Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2013-1756: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Published: 2014-06-09T19:55Z
Repository: https://github.com/markevans/dragonfly
Language: Markdown
Files changed: README.md
Commit date: 2013-02-19 10:44:47 +0000
Commit message: security update note
Diff: diff --git a/README.md b/README.md
index 0769d96..01d2c6e 100644
--- a/README.md
+++ b/README.md
@@ -5,10 +5,12 @@ Dragonfly is a <a href="http://rack.rubyforge.org">Rack</a> framework for on-the
 
 Ideal for using with Ruby on Rails (2.3 and 3), Sinatra and all that gubbins.
 
 However, Dragonfly is NOT JUST FOR RAILS, and NOT JUST FOR IMAGES!!
 
+**IMPORTANT: if you're running a version between 0.7.0 and 0.9.12, please update to 0.9.14 for a security update [details here](https://groups.google.com/forum/?fromgroups=#!topic/dragonfly-users/3c3WIU3VQTo)**
+
 For the lazy Rails user...
 --------------------------
 **Gemfile**:
 
 ```ruby

Fixed code: **IMPORTANT: if you're running a version between 0.7.0 and 0.9.12, please update to 0.9.14 for a security update [details here](https://groups.google.com/forum/?fromgroups=#!topic/dragonfly-users/3c3WIU3VQTo)**
CVE-2021-33473: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)
value: An argument injection vulnerability in Dragonfly Ruby Gem v1.3.0 allows attackers to read and write arbitrary files when the verify_url option is disabled. This vulnerability is exploited via a crafted URL.
CWE description: The product constructs a string for a command to be executed by a separate component
in another control sphere, but it does not properly delimit the
intended arguments, options, or switches within that command string.
CVSS v3 base score: 9.1
Published: 2022-06-02T20:15Z
Repository: https://github.com/markevans/dragonfly
Language: Unknown
Commit date: 2021-05-19 09:49:04 +0100
Commit message: Merge branch 'better-security'
CVE-2021-33564: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)
value: An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verify_url option is disabled. This may lead to code execution. The problem occurs because the generate and process features mishandle use of the ImageMagick convert utility.
CWE description: The product constructs a string for a command to be executed by a separate component
in another control sphere, but it does not properly delimit the
intended arguments, options, or switches within that command string.
CVSS v3 base score: 9.8
Published: 2021-05-29T14:15Z
Repository: https://github.com/markevans/dragonfly
Language: Unknown
Commit date: 2021-05-19 09:49:04 +0100
Commit message: Merge branch 'better-security'
CVE-2023-26483: Other (NVD-CWE-Other)
value: gosaml2 is a Pure Go implementation of SAML 2.0. SAML Service Providers using this library for SAML authentication support are likely susceptible to Denial of Service attacks. A bug in this library enables attackers to craft a `deflate`-compressed request which will consume significantly more memory during processing than the size of the original request. This may eventually lead to memory exhaustion and the process being killed. The maximum compression ratio achievable with `deflate` is 1032:1, so by limiting the size of bodies passed to gosaml2, limiting the rate and concurrency of calls, and ensuring that lots of memory is available to the process it _may_ be possible to help Go's garbage collector "keep up". Implementors are encouraged not to rely on this. This issue is fixed  in version 0.9.0.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 5.3
Published: 2023-03-03T23:15Z
Repository: https://github.com/russellhaering/gosaml2
Language: Unknown
Commit date: 2023-03-01 13:48:05 -0800
Commit message: Merge pull request from GHSA-6gc3-crp7-25w5

Configurable deflate-bomb protection
CVE-2014-2570: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in www/make_subset.php in PHP Font Lib before 0.3.1 allows remote attackers to inject arbitrary web script or HTML via the name parameter.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2015-08-31T18:59Z
Repository: https://github.com/PhenX/php-font-lib
Language: PHP
Files changed: www/make_subset.php
Commit date: 2014-03-19 18:15:11 +0100
Commit message: Fix a possible XSS

Diff: diff --git a/www/make_subset.php b/www/make_subset.php
index 377169b..812cb5e 100644
--- a/www/make_subset.php
+++ b/www/make_subset.php
@@ -59,11 +59,11 @@ if (isset($_POST["subset"])) {
   <meta charset="utf-8" />
   <title>Subset maker</title>
   <link rel="stylesheet" href="css/style.css" />
 </head>
 <body>
-  <h1><?php echo $name; ?></h1>
+  <h1><?php echo htmlentities($name); ?></h1>
   <form name="make-subset" method="post" action="?fontfile=<?php echo $fontfile; ?>">
     <label>
       Insert the text from which you want the glyphs in the subsetted font: <br />
       <textarea name="subset" cols="50" rows="20"></textarea>
     </label>

Vulnerable code:   <h1><?php echo $name; ?></h1>
Fixed code:   <h1><?php echo htmlentities($name); ?></h1>
CVE-2021-4305: Inefficient Regular Expression Complexity (CWE-1333)
value: A vulnerability was found in Woorank robots-txt-guard. It has been rated as problematic. Affected by this issue is the function makePathPattern of the file lib/patterns.js. The manipulation of the argument pattern leads to inefficient regular expression complexity. The exploit has been disclosed to the public and may be used. The name of the patch is c03827cd2f9933619c23894ce7c98401ea824020. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217448.
CWE description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CVSS v3 base score: 7.5
Published: 2023-01-05T11:15Z
Repository: https://github.com/Woorank/robots-txt-guard
Language: Unknown
Commit date: 2021-02-07 13:40:28 +0100
Commit message: Merge pull request #4 from Woorank/redos

Mitigate against Redos
CVE-2024-34064: Insufficient Information (NVD-CWE-noinfo)
value: Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for CVE-2024-22195 only addressed spaces but not other characters. Accepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe. This vulnerability is fixed in 3.1.4.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-06T15:15Z
Repository: https://github.com/pallets/jinja
Language: Unknown
Commit date: 2024-05-05 16:35:24 -0700
Commit message: Merge pull request from GHSA-h75v-3vvj-5mfj

disallow invalid characters in keys to xmlattr filter
CVE-2013-2126: Resource Management Errors (CWE-399)
value: Multiple double free vulnerabilities in the LibRaw::unpack function in libraw_cxx.cpp in LibRaw before 0.15.2 allow context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a malformed full-color (1) Foveon or (2) sRAW image file.
