Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2024-31582: Insufficient Information (NVD-CWE-noinfo)
value: FFmpeg version n6.1 was discovered to contain a heap buffer overflow vulnerability in the draw_block_rectangle function of libavfilter/vf_codecview.c. This vulnerability allows attackers to cause undefined behavior or a Denial of Service (DoS) via crafted input.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-17T19:15Z
Repository: https://github.com/ffmpeg/ffmpeg
Language: C
Files changed: libavfilter/vf_codecview.c
Commit date: 2024-01-05 01:14:33 +0800
Commit message: avfilter/vf_codecview: fix heap buffer overflow

And improve the performance by a little bit.

Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>

Diff: diff --git a/libavfilter/vf_codecview.c b/libavfilter/vf_codecview.c
index 55d9c8c04f..f65ccbda70 100644
--- a/libavfilter/vf_codecview.c
+++ b/libavfilter/vf_codecview.c
@@ -214,13 +214,10 @@ static void draw_block_rectangle(uint8_t *buf, int sx, int sy, int w, int h, ptr
     for (int y = sy; y < sy + h; y++) {
         buf[sx] = color;
         buf[sx + w - 1] = color;
         buf += stride;
     }
-
-    for (int x = sx; x < sx + w; x++)
-        buf[x] = color;
 }
 
 static int filter_frame(AVFilterLink *inlink, AVFrame *frame)
 {
     AVFilterContext *ctx = inlink->dst;

Vulnerable code: 
    for (int x = sx; x < sx + w; x++)
        buf[x] = color;
CVE-2024-31585: Insufficient Information (NVD-CWE-noinfo)
value: FFmpeg version n5.1 to n6.1 was discovered to contain an Off-by-one Error vulnerability in libavfilter/avf_showspectrum.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-17T19:15Z
Repository: https://github.com/ffmpeg/ffmpeg
Language: C
Files changed: libavfilter/avf_showspectrum.c
Commit date: 2023-12-29 01:19:04 +0100
Commit message: avfilter/avf_showspectrum: fix off by 1 error

Fixes: out of array access
Fixes: tickets/10749/poc15ffmpeg

Regression since: 81df787b53eb5c6433731f6eaaf7f2a94d8a8c80

Found-by: Zeng Yunxiang
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Diff: diff --git a/libavfilter/avf_showspectrum.c b/libavfilter/avf_showspectrum.c
index 8cf73fce70..99a5c33d09 100644
--- a/libavfilter/avf_showspectrum.c
+++ b/libavfilter/avf_showspectrum.c
@@ -1782,11 +1782,11 @@ static int showspectrumpic_request_frame(AVFilterLink *outlink)
 
         while (x < sz) {
             int acc_samples = 0;
             int dst_offset = 0;
 
-            while (nb_frame <= s->nb_frames) {
+            while (nb_frame < s->nb_frames) {
                 AVFrame *cur_frame = s->frames[nb_frame];
                 int cur_frame_samples = cur_frame->nb_samples;
                 int nb_samples = 0;
 
                 if (acc_samples < spf) {

Vulnerable code:             while (nb_frame <= s->nb_frames) {
Fixed code:             while (nb_frame < s->nb_frames) {
CVE-2020-7041: Improper Certificate Validation (CWE-295)
value: An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because an X509_check_host negative error code is interpreted as a successful return value.
CWE description: The product does not validate, or incorrectly validates, a certificate.
CVSS v3 base score: 5.3
Published: 2020-02-27T18:15Z
Repository: https://github.com/adrienverge/openfortivpn
Language: Other
Files changed: CHANGELOG.md, configure.ac
Commit date: 2020-02-26 17:02:52 +0100
Commit message: openfortivpn version 1.12.0

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4ad545a..4758e54 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,10 +12,22 @@ Releases
 --------
 
 This high level changelog is usually updated when a release is tagged.
 On the master branch there may be changes that are not (yet) described here.
 
+### 1.12.0
+
+* [-] fix CVE-2020-7043: TLS Certificate CommonName NULL Byte Vulnerability
+* [-] fix CVE-2020-7042: use of uninitialized memory in X509_check_host
+* [-] fix CVE-2020-7041: incorrect use of X509_check_host (regarding return value).
+* [-] always hide cleartest password in -vv output
+* [+] add a clear warning about sensitive information in the debug output
+* [+] add a hint in debug output when password is read from config file
+* [-] fix segfault when connecting with empty password
+* [+] use resolvconf if available to update resolv.conf file
+* [~] replace semicolon by space in dns-suffix string
+
 ### 1.11.0
 
 * [+] allow to connect with empty password (and with smartcard instead of username)
 * [~] properly handle manipulations of resolv.conf
 * [+] support dns-suffix feature
diff --git a/configure.ac b/configure.ac
index 148dac7..c67a11d 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,10 +1,10 @@
 #                                               -*- Autoconf -*-
 # Process this file with autoconf to produce a configure script.
 
