Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2021-29658: Other (NVD-CWE-Other)
value: The unofficial vscode-rufo extension before 0.0.4 for Visual Studio Code allows attackers to execute arbitrary binaries if the user opens a crafted workspace folder.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 8.8
Published: 2021-03-31T17:15Z
Repository: https://github.com/jnbt/vscode-rufo
Language: JSON
Files changed: CHANGELOG.md, package.json
Commit date: 2021-03-31 09:41:30 +0200
Commit message: Move rufo path setting to application scope

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index c707be2..5c30958 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,11 +2,12 @@
 All notable changes to the "vscode-rufo" extension will be documented in this file.
 
 Check [Keep a Changelog](http://keepachangelog.com/) for recommendations on how to structure this file.
 
 ## [Unreleased]
-- Format Ruby source code via Rufo
+
+- Move rufo path setting to application scope
 
 ## [0.0.3] - 2020-12-21
 
 - Update extension structure
 
diff --git a/package.json b/package.json
index 985ec4e..c9f677c 100644
--- a/package.json
+++ b/package.json
@@ -42,11 +42,12 @@
             "title": "Rufo",
             "properties": {
                 "rufo.exe": {
                     "type": "string",
                     "default": "rufo",
-                    "description": "Path to invoke rufo"
+                    "description": "Path to invoke rufo",
+                    "scope": "application"
                 },
                 "rufo.useBundler": {
                     "type": "boolean",
                     "default": false,
                     "description": "Whether Rufo should be started via Bundler"

Vulnerable code: - Format Ruby source code via Rufo
                    "description": "Path to invoke rufo"
Fixed code: 
- Move rufo path setting to application scope
                    "description": "Path to invoke rufo",
                    "scope": "application"
CVE-2015-10004: Exposure of Resource to Wrong Sphere (CWE-668)
value: Token validation methods are susceptible to a timing side-channel during HMAC comparison. With a large enough number of requests over a low latency connection, an attacker may use this to determine the expected HMAC.
CWE description: The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
CVSS v3 base score: 7.5
Published: 2022-12-27T22:15Z
Repository: https://github.com/robbert229/jwt
Language: Unknown
Commit date: 2017-04-26 12:11:22 -0700
Commit message: Merge pull request #13 from polezaivsani/fix_timming_sidechannel

Spoil timming side-channel attack when comparing macs
CVE-2023-48221: Use of Externally-Controlled Format String (CWE-134)
value: wire-avs provides Audio, Visual, and Signaling (AVS) functionality sure the secure messaging software Wire. Prior to versions 9.2.22 and 9.3.5, a remote format string vulnerability could potentially allow an attacker to cause a denial of service or possibly execute arbitrary code. The issue has been fixed in wire-avs 9.2.22 & 9.3.5 and is already included on all Wire products. No known workarounds are available.
CWE description: The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
CVSS v3 base score: 8.8
Published: 2023-11-20T18:15Z
Repository: https://github.com/wireapp/wire-avs
Language: Unknown
Commit date: 2023-07-14 17:24:28 +0200
Commit message: Merge branch 'release-9.2' into release-9.3
CVE-2021-33657: Out-of-bounds Write (CWE-787)
value: There is a heap overflow problem in video/SDL_pixels.c in SDL (Simple DirectMedia Layer) 2.x to 2.0.18 versions. By crafting a malicious .BMP file, an attacker can cause the application using this library to crash, denial of service or Code execution.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.8
Published: 2022-04-01T23:15Z
Repository: https://github.com/libsdl-org/SDL
Language: C
Files changed: src/video/SDL_pixels.c
Commit date: 2021-11-30 12:37:39 -0800
Commit message: Always create a full 256-entry map in case color values are out of range

Fixes https://github.com/libsdl-org/SDL/issues/5042

Diff: diff --git a/src/video/SDL_pixels.c b/src/video/SDL_pixels.c
index ac04533c5..9bb02f771 100644
--- a/src/video/SDL_pixels.c
+++ b/src/video/SDL_pixels.c
@@ -945,11 +945,11 @@ Map1to1(SDL_Palette * src, SDL_Palette * dst, int *identical)
                 return (NULL);
             }
         }
         *identical = 0;
     }
-    map = (Uint8 *) SDL_malloc(src->ncolors);
+    map = (Uint8 *) SDL_calloc(256, sizeof(Uint8));
     if (map == NULL) {
         SDL_OutOfMemory();
         return (NULL);
     }
     for (i = 0; i < src->ncolors; ++i) {
@@ -969,11 +969,11 @@ Map1toN(SDL_PixelFormat * src, Uint8 Rmod, Uint8 Gmod, Uint8 Bmod, Uint8 Amod,
     int i;
     int bpp;
     SDL_Palette *pal = src->palette;
 
     bpp = ((dst->BytesPerPixel == 3) ? 4 : dst->BytesPerPixel);
-    map = (Uint8 *) SDL_malloc(pal->ncolors * bpp);
+    map = (Uint8 *) SDL_calloc(256, bpp);
     if (map == NULL) {
         SDL_OutOfMemory();
         return (NULL);
     }
 

Vulnerable code:     map = (Uint8 *) SDL_malloc(src->ncolors);
    map = (Uint8 *) SDL_malloc(pal->ncolors * bpp);
Fixed code:     map = (Uint8 *) SDL_calloc(256, sizeof(Uint8));
    map = (Uint8 *) SDL_calloc(256, bpp);
CVE-2022-4743: Missing Release of Memory after Effective Lifetime (CWE-401)
value: A potential memory leak issue was discovered in SDL2 in GLES_CreateTexture() function in SDL_render_gles.c. The vulnerability allows an attacker to cause a denial of service attack. The vulnerability affects SDL2 v2.0.4 and above. SDL-1.x are not affected.
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CVSS v3 base score: 7.5
Published: 2023-01-12T19:15Z
Repository: https://github.com/libsdl-org/SDL
Language: C
Files changed: src/render/opengles/SDL_render_gles.c
Commit date: 2022-09-20 20:14:01 -0700
Commit message: Fix potential memory leak in GLES_CreateTexture