CWE description: Weaknesses in this category are related to improper management of system resources.
Published: 2013-08-14T15:55Z
Repository: https://github.com/LibRaw/LibRaw
Language: C++
Files changed: src/libraw_cxx.cpp
Commit date: 2013-05-26 11:53:39 +0400
Commit message: prevent double-free() on broken full-color images error handling

Diff: diff --git a/src/libraw_cxx.cpp b/src/libraw_cxx.cpp
index e36c11a..f45521b 100644
--- a/src/libraw_cxx.cpp
+++ b/src/libraw_cxx.cpp
@@ -1142,21 +1142,27 @@ int LibRaw::unpack(void)
                 S.iwidth = S.width;
                 S.iheight= S.height;
                 IO.shrink = 0;
 				S.raw_pitch = S.width*8;
                 // allocate image as temporary buffer, size 
-                imgdata.rawdata.raw_alloc = calloc(S.iwidth*S.iheight,sizeof(*imgdata.image));
-                imgdata.image = (ushort (*)[4]) imgdata.rawdata.raw_alloc;
+                imgdata.rawdata.raw_alloc = 0;
+                imgdata.image = (ushort (*)[4]) calloc(S.iwidth*S.iheight,sizeof(*imgdata.image));
               }
             ID.input->seek(libraw_internal_data.unpacker_data.data_offset, SEEK_SET);
 
 			unsigned m_save = C.maximum;
 			if(load_raw == &LibRaw::unpacked_load_raw && !strcasecmp(imgdata.idata.make,"Nikon"))
 				C.maximum=65535;
             (this->*load_raw)();
 			if(load_raw == &LibRaw::unpacked_load_raw && !strcasecmp(imgdata.idata.make,"Nikon"))
 				C.maximum = m_save;
+			if (decoder_info.decoder_flags & LIBRAW_DECODER_LEGACY)
+			{
+				// successfully decoded legacy image, attach image to raw_alloc
+				imgdata.rawdata.raw_alloc = imgdata.image;
+				imgdata.image = 0; 
+			}
           }
 
         if(imgdata.rawdata.raw_image)
           crop_masked_pixels(); // calculate black levels
 

Vulnerable code:                 imgdata.rawdata.raw_alloc = calloc(S.iwidth*S.iheight,sizeof(*imgdata.image));
                imgdata.image = (ushort (*)[4]) imgdata.rawdata.raw_alloc;
Fixed code:                 imgdata.rawdata.raw_alloc = 0;
                imgdata.image = (ushort (*)[4]) calloc(S.iwidth*S.iheight,sizeof(*imgdata.image));
			if (decoder_info.decoder_flags & LIBRAW_DECODER_LEGACY)
			{
				// successfully decoded legacy image, attach image to raw_alloc
				imgdata.rawdata.raw_alloc = imgdata.image;
				imgdata.image = 0; 
			}
CVE-2018-5813: Loop with Unreachable Exit Condition ('Infinite Loop') (CWE-835)
value: An error within the "parse_minolta()" function (dcraw/dcraw.c) in LibRaw versions prior to 0.18.11 can be exploited to trigger an infinite loop via a specially crafted file.
CWE description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CVSS v3 base score: 6.5
Published: 2018-12-07T22:29Z
Repository: https://github.com/LibRaw/LibRaw
Language: C++
Files changed: dcraw/dcraw.c, internal/dcraw_common.cpp
Commit date: 2018-05-10 11:27:30 +0300
Commit message: Secunia Advisory SA83050: possible infinite loop in parse_minolta()

Diff: diff --git a/dcraw/dcraw.c b/dcraw/dcraw.c
index ace1866c..d1c8895b 100644
--- a/dcraw/dcraw.c
+++ b/dcraw/dcraw.c
@@ -15667,15 +15667,22 @@ void CLASS parse_minolta(int base)
   fseek(ifp, base, SEEK_SET);
   if (fgetc(ifp) || fgetc(ifp) - 'M' || fgetc(ifp) - 'R')
     return;
   order = fgetc(ifp) * 0x101;
   offset = base + get4() + 8;
+#ifdef LIBRAW_LIBRARY_BUILD
+  if(offset>ifp->size()-8) // At least 8 bytes for tag/len
+    offset = ifp->size()-8;
+#endif
+
   while ((save = ftell(ifp)) < offset)
   {
     for (tag = i = 0; i < 4; i++)
       tag = tag << 8 | fgetc(ifp);
     len = get4();
+    if(len < 0)
+      return; // just ignore wrong len?? or raise bad file exception?
     switch (tag)
     {
     case 0x505244: /* PRD */
       fseek(ifp, 8, SEEK_CUR);
       high = get2();
diff --git a/internal/dcraw_common.cpp b/internal/dcraw_common.cpp
index e0060856..6406198f 100644
--- a/internal/dcraw_common.cpp
+++ b/internal/dcraw_common.cpp
@@ -14329,15 +14329,22 @@ void CLASS parse_minolta(int base)
   fseek(ifp, base, SEEK_SET);
   if (fgetc(ifp) || fgetc(ifp) - 'M' || fgetc(ifp) - 'R')
     return;
   order = fgetc(ifp) * 0x101;
   offset = base + get4() + 8;
+#ifdef LIBRAW_LIBRARY_BUILD
+  if(offset>ifp->size()-8) // At least 8 bytes for tag/len
+    offset = ifp->size()-8;
+#endif
+
   while ((save = ftell(ifp)) < offset)
   {
     for (tag = i = 0; i < 4; i++)
       tag = tag << 8 | fgetc(ifp);
     len = get4();
+    if(len < 0)
+      return; // just ignore wrong len?? or raise bad file exception?
     switch (tag)
     {
     case 0x505244: /* PRD */
       fseek(ifp, 8, SEEK_CUR);
       high = get2();

Fixed code: #ifdef LIBRAW_LIBRARY_BUILD
  if(offset>ifp->size()-8) // At least 8 bytes for tag/len
    offset = ifp->size()-8;
#endif

    if(len < 0)
      return; // just ignore wrong len?? or raise bad file exception?
