the capture_dependencies function in `sagemaker.serve.save_retrive.version_1_0_0.save.utils` module allows for potentially unsafe Operating System (OS) Command Injection if inappropriate command is passed as the “requirements_path” parameter. This consequently may allow an unprivileged third party to cause remote code execution, denial of service, affecting both confidentiality and integrity. This issue has been addressed in version 2.214.3. Users are advised to upgrade. Users unable to upgrade should not override the “requirements_path” parameter of capture_dependencies function in `sagemaker.serve.save_retrive.version_1_0_0.save.utils`, and instead use the default value.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-03T11:15Z
Repository: https://github.com/aws/sagemaker-python-sdk
Language: Python
Files changed: src/sagemaker/serve/save_retrive/version_1_0_0/save/utils.py
Commit date: 2024-04-02 14:50:01 -0700
Commit message: [Fix] Switch to subprocess in ModelBuilder when capturing dependencies (#4556)

* [Fix] Switch to subprogress in ModelBuilder when capturing dependencies

* Fix style issues and explicitly set check to true
Diff: diff --git a/src/sagemaker/serve/save_retrive/version_1_0_0/save/utils.py b/src/sagemaker/serve/save_retrive/version_1_0_0/save/utils.py
index 73700664..305b66fa 100644
--- a/src/sagemaker/serve/save_retrive/version_1_0_0/save/utils.py
+++ b/src/sagemaker/serve/save_retrive/version_1_0_0/save/utils.py
@@ -3,10 +3,11 @@ from __future__ import absolute_import
 import secrets
 import hmac
 import hashlib
 import os
 import logging
+import subprocess
 import sys
 import platform
 from collections import defaultdict
 from pathlib import Path
 import tempfile
@@ -96,14 +97,14 @@ def capture_dependencies(requirements_path: str):
         sagemaker_dependency = f"{sagemaker.__package__}=={sagemaker.__version__}"
         with open(requirements_path, "w") as f:
             f.write(sagemaker_dependency)
         return
 
-    command = f"pigar gen -f {Path(requirements_path)} {os.getcwd()}"
-    logging.info("Running command %s", command)
+    command = ["pigar", "gen", "-f", str(Path(requirements_path)), str(os.getcwd())]
+    logging.info("Running command: %s", " ".join(command))
 
-    os.system(command)
+    subprocess.run(command, check=True, capture_output=True)
     logger.info("Dependencies captured successfully")
 
 
 def capture_optimization_metadata(model: Model, framework) -> dict:
     """Placeholder docstring"""

Vulnerable code:     command = f"pigar gen -f {Path(requirements_path)} {os.getcwd()}"
    logging.info("Running command %s", command)
    os.system(command)
Fixed code: import subprocess
    command = ["pigar", "gen", "-f", str(Path(requirements_path)), str(os.getcwd())]
    logging.info("Running command: %s", " ".join(command))
    subprocess.run(command, check=True, capture_output=True)
CVE-2023-51700: Deserialization of Untrusted Data (CWE-502)
value: Unofficial Mobile BankID Integration for WordPress lets users employ Mobile BankID to authenticate themselves on your WordPress site. Prior to 1.0.1, WP-Mobile-BankID-Integration is affected by a vulnerability classified as a Deserialization of Untrusted Data vulnerability, specifically impacting scenarios where an attacker can manipulate the database. If unauthorized actors gain access to the database, they could exploit this vulnerability to execute object injection attacks. This could lead to unauthorized code execution, data manipulation, or data exfiltration within the WordPress environment.  Users of the plugin should upgrade to version 1.0.1 (or later), where the serialization and deserialization of OrderResponse objects have been switched out to an array stored as JSON.  A possible workaround for users unable to upgrade immediately is to enforce stricter access controls on the database, ensuring that only trusted and authorized entities can modify data. Additionally, implementing monitoring tools to detect unusual database activities could help identify and mitigate potential exploitation attempts.

CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 9.8
Published: 2023-12-27T18:15Z
Repository: https://github.com/jamieblomerus/WP-Mobile-BankID-Integration
Language: Unknown
Commit date: 2023-12-25 16:15:41 +0100
Commit message: Merge pull request from GHSA-pqwp-qrp7-grg4

Fixed CWE-502 vulnerability
CVE-2024-36127: Insufficient Information (NVD-CWE-noinfo)
value: apko is an apk-based OCI image builder. apko exposures HTTP basic auth credentials from repository and keyring URLs in log output. This vulnerability is fixed in v0.14.5.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-06-03T15:15Z
Repository: https://github.com/chainguard-dev/apko
Language: Go
Files changed: pkg/build/types/types.go
Commit date: 2024-05-29 12:28:30 -0400
Commit message: fix: redact URLs in config marshaling

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>

Diff: diff --git a/pkg/build/types/types.go b/pkg/build/types/types.go
index e53fb8e..1e1273b 100644
--- a/pkg/build/types/types.go
+++ b/pkg/build/types/types.go
@@ -14,10 +14,11 @@
 
 package types
 
 import (
 	"fmt"
+	"net/url"
 	"runtime"
 	"sort"
 
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 )
@@ -93,10 +94,37 @@ type ImageContents struct {
 	Packages []string `json:"packages,omitempty" yaml:"packages,omitempty"`
 	// Optional: Base image to build on top of. Warning: Experimental.
 	BaseImage *BaseImageDescriptor `json:"baseimage,omitempty" yaml:"baseimage,omitempty"`
 }
 
+// MarshalYAML implements yaml.Marshaler for ImageContents, redacting URLs in
+// the ImageContents struct fields.
+func (i ImageContents) MarshalYAML() (interface{}, error) {
+	type redactedImageContents ImageContents
+	ri := redactedImageContents(i)
+
+	for idx, repo := range ri.Repositories {
+		rawURL := repo
+		parsed, err := url.Parse(rawURL)
+		if err != nil {
+			return nil, fmt.Errorf("parsing repository URL: %w", err)
+		}
+		ri.Repositories[idx] = parsed.Redacted()
+	}
+
+	for idx, key := range ri.Keyring {
+		rawURL := key
+		parsed, err := url.Parse(rawURL)
+		if err != nil {
+			return nil, fmt.Errorf("parsing public key URL: %w", err)
+		}
+		ri.Keyring[idx] = parsed.Redacted()
+	}
+
+	return ri, nil
+}
+
 type ImageEntrypoint struct {
 	// Optional: The type of entrypoint. Only "service-bundle" is supported.
 	Type string `json:"type,omitempty"`
 	// Required: The command of the entrypoint
 	Command string `json:"command,omitempty"`

Fixed code: 	"net/url"
// MarshalYAML implements yaml.Marshaler for ImageContents, redacting URLs in
// the ImageContents struct fields.
func (i ImageContents) MarshalYAML() (interface{}, error) {
	type redactedImageContents ImageContents
	ri := redactedImageContents(i)

	for idx, repo := range ri.Repositories {
		rawURL := repo
		parsed, err := url.Parse(rawURL)
		if err != nil {
			return nil, fmt.Errorf("parsing repository URL: %w", err)
		}
		ri.Repositories[idx] = parsed.Redacted()
	}

	for idx, key := range ri.Keyring {
		rawURL := key
		parsed, err := url.Parse(rawURL)
		if err != nil {
			return nil, fmt.Errorf("parsing public key URL: %w", err)
		}
		ri.Keyring[idx] = parsed.Redacted()
	}

	return ri, nil
}
CVE-2013-0250: Other (NVD-CWE-Other)
value: The init_nss_hash function in exec/totemcrypto.c in Corosync 2.0 before 2.3 does not properly initialize the HMAC key, which allows remote attackers to cause a denial of service (crash) via a crafted packet.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Published: 2014-06-06T14:55Z
Repository: https://github.com/corosync/corosync
Language: C
Files changed: exec/totemcrypto.c
Commit date: 2013-01-14 11:23:32 +0100
Commit message: totemcrypto: fix hmac key initialization

Signed-off-by: Fabio M. Di Nitto <fdinitto@redhat.com>
Reviewed-by: Jan Friesse <jfriesse@redhat.com>

