Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2018-1002205: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: DotNetZip.Semvered before 1.11.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 5.5
Published: 2018-07-25T17:29Z
Repository: https://github.com/haf/DotNetZip.Semverd
Language: Unknown
Commit date: 2018-05-07 21:30:52 +0200
Commit message: Merge pull request #121 from shana/bugs/relative-paths

Sanitize zip entry paths before extracting
CVE-2024-23329: Incorrect Authorization (CWE-863)
value:  changedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint `/api/v1/watch/<uuid>/history` can be accessed by any unauthorized user. As a result any unauthorized user can check one's watch history. However, because unauthorized party first needs to know a watch UUID, and the watch history endpoint itself returns only paths to the snapshot on the server, an impact on users' data privacy is minimal. This issue has been addressed in version 0.45.13. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 3.7
Published: 2024-01-19T20:15Z
Repository: https://github.com/dgtlmoon/changedetection.io
Language: Python
Files changed: changedetectionio/api/api_v1.py
Commit date: 2024-01-18 23:19:09 +0100
Commit message: Security update - Adding API token secure check for API endpoint `/api/v1/watch/<uuid>/history` @rozpuszczalny

Diff: diff --git a/changedetectionio/api/api_v1.py b/changedetectionio/api/api_v1.py
index 190bd44..92b4728 100644
--- a/changedetectionio/api/api_v1.py
+++ b/changedetectionio/api/api_v1.py
@@ -131,10 +131,11 @@ class WatchHistory(Resource):
         # datastore is a black box dependency
         self.datastore = kwargs['datastore']
 
     # Get a list of available history for a watch by UUID
     # curl http://localhost:5000/api/v1/watch/<string:uuid>/history
+    @auth.check_token
     def get(self, uuid):
         """
         @api {get} /api/v1/watch/<string:uuid>/history Get a list of all historical snapshots available for a watch
         @apiDescription Requires `uuid`, returns list
         @apiExample {curl} Example usage:

Fixed code:     @auth.check_token
CVE-2021-41110: Deserialization of Untrusted Data (CWE-502)
value: cwlviewer is a web application to view and share Common Workflow Language workflows. Versions prior to 1.3.1 contain a Deserialization of Untrusted Data vulnerability. Commit number f6066f09edb70033a2ce80200e9fa9e70a5c29de (dated 2021-09-30) contains a patch. There are no available workarounds aside from installing the patch. The SnakeYaml constructor, by default, allows any data to be parsed. To fix the issue the object needs to be created with a `SafeConstructor` object, as seen in the patch.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 9.8
Published: 2021-10-01T13:15Z
Repository: https://github.com/common-workflow-language/cwlviewer
Language: Java
Files changed: src/main/java/org/commonwl/view/cwl/CWLService.java
Commit date: 2021-09-30 12:28:09 +0000
Commit message: Use Yaml SafeConstructor (#355)


Diff: diff --git a/src/main/java/org/commonwl/view/cwl/CWLService.java b/src/main/java/org/commonwl/view/cwl/CWLService.java
index f26bef4..edc2e3b 100644
--- a/src/main/java/org/commonwl/view/cwl/CWLService.java
+++ b/src/main/java/org/commonwl/view/cwl/CWLService.java
@@ -62,10 +62,11 @@ import org.yaml.snakeyaml.Yaml;
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.databind.node.ArrayNode;
 import com.fasterxml.jackson.databind.node.ObjectNode;
 import com.fasterxml.jackson.databind.node.TextNode;
+import org.yaml.snakeyaml.constructor.SafeConstructor;
 
 /**
  * Provides CWL parsing for workflows to gather an overview
  * for display and visualisation
  */
@@ -600,14 +601,12 @@ public class CWLService {
      * @param path A Path to a file containing the yaml content
      * @return A JsonNode with the content of the document
      * @throws IOException 
      */
     private JsonNode yamlPathToJson(Path path) throws IOException {
-        Yaml reader = new Yaml();
+        Yaml reader = new Yaml(new SafeConstructor());
         ObjectMapper mapper = new ObjectMapper();
-        Path p;
-        
         try (InputStream in = Files.newInputStream(path)) {
         	return mapper.valueToTree(reader.load(in));
         }
     }
 
@@ -616,11 +615,11 @@ public class CWLService {
      * Converts a yaml String to JsonNode
      * @param yamlStream An InputStream containing the yaml content
      * @return A JsonNode with the content of the document
      */
     private JsonNode yamlStreamToJson(InputStream yamlStream) {
-        Yaml reader = new Yaml();
+        Yaml reader = new Yaml(new SafeConstructor());
         ObjectMapper mapper = new ObjectMapper();
 		return mapper.valueToTree(reader.load(yamlStream));
     }
 
     /**

Vulnerable code:         Yaml reader = new Yaml();
        Path p;
        
        Yaml reader = new Yaml();
Fixed code: import org.yaml.snakeyaml.constructor.SafeConstructor;
        Yaml reader = new Yaml(new SafeConstructor());
        Yaml reader = new Yaml(new SafeConstructor());
CVE-2019-12900: Out-of-bounds Write (CWE-787)
value: BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2019-06-19T23:15Z
Repository: https://gitlab.com/federicomenaquintero/bzip2
Language: C
Files changed: decompress.c
Commit date: 2019-06-05 18:55:59 -0500
Commit message: Make sure nSelectors is not out of range

nSelectors is used in a loop from 0 to nSelectors to access selectorMtf
which is
	UChar    selectorMtf[BZ_MAX_SELECTORS];
so if nSelectors is bigger than BZ_MAX_SELECTORS it'll do an invalid memory
access

Fixes out of bounds access discovered while fuzzying karchive

Diff: diff --git a/decompress.c b/decompress.c
index ab6a624..f3db91d 100644
--- a/decompress.c
+++ b/decompress.c
@@ -285,11 +285,11 @@ Int32 BZ2_decompress ( DState* s )
 