#ifdef LIBRAW_LIBRARY_BUILD
  if(offset>ifp->size()-8) // At least 8 bytes for tag/len
    offset = ifp->size()-8;
#endif

    if(len < 0)
      return; // just ignore wrong len?? or raise bad file exception?
CVE-2020-24870: Out-of-bounds Write (CWE-787)
value: Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in identify.cpp.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.8
Published: 2021-06-02T16:15Z
Repository: https://github.com/LibRaw/LibRaw
Language: C++
Files changed: src/metadata/identify.cpp
Commit date: 2020-08-19 22:01:00 +0300
Commit message: limit loops to MIN(colors,4) in dng fields parser

Diff: diff --git a/src/metadata/identify.cpp b/src/metadata/identify.cpp
index ce60c1ba6..6cc7de0d4 100644
--- a/src/metadata/identify.cpp
+++ b/src/metadata/identify.cpp
@@ -1297,23 +1297,23 @@ void LibRaw::identify_process_dng_fields()
 						FORCC for (int j = 0; j < 3; j++) cm[c][j] =
 							tiff_ifd[sidx].dng_color[colidx].colormatrix[c][j];
 
 						if (calidx[colidx] == sidx)
 						{
-							for (int i = 0; i < colors; i++)
+							for (int i = 0; i < colors && i < 4; i++)
 								FORCC
 								cc[i][c] = tiff_ifd[sidx].dng_color[colidx].calibration[i][c];
 						}
 
 						if (abidx == sidx)
-							for (int i = 0; i < colors; i++)
+							for (int i = 0; i < colors && i < 4; i++)
 								FORCC cc[i][c] *= tiff_ifd[sidx].dng_levels.analogbalance[i];
 						int j;
-						FORCC for (int i = 0; i < 3; i++) for (cam_xyz[c][i] = j = 0;
-							j < colors; j++)
-							cam_xyz[c][i] +=
-							cc[c][j] * cm[j][i]; // add AsShotXY later * xyz[i];
+						FORCC for (int i = 0; i < 3; i++) 
+                            for (cam_xyz[c][i] = j = 0; j < colors && j < 4; j++)
+							    cam_xyz[c][i] +=
+							        cc[c][j] * cm[j][i]; // add AsShotXY later * xyz[i];
 						cam_xyz_coeff(cmatrix, cam_xyz);
 					}
 				}
 			}
 
@@ -1503,11 +1503,11 @@ void LibRaw::identify_process_dng_fields()
 			/* Special case, per_channel blacks in RepeatDim, average for per-channel */
 			int csum[4] = { 0,0,0,0 }, ccount[4] = { 0,0,0,0 };
 			int i = 6;
 			for (unsigned row = 0; row < imgdata.color.dng_levels.dng_cblack[4]; row++)
 				for (unsigned col = 0; col < imgdata.color.dng_levels.dng_cblack[5]; col++)
-					for (unsigned c = 0; c < tiff_samples; c++)
+					for (unsigned c = 0; c < tiff_samples && c < 4; c++)
 					{
 						csum[c] += imgdata.color.dng_levels.dng_cblack[i];
 						ccount[c]++;
 						i++;
 					}

Vulnerable code: 							for (int i = 0; i < colors; i++)
							for (int i = 0; i < colors; i++)
						FORCC for (int i = 0; i < 3; i++) for (cam_xyz[c][i] = j = 0;
							j < colors; j++)
							cam_xyz[c][i] +=
							cc[c][j] * cm[j][i]; // add AsShotXY later * xyz[i];
					for (unsigned c = 0; c < tiff_samples; c++)
Fixed code: 							for (int i = 0; i < colors && i < 4; i++)
							for (int i = 0; i < colors && i < 4; i++)
						FORCC for (int i = 0; i < 3; i++) 
                            for (cam_xyz[c][i] = j = 0; j < colors && j < 4; j++)
							    cam_xyz[c][i] +=
							        cc[c][j] * cm[j][i]; // add AsShotXY later * xyz[i];
					for (unsigned c = 0; c < tiff_samples && c < 4; c++)
CVE-2020-35530: Out-of-bounds Write (CWE-787)
value: In LibRaw, there is an out-of-bounds write vulnerability within the "new_node()" function (libraw\src\x3f\x3f_utils_patched.cpp) that can be triggered via a crafted X3F file.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2022-09-01T18:15Z
Repository: https://github.com/LibRaw/LibRaw
Language: C++
Files changed: internal/x3f_tools.h, src/x3f/x3f_utils_patched.cpp
Commit date: 2020-04-04 19:34:12 +0300
Commit message: X3F: check huffman tree size

Diff: diff --git a/internal/x3f_tools.h b/internal/x3f_tools.h
index 6d8012d86..7e1de0ec7 100644
--- a/internal/x3f_tools.h
+++ b/internal/x3f_tools.h
@@ -211,10 +211,11 @@ typedef struct x3f_huffnode_s
 } x3f_huffnode_t;
 
 typedef struct x3f_hufftree_s
 {
   uint32_t free_node_index; /* Free node index in huffman tree array */
+  uint32_t total_node_index;
   x3f_huffnode_t *nodes;    /* Coding tree */
 } x3f_hufftree_t;
 
 typedef struct x3f_true_huffman_element_s
 {
diff --git a/src/x3f/x3f_utils_patched.cpp b/src/x3f/x3f_utils_patched.cpp
index 9ed2da541..8d59df069 100644
--- a/src/x3f/x3f_utils_patched.cpp
+++ b/src/x3f/x3f_utils_patched.cpp
@@ -177,10 +177,11 @@ static void cleanup_huffman_tree(x3f_hufftree_t *HTP) { free(HTP->nodes); }
 static void new_huffman_tree(x3f_hufftree_t *HTP, int bits)
 {
   int leaves = 1 << bits;
 
   HTP->free_node_index = 0;
+  HTP->total_node_index = HUF_TREE_MAX_NODES(leaves);
   HTP->nodes = (x3f_huffnode_t *)calloc(1, HUF_TREE_MAX_NODES(leaves) *
                                                sizeof(x3f_huffnode_t));
 }
 
 /* --------------------------------------------------------------------- */
@@ -706,10 +707,12 @@ static char *display_code(int length, uint32_t code, char *buffer)
 }
 #endif
 
 static x3f_huffnode_t *new_node(x3f_hufftree_t *tree)
 {
+	if (tree->free_node_index >= tree->total_node_index)