Diff: diff --git a/exec/totemcrypto.c b/exec/totemcrypto.c
index 44faaaf5..90cbb248 100644
--- a/exec/totemcrypto.c
+++ b/exec/totemcrypto.c
@@ -476,12 +476,12 @@ static int init_nss_hash(struct crypto_instance *instance)
 	if (!hash_to_nss[instance->crypto_hash_type]) {
 		return 0;
 	}
 
 	hash_param.type = siBuffer;
-	hash_param.data = 0;
-	hash_param.len = 0;
+	hash_param.data = instance->private_key;
+	hash_param.len = instance->private_key_len;
 
 	hash_slot = PK11_GetBestSlot(hash_to_nss[instance->crypto_hash_type], NULL);
 	if (hash_slot == NULL) {
 		log_printf(instance->log_level_security, "Unable to find security slot (err %d)",
 			   PR_GetError());

Vulnerable code: 	hash_param.data = 0;
	hash_param.len = 0;
Fixed code: 	hash_param.data = instance->private_key;
	hash_param.len = instance->private_key_len;
CVE-2019-19576: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 9.8
Published: 2019-12-04T18:15Z
Repository: https://github.com/getk2/k2
Language: PHP
Files changed: media/k2/assets/vendors/verot/class.upload.php/src/class.upload.php
Commit date: 2019-12-03 21:14:08 +0200
Commit message: Update class.upload.php

Diff: diff --git a/media/k2/assets/vendors/verot/class.upload.php/src/class.upload.php b/media/k2/assets/vendors/verot/class.upload.php/src/class.upload.php
index 5e992d99..683d67d8 100755
--- a/media/k2/assets/vendors/verot/class.upload.php/src/class.upload.php
+++ b/media/k2/assets/vendors/verot/class.upload.php/src/class.upload.php
@@ -2990,11 +2990,11 @@ class upload {
                         $this->log .= '- file renamed as ' . $file_src_name_body . '.' . $file_src_name_ext . '!<br />';
                     }
                 }
                 // if the file is text based, or has a dangerous extension, we rename it as .txt
                 if ((((substr($this->file_src_mime, 0, 5) == 'text/' && $this->file_src_mime != 'text/rtf') || strpos($this->file_src_mime, 'javascript') !== false)  && (substr($file_src_name, -4) != '.txt'))
-                    || preg_match('/\.(php|php5|php4|php3|phtml|pl|py|cgi|asp|js)$/i', $this->file_src_name)
+                    || preg_match('/\.(asp|cgi|js|ph3|ph4|ph5|ph7|phar|php|php3|php4|php5|php7|phps|phtml|pl|py)$/i', $this->file_src_name)
                     || $this->file_force_extension && empty($file_src_name_ext)) {
                     $this->file_src_mime = 'text/plain';
                     if ($this->file_src_name_ext) $file_src_name_body = $file_src_name_body . '.' . $this->file_src_name_ext;
                     $file_src_name_ext = 'txt';
                     $file_src_name = $file_src_name_body . '.' . $file_src_name_ext;

Vulnerable code:                     || preg_match('/\.(php|php5|php4|php3|phtml|pl|py|cgi|asp|js)$/i', $this->file_src_name)
Fixed code:                     || preg_match('/\.(asp|cgi|js|ph3|ph4|ph5|ph7|phar|php|php3|php4|php5|php7|phps|phtml|pl|py)$/i', $this->file_src_name)
CVE-2012-1597: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in the textEncode function in classes/ezjscajaxcontent.php in eZ JS Core in eZ Publish before 1.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2012-08-17T00:55Z
Repository: https://github.com/ezsystems/ezjscore
Language: PHP
Files changed: classes/ezjscajaxcontent.php
Commit date: 2012-05-09 12:17:22 +0200
Commit message: Fixed #019245: XSS exploit on eZJSCore RUN command

Diff: diff --git a/classes/ezjscajaxcontent.php b/classes/ezjscajaxcontent.php
index bab1cf9..97610b1 100644
--- a/classes/ezjscajaxcontent.php
+++ b/classes/ezjscajaxcontent.php
@@ -125,11 +125,11 @@ class ezjscAjaxContent
     public static function textEncode( $mix )
     {
         if ( is_array( $mix ) )
             return implode(',', array_map( array('ezjscAjaxContent', 'textEncode'), array_filter( $mix ) ) );
 