       /*--- Now the selectors ---*/
       GET_BITS(BZ_X_SELECTOR_1, nGroups, 3);
       if (nGroups < 2 || nGroups > 6) RETURN(BZ_DATA_ERROR);
       GET_BITS(BZ_X_SELECTOR_2, nSelectors, 15);
-      if (nSelectors < 1) RETURN(BZ_DATA_ERROR);
+      if (nSelectors < 1 || nSelectors > BZ_MAX_SELECTORS) RETURN(BZ_DATA_ERROR);
       for (i = 0; i < nSelectors; i++) {
          j = 0;
          while (True) {
             GET_BIT(BZ_X_SELECTOR_3, uc);
             if (uc == 0) break;

Vulnerable code:       if (nSelectors < 1) RETURN(BZ_DATA_ERROR);
Fixed code:       if (nSelectors < 1 || nSelectors > BZ_MAX_SELECTORS) RETURN(BZ_DATA_ERROR);
CVE-2022-37451: Release of Invalid Pointer or Reference (CWE-763)
value: Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_malloc.
CWE description: The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.
CVSS v3 base score: 7.5
Published: 2022-08-06T18:15Z
Repository: https://github.com/Exim/exim
Language: C
Files changed: src/src/auths/call_pam.c
Commit date: 2021-10-16 16:34:03 +0100
Commit message: Fix PAM auth.  Bug 2813

Diff: diff --git a/src/src/auths/call_pam.c b/src/src/auths/call_pam.c
index 80bb23ec3..03b9be1a8 100644
--- a/src/src/auths/call_pam.c
+++ b/src/src/auths/call_pam.c
@@ -86,11 +86,11 @@ for (int i = 0; i < num_msg; i++)
       if (!(arg = string_nextinlist(&pam_args, &sep, NULL, 0)))
 	{
 	arg = US"";
 	pam_arg_ended = TRUE;
 	}
-      reply[i].resp = CS string_copy_malloc(arg); /* PAM frees resp */
+      reply[i].resp = strdup(CCS arg); /* Use libc malloc, PAM frees resp directly*/
       reply[i].resp_retcode = PAM_SUCCESS;
       break;
 
     case PAM_TEXT_INFO:    /* Just acknowledge messages */
     case PAM_ERROR_MSG:

Vulnerable code:       reply[i].resp = CS string_copy_malloc(arg); /* PAM frees resp */
Fixed code:       reply[i].resp = strdup(CCS arg); /* Use libc malloc, PAM frees resp directly*/
CVE-2022-37452: Out-of-bounds Write (CWE-787)
value: Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name is set.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2022-08-07T18:15Z
Repository: https://github.com/Exim/exim
Language: C
Files changed: src/src/host.c
Commit date: 2021-05-17 12:09:31 +0200
Commit message: Fix host_name_lookup (Close 2747)

Thanks to Nico R for providing a reproducing configuration.

        host_lookup             = *
        message_size_limit      = ${if def:sender_host_name {32M}{32M}}
        acl_smtp_connect        = acl_smtp_connect
        acl_smtp_rcpt           = acl_smtp_rcpt

        begin acl
          acl_smtp_connect:
                warn ratelimit = 256 / 1m / per_conn
                accept

          acl_smtp_rcpt:
                accept hosts = 127.0.0.*

        begin routers
        null:
          driver          = accept
          transport       = null

        begin transports
        null:
          driver          = appendfile
          file            = /dev/null

Tested with

        swaks -f mailbox@example.org -t mailbox@example.org --pipe 'exim -bh 127.0.0.1 -C /opt/exim/etc/exim-bug.conf'

The IP must have a PTR to "localhost." to reproduce it.

(cherry picked from commit 20812729e3e47a193a21d326ecd036d67a8b2724)

Diff: diff --git a/src/src/host.c b/src/src/host.c
index 5e66517e8..e11931b60 100644
--- a/src/src/host.c
+++ b/src/src/host.c
@@ -1580,11 +1580,11 @@ Put it in permanent memory. */
 
   /* If the host has aliases, build a copy of the alias list */
 
   if (hosts->h_aliases)
     {
-    int count = 1;
+    int count = 1;  /* need 1 more for terminating NULL */
     uschar **ptr;
 
     for (uschar ** aliases = USS hosts->h_aliases; *aliases; aliases++) count++;
     store_pool = POOL_PERM;
     ptr = sender_host_aliases = store_get(count * sizeof(uschar *), FALSE);
@@ -1689,11 +1689,11 @@ while ((ordername = string_nextinlist(&list, &sep, NULL, 0)))
 
     if (rc == DNS_SUCCEED)
       {
       uschar **aptr = NULL;
       int ssize = 264;
-      int count = 0;
+      int count = 1;  /* need 1 more for terminating NULL */
       int old_pool = store_pool;
 
       sender_host_dnssec = dns_is_secure(dnsa);
       DEBUG(D_dns)
         debug_printf("Reverse DNS security status: %s\n",

Vulnerable code:     int count = 1;
      int count = 0;
Fixed code:     int count = 1;  /* need 1 more for terminating NULL */
      int count = 1;  /* need 1 more for terminating NULL */
CVE-2017-9224: Out-of-bounds Read (CWE-125)
value: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in match_at() during regular expression searching. A logical error involving order of validation and access in match_at() could result in an out-of-bounds read from a stack buffer.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-05-24T15:29Z
Repository: https://github.com/kkos/oniguruma
Language: C
Files changed: src/regexec.c
Commit date: 2017-05-23 10:28:58 +0900
Commit message: fix #57 : DATA_ENSURE() check must be before data access