Diff: diff --git a/src/render/opengles/SDL_render_gles.c b/src/render/opengles/SDL_render_gles.c
index a5fbab309..ba08a46e2 100644
--- a/src/render/opengles/SDL_render_gles.c
+++ b/src/render/opengles/SDL_render_gles.c
@@ -357,10 +357,13 @@ GLES_CreateTexture(SDL_Renderer * renderer, SDL_Texture * texture)
     renderdata->glGetError();
     renderdata->glEnable(GL_TEXTURE_2D);
     renderdata->glGenTextures(1, &data->texture);
     result = renderdata->glGetError();
     if (result != GL_NO_ERROR) {
+        if (texture->access == SDL_TEXTUREACCESS_STREAMING) {
+            SDL_free(data->pixels);
+        }
         SDL_free(data);
         return GLES_SetError("glGenTextures()", result);
     }
 
     data->type = GL_TEXTURE_2D;
@@ -385,10 +388,13 @@ GLES_CreateTexture(SDL_Renderer * renderer, SDL_Texture * texture)
     renderdata->drawstate.texture = texture;
     renderdata->drawstate.texturing = SDL_FALSE;
 
     result = renderdata->glGetError();
     if (result != GL_NO_ERROR) {
+        if (texture->access == SDL_TEXTUREACCESS_STREAMING) {
+            SDL_free(data->pixels);
+        }
         SDL_free(data);
         return GLES_SetError("glTexImage2D()", result);
     }
 
     texture->driverdata = data;

Fixed code:         if (texture->access == SDL_TEXTUREACCESS_STREAMING) {
            SDL_free(data->pixels);
        }
        if (texture->access == SDL_TEXTUREACCESS_STREAMING) {
            SDL_free(data->pixels);
        }
CVE-2023-2800: Insecure Temporary File (CWE-377)
value: Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0.
CWE description: Creating and using insecure temporary files can leave application and system data vulnerable to attack.
CVSS v3 base score: 4.7
Published: 2023-05-18T17:15Z
Repository: https://github.com/huggingface/transformers
Language: Python
Files changed: src/transformers/utils/hub.py
Commit date: 2023-05-16 11:10:54 +0100
Commit message: Use `mkstemp` to replace deprecated `mktemp` (#23372)

* Use `mkstemp` to replace deprecated `mktemp`

The `tempfile.mktemp` function is [deprecated](https://docs.python.org/3/library/tempfile.html#tempfile.mktemp) due to [security issues](https://cwe.mitre.org/data/definitions/377.html).

* Update src/transformers/utils/hub.py

Co-authored-by: amyeroberts <22614925+amyeroberts@users.noreply.github.com>

---------

Co-authored-by: amyeroberts <22614925+amyeroberts@users.noreply.github.com>
Diff: diff --git a/src/transformers/utils/hub.py b/src/transformers/utils/hub.py
index 58aac59d2..335547f2b 100644
--- a/src/transformers/utils/hub.py
+++ b/src/transformers/utils/hub.py
@@ -576,11 +576,11 @@ def download_url(url, proxies=None):
         f"Using `from_pretrained` with the url of a file (here {url}) is deprecated and won't be possible anymore in"
         " v5 of Transformers. You should host your file on the Hub (hf.co) instead and use the repository ID. Note"
         " that this is not compatible with the caching system (your file will be downloaded at each execution) or"
         " multiple processes (each process will download the file in a different temporary file)."
     )
-    tmp_file = tempfile.mktemp()
+    tmp_file = tempfile.mkstemp()[1]
     with open(tmp_file, "wb") as f:
         http_get(url, f, proxies=proxies)
     return tmp_file
 
 

Vulnerable code:     tmp_file = tempfile.mktemp()
Fixed code:     tmp_file = tempfile.mkstemp()[1]
CVE-2021-4048: Out-of-bounds Read (CWE-125)
value: An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version 0.3.18. Specially crafted inputs passed to these functions could cause an application using lapack to crash or possibly disclose portions of its memory.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.1
Published: 2021-12-08T22:15Z
Repository: https://github.com/xianyi/OpenBLAS
Language: Other
Files changed: lapack-netlib/SRC/zlarrv.f
Commit date: 2021-10-01 11:19:53 +0200
Commit message: Fix out of bounds read in ?llarv (Reference-LAPACK PR 625)
Diff: diff --git a/lapack-netlib/SRC/zlarrv.f b/lapack-netlib/SRC/zlarrv.f
index 23976dbe..8d10e3c2 100644
--- a/lapack-netlib/SRC/zlarrv.f
+++ b/lapack-netlib/SRC/zlarrv.f
@@ -349,11 +349,11 @@
 
       INFO = 0
 *
 *     Quick return if possible
 *
-      IF( N.LE.0 ) THEN
+      IF( (N.LE.0).OR.(M.LE.0) ) THEN
          RETURN
       END IF
 *
 *     The first N entries of WORK are reserved for the eigenvalues
       INDLD = N+1

Vulnerable code:       IF( N.LE.0 ) THEN
Fixed code:       IF( (N.LE.0).OR.(M.LE.0) ) THEN
CVE-2021-4048: Out-of-bounds Read (CWE-125)
value: An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version 0.3.18. Specially crafted inputs passed to these functions could cause an application using lapack to crash or possibly disclose portions of its memory.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.1
Published: 2021-12-08T22:15Z
Repository: https://github.com/xianyi/OpenBLAS
Language: Other
Files changed: lapack-netlib/SRC/clarrv.f
Commit date: 2021-10-01 11:17:21 +0200
Commit message: Fix out of bounds read in ?llarv (Reference-LAPACK PR 625)
Diff: diff --git a/lapack-netlib/SRC/clarrv.f b/lapack-netlib/SRC/clarrv.f
index a45f55ac..26a9febc 100644
--- a/lapack-netlib/SRC/clarrv.f
+++ b/lapack-netlib/SRC/clarrv.f
@@ -349,11 +349,11 @@
 