-        return $mix;
+        return htmlspecialchars( $mix );
     }
 
     /**
      * Function for encoding content object(s) or node(s) to simplified
      * json objects, xml or array hash

Vulnerable code:         return $mix;
Fixed code:         return htmlspecialchars( $mix );
CVE-2024-28861: Insufficient Information (NVD-CWE-noinfo)
value: Symfony 1 is a community-driven fork of the 1.x branch of Symfony, a PHP framework for web projects. Starting in version 1.1.0 and prior to version 1.5.19, Symfony 1 has a gadget chain due to dangerous deserialization in `sfNamespacedParameterHolder` class that would enable an attacker to get remote code execution if a developer deserializes user input in their project. Version 1.5.19 contains a patch for the issue.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-22T17:15Z
Repository: https://github.com/FriendsOfSymfony1/symfony1
Language: PHP
Files changed: lib/util/sfNamespacedParameterHolder.class.php, lib/util/sfParameterHolder.class.php
Commit date: 2024-03-19 13:46:06 +0100
Commit message: Hotfix: Add type checking for deserialized data in sfParameterHolder and sfNamespacedParameterHolder (CVE-2024-28861)

Diff: diff --git a/lib/util/sfNamespacedParameterHolder.class.php b/lib/util/sfNamespacedParameterHolder.class.php
index 9b816c7..85ae559 100644
--- a/lib/util/sfNamespacedParameterHolder.class.php
+++ b/lib/util/sfNamespacedParameterHolder.class.php
@@ -51,15 +51,23 @@ class sfNamespacedParameterHolder extends sfParameterHolder
         return [$this->default_namespace, $this->parameters];
     }
 
     /**
      * Unserializes a sfParameterHolder instance for PHP 7.4+.
+     * [CVE-2024-28861] Check type of returned data to avoid deserialization vulnerabilities.
      *
      * @param array $data
      */
     public function __unserialize($data)
     {
+        if (!is_array($data) || 2 !== \count($data)) {
+            $this->default_namespace = null;
+            $this->parameters = [];
+
+            return;
+        }
+
         $this->default_namespace = $data[0];
         $this->parameters = $data[1];
     }
 
     /**
diff --git a/lib/util/sfParameterHolder.class.php b/lib/util/sfParameterHolder.class.php
index 45ce953..82544b9 100644
--- a/lib/util/sfParameterHolder.class.php
+++ b/lib/util/sfParameterHolder.class.php
@@ -39,15 +39,22 @@ class sfParameterHolder implements Serializable
         return $this->parameters;
     }
 
     /**
      * Unserializes a sfParameterHolder instance for PHP 7.4+.
+     * [CVE-2024-28861] Check type of returned data to avoid deserialization vulnerabilities.
      *
      * @param array $data
      */
     public function __unserialize($data)
     {
+        if (!is_array($data)) {
+            $this->parameters = [];
+
+            return;
+        }
+
         $this->parameters = $data;
     }
 
     /**
      * Clears all parameters associated with this request.

Fixed code:      * [CVE-2024-28861] Check type of returned data to avoid deserialization vulnerabilities.
        if (!is_array($data) || 2 !== \count($data)) {
            $this->default_namespace = null;
            $this->parameters = [];

            return;
        }

     * [CVE-2024-28861] Check type of returned data to avoid deserialization vulnerabilities.
        if (!is_array($data)) {
            $this->parameters = [];

            return;
        }
CVE-2021-28662: Improper Encoding or Escaping of Output (CWE-116)
value: An issue was discovered in Squid 4.x before 4.15 and 5.x before 5.0.6. If a remote server sends a certain response header over HTTP or HTTPS, there is a denial of service. This header can plausibly occur in benign network traffic.
CWE description: The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CVSS v3 base score: 6.5
Published: 2021-05-27T12:15Z
Repository: https://github.com/squid-cache/squid
Language: C++
Files changed: src/http/RegisteredHeaders.cc
Commit date: 2021-03-16 11:45:11 -0400
Commit message: Merge pull request from GHSA-jjq6-mh2h-g39h