Diff: diff --git a/src/regexec.c b/src/regexec.c
index 35fef11..d4e577d 100644
--- a/src/regexec.c
+++ b/src/regexec.c
@@ -1471,18 +1471,13 @@ match_at(regex_t* reg, const UChar* str, const UChar* end,
       /* default behavior: return first-matching result. */
       goto finish;
       break;
 
     case OP_EXACT1:  MOP_IN(OP_EXACT1);
-#if 0
       DATA_ENSURE(1);
       if (*p != *s) goto fail;
       p++; s++;
-#endif
-      if (*p != *s++) goto fail;
-      DATA_ENSURE(0);
-      p++;
       MOP_OUT;
       break;
 
     case OP_EXACT1_IC:  MOP_IN(OP_EXACT1_IC);
       {

Vulnerable code: #if 0
#endif
      if (*p != *s++) goto fail;
      DATA_ENSURE(0);
      p++;
CVE-2017-9225: Out-of-bounds Write (CWE-787)
value: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds write in onigenc_unicode_get_case_fold_codes_by_str() occurs during regular expression compilation. Code point 0xFFFFFFFF is not properly handled in unicode_unfold_key(). A malformed regular expression could result in 4 bytes being written off the end of a stack buffer of expand_case_fold_string() during the call to onigenc_unicode_get_case_fold_codes_by_str(), a typical stack buffer overflow.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-05-24T15:29Z
Repository: https://github.com/kkos/oniguruma
Language: Python
Files changed: src/gperf_unfold_key_conv.py, src/unicode_unfold_key.c
Commit date: 2017-05-22 18:09:39 +0900
Commit message: fix #56 : return invalid result for codepoint 0xFFFFFFFF

Diff: diff --git a/src/gperf_unfold_key_conv.py b/src/gperf_unfold_key_conv.py
index dcd8587..34f9c2f 100755
--- a/src/gperf_unfold_key_conv.py
+++ b/src/gperf_unfold_key_conv.py
@@ -34,11 +34,11 @@ def parse_line(s):
     if r != s: return r
     r = re.sub(REG_GET_HASH, 'int key = hash(&code);', s)
     if r != s: return r
     r = re.sub(REG_GET_CODE, 'OnigCodePoint gcode = wordlist[key].code;', s)
     if r != s: return r
-    r = re.sub(REG_CODE_CHECK, 'if (code == gcode)', s)
+    r = re.sub(REG_CODE_CHECK, 'if (code == gcode && wordlist[key].index >= 0)', s)
     if r != s: return r
 
     return s
 
 def parse_file(f):
diff --git a/src/unicode_unfold_key.c b/src/unicode_unfold_key.c
index a5aff90..15302ca 100644
--- a/src/unicode_unfold_key.c
+++ b/src/unicode_unfold_key.c
@@ -2848,11 +2848,11 @@ unicode_unfold_key(OnigCodePoint code)
 
       if (key <= MAX_HASH_VALUE && key >= 0)
         {
           OnigCodePoint gcode = wordlist[key].code;
 
-          if (code == gcode)
+          if (code == gcode && wordlist[key].index >= 0)
             return &wordlist[key];
         }
     }
   return 0;
 }

Vulnerable code:     r = re.sub(REG_CODE_CHECK, 'if (code == gcode)', s)
          if (code == gcode)
Fixed code:     r = re.sub(REG_CODE_CHECK, 'if (code == gcode && wordlist[key].index >= 0)', s)
          if (code == gcode && wordlist[key].index >= 0)
CVE-2017-9226: Out-of-bounds Write (CWE-787)
value: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetch_token() and fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of '\700' would produce an invalid code point value larger than 0xff in next_state_val(), resulting in an out-of-bounds write memory corruption.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-05-24T15:29Z
Repository: https://github.com/kkos/oniguruma
Language: C
Files changed: src/regparse.c
Commit date: 2017-05-19 15:44:47 +0900
Commit message: fix #55 : Byte value expressed in octal must be smaller than 256

Diff: diff --git a/src/regparse.c b/src/regparse.c
index 665998e..f7acc5f 100644
--- a/src/regparse.c
+++ b/src/regparse.c
@@ -3018,11 +3018,11 @@ fetch_token_in_cc(OnigToken* tok, UChar** src, UChar* end, ScanEnv* env)
     case '1': case '2': case '3': case '4': case '5': case '6': case '7':
       if (IS_SYNTAX_OP(syn, ONIG_SYN_OP_ESC_OCTAL3)) {
         PUNFETCH;
         prev = p;
         num = scan_unsigned_octal_number(&p, end, 3, enc);
-        if (num < 0) return ONIGERR_TOO_BIG_NUMBER;
+        if (num < 0 || num >= 256) return ONIGERR_TOO_BIG_NUMBER;
         if (p == prev) {  /* can't read nothing. */
           num = 0; /* but, it's not error */
         }
         tok->type = TK_RAW_BYTE;
         tok->base = 8;
@@ -3390,11 +3390,11 @@ fetch_token(OnigToken* tok, UChar** src, UChar* end, ScanEnv* env)
       /* fall through */
     case '0':
       if (IS_SYNTAX_OP(syn, ONIG_SYN_OP_ESC_OCTAL3)) {
         prev = p;
         num = scan_unsigned_octal_number(&p, end, (c == '0' ? 2:3), enc);
-        if (num < 0) return ONIGERR_TOO_BIG_NUMBER;
+        if (num < 0 || num >= 256) return ONIGERR_TOO_BIG_NUMBER;
         if (p == prev) {  /* can't read nothing. */
           num = 0; /* but, it's not error */
         }
         tok->type = TK_RAW_BYTE;
         tok->base = 8;

Vulnerable code:         if (num < 0) return ONIGERR_TOO_BIG_NUMBER;
        if (num < 0) return ONIGERR_TOO_BIG_NUMBER;
Fixed code:         if (num < 0 || num >= 256) return ONIGERR_TOO_BIG_NUMBER;
        if (num < 0 || num >= 256) return ONIGERR_TOO_BIG_NUMBER;
CVE-2017-9226: Out-of-bounds Write (CWE-787)
value: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetch_token() and fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of '\700' would produce an invalid code point value larger than 0xff in next_state_val(), resulting in an out-of-bounds write memory corruption.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-05-24T15:29Z
Repository: https://github.com/kkos/oniguruma
Language: C
Files changed: src/regparse.c
Commit date: 2017-05-18 17:05:27 +0900
Commit message: fix #55 : check too big code point value for single byte value in next_state_val()