 AC_PREREQ([2.63])
-AC_INIT([openfortivpn], [1.11.0])
+AC_INIT([openfortivpn], [1.12.0])
 AC_CONFIG_SRCDIR([src/main.c])
 AM_INIT_AUTOMAKE([foreign subdir-objects])
 
 # Checks for programs.
 AC_PROG_CC

Vulnerable code: AC_INIT([openfortivpn], [1.11.0])
Fixed code: ### 1.12.0

* [-] fix CVE-2020-7043: TLS Certificate CommonName NULL Byte Vulnerability
* [-] fix CVE-2020-7042: use of uninitialized memory in X509_check_host
* [-] fix CVE-2020-7041: incorrect use of X509_check_host (regarding return value).
* [-] always hide cleartest password in -vv output
* [+] add a clear warning about sensitive information in the debug output
* [+] add a hint in debug output when password is read from config file
* [-] fix segfault when connecting with empty password
* [+] use resolvconf if available to update resolv.conf file
* [~] replace semicolon by space in dns-suffix string

AC_INIT([openfortivpn], [1.12.0])
CVE-2020-7041: Improper Certificate Validation (CWE-295)
value: An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because an X509_check_host negative error code is interpreted as a successful return value.
CWE description: The product does not validate, or incorrectly validates, a certificate.
CVSS v3 base score: 5.3
Published: 2020-02-27T18:15Z
Repository: https://github.com/adrienverge/openfortivpn
Language: C
Files changed: src/tunnel.c
Commit date: 2020-02-26 16:49:56 +0100
Commit message: correctly check return value of X509_check_host

CVE-2020-7041 incorrect use of X509_check_host (regarding return value)
is fixed with this commit.

The flaw came in with #242 and prevented proper host name verification
when openssl >= 1.0.2 was in use since openfortivpn 1.7.0.

Diff: diff --git a/src/tunnel.c b/src/tunnel.c
index 9b577e4..84ca7f4 100644
--- a/src/tunnel.c
+++ b/src/tunnel.c
@@ -664,11 +664,12 @@ static int ssl_verify_cert(struct tunnel *tunnel)
 
 	subj = X509_get_subject_name(cert);
 
 #ifdef HAVE_X509_CHECK_HOST
 	// Use OpenSSL native host validation if v >= 1.0.2.
-	if (X509_check_host(cert, common_name, FIELD_SIZE, 0, NULL))
+	// correctly check return value of X509_check_host
+	if (X509_check_host(cert, common_name, FIELD_SIZE, 0, NULL) == 1)
 		cert_valid = 1;
 #else
 	// Use explicit Common Name check if native validation not available.
 	// Note: this will ignore Subject Alternative Name fields.
 	if (subj

Vulnerable code: 	if (X509_check_host(cert, common_name, FIELD_SIZE, 0, NULL))
Fixed code: 	// correctly check return value of X509_check_host
	if (X509_check_host(cert, common_name, FIELD_SIZE, 0, NULL) == 1)
CVE-2020-7042: Improper Certificate Validation (CWE-295)
value: An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because the hostname check operates on uninitialized memory. The outcome is that a valid certificate is never accepted (only a malformed certificate may be accepted).
CWE description: The product does not validate, or incorrectly validates, a certificate.
CVSS v3 base score: 5.3
Published: 2020-02-27T18:15Z
Repository: https://github.com/adrienverge/openfortivpn
Language: Other
Files changed: CHANGELOG.md, configure.ac
Commit date: 2020-02-26 17:02:52 +0100
Commit message: openfortivpn version 1.12.0

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4ad545a..4758e54 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,10 +12,22 @@ Releases
 --------
 
 This high level changelog is usually updated when a release is tagged.
 On the master branch there may be changes that are not (yet) described here.
 
+### 1.12.0
+
+* [-] fix CVE-2020-7043: TLS Certificate CommonName NULL Byte Vulnerability
+* [-] fix CVE-2020-7042: use of uninitialized memory in X509_check_host
+* [-] fix CVE-2020-7041: incorrect use of X509_check_host (regarding return value).
+* [-] always hide cleartest password in -vv output
+* [+] add a clear warning about sensitive information in the debug output
+* [+] add a hint in debug output when password is read from config file
+* [-] fix segfault when connecting with empty password
+* [+] use resolvconf if available to update resolv.conf file
+* [~] replace semicolon by space in dns-suffix string
+
 ### 1.11.0
 
 * [+] allow to connect with empty password (and with smartcard instead of username)
 * [~] properly handle manipulations of resolv.conf
 * [+] support dns-suffix feature
diff --git a/configure.ac b/configure.ac
index 148dac7..c67a11d 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,10 +1,10 @@
 #                                               -*- Autoconf -*-
 # Process this file with autoconf to produce a configure script.
 
 AC_PREREQ([2.63])
-AC_INIT([openfortivpn], [1.11.0])
+AC_INIT([openfortivpn], [1.12.0])
 AC_CONFIG_SRCDIR([src/main.c])
 AM_INIT_AUTOMAKE([foreign subdir-objects])
 
 # Checks for programs.
 AC_PROG_CC

Vulnerable code: AC_INIT([openfortivpn], [1.11.0])
Fixed code: ### 1.12.0

* [-] fix CVE-2020-7043: TLS Certificate CommonName NULL Byte Vulnerability
* [-] fix CVE-2020-7042: use of uninitialized memory in X509_check_host
* [-] fix CVE-2020-7041: incorrect use of X509_check_host (regarding return value).
* [-] always hide cleartest password in -vv output
* [+] add a clear warning about sensitive information in the debug output
* [+] add a hint in debug output when password is read from config file
* [-] fix segfault when connecting with empty password
* [+] use resolvconf if available to update resolv.conf file
* [~] replace semicolon by space in dns-suffix string

AC_INIT([openfortivpn], [1.12.0])
CVE-2020-7042: Use of Uninitialized Resource (CWE-908)
value: An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because the hostname check operates on uninitialized memory. The outcome is that a valid certificate is never accepted (only a malformed certificate may be accepted).
CWE description: The product uses or accesses a resource that has not been initialized.
CVSS v3 base score: 5.3
Published: 2020-02-27T18:15Z
Repository: https://github.com/adrienverge/openfortivpn
Language: Other
Files changed: CHANGELOG.md, configure.ac
Commit date: 2020-02-26 17:02:52 +0100
Commit message: openfortivpn version 1.12.0

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4ad545a..4758e54 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,10 +12,22 @@ Releases
 --------
 
 This high level changelog is usually updated when a release is tagged.
 On the master branch there may be changes that are not (yet) described here.
 