+		throw LIBRAW_EXCEPTION_IO_CORRUPT;
   x3f_huffnode_t *t = &tree->nodes[tree->free_node_index];
 
   t->branch[0] = NULL;
   t->branch[1] = NULL;
   t->leaf = UNDEFINED_LEAF;

Fixed code:   uint32_t total_node_index;
  HTP->total_node_index = HUF_TREE_MAX_NODES(leaves);
	if (tree->free_node_index >= tree->total_node_index)
		throw LIBRAW_EXCEPTION_IO_CORRUPT;
CVE-2020-35531: Out-of-bounds Read (CWE-125)
value: In LibRaw, an out-of-bounds read vulnerability exists within the get_huffman_diff() function (libraw\src\x3f\x3f_utils_patched.cpp) when reading data from an image file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2022-09-01T18:15Z
Repository: https://github.com/LibRaw/LibRaw
Language: C++
Files changed: src/x3f/x3f_utils_patched.cpp
Commit date: 2020-04-04 19:34:05 +0300
Commit message: X3F: check for data offset limit

Diff: diff --git a/src/x3f/x3f_utils_patched.cpp b/src/x3f/x3f_utils_patched.cpp
index 61a42045c..9ed2da541 100644
--- a/src/x3f/x3f_utils_patched.cpp
+++ b/src/x3f/x3f_utils_patched.cpp
@@ -1040,10 +1040,12 @@ static void huffman_decode_row(x3f_info_t *I, x3f_directory_entry_t *DE,
 
   int16_t c[3] = {(int16_t)offset, (int16_t)offset, (int16_t)offset};
   int col;
   bit_state_t BS;
 
+  if (HUF->row_offsets.element[row] > ID->data_size - 1)
+	  throw LIBRAW_EXCEPTION_IO_CORRUPT;
   set_bit_state(&BS, (uint8_t *)ID->data + HUF->row_offsets.element[row]);
 
   for (col = 0; col < ID->columns; col++)
   {
     int color;

Fixed code:   if (HUF->row_offsets.element[row] > ID->data_size - 1)
	  throw LIBRAW_EXCEPTION_IO_CORRUPT;
CVE-2020-35532: Out-of-bounds Read (CWE-125)
value: In LibRaw, an out-of-bounds read vulnerability exists within the "simple_decode_row()" function (libraw\src\x3f\x3f_utils_patched.cpp) which can be triggered via an image with a large row_stride field.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2022-09-01T18:15Z
Repository: https://github.com/LibRaw/LibRaw
Language: C++
Files changed: src/x3f/x3f_utils_patched.cpp
Commit date: 2020-04-04 19:34:28 +0300
Commit message: X3F/simple_decode_row: check for data offset limit

Diff: diff --git a/src/x3f/x3f_utils_patched.cpp b/src/x3f/x3f_utils_patched.cpp
index 8d59df069..b85ef3735 100644
--- a/src/x3f/x3f_utils_patched.cpp
+++ b/src/x3f/x3f_utils_patched.cpp
@@ -1120,10 +1120,12 @@ static void simple_decode_row(x3f_info_t *I, x3f_directory_entry_t *DE,
 {
   x3f_directory_entry_header_t *DEH = &DE->header;
   x3f_image_data_t *ID = &DEH->data_subsection.image_data;
   x3f_huffman_t *HUF = ID->huffman;
 
+  if (row*row_stride > ID->data_size - (ID->columns*sizeof(uint32_t)))
+	  throw LIBRAW_EXCEPTION_IO_CORRUPT;
   uint32_t *data = (uint32_t *)((unsigned char *)ID->data + row * row_stride);
 
   uint16_t c[3] = {0, 0, 0};
   int col;
 

Fixed code:   if (row*row_stride > ID->data_size - (ID->columns*sizeof(uint32_t)))
	  throw LIBRAW_EXCEPTION_IO_CORRUPT;
CVE-2020-35533: Out-of-bounds Read (CWE-125)
value: In LibRaw, an out-of-bounds read vulnerability exists within the "LibRaw::adobe_copy_pixel()" function (libraw\src\decoders\dng.cpp) when reading data from the image file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2022-09-01T18:15Z
Repository: https://github.com/LibRaw/LibRaw
Language: C++
Files changed: src/decoders/decoders_dcraw.cpp
Commit date: 2020-04-08 21:18:13 +0300
Commit message: more room for ljpeg row

Diff: diff --git a/src/decoders/decoders_dcraw.cpp b/src/decoders/decoders_dcraw.cpp
index e8cbad777..fc7144ace 100644
--- a/src/decoders/decoders_dcraw.cpp
+++ b/src/decoders/decoders_dcraw.cpp
@@ -342,11 +342,11 @@ int LibRaw::ljpeg_start(struct jhead *jh, int info_only)
   if (jh->sraw)
   {
     FORC(4) jh->huff[2 + c] = jh->huff[1];
     FORC(jh->sraw) jh->huff[1 + c] = jh->huff[0];
   }
-  jh->row = (ushort *)calloc(jh->wide * jh->clrs, 4);
+  jh->row = (ushort *)calloc(jh->wide * jh->clrs, 16);
   merror(jh->row, "ljpeg_start()");
   return zero_after_ff = 1;
 }
 
 void LibRaw::ljpeg_end(struct jhead *jh)

Vulnerable code:   jh->row = (ushort *)calloc(jh->wide * jh->clrs, 4);
Fixed code:   jh->row = (ushort *)calloc(jh->wide * jh->clrs, 16);
CVE-2021-32142: Out-of-bounds Write (CWE-787)
value: Buffer Overflow vulnerability in LibRaw linux/unix v0.20.0 allows attacker to escalate privileges via the LibRaw_buffer_datastream::gets(char*, int) in /src/libraw/src/libraw_datastream.cpp.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2023-02-17T18:15Z
Repository: https://github.com/LibRaw/LibRaw
Language: C++
Files changed: src/libraw_datastream.cpp
Commit date: 2021-04-12 13:21:52 +0300
Commit message: check for input buffer size on datastream::gets

Diff: diff --git a/src/libraw_datastream.cpp b/src/libraw_datastream.cpp
index a5c1a84a3..a31ae9dd8 100644
--- a/src/libraw_datastream.cpp
+++ b/src/libraw_datastream.cpp
@@ -285,10 +285,11 @@ INT64 LibRaw_file_datastream::tell()
   return f->pubseekoff(0, std::ios_base::cur);
 }
 
 char *LibRaw_file_datastream::gets(char *str, int sz)
 {
+  if(sz<1) return NULL;
   LR_STREAM_CHK();
   std::istream is(f.get());