Diff: diff --git a/src/regparse.c b/src/regparse.c
index 11f9e34..665998e 100644
--- a/src/regparse.c
+++ b/src/regparse.c
@@ -4042,10 +4042,13 @@ next_state_val(CClassNode* cc, OnigCodePoint *vs, OnigCodePoint v,
   int r;
 
   switch (*state) {
   case CCS_VALUE:
     if (*type == CCV_SB) {
+      if (*vs > 0xff)
+          return ONIGERR_INVALID_CODE_POINT_VALUE;
+
       BITSET_SET_BIT(cc->bs, (int )(*vs));
     }
     else if (*type == CCV_CODE_POINT) {
       r = add_code_range(&(cc->mbuf), env, *vs, *vs);
       if (r < 0) return r;

Fixed code:       if (*vs > 0xff)
          return ONIGERR_INVALID_CODE_POINT_VALUE;
CVE-2017-9227: Out-of-bounds Read (CWE-125)
value: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in mbc_enc_len() during regular expression searching. Invalid handling of reg->dmin in forward_search_range() could result in an invalid pointer dereference, as an out-of-bounds read from a stack buffer.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-05-24T15:29Z
Repository: https://github.com/kkos/oniguruma
Language: C
Files changed: src/regexec.c
Commit date: 2017-05-23 16:15:35 +0900
Commit message: fix #58 : access to invalid address by reg->dmin value

Diff: diff --git a/src/regexec.c b/src/regexec.c
index d4e577d..2fa0f3d 100644
--- a/src/regexec.c
+++ b/src/regexec.c
@@ -3152,10 +3152,12 @@ forward_search_range(regex_t* reg, const UChar* str, const UChar* end, UChar* s,
     if (ONIGENC_IS_SINGLEBYTE(reg->enc)) {
       p += reg->dmin;
     }
     else {
       UChar *q = p + reg->dmin;
+
+      if (q >= end) return 0; /* fail */
       while (p < q) p += enclen(reg->enc, p);
     }
   }
 
  retry:

Fixed code: 
      if (q >= end) return 0; /* fail */
CVE-2017-9228: Out-of-bounds Write (CWE-787)
value: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write occurs in bitset_set_range() during regular expression compilation due to an uninitialized variable from an incorrect state transition. An incorrect state transition in parse_char_class() could create an execution path that leaves a critical local variable uninitialized until it's used as an index, resulting in an out-of-bounds write memory corruption.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-05-24T15:29Z
Repository: https://github.com/kkos/oniguruma
Language: C
Files changed: src/regparse.c
Commit date: 2017-05-24 13:43:25 +0900
Commit message: fix #60 : invalid state(CCS_VALUE) in parse_char_class()

Diff: diff --git a/src/regparse.c b/src/regparse.c
index 69875fa..1988747 100644
--- a/src/regparse.c
+++ b/src/regparse.c
@@ -4079,11 +4079,13 @@ next_state_class(CClassNode* cc, OnigCodePoint* vs, enum CCVALTYPE* type,
       r = add_code_range(&(cc->mbuf), env, *vs, *vs);
       if (r < 0) return r;
     }
   }
 
-  *state = CCS_VALUE;
+  if (*state != CCS_START)
+    *state = CCS_VALUE;
+
   *type  = CCV_CLASS;
   return 0;
 }
 
 static int

Vulnerable code:   *state = CCS_VALUE;
Fixed code:   if (*state != CCS_START)
    *state = CCS_VALUE;
CVE-2019-13224: Use After Free (CWE-416)
value: A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 9.8
Published: 2019-07-10T14:15Z
Repository: https://github.com/kkos/oniguruma
Language: C
Files changed: src/regext.c
Commit date: 2019-07-06 21:38:51 +0900
Commit message: Fix CVE-2019-13224: don't allow different encodings for onig_new_deluxe()

Diff: diff --git a/src/regext.c b/src/regext.c
index fa4b360..965c793 100644
--- a/src/regext.c
+++ b/src/regext.c
@@ -27,10 +27,11 @@
  * SUCH DAMAGE.
  */
 
 #include "regint.h"
 
+#if 0
 static void
 conv_ext0be32(const UChar* s, const UChar* end, UChar* conv)
 {
   while (s < end) {
     *conv++ = '\0';
@@ -156,10 +157,11 @@ conv_encoding(OnigEncoding from, OnigEncoding to, const UChar* s, const UChar* e
     }
   }
 
   return ONIGERR_NOT_SUPPORTED_ENCODING_COMBINATION;
 }
+#endif
 
 extern int
 onig_new_deluxe(regex_t** reg, const UChar* pattern, const UChar* pattern_end,
                 OnigCompileInfo* ci, OnigErrorInfo* einfo)
 {
@@ -167,13 +169,11 @@ onig_new_deluxe(regex_t** reg, const UChar* pattern, const UChar* pattern_end,
   UChar *cpat, *cpat_end;
 
   if (IS_NOT_NULL(einfo)) einfo->par = (UChar* )NULL;
 
   if (ci->pattern_enc != ci->target_enc) {
-    r = conv_encoding(ci->pattern_enc, ci->target_enc, pattern, pattern_end,
-                      &cpat, &cpat_end);
-    if (r != 0) return r;
+    return ONIGERR_NOT_SUPPORTED_ENCODING_COMBINATION;
   }
   else {
     cpat     = (UChar* )pattern;
     cpat_end = (UChar* )pattern_end;
   }

Vulnerable code:     r = conv_encoding(ci->pattern_enc, ci->target_enc, pattern, pattern_end,
                      &cpat, &cpat_end);
    if (r != 0) return r;
Fixed code: #if 0
#endif
    return ONIGERR_NOT_SUPPORTED_ENCODING_COMBINATION;
CVE-2019-16163: Uncontrolled Recursion (CWE-674)
value: Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c.
CWE description: The product does not properly control the amount of recursion that takes place,  consuming excessive resources, such as allocated memory or the program stack.
CVSS v3 base score: 7.5
Published: 2019-09-09T17:15Z
Repository: https://github.com/kkos/oniguruma
Language: C
Files changed: src/regparse.c
Commit date: 2019-07-29 12:52:56 +0900
Commit message: fix #147: Stack Exhaustion Problem caused by some parsing functions in regcomp.c making recursive calls to themselves.