       INFO = 0
 *
 *     Quick return if possible
 *
-      IF( N.LE.0 ) THEN
+      IF( (N.LE.0) .OR. (M.LE.0) ) THEN
          RETURN
       END IF
 *
 *     The first N entries of WORK are reserved for the eigenvalues
       INDLD = N+1

Vulnerable code:       IF( N.LE.0 ) THEN
Fixed code:       IF( (N.LE.0) .OR. (M.LE.0) ) THEN
CVE-2021-4048: Out-of-bounds Read (CWE-125)
value: An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version 0.3.18. Specially crafted inputs passed to these functions could cause an application using lapack to crash or possibly disclose portions of its memory.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.1
Published: 2021-12-08T22:15Z
Repository: https://github.com/xianyi/OpenBLAS
Language: Other
Files changed: lapack-netlib/SRC/slarrv.f
Commit date: 2021-10-01 11:19:07 +0200
Commit message: Fix out of bounds read in ?llarv (Reference-LAPACK PR 625)
Diff: diff --git a/lapack-netlib/SRC/slarrv.f b/lapack-netlib/SRC/slarrv.f
index 04519fde..9448b2fd 100644
--- a/lapack-netlib/SRC/slarrv.f
+++ b/lapack-netlib/SRC/slarrv.f
@@ -351,11 +351,11 @@
 
       INFO = 0
 *
 *     Quick return if possible
 *
-      IF( N.LE.0 ) THEN
+      IF( (N.LE.0).OR.(M.LE.0) ) THEN
          RETURN
       END IF
 *
 *     The first N entries of WORK are reserved for the eigenvalues
       INDLD = N+1

Vulnerable code:       IF( N.LE.0 ) THEN
Fixed code:       IF( (N.LE.0).OR.(M.LE.0) ) THEN
CVE-2021-4048: Out-of-bounds Read (CWE-125)
value: An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version 0.3.18. Specially crafted inputs passed to these functions could cause an application using lapack to crash or possibly disclose portions of its memory.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.1
Published: 2021-12-08T22:15Z
Repository: https://github.com/xianyi/OpenBLAS
Language: Other
Files changed: lapack-netlib/SRC/dlarrv.f
Commit date: 2021-10-01 11:18:20 +0200
Commit message: Fix out of bounds read in ?llarv (Reference-LAPACK PR 625)
Diff: diff --git a/lapack-netlib/SRC/dlarrv.f b/lapack-netlib/SRC/dlarrv.f
index 4a59a2bb..a1c6e9c9 100644
--- a/lapack-netlib/SRC/dlarrv.f
+++ b/lapack-netlib/SRC/dlarrv.f
@@ -351,11 +351,11 @@
 
       INFO = 0
 *
 *     Quick return if possible
 *
-      IF( N.LE.0 ) THEN
+      IF( (N.LE.0).OR.(M.LE.0) ) THEN
          RETURN
       END IF
 *
 *     The first N entries of WORK are reserved for the eigenvalues
       INDLD = N+1

Vulnerable code:       IF( N.LE.0 ) THEN
Fixed code:       IF( (N.LE.0).OR.(M.LE.0) ) THEN
CVE-2019-25088: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in ytti Oxidized Web. It has been classified as problematic. Affected is an unknown function of the file lib/oxidized/web/views/conf_search.haml. The manipulation of the argument to_research leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 55ab9bdc68b03ebce9280b8746ef31d7fdedcc45. It is recommended to apply a patch to fix this issue. VDB-216870 is the identifier assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-12-27T10:15Z
Repository: https://github.com/ytti/oxidized-web
Language: Other
Files changed: lib/oxidized/web/views/conf_search.haml
Commit date: 2019-07-01 18:26:57 +0300
Commit message: escape user input to fix XSS "vulnerability" (#195)


Diff: diff --git a/lib/oxidized/web/views/conf_search.haml b/lib/oxidized/web/views/conf_search.haml
index 7346807..44f1631 100644
--- a/lib/oxidized/web/views/conf_search.haml
+++ b/lib/oxidized/web/views/conf_search.haml
@@ -1,11 +1,12 @@
 .row.tbl-header
   .col-xs-12
     %h4
       %a{href: url_for('/nodes')} nodes
       \/ Nodes that contain 
-      %span "#{@to_research}"
+      %span
+        &= "#{@to_research}"
   
 .row
   .pull-right
     %form
       %button.ColVis_Button{type: 'button', onclick: 'history.go();'}

Vulnerable code:       %span "#{@to_research}"
Fixed code:       %span
        &= "#{@to_research}"
CVE-2021-4282: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in FreePBX voicemail. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file page.voicemail.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 14.0.6.25 is able to address this issue. The name of the patch is 12e1469ef9208eda9d8955206e78345949236ee6. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216871.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-27T10:15Z
Repository: https://github.com/FreePBX/voicemail
Language: Unknown
Commit date: 2021-09-15 06:53:32 +0000
Commit message: Merge pull request #78 in FREEPBX/voicemail from feature/FREEI-2107-stored-xss-in-freepbx-14 to release/14.0

* commit 'ffce4882016076acd16fe0f676246905aa3cb2f3':
  FREEI-2107--stored-xss
CVE-2021-3862: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: icecoder is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2022-01-17T14:15Z
Repository: https://github.com/icecoder/icecoder
Language: PHP
Files changed: editor.php
Commit date: 2022-01-17 12:38:29 +0000
Commit message: rXSS cleaned username in editor info display
Diff: diff --git a/editor.php b/editor.php
index 417ba43..7b7fa26 100644
--- a/editor.php
+++ b/editor.php
@@ -148,11 +148,11 @@ h2 {color: rgba(0,198,255,0.7)}
         <?php
         if ("" !== $_SESSION['username']) {
             ?>
             <h2><?php echo $t['multi-user']; ?></h2>
             <span class="heading"><?php echo $t['Username']; ?></span><br>
-            <?php echo $_SESSION['username'];?><br><br>
+            <?php echo xssClean($_SESSION['username'], "html");?><br><br>
             <?php
         }
         ?>
 		<h2>ICEcoder</h2>
 		<span class="heading"><?php echo $t['version'];?></span><br>