+### 1.12.0
+
+* [-] fix CVE-2020-7043: TLS Certificate CommonName NULL Byte Vulnerability
+* [-] fix CVE-2020-7042: use of uninitialized memory in X509_check_host
+* [-] fix CVE-2020-7041: incorrect use of X509_check_host (regarding return value).
+* [-] always hide cleartest password in -vv output
+* [+] add a clear warning about sensitive information in the debug output
+* [+] add a hint in debug output when password is read from config file
+* [-] fix segfault when connecting with empty password
+* [+] use resolvconf if available to update resolv.conf file
+* [~] replace semicolon by space in dns-suffix string
+
 ### 1.11.0
 
 * [+] allow to connect with empty password (and with smartcard instead of username)
 * [~] properly handle manipulations of resolv.conf
 * [+] support dns-suffix feature
diff --git a/configure.ac b/configure.ac
index 148dac7..c67a11d 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,10 +1,10 @@
 #                                               -*- Autoconf -*-
 # Process this file with autoconf to produce a configure script.
 
 AC_PREREQ([2.63])
-AC_INIT([openfortivpn], [1.11.0])
+AC_INIT([openfortivpn], [1.12.0])
 AC_CONFIG_SRCDIR([src/main.c])
 AM_INIT_AUTOMAKE([foreign subdir-objects])
 
 # Checks for programs.
 AC_PROG_CC

Vulnerable code: AC_INIT([openfortivpn], [1.11.0])
Fixed code: ### 1.12.0

* [-] fix CVE-2020-7043: TLS Certificate CommonName NULL Byte Vulnerability
* [-] fix CVE-2020-7042: use of uninitialized memory in X509_check_host
* [-] fix CVE-2020-7041: incorrect use of X509_check_host (regarding return value).
* [-] always hide cleartest password in -vv output
* [+] add a clear warning about sensitive information in the debug output
* [+] add a hint in debug output when password is read from config file
* [-] fix segfault when connecting with empty password
* [+] use resolvconf if available to update resolv.conf file
* [~] replace semicolon by space in dns-suffix string

AC_INIT([openfortivpn], [1.12.0])
CVE-2020-7042: Improper Certificate Validation (CWE-295)
value: An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because the hostname check operates on uninitialized memory. The outcome is that a valid certificate is never accepted (only a malformed certificate may be accepted).
CWE description: The product does not validate, or incorrectly validates, a certificate.
CVSS v3 base score: 5.3
Published: 2020-02-27T18:15Z
Repository: https://github.com/adrienverge/openfortivpn
Language: C
Files changed: src/tunnel.c
Commit date: 2020-02-26 16:49:56 +0100
Commit message: supply proper input buffer to X509_check_host

CVE-2020-7042 use of uninitialized memory in X509_check_host is fixed with
this commit

the uninitialized buffer common_name was passed as argument to X509_check_host
which prevented proper host name validation when openssl >= 1.0.2 was in use.
This came in with #282 which went into openfortivpn 1.7.1.
Unfortunately, this problem has stayed unnoticed because the return value
was not properly checked either (which is a separate issue, with CVE-2020-7041,
and which has been fixed by the previous commit)

Diff: diff --git a/src/tunnel.c b/src/tunnel.c
index 84ca7f4..f0466a6 100644
--- a/src/tunnel.c
+++ b/src/tunnel.c
@@ -650,11 +650,10 @@ static int ssl_verify_cert(struct tunnel *tunnel)
 	struct x509_digest *elem;
 	char digest_str[SHA256STRLEN], *subject, *issuer;
 	char *line;
 	int i;
 	X509_NAME *subj;
-	char common_name[FIELD_SIZE + 1];
 
 	SSL_set_verify(tunnel->ssl_handle, SSL_VERIFY_PEER, NULL);
 
 	X509 *cert = SSL_get_peer_certificate(tunnel->ssl_handle);
 	if (cert == NULL) {
@@ -664,14 +663,17 @@ static int ssl_verify_cert(struct tunnel *tunnel)
 
 	subj = X509_get_subject_name(cert);
 
 #ifdef HAVE_X509_CHECK_HOST
 	// Use OpenSSL native host validation if v >= 1.0.2.
-	// correctly check return value of X509_check_host
-	if (X509_check_host(cert, common_name, FIELD_SIZE, 0, NULL) == 1)
+	// compare against gateway_host and correctly check return value
+	// to fix piror Incorrect use of X509_check_host
+	if (X509_check_host(cert, tunnel->config->gateway_host,
+	                    0, 0, NULL) == 1)
 		cert_valid = 1;
 #else
+	char common_name[FIELD_SIZE + 1];
 	// Use explicit Common Name check if native validation not available.
 	// Note: this will ignore Subject Alternative Name fields.
 	if (subj
 	    && X509_NAME_get_text_by_NID(subj, NID_commonName, common_name,
 	                                 FIELD_SIZE) > 0

Vulnerable code: 	char common_name[FIELD_SIZE + 1];
	// correctly check return value of X509_check_host
	if (X509_check_host(cert, common_name, FIELD_SIZE, 0, NULL) == 1)
Fixed code: 	// compare against gateway_host and correctly check return value
	// to fix piror Incorrect use of X509_check_host
	if (X509_check_host(cert, tunnel->config->gateway_host,
	                    0, 0, NULL) == 1)
	char common_name[FIELD_SIZE + 1];
CVE-2020-7042: Use of Uninitialized Resource (CWE-908)
value: An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because the hostname check operates on uninitialized memory. The outcome is that a valid certificate is never accepted (only a malformed certificate may be accepted).
CWE description: The product uses or accesses a resource that has not been initialized.
CVSS v3 base score: 5.3
Published: 2020-02-27T18:15Z
Repository: https://github.com/adrienverge/openfortivpn
Language: C
Files changed: src/tunnel.c
Commit date: 2020-02-26 16:49:56 +0100
Commit message: supply proper input buffer to X509_check_host