Diff: diff --git a/src/regparse.c b/src/regparse.c
index 123d6cb4..1a1ef6b0 100644
--- a/src/regparse.c
+++ b/src/regparse.c
@@ -6237,10 +6237,11 @@ parse_char_class(Node** np, PToken* tok, UChar** src, UChar* end, ScanEnv* env)
 
   *np = NULL_NODE;
   env->parse_depth++;
   if (env->parse_depth > ParseDepthLimit)
     return ONIGERR_PARSE_DEPTH_LIMIT_OVER;
+
   prev_cc = (CClassNode* )NULL;
   r = fetch_token_in_cc(tok, src, end, env);
   if (r == TK_CHAR && tok->u.c == '^' && tok->escaped == 0) {
     neg = 1;
     r = fetch_token_in_cc(tok, src, end, env);
@@ -7818,18 +7819,22 @@ i_apply_case_fold(OnigCodePoint from, OnigCodePoint to[], int to_len, void* arg)
 
 static int
 parse_exp(Node** np, PToken* tok, int term, UChar** src, UChar* end,
           ScanEnv* env, int group_head)
 {
-  int r, len, group = 0;
+  int r, len, group;
   Node* qn;
   Node** tp;
+  unsigned int parse_depth;
 
+  group = 0;
   *np = NULL;
   if (tok->type == (enum TokenSyms )term)
     goto end_of_token;
 
+  parse_depth = env->parse_depth;
+
   switch (tok->type) {
   case TK_ALT:
   case TK_EOT:
   end_of_token:
     *np = node_new_empty();
@@ -8143,10 +8148,14 @@ parse_exp(Node** np, PToken* tok, int term, UChar** src, UChar* end,
       Node* target;
 
       if (is_invalid_quantifier_target(*tp))
         return ONIGERR_TARGET_OF_REPEAT_OPERATOR_INVALID;
 
+      parse_depth++;
+      if (parse_depth > ParseDepthLimit)
+        return ONIGERR_PARSE_DEPTH_LIMIT_OVER;
+
       qn = node_new_quantifier(tok->u.repeat.lower, tok->u.repeat.upper,
                                r == TK_INTERVAL);
       CHECK_NULL_RETURN_MEMERR(qn);
       QUANT_(qn)->greedy = tok->u.repeat.greedy;
       if (group == 2) {

Vulnerable code:   int r, len, group = 0;
Fixed code: 
  int r, len, group;
  unsigned int parse_depth;
  group = 0;
  parse_depth = env->parse_depth;

      parse_depth++;
      if (parse_depth > ParseDepthLimit)
        return ONIGERR_PARSE_DEPTH_LIMIT_OVER;
CVE-2019-19246: Out-of-bounds Read (CWE-125)
value: Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in str_lower_case_match in regexec.c.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2019-11-25T17:15Z
Repository: https://github.com/kkos/oniguruma
Language: C
Files changed: src/regexec.c
Commit date: 2019-08-14 08:41:44 +0900
Commit message: fix heap-buffer-overflow

Diff: diff --git a/src/regexec.c b/src/regexec.c
index 0753b070..634ee422 100644
--- a/src/regexec.c
+++ b/src/regexec.c
@@ -4194,10 +4194,11 @@ str_lower_case_match(OnigEncoding enc, int case_fold_flag,
 
   while (t < tend) {
     lowlen = ONIGENC_MBC_CASE_FOLD(enc, case_fold_flag, &p, end, lowbuf);
     q = lowbuf;
     while (lowlen > 0) {
+      if (t >= tend)    return 0;
       if (*t++ != *q++) return 0;
       lowlen--;
     }
   }
 

Fixed code:       if (t >= tend)    return 0;
CVE-2020-5203: Improper Input Validation (CWE-20)
value: In Fat-Free Framework 3.7.1, attackers can achieve arbitrary code execution if developers choose to pass user controlled input (e.g., $_REQUEST, $_GET, or $_POST) to the framework's Clear method.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 9.8
Published: 2020-03-11T14:15Z
Repository: https://github.com/bcosca/fatfree-core
Language: PHP
Files changed: base.php
Commit date: 2020-01-04 15:44:00 +0100
Commit message: ensure misuse of clear() wont open a vulnerability

Diff: diff --git a/base.php b/base.php
index e8234d6..441ade5 100644
--- a/base.php
+++ b/base.php
@@ -501,10 +501,12 @@ final class Base extends Prefab implements ArrayAccess {
 		}
 		if (!isset($parts[1]) && array_key_exists($parts[0],$this->init))
 			// Reset global to default value
 			$this->hive[$parts[0]]=$this->init[$parts[0]];
 		else {
+			// Ensure we have no code injection
+			$key=preg_replace('/(\)\W*\w+.*$)/','',$key);
 			eval('unset('.$this->compile('@this->hive.'.$key).');');
 			if ($parts[0]=='SESSION') {
 				session_commit();
 				session_start();
 			}
@@ -2961,17 +2963,15 @@ class Preview extends View {
 	*	Convert token to variable
 	*	@return string
 	*	@param $str string
 	**/
 	function token($str) {
-		$fw=$this->fw;
-		$str=trim(preg_replace('/\{\{(.+?)\}\}/s',trim('\1'),
-			$fw->compile($str)));
+		$str=trim(preg_replace('/\{\{(.+?)\}\}/s','\1',$this->fw->compile($str)));
 		if (preg_match('/^(.+)(?<!\|)\|((?:\h*\w+(?:\h*[,;]?))+)$/s',
 			$str,$parts)) {
 			$str=trim($parts[1]);
-			foreach ($fw->split(trim($parts[2],"\xC2\xA0")) as $func)
+			foreach ($this->fw->split(trim($parts[2],"\xC2\xA0")) as $func)
 				$str=((empty($this->filter[$cmd=$func]) &&
 					function_exists($cmd)) ||
 					is_string($cmd=$this->filter($func)))?
 					$cmd.'('.$str.')':
 					'Base::instance()->'.