Vulnerable code:             <?php echo $_SESSION['username'];?><br><br>
Fixed code:             <?php echo xssClean($_SESSION['username'], "html");?><br><br>
CVE-2024-28181: Insufficient Information (NVD-CWE-noinfo)
value:  turbo_boost-commands is a set of commands to help you build robust reactive applications with Rails & Hotwire. TurboBoost Commands has existing protections in place to guarantee that only public methods on Command classes can be invoked; however, the existing checks aren't as robust as they should be. It's possible for a sophisticated attacker to invoke more methods than should be permitted depending on the the strictness of authorization checks that individual applications enforce. Being able to call some of these methods can have security implications. Commands verify that the class must be a `Command` and that the method requested is defined as a public method; however, this isn't robust enough to guard against all unwanted code execution. The library should more strictly enforce which methods are considered safe before allowing them to be executed. This issue has been addressed in versions 0.1.3, and 0.2.2. Users are advised to upgrade. Users unable to upgrade should see the repository GHSA for workaround advice.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-14T18:15Z
Repository: https://github.com/hopsoft/turbo_boost-commands
Language: Ruby
Files changed: lib/turbo_boost/commands/runner.rb
Commit date: 2024-03-14 09:58:19 -0600
Commit message: Merge pull request from GHSA-mp76-7w5v-pr75


Diff: diff --git a/lib/turbo_boost/commands/runner.rb b/lib/turbo_boost/commands/runner.rb
index 3589c06..be35064 100644
--- a/lib/turbo_boost/commands/runner.rb
+++ b/lib/turbo_boost/commands/runner.rb
@@ -38,11 +38,12 @@ class TurboBoost::Commands::Runner
       raise TurboBoost::Commands::InvalidClassError,
         "`#{command_class_name}` is not a subclass of `TurboBoost::Commands::Command`!"
     end
 
     # validate method
-    unless command_instance.respond_to?(command_method_name)
+    ancestors = command_class.ancestors[0..command_class.ancestors.index(TurboBoost::Commands::Command) - 1]
+    unless ancestors.any? { |a| a.public_instance_methods(false).any? command_method_name.to_sym }
       raise TurboBoost::Commands::InvalidMethodError,
         "`#{command_class_name}` does not define the public method `#{command_method_name}`!"
     end
 
     # validate csrf token

Vulnerable code:     unless command_instance.respond_to?(command_method_name)
Fixed code:     ancestors = command_class.ancestors[0..command_class.ancestors.index(TurboBoost::Commands::Command) - 1]
    unless ancestors.any? { |a| a.public_instance_methods(false).any? command_method_name.to_sym }
CVE-2023-0564: Weak Password Requirements (CWE-521)
value: Weak Password Requirements in GitHub repository froxlor/froxlor prior to 2.0.10.


CWE description: The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.
CVSS v3 base score: 7.5
Published: 2023-01-29T01:15Z
Repository: https://github.com/froxlor/froxlor
Language: PHP
Files changed: lib/Froxlor/Api/Commands/DirProtections.php
Commit date: 2023-01-28 11:40:07 +0100
Commit message: enforce password requirements set in settings for directory-protection

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>

Diff: diff --git a/lib/Froxlor/Api/Commands/DirProtections.php b/lib/Froxlor/Api/Commands/DirProtections.php
index 8b478103a..690adf8b9 100644
--- a/lib/Froxlor/Api/Commands/DirProtections.php
+++ b/lib/Froxlor/Api/Commands/DirProtections.php
@@ -85,11 +85,12 @@ class DirProtections extends ApiCommand implements ResourceEntity
 		// validation
 		$path = FileDir::makeCorrectDir(Validate::validate($path, 'path', Validate::REGEX_DIR, '', [], true));
 		$path = FileDir::makeCorrectDir($customer['documentroot'] . '/' . $path);
 		$username = Validate::validate($username, 'username', '/^[a-zA-Z0-9][a-zA-Z0-9\-_]+\$?$/', '', [], true);
 		$authname = Validate::validate($authname, 'directory_authname', '/^[a-zA-Z0-9][a-zA-Z0-9\-_ ]+\$?$/', '', [], true);
-		Validate::validate($password, 'password', '', '', [], true);
+		$password = Validate::validate($password, 'password', '', '', [], true);
+		$password = Crypt::validatePassword($password, true);
 
 		// check for duplicate usernames for the path
 		$username_path_check_stmt = Database::prepare("
 			SELECT `id`, `username`, `path` FROM `" . TABLE_PANEL_HTPASSWDS . "`
 			WHERE `username`= :username AND `path`= :path AND `customerid`= :customerid
@@ -242,11 +243,12 @@ class DirProtections extends ApiCommand implements ResourceEntity
 		// get needed customer info
 		$customer = $this->getCustomerData();
 
 		// validation
 		$authname = Validate::validate($authname, 'directory_authname', '/^[a-zA-Z0-9][a-zA-Z0-9\-_ ]+\$?$/', '', [], true);
-		Validate::validate($password, 'password', '', '', [], true);
+		$password = Validate::validate($password, 'password', '', '', [], true);
+		$password = Crypt::validatePassword($password, true);
 
 		$upd_query = "";
 		$upd_params = [
 			"id" => $result['id'],
 			"cid" => $customer['customerid']

Vulnerable code: 		Validate::validate($password, 'password', '', '', [], true);
		Validate::validate($password, 'password', '', '', [], true);
Fixed code: 		$password = Validate::validate($password, 'password', '', '', [], true);
		$password = Crypt::validatePassword($password, true);
		$password = Validate::validate($password, 'password', '', '', [], true);
		$password = Crypt::validatePassword($password, true);
CVE-2023-0572: Improper Check for Unusual or Exceptional Conditions (CWE-754)
value: Unchecked Error Condition in GitHub repository froxlor/froxlor prior to 2.0.10.