   is.getline(str, sz);
   if (is.fail())
     return 0;
@@ -419,10 +420,11 @@ INT64 LibRaw_buffer_datastream::tell()
   return INT64(streampos);
 }
 
 char *LibRaw_buffer_datastream::gets(char *s, int sz)
 {
+  if(sz<1) return NULL;
   unsigned char *psrc, *pdest, *str;
   str = (unsigned char *)s;
   psrc = buf + streampos;
   pdest = str;
   if(streampos >= streamsize) return NULL;
@@ -616,10 +618,11 @@ INT64 LibRaw_bigfile_datastream::tell()
 #endif
 }
 
 char *LibRaw_bigfile_datastream::gets(char *str, int sz)
 {
+  if(sz<1) return NULL;
   LR_BF_CHK();
   return fgets(str, sz, f);
 }
 
 int LibRaw_bigfile_datastream::scanf_one(const char *fmt, void *val)

Fixed code:   if(sz<1) return NULL;
  if(sz<1) return NULL;
  if(sz<1) return NULL;
CVE-2021-46704: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument (lib/ui/api.ts and lib/ping.ts). The vulnerability arises from insufficient input validation combined with a missing authorization check.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2022-03-06T07:15Z
Repository: https://github.com/genieacs/genieacs
Language: TypeScript
Files changed: lib/ping.ts
Commit date: 2021-10-15 16:21:08 -0700
Commit message: Validate host arg passed to ping

Fixes remote code execution vulnerability reported by Alex Hordijk.

Diff: diff --git a/lib/ping.ts b/lib/ping.ts
index 6bf9ca5..e09cb77 100644
--- a/lib/ping.ts
+++ b/lib/ping.ts
@@ -17,10 +17,11 @@
  * along with GenieACS.  If not, see <http://www.gnu.org/licenses/>.
  */
 
 import { platform } from "os";
 import { exec } from "child_process";
+import { domainToASCII } from "url";
 
 export interface PingResult {
   packetsTransmitted: number;
   packetsReceived: number;
   packetLoss: number;
@@ -28,15 +29,27 @@ export interface PingResult {
   avg: number;
   max: number;
   mdev: number;
 }
 
+function isValidHost(host: string): boolean {
+  // Valid chars in IPv4, IPv6, domain names
+  if (/^[a-zA-Z0-9\-.:[\]-]+$/.test(host)) return true;
+
+  // Check if input is an IDN convert to Punycode
+  // Can't merge with above because domainToASCII doesn't accept IP addresses
+  return /^[a-zA-Z0-9\-.:[\]-]+$/.test(domainToASCII(host));
+}
+
 export function ping(
   host: string,
   callback: (err: Error, res?: PingResult, stdout?: string) => void
 ): void {
   let cmd: string, parseRegExp1: RegExp, parseRegExp2: RegExp;
+  // Validate input to prevent possible remote code execution
+  // Credit to Alex Hordijk for reporting this vulnerability
+  if (!isValidHost(host)) return callback(new Error("Invalid host"));
   host = host.replace("[", "").replace("]", "");
   switch (platform()) {
     case "linux":
       cmd = `ping -w 1 -i 0.2 -c 3 ${host}`;
       parseRegExp1 =

Fixed code: import { domainToASCII } from "url";
function isValidHost(host: string): boolean {
  // Valid chars in IPv4, IPv6, domain names
  if (/^[a-zA-Z0-9\-.:[\]-]+$/.test(host)) return true;

  // Check if input is an IDN convert to Punycode
  // Can't merge with above because domainToASCII doesn't accept IP addresses
  return /^[a-zA-Z0-9\-.:[\]-]+$/.test(domainToASCII(host));
}

  // Validate input to prevent possible remote code execution
  // Credit to Alex Hordijk for reporting this vulnerability
  if (!isValidHost(host)) return callback(new Error("Invalid host"));
CVE-2017-9305: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: lib/core/TikiFilter/PreventXss.php in Tiki Wiki CMS Groupware 16.2 allows remote attackers to bypass the XSS filter via padded zero characters, as demonstrated by an attack on tiki-batch_send_newsletter.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-05-31T04:29Z
Repository: https://github.com/tikiorg/tiki
Language: PHP
Files changed: lib/core/TikiFilter/PreventXss.php
Commit date: 2017-04-05 13:31:29 +0000
Commit message: [SEC] XSS Bypass - prevents bypassing of the xss filter by padding zeros

git-svn-id: https://svn.code.sf.net/p/tikiwiki/code/branches/17.x@62084 b456876b-0849-0410-b77d-98878d47e9d5

Diff: diff --git a/lib/core/TikiFilter/PreventXss.php b/lib/core/TikiFilter/PreventXss.php
index ff43e6f81e..cefe488d19 100644
--- a/lib/core/TikiFilter/PreventXss.php
+++ b/lib/core/TikiFilter/PreventXss.php
@@ -181,18 +181,17 @@ class TikiFilter_PreventXss implements Zend\Filter\FilterInterface
 			$search .= 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
 			$search .= '1234567890!@#$%^&*()';
 			$search .= '~`";:?+/={}[]-_|\'\\';
 			for ($i = 0, $istrlen_search = strlen($search); $i < $istrlen_search; $i++) {
 				// ;? matches the ;, which is optional
-				// 0{0,8} matches any padded zeros,
-				// which are optional and go up to 8 chars
+				// 0* matches any padded zeros, which are optional
 				// &#x0040 @ search for the hex values
-				$patterns[] = '/(&#[xX]0{0,8}'.dechex(ord($search[$i])).';?)/i';
+				$patterns[] = '/(&#x0*'.dechex(ord($search[$i])).';?)/i';
 				$replacements[] = $search[$i];
-				// &#00064 @ 0{0,8} matches '0' zero to eight times
+				// &#00064 @ 0* matches padded zeros
 				// with a ;
-				$patterns[] = '/(&#0{0,8}'.ord($search[$i]).';?)/';