CVE-2020-7042 use of uninitialized memory in X509_check_host is fixed with
this commit

the uninitialized buffer common_name was passed as argument to X509_check_host
which prevented proper host name validation when openssl >= 1.0.2 was in use.
This came in with #282 which went into openfortivpn 1.7.1.
Unfortunately, this problem has stayed unnoticed because the return value
was not properly checked either (which is a separate issue, with CVE-2020-7041,
and which has been fixed by the previous commit)

Diff: diff --git a/src/tunnel.c b/src/tunnel.c
index 84ca7f4..f0466a6 100644
--- a/src/tunnel.c
+++ b/src/tunnel.c
@@ -650,11 +650,10 @@ static int ssl_verify_cert(struct tunnel *tunnel)
 	struct x509_digest *elem;
 	char digest_str[SHA256STRLEN], *subject, *issuer;
 	char *line;
 	int i;
 	X509_NAME *subj;
-	char common_name[FIELD_SIZE + 1];
 
 	SSL_set_verify(tunnel->ssl_handle, SSL_VERIFY_PEER, NULL);
 
 	X509 *cert = SSL_get_peer_certificate(tunnel->ssl_handle);
 	if (cert == NULL) {
@@ -664,14 +663,17 @@ static int ssl_verify_cert(struct tunnel *tunnel)
 
 	subj = X509_get_subject_name(cert);
 
 #ifdef HAVE_X509_CHECK_HOST
 	// Use OpenSSL native host validation if v >= 1.0.2.
-	// correctly check return value of X509_check_host
-	if (X509_check_host(cert, common_name, FIELD_SIZE, 0, NULL) == 1)
+	// compare against gateway_host and correctly check return value
+	// to fix piror Incorrect use of X509_check_host
+	if (X509_check_host(cert, tunnel->config->gateway_host,
+	                    0, 0, NULL) == 1)
 		cert_valid = 1;
 #else
+	char common_name[FIELD_SIZE + 1];
 	// Use explicit Common Name check if native validation not available.
 	// Note: this will ignore Subject Alternative Name fields.
 	if (subj
 	    && X509_NAME_get_text_by_NID(subj, NID_commonName, common_name,
 	                                 FIELD_SIZE) > 0

Vulnerable code: 	char common_name[FIELD_SIZE + 1];
	// correctly check return value of X509_check_host
	if (X509_check_host(cert, common_name, FIELD_SIZE, 0, NULL) == 1)
Fixed code: 	// compare against gateway_host and correctly check return value
	// to fix piror Incorrect use of X509_check_host
	if (X509_check_host(cert, tunnel->config->gateway_host,
	                    0, 0, NULL) == 1)
	char common_name[FIELD_SIZE + 1];
CVE-2020-7043: Improper Certificate Validation (CWE-295)
value: An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL before 1.0.2. tunnel.c mishandles certificate validation because hostname comparisons do not consider '\0' characters, as demonstrated by a good.example.com\x00evil.example.com attack.
CWE description: The product does not validate, or incorrectly validates, a certificate.
CVSS v3 base score: 9.1
Published: 2020-02-27T18:15Z
Repository: https://github.com/adrienverge/openfortivpn
Language: Other
Files changed: CHANGELOG.md, configure.ac
Commit date: 2020-02-26 17:02:52 +0100
Commit message: openfortivpn version 1.12.0

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4ad545a..4758e54 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,10 +12,22 @@ Releases
 --------
 
 This high level changelog is usually updated when a release is tagged.
 On the master branch there may be changes that are not (yet) described here.
 
+### 1.12.0
+
+* [-] fix CVE-2020-7043: TLS Certificate CommonName NULL Byte Vulnerability
+* [-] fix CVE-2020-7042: use of uninitialized memory in X509_check_host
+* [-] fix CVE-2020-7041: incorrect use of X509_check_host (regarding return value).
+* [-] always hide cleartest password in -vv output
+* [+] add a clear warning about sensitive information in the debug output
+* [+] add a hint in debug output when password is read from config file
+* [-] fix segfault when connecting with empty password
+* [+] use resolvconf if available to update resolv.conf file
+* [~] replace semicolon by space in dns-suffix string
+
 ### 1.11.0
 
 * [+] allow to connect with empty password (and with smartcard instead of username)
 * [~] properly handle manipulations of resolv.conf
 * [+] support dns-suffix feature
diff --git a/configure.ac b/configure.ac
index 148dac7..c67a11d 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,10 +1,10 @@
 #                                               -*- Autoconf -*-
 # Process this file with autoconf to produce a configure script.
 