CWE description: The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
CVSS v3 base score: 5.3
Published: 2023-01-29T23:15Z
Repository: https://github.com/froxlor/froxlor
Language: PHP
Files changed: error_report.php
Commit date: 2023-01-28 11:57:43 +0100
Commit message: add missing use statement for error-reporting to include the dbms version

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>

Diff: diff --git a/error_report.php b/error_report.php
index ad51c86b48..0f2347452f 100644
--- a/error_report.php
+++ b/error_report.php
@@ -31,10 +31,11 @@ if (!defined('AREA')) {
 use Froxlor\FileDir;
 use Froxlor\Froxlor;
 use Froxlor\UI\Panel\UI;
 use Froxlor\UI\Request;
 use Froxlor\UI\Response;
+use Froxlor\Database\Database;
 
 // This file is being included in admin_domains and customer_domains
 // and therefore does not need to require lib/init.php
 
 $errid = Request::any('errorid');

Fixed code: use Froxlor\Database\Database;
CVE-2023-1307: Authentication Bypass by Primary Weakness (CWE-305)
value: Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to 2.0.13.
CWE description: The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
CVSS v3 base score: 9.8
Published: 2023-03-10T01:15Z
Repository: https://github.com/froxlor/froxlor
Language: PHP
Files changed: lib/Froxlor/System/Crypt.php
Commit date: 2023-02-22 09:35:27 +0100
Commit message: type-safe comparsion of md5-compatibility hash-validation

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>

Diff: diff --git a/lib/Froxlor/System/Crypt.php b/lib/Froxlor/System/Crypt.php
index 9faf82f571..0ca6b67685 100644
--- a/lib/Froxlor/System/Crypt.php
+++ b/lib/Froxlor/System/Crypt.php
@@ -196,11 +196,11 @@ class Crypt
 		if (strlen($pwd_hash) == 32 && ctype_xdigit($pwd_hash)) {
 			$pwd_check = md5($password);
 			$update_hash = true;
 		}
 
-		if ($pwd_hash == $pwd_check || password_verify($password, $pwd_hash)) {
+		if ($pwd_hash === $pwd_check || password_verify($password, $pwd_hash)) {
 			// check for update of hash (only if our database is ready to handle the bigger string)
 			$is_ready = Froxlor::versionCompare2("0.9.33", Froxlor::getVersion()) <= 0;
 			if ((password_needs_rehash($pwd_hash, $algo) || $update_hash) && $is_ready) {
 				$upd_stmt = Database::prepare("
 					UPDATE " . $table . " SET `password` = :newpasswd WHERE `" . $uid . "` = :uid

Vulnerable code: 		if ($pwd_hash == $pwd_check || password_verify($password, $pwd_hash)) {
Fixed code: 		if ($pwd_hash === $pwd_check || password_verify($password, $pwd_hash)) {
CVE-2023-3172: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Path Traversal in GitHub repository froxlor/froxlor prior to 2.0.20.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.2
Published: 2023-06-09T01:15Z
Repository: https://github.com/froxlor/froxlor
Language: PHP
Files changed: admin_autoupdate.php
Commit date: 2023-05-25 09:51:55 +0200
Commit message: secure filename of local-archive in webupdate

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>

Diff: diff --git a/admin_autoupdate.php b/admin_autoupdate.php
index c06331f129..dcaedae881 100644
--- a/admin_autoupdate.php
+++ b/admin_autoupdate.php
@@ -26,11 +26,11 @@
 const AREA = 'admin';
 require __DIR__ . '/lib/init.php';
 
 use Froxlor\Froxlor;
 use Froxlor\FroxlorLogger;
-use Froxlor\Http\HttpClient;
+use Froxlor\FileDir;
 use Froxlor\Install\AutoUpdate;
 use Froxlor\Settings;
 use Froxlor\UI\Panel\UI;
 use Froxlor\UI\Response;
 
@@ -130,11 +130,11 @@ elseif ($page == 'getdownload') {
 	]);
 } // extract and install new version
 elseif ($page == 'extract') {
 	if (isset($_POST['send']) && $_POST['send'] == 'send') {
 		$toExtract = isset($_POST['archive']) ? $_POST['archive'] : null;
-		$localArchive = Froxlor::getInstallDir() . '/updates/' . $toExtract;
+		$localArchive = FileDir::makeCorrectFile(Froxlor::getInstallDir() . '/updates/' . $toExtract);
 		$log->logAction(FroxlorLogger::ADM_ACTION, LOG_NOTICE, "Extracting " . $localArchive . " to " . Froxlor::getInstallDir());
 		$result = AutoUpdate::extractZip($localArchive);
 		if ($result > 0) {
 			// error
 			Response::redirectTo($filename, [
@@ -144,11 +144,11 @@ elseif ($page == 'extract') {
 		}
 		// redirect to update-page
 		Response::redirectTo('admin_updates.php');
 	} else {
 		$toExtract = isset($_GET['archive']) ? $_GET['archive'] : null;
-		$localArchive = Froxlor::getInstallDir() . '/updates/' . $toExtract;
+		$localArchive = FileDir::makeCorrectFile(Froxlor::getInstallDir() . '/updates/' . $toExtract);
 	}
 
 	if (!file_exists($localArchive)) {
 		Response::redirectTo($filename, [
 			'page' => 'error',

Vulnerable code: use Froxlor\Http\HttpClient;
		$localArchive = Froxlor::getInstallDir() . '/updates/' . $toExtract;
		$localArchive = Froxlor::getInstallDir() . '/updates/' . $toExtract;
Fixed code: use Froxlor\FileDir;
		$localArchive = FileDir::makeCorrectFile(Froxlor::getInstallDir() . '/updates/' . $toExtract);
		$localArchive = FileDir::makeCorrectFile(Froxlor::getInstallDir() . '/updates/' . $toExtract);
CVE-2023-3192: Session Fixation (CWE-384)
value: Session Fixation in GitHub repository froxlor/froxlor prior to 2.1.0.
CWE description: Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
CVSS v3 base score: 5.4
Published: 2023-06-11T11:15Z
Repository: https://github.com/froxlor/froxlor
Language: PHP
Files changed: admin_customers.php, admin_index.php, index.php
Commit date: 2023-06-11 12:05:33 +0200
Commit message: regenerate session-id after login / su-action