+				$patterns[] = '/(&#0*'.ord($search[$i]).';?)/';
 				$replacements[] = $search[$i];
 			}
 		}
 		$val = preg_replace($patterns, $replacements, $val);
 		if ($val_before == $val) {

Vulnerable code: 				// 0{0,8} matches any padded zeros,
				// which are optional and go up to 8 chars
				$patterns[] = '/(&#[xX]0{0,8}'.dechex(ord($search[$i])).';?)/i';
				// &#00064 @ 0{0,8} matches '0' zero to eight times
				$patterns[] = '/(&#0{0,8}'.ord($search[$i]).';?)/';
Fixed code: 				// 0* matches any padded zeros, which are optional
				$patterns[] = '/(&#x0*'.dechex(ord($search[$i])).';?)/i';
				// &#00064 @ 0* matches padded zeros
				$patterns[] = '/(&#0*'.ord($search[$i]).';?)/';
CVE-2023-28626: Uncontrolled Resource Consumption (CWE-400)
value: comrak is a CommonMark + GFM compatible Markdown parser and renderer written in rust. A range of quadratic parsing issues are present in Comrak. These can be used to craft denial-of-service attacks on services that use Comrak to parse Markdown. This issue has been addressed in version 0.17.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as `GHSL-2023-047`
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 7.5
Published: 2023-03-28T21:15Z
Repository: https://github.com/kivikakk/comrak
Language: Unknown
Commit date: 2023-03-28 10:26:21 +1100
Commit message: Merge pull request from GHSA-8hqf-xjwp-p67v

Address quadratic complexity issues from upstream, pest
CVE-2023-28631: Improper Handling of Exceptional Conditions (CWE-755)
value: comrak is a CommonMark + GFM compatible Markdown parser and renderer written in rust. A Comrak AST can be constructed manually by a program instead of parsing a Markdown document with `parse_document`. This AST can then be converted to HTML via `html::format_document_with_plugins`. However, the HTML formatting code assumes that the AST is well-formed. For example, many AST notes contain `[u8]` fields which the formatting code assumes is valid UTF-8 data. Several bugs can be triggered if this is not the case. Version 0.17.0 contains adjustments to the AST, storing strings instead of unvalidated byte arrays. Users are advised to upgrade. Users unable to upgrade may manually validate UTF-8 correctness of all data when assigning to `&[u8]` and `Vec<u8>` fields in the AST. This issue is also tracked as `GHSL-2023-049`.
CWE description: The product does not handle or incorrectly handles an exceptional condition.
CVSS v3 base score: 9.8
Published: 2023-03-28T21:15Z
Repository: https://github.com/kivikakk/comrak
Language: Unknown
Commit date: 2023-03-28 11:03:48 +1100
Commit message: Merge pull request from GHSA-5r3x-p7xx-x6q5

store/expose String in AST, not Vec<u8>
CVE-2021-43114: Other (NVD-CWE-Other)
value: FORT Validator versions prior to 1.5.2 will crash if an RPKI CA publishes an X.509 EE certificate. This will lead to RTR clients such as BGP routers to lose access to the RPKI VRP data set, effectively disabling Route Origin Validation.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 7.5
Published: 2021-11-09T13:15Z
Repository: https://github.com/NICMx/FORT-validator
Language: C
Files changed: autogen.sh, src/log.c
Commit date: 2021-08-30 17:07:15 +0000
Commit message: Make FORT compile on OpenBSD

Diff: diff --git a/autogen.sh b/autogen.sh
index 50e8fba..d9debd2 100755
--- a/autogen.sh
+++ b/autogen.sh
@@ -1,6 +1,6 @@
-#!/bin/bash
+#!/bin/sh
 
 # Hello.
 # Run this file to generate the configure script.
 # You'll need Autoconf and Automake installed!
 
diff --git a/src/log.c b/src/log.c
index 48658bd..bdae4b5 100644
--- a/src/log.c
+++ b/src/log.c
@@ -1,10 +1,11 @@
 #include "log.h"
 
 #include <execinfo.h>
 #include <openssl/bio.h>
 #include <openssl/err.h>
+#include <pthread.h>
 #include <signal.h>
 #include <syslog.h>
 #include <time.h>
 #include <unistd.h>
 

Vulnerable code: #!/bin/bash
Fixed code: #!/bin/sh
#include <pthread.h>
CVE-2021-29483: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: ManageWiki is an extension to the MediaWiki project. The 'wikiconfig' API leaked the value of private configuration variables set through the ManageWiki variable to all users. This has been patched by https://github.com/miraheze/ManageWiki/compare/99f3b2c8af18...befb83c66f5b.patch. If you are unable to patch set `$wgAPIListModules['wikiconfig'] = 'ApiQueryDisabled';` or remove private config as a workaround.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 7.5
Published: 2021-04-28T22:15Z
Repository: https://github.com/miraheze/ManageWiki
Language: PHP
Files changed: includes/api/ApiQueryWikiConfig.php
Commit date: 2021-04-28 21:33:37 +0200
Commit message: Merge pull request from GHSA-jmc9-rv2f-g8vv

The ManageWiki API currently allows viewing of sensitive information set as visible to only ManageWiki right users, such as Discord and Slack webhooks. This fixes it by adding a check to the API, to hide it if the config has set `$wgManageWikiSettings[SETTING]['requires']['visibility']['permissions']` so information on sensitive settings are never displayed via the API.