 AC_PREREQ([2.63])
-AC_INIT([openfortivpn], [1.11.0])
+AC_INIT([openfortivpn], [1.12.0])
 AC_CONFIG_SRCDIR([src/main.c])
 AM_INIT_AUTOMAKE([foreign subdir-objects])
 
 # Checks for programs.
 AC_PROG_CC

Vulnerable code: AC_INIT([openfortivpn], [1.11.0])
Fixed code: ### 1.12.0

* [-] fix CVE-2020-7043: TLS Certificate CommonName NULL Byte Vulnerability
* [-] fix CVE-2020-7042: use of uninitialized memory in X509_check_host
* [-] fix CVE-2020-7041: incorrect use of X509_check_host (regarding return value).
* [-] always hide cleartest password in -vv output
* [+] add a clear warning about sensitive information in the debug output
* [+] add a hint in debug output when password is read from config file
* [-] fix segfault when connecting with empty password
* [+] use resolvconf if available to update resolv.conf file
* [~] replace semicolon by space in dns-suffix string

AC_INIT([openfortivpn], [1.12.0])
CVE-2022-24795: Heap-based Buffer Overflow (CWE-122)
value: yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of `yajl` contain an integer overflow which leads to subsequent heap memory corruption when dealing with large (~2GB) inputs. The reallocation logic at `yajl_buf.c#L64` may result in the `need` 32bit integer wrapping to 0 when `need` approaches a value of 0x80000000 (i.e. ~2GB of data), which results in a reallocation of buf->alloc into a small heap chunk. These integers are declared as `size_t` in the 2.x branch of `yajl`, which practically prevents the issue from triggering on 64bit platforms, however this does not preclude this issue triggering on 32bit builds on which `size_t` is a 32bit integer. Subsequent population of this under-allocated heap chunk is based on the original buffer size, leading to heap memory corruption. This vulnerability mostly impacts process availability. Maintainers believe exploitation for arbitrary code execution is unlikely. A patch is available and anticipated to be part of yajl-ruby version 1.4.2. As a workaround, avoid passing large inputs to YAJL.
CWE description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CVSS v3 base score: 7.5
Published: 2022-04-05T16:15Z
Repository: https://github.com/brianmario/yajl-ruby
Language: Unknown
Commit date: 2021-06-24 14:22:27 -0700
Commit message: Merge pull request #204 from eileencodes/fix-c-warnings

Fix c warnings
CVE-2022-24795: Integer Overflow or Wraparound (CWE-190)
value: yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of `yajl` contain an integer overflow which leads to subsequent heap memory corruption when dealing with large (~2GB) inputs. The reallocation logic at `yajl_buf.c#L64` may result in the `need` 32bit integer wrapping to 0 when `need` approaches a value of 0x80000000 (i.e. ~2GB of data), which results in a reallocation of buf->alloc into a small heap chunk. These integers are declared as `size_t` in the 2.x branch of `yajl`, which practically prevents the issue from triggering on 64bit platforms, however this does not preclude this issue triggering on 32bit builds on which `size_t` is a 32bit integer. Subsequent population of this under-allocated heap chunk is based on the original buffer size, leading to heap memory corruption. This vulnerability mostly impacts process availability. Maintainers believe exploitation for arbitrary code execution is unlikely. A patch is available and anticipated to be part of yajl-ruby version 1.4.2. As a workaround, avoid passing large inputs to YAJL.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 7.5
Published: 2022-04-05T16:15Z
Repository: https://github.com/brianmario/yajl-ruby
Language: Unknown
Commit date: 2021-06-24 14:22:27 -0700
Commit message: Merge pull request #204 from eileencodes/fix-c-warnings

Fix c warnings
CVE-2021-32812: Improper Encoding or Escaping of Output (CWE-116)
value: Monkshu is an enterprise application server for mobile apps (iOS and Android), responsive HTML 5 apps, and JSON API services. In version 2.90 and earlier, there is a reflected cross-site scripting vulnerability in frontend HTTP server. The attacker can send in a carefully crafted URL along with a known bug in the server which will cause a 500 error, and the response will then embed the URL provided by the hacker. The impact is moderate as the hacker must also be able to craft an HTTP request which should cause a 500 server error. None such requests are known as this point. The issue is patched in version 2.95. As a workaround, one may use a disk caching plugin.
CWE description: The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CVSS v3 base score: 6.1
Published: 2021-08-02T23:15Z
Repository: https://github.com/TekMonksGitHub/monkshu
Language: JavaScript
Files changed: frontend/server/server.js
Commit date: 2021-07-31 14:01:35 +0900
Commit message: Fix for GHSA-hcpx-66hq-7g4x. Cross-site reflection

Diff: diff --git a/frontend/server/server.js b/frontend/server/server.js
index 2895e77..3bf2bef 100644
--- a/frontend/server/server.js
+++ b/frontend/server/server.js
@@ -129,16 +129,16 @@ function _sendFile(fileRequested, req, res, stats) {
 			const acceptEncodingHeader = req.headers["accept-encoding"] || "";
 
 			if (conf.enableGZIPEncoding && acceptEncodingHeader.includes("gzip") && mime && (!Array.isArray(mime) || Array.isArray(mime) && mime[1]) ) {
 				res.writeHead(200, _getServerHeaders({ "Content-Type": Array.isArray(mime)?mime[0]:mime, "Content-Encoding": "gzip" }, stats));
 				rawStream.pipe(zlib.createGzip()).pipe(res)
-				.on("error", err => _sendError(req, res, 500, `500: ${req.url}, Server error: ${err}`))
+				.on("error", err => _sendError(req, res, 500, `500: Error: ${err}`))
 				.on("end", _ => res.end());
 			} else {
 				res.writeHead(200, mime ? _getServerHeaders({"Content-Type":Array.isArray(mime)?mime[0]:mime}, stats) : _getServerHeaders({}, stats));
 				rawStream.on("data", chunk => res.write(chunk, "binary"))
-					.on("error", err => _sendError(req, res, 500, `500: ${req.url}, Server error: ${err}`))
+					.on("error", err => _sendError(req, res, 500, `500: Error: ${err}`))
 					.on("end", _ => res.end());
 			}
 		}
 	});
 }