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>

Diff: diff --git a/admin_customers.php b/admin_customers.php
index 05f9656af4..6fe2cd188f 100644
--- a/admin_customers.php
+++ b/admin_customers.php
@@ -92,10 +92,11 @@ if (($page == 'customers' || $page == 'overview') && $userinfo['customers'] != '
 			}
 
 			$result['switched_user'] = CurrentUser::getData();
 			$result['adminsession'] = 0;
 			$result['userid'] = $result['customerid'];
+			session_regenerate_id();
 			CurrentUser::setData($result);
 
 			$log->logAction(FroxlorLogger::ADM_ACTION, LOG_INFO, "switched user and is now '" . $destination_user . "'");
 
 			$target = (isset($_GET['target']) ? $_GET['target'] : 'index');
diff --git a/admin_index.php b/admin_index.php
index 91ea51a594..c1c18c7dce 100644
--- a/admin_index.php
+++ b/admin_index.php
@@ -51,10 +51,11 @@ if ($action == 'logout') {
 	Response::redirectTo('index.php');
 } elseif ($action == 'suback') {
 	if (is_array(CurrentUser::getField('switched_user'))) {
 		$result = CurrentUser::getData();
 		$result = $result['switched_user'];
+		session_regenerate_id();
 		CurrentUser::setData($result);
 		$target = (isset($_GET['target']) ? $_GET['target'] : 'index');
 		$redirect = "admin_" . $target . ".php";
 		if (!file_exists(\Froxlor\Froxlor::getInstallDir() . "/" . $redirect)) {
 			$redirect = "admin_index.php";
diff --git a/index.php b/index.php
index 2bdd947ca7..7860686e0a 100644
--- a/index.php
+++ b/index.php
@@ -784,10 +784,11 @@ if ($action == 'll') {
 }
 
 function finishLogin($userinfo)
 {
 	if (isset($userinfo['userid']) && $userinfo['userid'] != '') {
+		session_regenerate_id();
 		CurrentUser::setData($userinfo);
 
 		$language = $userinfo['def_language'] ?? Settings::Get('panel.standardlanguage');
 		CurrentUser::setField('language', $language);
 

Fixed code: 			session_regenerate_id();
		session_regenerate_id();
		session_regenerate_id();
CVE-2023-3668: Improper Encoding or Escaping of Output (CWE-116)
value: Improper Encoding or Escaping of Output in GitHub repository froxlor/froxlor prior to 2.0.21.
CWE description: The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CVSS v3 base score: 7.2
Published: 2023-07-14T01:15Z
Repository: https://github.com/froxlor/froxlor
Language: PHP
Files changed: admin_configfiles.php
Commit date: 2023-07-07 09:46:31 +0200
Commit message: validate generated config-json parameter string

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>

Diff: diff --git a/admin_configfiles.php b/admin_configfiles.php
index ac4630db7a..0770c8a763 100644
--- a/admin_configfiles.php
+++ b/admin_configfiles.php
@@ -31,10 +31,11 @@ use Froxlor\FileDir;
 use Froxlor\Froxlor;
 use Froxlor\Settings;
 use Froxlor\UI\Panel\UI;
 use Froxlor\UI\Request;
 use Froxlor\UI\Response;
+use Froxlor\Validate\Validate;
 
 if ($userinfo['change_serversettings'] == '1') {
 	if ($action == 'setconfigured') {
 		Settings::Set('panel.is_configured', '1', true);
 		Response::redirectTo('admin_configfiles.php');
@@ -89,18 +90,33 @@ if ($userinfo['change_serversettings'] == '1') {
 		// sort by distribution name
 		asort($distributions_select);
 	}
 
 	if ($distribution != "" && isset($_POST['finish'])) {
+		$valid_keys = ['http', 'dns', 'smtp', 'mail', 'ftp', 'system', 'distro'];
 		unset($_POST['finish']);
 		unset($_POST['csrf_token']);
 		$params = $_POST;
 		$params['distro'] = $distribution;
 		$params['system'] = [];
 		foreach ($_POST['system'] as $sysdaemon) {
 			$params['system'][] = $sysdaemon;
 		}
+		// validate params
+		foreach ($params as $key => $value) {
+			if (!in_array($key, $valid_keys)) {
+				unset($params[$key]);
+				continue;
+			}
+			if (!is_array($value)) {
+				$params[$key] = Validate::validate($value, $key);
+			} else {
+				foreach ($value as $subkey => $subvalue) {
+					$params[$key][$subkey] = Validate::validate($subvalue, $key.'.'.$subkey);
+				}
+			}
+		}
 		$params_content = json_encode($params);
 		$params_filename = FileDir::makeCorrectFile(Froxlor::getInstallDir() . 'install/' . Froxlor::genSessionId() . '.json');
 		file_put_contents($params_filename, $params_content);
 
 		UI::twigBuffer('settings/configuration-final.html.twig', [

Fixed code: use Froxlor\Validate\Validate;
		$valid_keys = ['http', 'dns', 'smtp', 'mail', 'ftp', 'system', 'distro'];
		// validate params
		foreach ($params as $key => $value) {
			if (!in_array($key, $valid_keys)) {
				unset($params[$key]);
				continue;
			}
			if (!is_array($value)) {
				$params[$key] = Validate::validate($value, $key);
			} else {
				foreach ($value as $subkey => $subvalue) {
					$params[$key][$subkey] = Validate::validate($subvalue, $key.'.'.$subkey);
				}
			}
		}
CVE-2022-45473: Insufficient Information (NVD-CWE-noinfo)
value: In drachtio-server 0.8.18, /var/log/drachtio has mode 0777 and drachtio.log has mode 0666.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.5
Published: 2022-11-18T18:15Z
Repository: https://github.com/drachtio/drachtio-server
Language: C++
Files changed: src/controller.cpp
Commit date: 2022-11-23 16:07:49 -0500
Commit message: make drachtio log file not globally readable (#241)