See https://phabricator.miraheze.org/T7213
Diff: diff --git a/includes/api/ApiQueryWikiConfig.php b/includes/api/ApiQueryWikiConfig.php
index 1879720..19394a7 100644
--- a/includes/api/ApiQueryWikiConfig.php
+++ b/includes/api/ApiQueryWikiConfig.php
@@ -1,6 +1,9 @@
 <?php
+
+use MediaWiki\MediaWikiServices;
+
 class ApiQueryWikiConfig extends ApiQueryBase {
 	public function __construct( $query, $moduleName ) {
 		parent::__construct( $query, $moduleName, 'wcf' );
 	}
 
@@ -29,10 +32,18 @@ class ApiQueryWikiConfig extends ApiQueryBase {
 			];
 
 			$mwSet = new ManageWikiSettings( $wiki );
 			if ( isset( $prop['settings'] ) ) {
 				$wikiData['settings'] = $mwSet->list();
+				
+				$config = MediaWikiServices::getInstance()->getConfigFactory()->makeConfig( 'managewiki' );
+	
+				foreach ( $config->get( 'ManageWikiSettings' ) as $setting => $options ) {
+					if ( isset( $options['requires']['visibility']['permissions'] ) ) {
+						unset( $wikiData['settings'][$setting] );
+					}
+				}
 			}
 
 			$mwExt = new ManageWikiExtensions( $wiki );
 			if ( isset( $prop['extensions'] ) ) {
 				$wikiData['extensions'] = $mwExt->list();

Fixed code: 
use MediaWiki\MediaWikiServices;

				
				$config = MediaWikiServices::getInstance()->getConfigFactory()->makeConfig( 'managewiki' );
	
				foreach ( $config->get( 'ManageWikiSettings' ) as $setting => $options ) {
					if ( isset( $options['requires']['visibility']['permissions'] ) ) {
						unset( $wikiData['settings'][$setting] );
					}
				}
CVE-2024-25109: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: ManageWiki is a MediaWiki extension allowing users to manage wikis. Special:ManageWiki does not escape escape interface messages on the `columns` and `help` keys on the form descriptor. An attacker may exploit this and would have a cross site scripting attack vector. Exploiting this on-wiki requires the `(editinterface)` right. Users should apply the code changes in commits `886cc6b94`, `2ef0f50880`, and `6942e8b2c` to resolve this vulnerability. There are no known workarounds for this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2024-02-09T23:15Z
Repository: https://github.com/miraheze/ManageWiki
Language: PHP
Files changed: includes/Helpers/ManageWikiTypes.php
Commit date: 2024-02-09 22:11:50 +0100
Commit message: Escape output

See security advisory
Diff: diff --git a/includes/Helpers/ManageWikiTypes.php b/includes/Helpers/ManageWikiTypes.php
index 554b70f2..2fe084e3 100644
--- a/includes/Helpers/ManageWikiTypes.php
+++ b/includes/Helpers/ManageWikiTypes.php
@@ -328,11 +328,11 @@ class ManageWikiTypes {
 				];
 				break;
 			case 'usergroups':
 				$groups = [];
 				foreach ( (array)$groupList as $group ) {
-					$groups[UserGroupMembership::getGroupName( $group )] = $group;
+					$groups[htmlspecialchars( UserGroupMembership::getGroupName( $group ) )] = $group;
 				}
 
 				$configs = [
 					'type' => 'multiselect',
 					'options' => isset( $options['options'] ) ? array_merge( $groups, $options['options'] ) : $groups,

Vulnerable code: 					$groups[UserGroupMembership::getGroupName( $group )] = $group;
Fixed code: 					$groups[htmlspecialchars( UserGroupMembership::getGroupName( $group ) )] = $group;
CVE-2022-2564: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 9.8
Published: 2022-07-28T20:15Z
Repository: https://github.com/automattic/mongoose
Language: JavaScript
Files changed: lib/schema.js, test/schema.test.js
Commit date: 2022-07-18 22:21:57 -0400
Commit message: fix(schema): disallow setting __proto__ when creating schema with dotted properties

Fix #12085

Diff: diff --git a/lib/schema.js b/lib/schema.js
index 781ccdbbc..730bddeac 100644
--- a/lib/schema.js
+++ b/lib/schema.js
@@ -552,10 +552,14 @@ Schema.prototype.add = function add(obj, prefix) {
   }
 
   const keys = Object.keys(obj);
   const typeKey = this.options.typeKey;
   for (const key of keys) {
+    if (utils.specialProperties.has(key)) {
+      continue;
+    }
+
     const fullPath = prefix + key;
     const val = obj[key];
 
     if (val == null) {
       throw new TypeError('Invalid value for schema path `' + fullPath +
@@ -852,10 +856,13 @@ Schema.prototype.path = function(path, obj) {
   const last = subpaths.pop();
   let branch = this.tree;
   let fullPath = '';
 
   for (const sub of subpaths) {
+    if (utils.specialProperties.has(sub)) {
+      throw new Error('Cannot set special property `' + sub + '` on a schema');
+    }
     fullPath = fullPath += (fullPath.length > 0 ? '.' : '') + sub;
     if (!branch[sub]) {
       this.nested[fullPath] = true;
       branch[sub] = {};
     }
diff --git a/test/schema.test.js b/test/schema.test.js
index 7bc6299e2..6ef548b00 100644
--- a/test/schema.test.js
+++ b/test/schema.test.js
@@ -2790,6 +2790,16 @@ describe('schema', function() {
           of: subSchema
         }
       });
     }, /Cannot use schema-level projections.*subdocument_mapping.not_selected/);
   });
+
+  it('disallows setting special properties with `add()` or constructor (gh-12085)', async function() {
+    const maliciousPayload = '{"__proto__.toString": "Number"}';
+
+    assert.throws(() => {
+      mongoose.Schema(JSON.parse(maliciousPayload));
+    }, /__proto__/);
+
+    assert.ok({}.toString());
+  });
 });

Fixed code:     if (utils.specialProperties.has(key)) {
      continue;
    }

    if (utils.specialProperties.has(sub)) {
      throw new Error('Cannot set special property `' + sub + '` on a schema');
    }

  it('disallows setting special properties with `add()` or constructor (gh-12085)', async function() {
    const maliciousPayload = '{"__proto__.toString": "Number"}';

    assert.throws(() => {
      mongoose.Schema(JSON.parse(maliciousPayload));
    }, /__proto__/);

    assert.ok({}.toString());
  });
CVE-2013-0730: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in Newscoop 4.x through 4.1.0 allow remote attackers to inject arbitrary web script or HTML via vectors involving the (1) language parameter to application/modules/admin/controllers/LanguagesController.php or (2) user parameter to application/modules/admin/controllers/UserController.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2013-02-22T00:55Z
Repository: https://github.com/sourcefabric/Newscoop
Language: Unknown
Commit date: 2013-01-31 18:07:16 +0100
Commit message: Merge remote-tracking branch 'holman/fix-user-edit-injection' into v4.1
CVE-2011-4715: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Directory traversal vulnerability in cgi-bin/koha/mainpage.pl in Koha 3.4 before 3.4.7 and 3.6 before 3.6.1, and LibLime Koha 4.2 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the KohaOpacLanguage cookie to cgi-bin/opac/opac-main.pl, related to Output.pm.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Published: 2011-12-08T19:55Z
Repository: https://github.com/liblime/LibLime-Koha
Language: Perl
Files changed: C4/Output.pm
Commit date: 2011-11-25 00:16:12 -0800
Commit message: [#21464023] Security: arbitrary file inclusion

Poor input cleansing can allow a well-constructed cookie
to return the contents of arbitrary file system objects.