Vulnerable code: 		$fw=$this->fw;
		$str=trim(preg_replace('/\{\{(.+?)\}\}/s',trim('\1'),
			$fw->compile($str)));
			foreach ($fw->split(trim($parts[2],"\xC2\xA0")) as $func)
Fixed code: 			// Ensure we have no code injection
			$key=preg_replace('/(\)\W*\w+.*$)/','',$key);
		$str=trim(preg_replace('/\{\{(.+?)\}\}/s','\1',$this->fw->compile($str)));
			foreach ($this->fw->split(trim($parts[2],"\xC2\xA0")) as $func)
CVE-2020-5203: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: In Fat-Free Framework 3.7.1, attackers can achieve arbitrary code execution if developers choose to pass user controlled input (e.g., $_REQUEST, $_GET, or $_POST) to the framework's Clear method.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 9.8
Published: 2020-03-11T14:15Z
Repository: https://github.com/bcosca/fatfree-core
Language: PHP
Files changed: base.php
Commit date: 2020-01-04 15:44:00 +0100
Commit message: ensure misuse of clear() wont open a vulnerability

Diff: diff --git a/base.php b/base.php
index e8234d6..441ade5 100644
--- a/base.php
+++ b/base.php
@@ -501,10 +501,12 @@ final class Base extends Prefab implements ArrayAccess {
 		}
 		if (!isset($parts[1]) && array_key_exists($parts[0],$this->init))
 			// Reset global to default value
 			$this->hive[$parts[0]]=$this->init[$parts[0]];
 		else {
+			// Ensure we have no code injection
+			$key=preg_replace('/(\)\W*\w+.*$)/','',$key);
 			eval('unset('.$this->compile('@this->hive.'.$key).');');
 			if ($parts[0]=='SESSION') {
 				session_commit();
 				session_start();
 			}
@@ -2961,17 +2963,15 @@ class Preview extends View {
 	*	Convert token to variable
 	*	@return string
 	*	@param $str string
 	**/
 	function token($str) {
-		$fw=$this->fw;
-		$str=trim(preg_replace('/\{\{(.+?)\}\}/s',trim('\1'),
-			$fw->compile($str)));
+		$str=trim(preg_replace('/\{\{(.+?)\}\}/s','\1',$this->fw->compile($str)));
 		if (preg_match('/^(.+)(?<!\|)\|((?:\h*\w+(?:\h*[,;]?))+)$/s',
 			$str,$parts)) {
 			$str=trim($parts[1]);
-			foreach ($fw->split(trim($parts[2],"\xC2\xA0")) as $func)
+			foreach ($this->fw->split(trim($parts[2],"\xC2\xA0")) as $func)
 				$str=((empty($this->filter[$cmd=$func]) &&
 					function_exists($cmd)) ||
 					is_string($cmd=$this->filter($func)))?
 					$cmd.'('.$str.')':
 					'Base::instance()->'.

Vulnerable code: 		$fw=$this->fw;
		$str=trim(preg_replace('/\{\{(.+?)\}\}/s',trim('\1'),
			$fw->compile($str)));
			foreach ($fw->split(trim($parts[2],"\xC2\xA0")) as $func)
Fixed code: 			// Ensure we have no code injection
			$key=preg_replace('/(\)\W*\w+.*$)/','',$key);
		$str=trim(preg_replace('/\{\{(.+?)\}\}/s','\1',$this->fw->compile($str)));
			foreach ($this->fw->split(trim($parts[2],"\xC2\xA0")) as $func)
CVE-2020-7754: Insufficient Information (NVD-CWE-noinfo)
value: This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2020-10-27T15:15Z
Repository: https://github.com/npm/npm-user-validate
Language: JavaScript
Files changed: npm-user-validate.js, test/email.test.js
Commit date: 2020-10-15 15:45:49 -0700
Commit message: fix: update email validation

PR-URL: https://github.com/isaacs/npm-user-validate/pull/15
Credit: @
Close: #15
Reviewed-by: @isaacs

Diff: diff --git a/npm-user-validate.js b/npm-user-validate.js
index 9250ce3..ffd8791 100644
--- a/npm-user-validate.js
+++ b/npm-user-validate.js
@@ -9,10 +9,11 @@ var requirements = exports.requirements = {
     dot: 'Name may not start with "."',
     illegal: 'Name may not contain illegal character'
   },
   password: {},
   email: {
+    length: 'Email length must be less then or equal to 254 characters long',
     valid: 'Email must be an email address'
   }
 }
 
 var illegalCharacterRe = new RegExp('([' + [
@@ -43,11 +44,14 @@ function username (un) {
 
   return null
 }
 
 function email (em) {
-  if (!em.match(/^.+@.+\..+$/)) {
+  if (em.length > 254) {
+    return new Error(requirements.email.length)
+  }
+  if (!em.match(/^[^@]+@.+\..+$/)) {
     return new Error(requirements.email.valid)
   }
 
   return null
 }
diff --git a/test/email.test.js b/test/email.test.js
index c2e58ae..7cda76e 100644
--- a/test/email.test.js
+++ b/test/email.test.js
@@ -5,10 +5,17 @@ test('email misses an @', function (t) {
   var err = v('namedomain')
   t.type(err, 'object')
   t.end()
 })
 
+test('email is longer then 254 characters', function (t) {
+  var str = '@'.repeat(255)
+  var err = v(str)
+  t.type(err, 'object')
+  t.end()
+})
+
 test('email misses a dot', function (t) {
   var err = v('name@domain')
   t.type(err, 'object')
   t.end()
 })

Vulnerable code:   if (!em.match(/^.+@.+\..+$/)) {
Fixed code:     length: 'Email length must be less then or equal to 254 characters long',
  if (em.length > 254) {
    return new Error(requirements.email.length)
  }
  if (!em.match(/^[^@]+@.+\..+$/)) {
test('email is longer then 254 characters', function (t) {
  var str = '@'.repeat(255)
  var err = v(str)
  t.type(err, 'object')
  t.end()
})
CVE-2017-6954: Improper Privilege Management (CWE-269)
value: An issue was discovered in includes/component.php in the BuddyPress Docs plugin before 1.9.3 for WordPress. It is possible for authenticated users to edit documents of other users without proper permissions.
CWE description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CVSS v3 base score: 4.3
Published: 2017-03-17T09:59Z
Repository: https://github.com/boonebgorges/buddypress-docs
Language: PHP
Files changed: includes/component.php
Commit date: 2017-03-13 14:23:59 -0500
Commit message: Improved permission check when processing a Doc save request.