Diff: diff --git a/src/controller.cpp b/src/controller.cpp
index 5486696b31..c63ef1cc3c 100644
--- a/src/controller.cpp
+++ b/src/controller.cpp
@@ -66,10 +66,11 @@ THE SOFTWARE.
 #include <boost/log/expressions.hpp>
 #include <boost/log/attributes.hpp>
 #include <boost/log/sinks.hpp>
 #include <boost/log/sources/logger.hpp>
 #include <boost/algorithm/string/replace.hpp>
+#include <boost/filesystem.hpp>
 
 #if defined(__clang__)
     #pragma clang diagnostic pop
 #endif
 
@@ -1004,10 +1005,17 @@ namespace drachtio {
                         keywords::min_free_space = minSize * 1000000,
                         keywords::max_files = maxFiles
                     ));
                                
                     logging::core::get()->add_sink(m_sinkTextFile);
+                    boost::filesystem::permissions(name,
+                        boost::filesystem::perms::owner_read |
+                        boost::filesystem::perms::owner_write |
+                        boost::filesystem::perms::group_read |
+                        boost::filesystem::perms::group_write
+                    );
+
                 }
                 logging::core::get()->set_filter(
                    expr::attr<severity_levels>("Severity") <= m_current_severity_threshold
                 ) ;
             }

Fixed code: #include <boost/filesystem.hpp>
                    boost::filesystem::permissions(name,
                        boost::filesystem::perms::owner_read |
                        boost::filesystem::perms::owner_write |
                        boost::filesystem::perms::group_read |
                        boost::filesystem::perms::group_write
                    );
CVE-2022-47515: Insufficient Information (NVD-CWE-noinfo)
value: An issue was discovered in drachtio-server before 0.8.20. It allows remote attackers to cause a denial of service (daemon crash) via a long message in a TCP request that leads to std::length_error.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2022-12-18T05:15Z
Repository: https://github.com/drachtio/drachtio-server
Language: C++
Files changed: src/controller.cpp
Commit date: 2022-11-29 13:36:50 -0500
Commit message: bugfix (#245) - long incoming message crashes server

Diff: diff --git a/src/controller.cpp b/src/controller.cpp
index bc27f20421..2d410c2911 100644
--- a/src/controller.cpp
+++ b/src/controller.cpp
@@ -271,11 +271,11 @@ namespace drachtio {
     }
     void StackMsg::appendLine( char *szLine, bool complete ) {
         if( complete ) {
             m_os.flush() ;
             m_sipMessage = m_os.str() ;
-            m_sipMessage.resize( m_sipMessage.length() - 1) ;
+            if (m_sipMessage.length() > 1) m_sipMessage.resize( m_sipMessage.length() - 1) ;
             boost::replace_all(m_sipMessage, "\n", DR_CRLF);
         }
         else if( 0 == strcmp(szLine, "\n") ) {
             m_os << endl ;
         }

Vulnerable code:             m_sipMessage.resize( m_sipMessage.length() - 1) ;
Fixed code:             if (m_sipMessage.length() > 1) m_sipMessage.resize( m_sipMessage.length() - 1) ;
CVE-2015-10073: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability, which was classified as problematic, was found in tinymighty WikiSEO 1.2.1 on MediaWiki. This affects the function modifyHTML of the file WikiSEO.body.php of the component Meta Property Tag Handler. The manipulation of the argument content leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.2.2 is able to address this issue. The patch is named 089a5797be612b18a820f9f1e6593ad9a91b1dba. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220215.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 9.6
Published: 2023-02-06T20:15Z
Repository: https://github.com/tinymighty/wiki-seo
Language: PHP
Files changed: WikiSEO.body.php
Commit date: 2015-10-21 13:12:03 -0600
Commit message: Fix XSS in extension

This extension did not escape its user-supplied input for the meta property tags

Example: {{#seo:article:publisher=foo"><script>alert('XSS')</script> <b f="}}

This sort of vulnerability could be leveraged to take over other user's accounts
and other evil things.
Diff: diff --git a/WikiSEO.body.php b/WikiSEO.body.php
index 5ea54eb..7b25694 100644
--- a/WikiSEO.body.php
+++ b/WikiSEO.body.php
@@ -268,22 +268,22 @@ class WikiSEO{
 		if(!empty(self::$meta)){
 			foreach(self::$meta as $name => $content){
 				if ($name == 'description') {
 					$out->addMeta( $name, $content );
 					$out->addMeta( "twitter:description", $content );
-					$out->addHeadItem("og:description", "<meta property=\"og:description\" content=\"$content\" />" . "\n");
+					$out->addHeadItem("og:description", Html::element( 'meta', array( 'property' => 'og:description', 'content' => $content ) ) . "\n");
 				}
 				else {
 					$out->addMeta( $name, $content );
 				}
 
 			}
 		}
 		//set property tags
 		if(!empty(self::$property)){
 			foreach(self::$property as $property => $content){
-				$out->addHeadItem("$property", "<meta property=\"$property\" content=\"$content\" />" . "\n");
+				$out->addHeadItem("$property", Html::element( 'meta', array( 'property' => $property, 'content' => $content ) ) . "\n");
 			}
 		}
 
 	  return true;
 	}

Vulnerable code: 					$out->addHeadItem("og:description", "<meta property=\"og:description\" content=\"$content\" />" . "\n");
				$out->addHeadItem("$property", "<meta property=\"$property\" content=\"$content\" />" . "\n");
Fixed code: 					$out->addHeadItem("og:description", Html::element( 'meta', array( 'property' => 'og:description', 'content' => $content ) ) . "\n");
				$out->addHeadItem("$property", Html::element( 'meta', array( 'property' => $property, 'content' => $content ) ) . "\n");
CVE-2014-125053: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in Piwigo-Guest-Book up to 1.3.0. It has been declared as critical. This vulnerability affects unknown code of the file include/guestbook.inc.php of the component Navigation Bar. The manipulation of the argument start leads to sql injection. Upgrading to version 1.3.1 is able to address this issue. The patch is identified as 0cdd1c388edf15089c3a7541cefe7756e560581d. It is recommended to upgrade the affected component. VDB-217582 is the identifier assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-06T23:15Z
Repository: https://github.com/Piwigo/Piwigo-Guest-Book
Language: PHP
Files changed: include/guestbook.inc.php
Commit date: 2014-12-21 11:07:23 +0100
Commit message: potential SQL injection