Diff: diff --git a/C4/Output.pm b/C4/Output.pm
index e72c5e13a..155c5c4ca 100644
--- a/C4/Output.pm
+++ b/C4/Output.pm
@@ -141,10 +141,11 @@ sub themelanguage {
     $lang = accept_language( $http_accept_language, 
               getTranslatedLanguages($interface,'prog') )
       if $http_accept_language;
     # But, if there's a cookie set, obey it
     $lang = $query->cookie('KohaOpacLanguage') if $query->cookie('KohaOpacLanguage');
+    $lang =~ s/[^\p{IsAlnum}\-_]//g;
     # Fall back to English
     my @languages;
     if ($interface eq 'intranet') {
         @languages = split ",", C4::Context->preference("language");
     } else {

Fixed code:     $lang =~ s/[^\p{IsAlnum}\-_]//g;
CVE-2020-36407: Out-of-bounds Write (CWE-787)
value: libavif 0.8.0 and 0.8.1 has an out-of-bounds write in avifDecoderDataFillImageGrid.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.8
Published: 2021-07-01T03:15Z
Repository: https://github.com/AOMediaCodec/libavif
Language: C
Files changed: include/avif/internal.h, src/read.c
Commit date: 2020-08-10 14:26:09 -0700
Commit message: Set max image size to 16384 * 16384

Fix https://crbug.com/oss-fuzz/24728 and
https://crbug.com/oss-fuzz/24734.

Diff: diff --git a/include/avif/internal.h b/include/avif/internal.h
index 1e26a9a..992bc55 100644
--- a/include/avif/internal.h
+++ b/include/avif/internal.h
@@ -239,10 +239,14 @@ typedef struct avifSequenceHeader
     avifMatrixCoefficients matrixCoefficients;
     avifRange range;
 } avifSequenceHeader;
 avifBool avifSequenceHeaderParse(avifSequenceHeader * header, const avifROData * sample);
 
+// A maximum image size to avoid out-of-memory errors or integer overflow in
+// (32-bit) int or unsigned int arithmetic operations.
+#define AVIF_MAX_IMAGE_SIZE (16384 * 16384)
+
 #ifdef __cplusplus
 } // extern "C"
 #endif
 
 #endif // ifndef AVIF_INTERNAL_H
diff --git a/src/read.c b/src/read.c
index e992219..fa1a513 100644
--- a/src/read.c
+++ b/src/read.c
@@ -978,10 +978,13 @@ static avifBool avifParseImageGridBox(avifImageGrid * grid, const uint8_t * raw,
             return AVIF_FALSE;
         }
         CHECK(avifROStreamReadU32(&s, &grid->outputWidth));  // unsigned int(FieldLength) output_width;
         CHECK(avifROStreamReadU32(&s, &grid->outputHeight)); // unsigned int(FieldLength) output_height;
     }
+    if (grid->outputWidth > AVIF_MAX_IMAGE_SIZE / grid->outputHeight) {
+        return AVIF_FALSE;
+    }
     return AVIF_TRUE;
 }
 
 static avifBool avifParseImageSpatialExtentsProperty(avifProperty * prop, const uint8_t * raw, size_t rawLen)
 {

Fixed code: // A maximum image size to avoid out-of-memory errors or integer overflow in
// (32-bit) int or unsigned int arithmetic operations.
#define AVIF_MAX_IMAGE_SIZE (16384 * 16384)

    if (grid->outputWidth > AVIF_MAX_IMAGE_SIZE / grid->outputHeight) {
        return AVIF_FALSE;
    }
CVE-2024-23687: Use of Hard-coded Credentials (CWE-798)
value: Hard-coded credentials in FOLIO mod-data-export-spring versions before 1.5.4 and from 2.0.0 to 2.0.2 allows unauthenticated users to access critical APIs, modify user data, modify configurations including single-sign-on, and manipulate fees/fines.


CWE description: The product contains hard-coded credentials, such as a password or cryptographic key.
CVSS v3 base score: 9.1
Published: 2024-01-19T22:15Z
Repository: https://github.com/folio-org/mod-data-export-spring
Language: Unknown
Commit date: 2023-07-20 14:08:25 +0200
Commit message: Merge pull request from GHSA-vf78-3q9f-92g3

MODEXPS-226 - Invalid system user credentials usage