Vulnerable code: 				.on("error", err => _sendError(req, res, 500, `500: ${req.url}, Server error: ${err}`))
					.on("error", err => _sendError(req, res, 500, `500: ${req.url}, Server error: ${err}`))
Fixed code: 				.on("error", err => _sendError(req, res, 500, `500: Error: ${err}`))
					.on("error", err => _sendError(req, res, 500, `500: Error: ${err}`))
CVE-2021-32812: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Monkshu is an enterprise application server for mobile apps (iOS and Android), responsive HTML 5 apps, and JSON API services. In version 2.90 and earlier, there is a reflected cross-site scripting vulnerability in frontend HTTP server. The attacker can send in a carefully crafted URL along with a known bug in the server which will cause a 500 error, and the response will then embed the URL provided by the hacker. The impact is moderate as the hacker must also be able to craft an HTTP request which should cause a 500 server error. None such requests are known as this point. The issue is patched in version 2.95. As a workaround, one may use a disk caching plugin.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-08-02T23:15Z
Repository: https://github.com/TekMonksGitHub/monkshu
Language: JavaScript
Files changed: frontend/server/server.js
Commit date: 2021-07-31 14:01:35 +0900
Commit message: Fix for GHSA-hcpx-66hq-7g4x. Cross-site reflection

Diff: diff --git a/frontend/server/server.js b/frontend/server/server.js
index 2895e77..3bf2bef 100644
--- a/frontend/server/server.js
+++ b/frontend/server/server.js
@@ -129,16 +129,16 @@ function _sendFile(fileRequested, req, res, stats) {
 			const acceptEncodingHeader = req.headers["accept-encoding"] || "";
 
 			if (conf.enableGZIPEncoding && acceptEncodingHeader.includes("gzip") && mime && (!Array.isArray(mime) || Array.isArray(mime) && mime[1]) ) {
 				res.writeHead(200, _getServerHeaders({ "Content-Type": Array.isArray(mime)?mime[0]:mime, "Content-Encoding": "gzip" }, stats));
 				rawStream.pipe(zlib.createGzip()).pipe(res)
-				.on("error", err => _sendError(req, res, 500, `500: ${req.url}, Server error: ${err}`))
+				.on("error", err => _sendError(req, res, 500, `500: Error: ${err}`))
 				.on("end", _ => res.end());
 			} else {
 				res.writeHead(200, mime ? _getServerHeaders({"Content-Type":Array.isArray(mime)?mime[0]:mime}, stats) : _getServerHeaders({}, stats));
 				rawStream.on("data", chunk => res.write(chunk, "binary"))
-					.on("error", err => _sendError(req, res, 500, `500: ${req.url}, Server error: ${err}`))
+					.on("error", err => _sendError(req, res, 500, `500: Error: ${err}`))
 					.on("end", _ => res.end());
 			}
 		}
 	});
 }

Vulnerable code: 				.on("error", err => _sendError(req, res, 500, `500: ${req.url}, Server error: ${err}`))
					.on("error", err => _sendError(req, res, 500, `500: ${req.url}, Server error: ${err}`))
Fixed code: 				.on("error", err => _sendError(req, res, 500, `500: Error: ${err}`))
					.on("error", err => _sendError(req, res, 500, `500: Error: ${err}`))
CVE-2022-2494: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-07-22T04:15Z
Repository: https://github.com/openemr/openemr
Language: JavaScript
Files changed: portal/patient/scripts/app/patientdata.js
Commit date: 2022-05-21 21:44:04 -0700
Commit message: bug fix d (#5368)


Diff: diff --git a/portal/patient/scripts/app/patientdata.js b/portal/patient/scripts/app/patientdata.js
index 7fb2ab0ae3..4314335141 100644
--- a/portal/patient/scripts/app/patientdata.js
+++ b/portal/patient/scripts/app/patientdata.js
@@ -126,11 +126,11 @@ var page = {
                             if (value != page.patient.get(key)) {
                                 if (($("input[name=" + key + "]").attr('type') === 'radio' || $('#' + key).is('select')) && value == "") {
                                     value = 'Unassigned';
                                 }
                                 $('#' + key + 'InputContainer span.help-inline').html(
-                                '<a class="editval text-primary" onclick="page.toggleVal(this); return false;" data-tstate=new data-id="'+key+'">'+value+'</a>');
+                                '<a class="editval text-primary" onclick="page.toggleVal(this); return false;" data-tstate=new data-id="' + _.escape(key) + '">' + _.escape(value) + '</a>');
                                 $('#' + key + 'InputContainer span.help-inline').show();
                             }
                         });
                     }
                 }

Vulnerable code:                                 '<a class="editval text-primary" onclick="page.toggleVal(this); return false;" data-tstate=new data-id="'+key+'">'+value+'</a>');
Fixed code:                                 '<a class="editval text-primary" onclick="page.toggleVal(this); return false;" data-tstate=new data-id="' + _.escape(key) + '">' + _.escape(value) + '</a>');
CVE-2023-2566: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.1.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2023-05-08T05:15Z
Repository: https://github.com/openemr/openemr
Language: PHP
Files changed: library/htmlspecialchars.inc.php
Commit date: 2022-12-24 13:07:09 -0800
Commit message: fixes

Diff: diff --git a/library/htmlspecialchars.inc.php b/library/htmlspecialchars.inc.php
index 70529d6eb3c..9258c0e99fd 100644
--- a/library/htmlspecialchars.inc.php
+++ b/library/htmlspecialchars.inc.php
@@ -90,15 +90,33 @@ function xmlEscape($text)
 {
     return htmlspecialchars(($text ?? ''), ENT_XML1 | ENT_QUOTES);
 }
 