Diff: diff --git a/include/guestbook.inc.php b/include/guestbook.inc.php
index 395e013..9d30646 100644
--- a/include/guestbook.inc.php
+++ b/include/guestbook.inc.php
@@ -158,11 +158,11 @@ SELECT
 ;';
 $row = pwg_db_fetch_assoc(pwg_query($query));
 
 // navigation bar creation
 $page['start'] = 0;
-if (isset($_GET['start']))
+if (isset($_GET['start']) && is_numeric($_GET['start']) && $_GET['start'] >= 0)
 {
   $page['start'] = $_GET['start'];
 }
 
 $navigation_bar = create_navigation_bar(

Vulnerable code: if (isset($_GET['start']))
Fixed code: if (isset($_GET['start']) && is_numeric($_GET['start']) && $_GET['start'] >= 0)
CVE-2022-47516: Reachable Assertion (CWE-617)
value: An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.20. It allows remote attackers to cause a denial of service (daemon crash) via a crafted UDP message that leads to a failure of the libsofia-sip-ua/tport/tport.c self assertion.
CWE description: The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
CVSS v3 base score: 7.5
Published: 2022-12-18T05:15Z
Repository: https://github.com/davehorton/sofia-sip
Language: C
Files changed: libsofia-sip-ua/tport/tport.c
Commit date: 2022-11-28 14:44:30 -0500
Commit message: remove assert that can reasonably be expected to happen

Diff: diff --git a/libsofia-sip-ua/tport/tport.c b/libsofia-sip-ua/tport/tport.c
index edd73b56..dd72aa1a 100644
--- a/libsofia-sip-ua/tport/tport.c
+++ b/libsofia-sip-ua/tport/tport.c
@@ -3308,12 +3308,10 @@ tport_t *tport_tsend(tport_t *self,
   su_addrinfo_t *ai;
   tport_primary_t *primary;
   tp_name_t tpn[1];
   struct sigcomp_compartment *cc;
 
-  assert(self);
-
   if (!self || !msg || !_tpn) {
     msg_set_errno(msg, EINVAL);
     return NULL;
   }
 

Vulnerable code:   assert(self);
CVE-2022-47517: Off-by-one Error (CWE-193)
value: An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.19. It allows remote attackers to cause a denial of service (daemon crash) via a crafted UDP message that causes a url_canonize2 heap-based buffer over-read because of an off-by-one error.
CWE description: A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
CVSS v3 base score: 7.5
Published: 2022-12-18T05:15Z
Repository: https://github.com/davehorton/sofia-sip
Language: C
Files changed: libsofia-sip-ua/url/url.c
Commit date: 2022-11-27 19:47:24 -0500
Commit message: fix off-by-one access triggered eg by Contact: %

Diff: diff --git a/libsofia-sip-ua/url/url.c b/libsofia-sip-ua/url/url.c
index 71544735..6e437a4b 100644
--- a/libsofia-sip-ua/url/url.c
+++ b/libsofia-sip-ua/url/url.c
@@ -183,11 +183,11 @@ int url_reserved_p(char const *s)
  *
  * @return
  * The number of characters in corresponding but escaped string.
  *
  * You can handle a part of URL with reserved characters like this:
- * @code
+ *ï¿½@code
  * if (url_reserved_p(s))  {
  *   n = malloc(url_esclen(s, NULL) + 1);
  *   if (n) url_escape(n, s);
  * } else {
  *   n = malloc(strlen(s) + 1);
@@ -362,10 +362,11 @@ char *url_canonize2(char *d, char const * const s, size_t n,
 	return NULL;
       *d = c;
       continue;
     }
 
+    if (i >= strlen(s) - 1) return NULL;
     h1 = s[i + 1], h2 = s[i + 2];
 
     if (!IS_HEX(h1) || !IS_HEX(h2)) {
       *d = '\0';
       return NULL;
@@ -1086,11 +1087,11 @@ char *copy(char *buf, char *end, char const *src)
  * url_dup() with zero as @a bufsize and NULL as @a dst.
 
  * @param buf     Buffer for non-constant strings copied from @a src.
  * @param bufsize Size of @a buf.
  * @param dst     Destination URL structure.
- * @param src     Source URL structure.
+ *ï¿½@param src     Source URL structure.
  *
  * @return Number of characters required for
  * duplicating the strings in @a str, or -1 if an error
  * occurred.
  */
@@ -1170,11 +1171,11 @@ issize_t url_dup(char *buf, isize_t bufsize, url_t *dst, url_t const *src)
  * even if the buffer is too small for the duplicated strings.
  *
  * @param buf     Buffer for non-constant strings copied from @a src.
  * @param end     End of @a buf.
  * @param dst     Destination URL structure.
- * @param src     Source URL structure.
+ *ï¿½@param src     Source URL structure.
  *
  * @return
  * The macro URL_DUP() returns pointer to first unused byte in the
  * buffer @a buf.
  */

Vulnerable code:  * @code
 * @param src     Source URL structure.
 * @param src     Source URL structure.
Fixed code:  *ï¿½@code
    if (i >= strlen(s) - 1) return NULL;
 *ï¿½@param src     Source URL structure.
 *ï¿½@param src     Source URL structure.