Diff: diff --git a/includes/component.php b/includes/component.php
index f52f081..ec05a32 100644
--- a/includes/component.php
+++ b/includes/component.php
@@ -379,10 +379,18 @@ class BP_Docs_Component extends BP_Component {
 	function catch_page_load() {
 		global $bp;
 
 		if ( !empty( $_POST['doc-edit-submit'] ) ) {
 
+			// Existing Docs have a more specific permission check.
+			$doc = bp_docs_get_current_doc();
+			if ( $doc && ! current_user_can( 'bp_docs_edit', $doc->ID ) ) {
+				return;
+			} elseif ( ! $doc && ! current_user_can( 'bp_docs_create' ) ) {
+				return;
+			}
+
 			check_admin_referer( 'bp_docs_save' );
 
 			$this_doc = new BP_Docs_Query;
 			$result = $this_doc->save();
 

Fixed code: 			// Existing Docs have a more specific permission check.
			$doc = bp_docs_get_current_doc();
			if ( $doc && ! current_user_can( 'bp_docs_edit', $doc->ID ) ) {
				return;
			} elseif ( ! $doc && ! current_user_can( 'bp_docs_create' ) ) {
				return;
			}
CVE-2020-11081: Process Control (CWE-114)
value: osquery before version 4.4.0 enables a privilege escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables local escalation. This is fixed in version 4.4.0.
CWE description: Executing commands or loading libraries from an untrusted source or in an untrusted environment can cause an application to execute malicious commands (and payloads) on behalf of an attacker.
CVSS v3 base score: 8.2
Published: 2020-07-10T19:15Z
Repository: https://github.com/osquery/osquery
Language: Other
Files changed: libraries/cmake/formula/openssl/CMakeLists.txt
Commit date: 2020-05-08 22:14:12 -0400
Commit message: Disable openssl compression support (#6433)

Openssl was depending on zlib for SSL/TLS compression,
though it was trying to load it as a dynamic library.
On Windows especially this is an issue because the dll
could possibly be loaded from a insecure place,
so this can be exploited.

Moreover it's proven that compression can lead
to leaks of information; so we completely disable it
to resolve both issues.
Diff: diff --git a/libraries/cmake/formula/openssl/CMakeLists.txt b/libraries/cmake/formula/openssl/CMakeLists.txt
index 2f89bb50..9b2803df 100644
--- a/libraries/cmake/formula/openssl/CMakeLists.txt
+++ b/libraries/cmake/formula/openssl/CMakeLists.txt
@@ -5,24 +5,18 @@ set(OPENSSL_VERSION "1.1.1f")
 
 include(ExternalProject)
 
 function(opensslMain)
 
-  get_target_property(zlib_library_dir_path thirdparty_zlib BINARY_DIR)
-  get_target_property(zlib_library_lib_name thirdparty_zlib OUTPUT_NAME)
-  get_target_property(zlib_library_source_dir thirdparty_zlib SOURCE_DIR)
-
   set(common_options
     no-ssl2
     no-ssl3
     no-asm
     no-shared
     no-weak-ssl-ciphers
-    zlib-dynamic
+    no-comp
     enable-cms
-    "--with-zlib-include=${zlib_library_source_dir}/src"
-    "--with-zlib-lib=${zlib_library_dir_path}/${zlib_library_lib_name}"
   )
 
   add_library(thirdparty_openssl_ssl STATIC IMPORTED GLOBAL)
   add_library(thirdparty_openssl_crypto STATIC IMPORTED GLOBAL)
 

Vulnerable code:   get_target_property(zlib_library_dir_path thirdparty_zlib BINARY_DIR)
  get_target_property(zlib_library_lib_name thirdparty_zlib OUTPUT_NAME)
  get_target_property(zlib_library_source_dir thirdparty_zlib SOURCE_DIR)

    zlib-dynamic
    "--with-zlib-include=${zlib_library_source_dir}/src"
    "--with-zlib-lib=${zlib_library_dir_path}/${zlib_library_lib_name}"
Fixed code:     no-comp
CVE-2017-6429: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Buffer overflow in the tcpcapinfo utility in Tcpreplay before 4.2.0 Beta 1 allows remote attackers to have unspecified impact via a pcap file with an over-size packet.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.8
Published: 2017-03-15T15:59Z
Repository: https://github.com/appneta/tcpreplay
Language: Other
Files changed: docs/CHANGELOG, src/tcpcapinfo.c
Commit date: 2017-02-26 20:45:59 -0800
Commit message: #278 fail if capture has a packet that is too large (#286)

* #278 fail if capture has a packet that is too large

* Update CHANGELOG

Diff: diff --git a/docs/CHANGELOG b/docs/CHANGELOG
index 82f6846b..f54fd9be 100644
--- a/docs/CHANGELOG
+++ b/docs/CHANGELOG
@@ -1,6 +1,7 @@
 02/26/2017 Version 4.2.0beta1
+    - tcpcapinfo buffer overflow vulnerablily (#278)
     - Update git-clone instructions by Kyle McDonald (#277) 
     - Add protection against packet drift by Guillaume Scott (#268)
     - Include Travis-CI build support by Ilya Shipitsin (#264) (#285)
 
 11/19/2016 Version 4.1.2
diff --git a/src/tcpcapinfo.c b/src/tcpcapinfo.c
index 775f1625..96928820 100644
--- a/src/tcpcapinfo.c
+++ b/src/tcpcapinfo.c
@@ -279,10 +279,19 @@ main(int argc, char *argv[])
                     caplentoobig = 1;
                 }
                 caplen = pcap_ph.caplen;
             }
 