 /**
- * Special function to remove the 'javascript' string (case insensitive) for when including a variable within a html link
+ * Special function to remove the 'javascript' strings (case insensitive) for when including a variable within a html link
  */
-function javascriptStringRemove($text)
+function javascriptStringRemove(?string $text): string
 {
-    return str_ireplace('javascript', '', $text ?? '');
+    $returnText = str_ireplace('javascript', '', $text ?? '');
+
+    if (javascriptStringCheck($returnText)) {
+        $returnText = javascriptStringRemove($returnText);
+    }
+
+    return $returnText;
+}
+
+/**
+ * Special function to check if 'javascript' string (case insensitive) is in a variable within a html link
+ */
+function javascriptStringCheck(?string $text): bool
+{
+    if (stripos($text ?? '', 'javascript') === false) {
+        return false;
+    } else {
+        return true;
+    }
 }
 
 /**
  * Escape a PHP string for use as (part of) an HTML / XML text node.
  *

Vulnerable code:  * Special function to remove the 'javascript' string (case insensitive) for when including a variable within a html link
function javascriptStringRemove($text)
    return str_ireplace('javascript', '', $text ?? '');
Fixed code:  * Special function to remove the 'javascript' strings (case insensitive) for when including a variable within a html link
function javascriptStringRemove(?string $text): string
    $returnText = str_ireplace('javascript', '', $text ?? '');

    if (javascriptStringCheck($returnText)) {
        $returnText = javascriptStringRemove($returnText);
    }

    return $returnText;
}

/**
 * Special function to check if 'javascript' string (case insensitive) is in a variable within a html link
 */
function javascriptStringCheck(?string $text): bool
{
    if (stripos($text ?? '', 'javascript') === false) {
        return false;
    } else {
        return true;
    }
CVE-2023-2674: Improper Access Control (CWE-284)
value: Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.
CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVSS v3 base score: 4.3
Published: 2023-05-12T08:15Z
Repository: https://github.com/openemr/openemr
Language: PHP
Files changed: library/classes/Controller.class.php
Commit date: 2023-01-15 17:18:37 -0800
Commit message: bug fix (#6098)


Diff: diff --git a/library/classes/Controller.class.php b/library/classes/Controller.class.php
index 3b0d45cde44..e77943625a7 100644
--- a/library/classes/Controller.class.php
+++ b/library/classes/Controller.class.php
@@ -1,7 +1,10 @@
 <?php
 
+use OpenEMR\Common\Acl\AclMain;
+use OpenEMR\Common\Twig\TwigContainer;
+
 // TODO: @adunsulag move these into src/
 class Controller extends Smarty
 {
     public $template_mod;
     public $_current_action;
@@ -71,10 +74,16 @@ class Controller extends Smarty
          return include_once($file);
     }
 
     public function act($qarray)
     {
+        if ((array_key_first($qarray) ?? '') == 'practice_settings') {
+            if (!AclMain::aclCheckCore('admin', 'practice')) {
+                echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Practice Settings")]);
+                exit;
+            }
+        }
 
         if (isset($_GET['process'])) {
             unset($_GET['process']);
             unset($qarray['process']);
             $_POST['process'] = "true";

Fixed code: use OpenEMR\Common\Acl\AclMain;
use OpenEMR\Common\Twig\TwigContainer;

        if ((array_key_first($qarray) ?? '') == 'practice_settings') {
            if (!AclMain::aclCheckCore('admin', 'practice')) {
                echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Practice Settings")]);
                exit;
            }
        }
CVE-2023-2946: Improper Access Control (CWE-284)
value: Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.
CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVSS v3 base score: 8.1
Published: 2023-05-27T23:15Z
Repository: https://github.com/openemr/openemr
Language: PHP
Files changed: library/classes/Controller.class.php
Commit date: 2023-03-14 08:31:16 -0400
Commit message: fix: bug (#6284)


Diff: diff --git a/library/classes/Controller.class.php b/library/classes/Controller.class.php
index e77943625a7..d169f83bcb9 100644
--- a/library/classes/Controller.class.php
+++ b/library/classes/Controller.class.php
@@ -81,10 +81,17 @@ class Controller extends Smarty
                 echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Practice Settings")]);
                 exit;
             }
         }
 
+        if ((array_key_first($qarray) ?? '') == 'prescription') {
+            if (!AclMain::aclCheckCore('patients', 'prescriptions')) {
+                echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Prescriptions")]);
+                exit;
+            }
+        }
+
         if (isset($_GET['process'])) {
             unset($_GET['process']);
             unset($qarray['process']);
             $_POST['process'] = "true";
         }

Fixed code:         if ((array_key_first($qarray) ?? '') == 'prescription') {
            if (!AclMain::aclCheckCore('patients', 'prescriptions')) {
                echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Prescriptions")]);
                exit;
            }
        }
CVE-2022-0121: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hoppscotch hoppscotch/hoppscotch.This issue affects hoppscotch/hoppscotch before 2.1.1.


CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 8
Published: 2022-01-06T03:15Z
Repository: https://github.com/hoppscotch/hoppscotch
Language: Other
Files changed: packages/hoppscotch-app/components/lenses/renderers/HTMLLensRenderer.vue
Commit date: 2022-01-05 09:18:16 +0530
Commit message: fix: apply sandbox to HTML preview iframe

Diff: diff --git a/packages/hoppscotch-app/components/lenses/renderers/HTMLLensRenderer.vue b/packages/hoppscotch-app/components/lenses/renderers/HTMLLensRenderer.vue
index 3b43da26..2740aefa 100644
--- a/packages/hoppscotch-app/components/lenses/renderers/HTMLLensRenderer.vue
+++ b/packages/hoppscotch-app/components/lenses/renderers/HTMLLensRenderer.vue
@@ -47,10 +47,11 @@
       v-show="previewEnabled"
       ref="previewFrame"
       class="covers-response"
       src="about:blank"
       loading="lazy"
+      sandbox=""
     ></iframe>
   </div>
 </template>
 