Diff: diff --git a/src/http/RegisteredHeaders.cc b/src/http/RegisteredHeaders.cc
index a4f96db2b..84f177af2 100644
--- a/src/http/RegisteredHeaders.cc
+++ b/src/http/RegisteredHeaders.cc
@@ -35,11 +35,11 @@ HeaderTableRecord::HeaderTableRecord(const char *n, HdrType theId, HdrFieldType
 {}
 
 const HeaderTableRecord&
 HeaderLookupTable_t::lookup (const char *buf, const std::size_t len) const {
     const HeaderTableRecord *r = HttpHeaderHashTable::lookup(buf, len);
-    if (!r)
+    if (!r || r->id == Http::HdrType::OTHER)
         return BadHdr;
     return *r;
 }
 const HeaderTableRecord HeaderLookupTable_t::BadHdr {"*INVALID*:", Http::HdrType::BAD_HDR, Http::HdrFieldType::ftInvalid, HdrKind::None};
 

Vulnerable code:     if (!r)
Fixed code:     if (!r || r->id == Http::HdrType::OTHER)
CVE-2023-46724: Improper Certificate Validation (CWE-295)
value:  Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version 6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. Those who you use a prepackaged version of Squid should refer to the package vendor for availability information on updated packages.
CWE description: The product does not validate, or incorrectly validates, a certificate.
CVSS v3 base score: 7.5
Published: 2023-11-01T20:15Z
Repository: https://github.com/squid-cache/squid
Language: C++
Files changed: src/anyp/Uri.cc
Commit date: 2023-10-18 08:27:30 +0000
Commit message: Fix validation of certificates with CN=* (#1523)

The bug was discovered and detailed by Joshua Rogers at
https://megamansec.github.io/Squid-Security-Audit/
where it was filed as "Buffer UnderRead in SSL CN Parsing".
Diff: diff --git a/src/anyp/Uri.cc b/src/anyp/Uri.cc
index 3eed2366ab..ef77d4f766 100644
--- a/src/anyp/Uri.cc
+++ b/src/anyp/Uri.cc
@@ -173,10 +173,14 @@ urlInitialize(void)
     assert(0 == matchDomainName("*.foo.com", "x.foo.com", mdnHonorWildcards));
     assert(0 == matchDomainName("*.foo.com", ".x.foo.com", mdnHonorWildcards));
     assert(0 == matchDomainName("*.foo.com", ".foo.com", mdnHonorWildcards));
     assert(0 != matchDomainName("*.foo.com", "foo.com", mdnHonorWildcards));
 
+    assert(0 != matchDomainName("foo.com", ""));
+    assert(0 != matchDomainName("foo.com", "", mdnHonorWildcards));
+    assert(0 != matchDomainName("foo.com", "", mdnRejectSubsubDomains));
+
     /* more cases? */
 }
 
 /**
  * Extract the URI scheme and ':' delimiter from the given input buffer.
@@ -826,10 +830,12 @@ matchDomainName(const char *h, const char *d, MatchDomainNameFlags flags)
 
     if (hl == 0)
         return -1;
 
     dl = strlen(d);
+    if (dl == 0)
+        return 1;
 
     /*
      * Start at the ends of the two strings and work towards the
      * beginning.
      */

Fixed code:     assert(0 != matchDomainName("foo.com", ""));
    assert(0 != matchDomainName("foo.com", "", mdnHonorWildcards));
    assert(0 != matchDomainName("foo.com", "", mdnRejectSubsubDomains));

    if (dl == 0)
        return 1;
CVE-2015-6250: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: simple-php-captcha before commit 9d65a945029c7be7bb6bc893759e74c5636be694 allows remote attackers to automatically generate the captcha response by running the same code on the client-side.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 5.3
Published: 2017-09-06T21:29Z
Repository: https://github.com/claviska/simple-php-captcha
Language: Unknown
Commit date: 2015-08-31 18:05:22 -0400
Commit message: Merge pull request #17 from ALSchwalm/master

Switch from rand to mt_rand