+            if (caplentoobig) {
+                printf("\n\nCapture file appears to be damaged or corrupt.\n"
+                        "Contains packet of size %u, bigger than snap length %u\n",
+                        caplen, pcap_fh.snaplen);
+
+                close(fd);
+                break;
+            }
+
             /* check to make sure timestamps don't go backwards */
             if (last_sec > 0 && last_usec > 0) {
                 if ((pcap_ph.ts.tv_sec == last_sec) ? 
                         (pcap_ph.ts.tv_usec < last_usec) : 
                         (pcap_ph.ts.tv_sec < last_sec)) {
@@ -304,11 +313,11 @@ main(int argc, char *argv[])
                 } else {
                     printf("File truncated!  Unable to jump to next packet.\n");
                 }
 
                 close(fd);
-                continue;
+                break;
             }
 
             /* print the frame checksum */
             printf("\t%x\t", do_checksum_math((u_int16_t *)buf, caplen));
 

Vulnerable code:                 continue;
Fixed code:     - tcpcapinfo buffer overflow vulnerablily (#278)
            if (caplentoobig) {
                printf("\n\nCapture file appears to be damaged or corrupt.\n"
                        "Contains packet of size %u, bigger than snap length %u\n",
                        caplen, pcap_fh.snaplen);

                close(fd);
                break;
            }

                break;
CVE-2022-39243: Other (NVD-CWE-Other)
value: NuProcess is an external process execution implementation for Java. In all the versions of NuProcess where it forks processes by using the JVM's Java_java_lang_UNIXProcess_forkAndExec method (1.2.0+), attackers can use NUL characters in their strings to perform command line injection. Java's ProcessBuilder isn't vulnerable because of a check in ProcessBuilder.start. NuProcess is missing that check. This vulnerability can only be exploited to inject command line arguments on Linux. Version 2.0.5 contains a patch. As a workaround, users of the library can sanitize command strings to remove NUL characters prior to passing them to NuProcess for execution.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 9.8
Published: 2022-09-26T14:15Z
Repository: https://github.com/brettwooldridge/NuProcess
Language: Unknown
Commit date: 2022-09-20 11:06:48 -0700
Commit message: Merge pull request #143 from benhumphreys/harden-null-injection

Add a check for NUL characters in NuProcessBuilder to ensure the arguments provided to the command in code are interpreted consistently when the native process is started.
CVE-2022-38072: Improper Validation of Array Index (CWE-129)
value: An improper array index validation vulnerability exists in the stl_fix_normal_directions functionality of ADMesh Master Commit 767a105 and v0.98.4. A specially-crafted stl file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
CWE description: The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
CVSS v3 base score: 8.8
Published: 2023-04-03T16:15Z
Repository: https://github.com/admesh/admesh
Language: C
Files changed: src/normals.c
Commit date: 2022-11-18 23:04:28 +0100
Commit message: Check the neighbor_index in stl_check_normal_vector


Fixes #60
Diff: diff --git a/src/normals.c b/src/normals.c
index 2832899..91f1fd2 100644
--- a/src/normals.c
+++ b/src/normals.c
@@ -140,11 +140,12 @@ stl_fix_normal_directions(stl_file *stl) {
           stl_reverse_facet
           (stl, stl->neighbors_start[facet_num].neighbor[j]);
         }
       }
       /* If this edge of the facet is connected: */
-      if(stl->neighbors_start[facet_num].neighbor[j] != -1) {
+      if(stl->neighbors_start[facet_num].neighbor[j] != -1 &&
+         stl->neighbors_start[facet_num].neighbor[j] < stl->stats.number_of_facets*sizeof(char)) {
         /* If we haven't fixed this facet yet, add it to the list: */
         if(norm_sw[stl->neighbors_start[facet_num].neighbor[j]] != 1) {
           /* Add node to beginning of list. */
           newn = (struct stl_normal*)malloc(sizeof(struct stl_normal));
           if(newn == NULL) perror("stl_fix_normal_directions");

Vulnerable code:       if(stl->neighbors_start[facet_num].neighbor[j] != -1) {
Fixed code:       if(stl->neighbors_start[facet_num].neighbor[j] != -1 &&
         stl->neighbors_start[facet_num].neighbor[j] < stl->stats.number_of_facets*sizeof(char)) {
CVE-2022-33068: Integer Overflow or Wraparound (CWE-190)
value: An integer overflow in the component hb-ot-shape-fallback.cc of Harfbuzz v4.3.0 allows attackers to cause a Denial of Service (DoS) via unspecified vectors.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 5.5
Published: 2022-06-23T17:15Z
Repository: https://github.com/harfbuzz/harfbuzz
Language: C++
Files changed: src/hb-ot-color-sbix-table.hh
Commit date: 2022-06-01 07:39:20 -0600
Commit message: [sbix] Limit glyph extents

Fixes https://github.com/harfbuzz/harfbuzz/issues/3557

Diff: diff --git a/src/hb-ot-color-sbix-table.hh b/src/hb-ot-color-sbix-table.hh
index 9741ebd45..6efae43cd 100644
--- a/src/hb-ot-color-sbix-table.hh
+++ b/src/hb-ot-color-sbix-table.hh
@@ -296,10 +296,16 @@ struct sbix
       unsigned int strike_ppem = 0;
       hb_blob_t *blob = reference_png (font, glyph, &x_offset, &y_offset, &strike_ppem);
 
       const PNGHeader &png = *blob->as<PNGHeader>();
 
+      if (png.IHDR.height >= 65536 | png.IHDR.width >= 65536)
+      {
+	hb_blob_destroy (blob);
+	return false;
+      }
+
       extents->x_bearing = x_offset;
       extents->y_bearing = png.IHDR.height + y_offset;
       extents->width     = png.IHDR.width;
       extents->height    = -1 * png.IHDR.height;
 
diff --git a/test/fuzzing/fonts/sbix-extents.ttf b/test/fuzzing/fonts/sbix-extents.ttf
new file mode 100644
index 000000000..6f792df70
Binary files /dev/null and b/test/fuzzing/fonts/sbix-extents.ttf differ

Fixed code:       if (png.IHDR.height >= 65536 | png.IHDR.width >= 65536)
      {
	hb_blob_destroy (blob);
	return false;
      }