 <script setup lang="ts">

Fixed code:       sandbox=""
CVE-2023-34097: Insertion of Sensitive Information into Log File (CWE-532)
value: hoppscotch is an open source API development ecosystem. In versions prior to 2023.4.5 the database password is exposed in the logs when showing the database connection string. Attackers with access to read system logs will be able to elevate privilege with full access to the database. Users are advised to upgrade. There are no known workarounds for this vulnerability. 
CWE description: Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
CVSS v3 base score: 8.8
Published: 2023-06-05T21:15Z
Repository: https://github.com/hoppscotch/hoppscotch
Language: TypeScript
Files changed: packages/hoppscotch-backend/src/main.ts
Commit date: 2023-06-04 23:33:32 -0400
Commit message: fix: stop logging DATABASE_URL in logs

Diff: diff --git a/packages/hoppscotch-backend/src/main.ts b/packages/hoppscotch-backend/src/main.ts
index 15764ce15..920f7cce9 100644
--- a/packages/hoppscotch-backend/src/main.ts
+++ b/packages/hoppscotch-backend/src/main.ts
@@ -7,11 +7,10 @@ import * as session from 'express-session';
 import { emitGQLSchemaFile } from './gql-schema';
 
 async function bootstrap() {
   console.log(`Running in production: ${process.env.PRODUCTION}`);
   console.log(`Port: ${process.env.PORT}`);
-  console.log(`Database: ${process.env.DATABASE_URL}`);
 
   const app = await NestFactory.create(AppModule);
 
   app.use(
     session({

Vulnerable code:   console.log(`Database: ${process.env.DATABASE_URL}`);
CVE-2023-50254: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Deepin Linux's default document reader `deepin-reader` software suffers from a serious vulnerability in versions prior to 6.0.7 due to a design flaw that leads to remote command execution via crafted docx document. This is a file overwrite vulnerability. Remote code execution (RCE) can be achieved by overwriting files like .bash_rc, .bash_login, etc. RCE will be triggered when the user opens the terminal. Version 6.0.7 contains a patch for the issue.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.8
Published: 2023-12-22T17:15Z
Repository: https://github.com/linuxdeepin/deepin-reader
Language: Other
Files changed: debian/changelog
Commit date: 2023-12-19 05:11:52 +0000
Commit message: fix: change log 6.0.7

change log 6.0.7

Log: change log 6.0.7

Diff: diff --git a/debian/changelog b/debian/changelog
index 021f6a21..ab120a1b 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,5 +1,11 @@
+deepin-reader (6.0.7) unstable; urgency=medium
+
+  * change log 6.0.7.
+
+ -- muyuankai <muyuankai@uniontech.com>  Tue, 19 Dec 2023 11:49:10 +0800
+
 deepin-reader (6.0.6) unstable; urgency=medium
 
   * fix: can not copy
  
  -- fengli <fengli@uniontech.com>  Fri, 03 Nov 2023 13:23:33 +0800

Fixed code: deepin-reader (6.0.7) unstable; urgency=medium

  * change log 6.0.7.

 -- muyuankai <muyuankai@uniontech.com>  Tue, 19 Dec 2023 11:49:10 +0800
CVE-2023-50254: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Deepin Linux's default document reader `deepin-reader` software suffers from a serious vulnerability in versions prior to 6.0.7 due to a design flaw that leads to remote command execution via crafted docx document. This is a file overwrite vulnerability. Remote code execution (RCE) can be achieved by overwriting files like .bash_rc, .bash_login, etc. RCE will be triggered when the user opens the terminal. Version 6.0.7 contains a patch for the issue.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.8
Published: 2023-12-22T17:15Z
Repository: https://github.com/linuxdeepin/deepin-reader
Language: C++
Files changed: reader/document/Model.cpp
Commit date: 2023-12-12 08:47:53 +0000
Commit message: fix: deal with docx document format

deal with docx document format

Bug: https://pms.uniontech.com/bug-view-232871.html
Log: deal with docx document format

Diff: diff --git a/reader/document/Model.cpp b/reader/document/Model.cpp
index 273fb17e..b7220d52 100755
--- a/reader/document/Model.cpp
+++ b/reader/document/Model.cpp
@@ -11,10 +11,11 @@
 
 #include <QProcess>
 #include <QFile>
 #include <QDir>
 #include <QTimer>
+#include <QTemporaryFile>
 
 namespace deepin_reader {
 deepin_reader::Document *deepin_reader::DocumentFactory::getDocument(const int &fileType,
                                                                      const QString &filePath,
                                                                      const QString &convertedFileDir,
@@ -75,11 +76,14 @@ deepin_reader::Document *deepin_reader::DocumentFactory::getDocument(const int &
                 *pprocess = nullptr;
             }
             return nullptr;
         }
         qDebug() << "文档解压完成";
-
+        QTemporaryFile tmpFile(convertedFileDir + "/word/" + QCoreApplication::applicationName() + "_XXXXXX.html");
+        if( tmpFile.open()) { //fix 232871
+             tmpHtmlFilePath = tmpFile.fileName(); // returns the unique file name
+         }
         // docx -> html
         QProcess converter;
         *pprocess = &converter;
         converter.setWorkingDirectory(convertedFileDir + "/word");
         qDebug() << "正在将docx文档转换成html..." << tmpHtmlFilePath;

Fixed code: #include <QTemporaryFile>
        QTemporaryFile tmpFile(convertedFileDir + "/word/" + QCoreApplication::applicationName() + "_XXXXXX.html");
        if( tmpFile.open()) { //fix 232871
             tmpHtmlFilePath = tmpFile.fileName(); // returns the unique file name
         }