Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2023-50730: Uncontrolled Resource Consumption (CWE-400)
value: Grackle is a GraphQL server written in functional Scala, built on the Typelevel stack. The GraphQL specification requires that GraphQL fragments must not form cycles, either directly or indirectly. Prior to Grackle version 0.18.0, that requirement wasn't checked, and queries with cyclic fragments would have been accepted for type checking and compilation. The attempted compilation of such fragments would result in a JVM `StackOverflowError` being thrown. Some knowledge of an applications GraphQL schema would be required to construct such a query, however no knowledge of any application-specific performance or other behavioural characteristics would be needed.

Grackle uses the cats-parse library for parsing GraphQL queries. Prior to version 0.18.0, Grackle made use of the cats-parse `recursive` operator. However, `recursive` is not currently stack safe. `recursive` was used in three places in the parser: nested selection sets, nested input values (lists and objects), and nested list type declarations. Consequently, queries with deeply nested selection sets, input values or list types could be constructed which exploited this, causing a JVM `StackOverflowException` to be thrown during parsing. Because this happens very early in query processing, no specific knowledge of an applications GraphQL schema would be required to construct such a query.

The possibility of small queries resulting in stack overflow is a potential denial of service vulnerability. This potentially affects all applications using Grackle which have untrusted users. Both stack overflow issues have been resolved in the v0.18.0 release of Grackle. As a workaround, users could interpose a sanitizing layer in between untrusted input and Grackle query processing.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 7.5
Published: 2023-12-22T21:15Z
Repository: https://github.com/typelevel/grackle
Language: Unknown
Commit date: 2023-12-18 13:58:16 -0800
Commit message: Merge pull request from GHSA-g56x-7j6w-g8r8

Add limits to parser; improve variable and fragment validation
CVE-2023-50730: Allocation of Resources Without Limits or Throttling (CWE-770)
value: Grackle is a GraphQL server written in functional Scala, built on the Typelevel stack. The GraphQL specification requires that GraphQL fragments must not form cycles, either directly or indirectly. Prior to Grackle version 0.18.0, that requirement wasn't checked, and queries with cyclic fragments would have been accepted for type checking and compilation. The attempted compilation of such fragments would result in a JVM `StackOverflowError` being thrown. Some knowledge of an applications GraphQL schema would be required to construct such a query, however no knowledge of any application-specific performance or other behavioural characteristics would be needed.

Grackle uses the cats-parse library for parsing GraphQL queries. Prior to version 0.18.0, Grackle made use of the cats-parse `recursive` operator. However, `recursive` is not currently stack safe. `recursive` was used in three places in the parser: nested selection sets, nested input values (lists and objects), and nested list type declarations. Consequently, queries with deeply nested selection sets, input values or list types could be constructed which exploited this, causing a JVM `StackOverflowException` to be thrown during parsing. Because this happens very early in query processing, no specific knowledge of an applications GraphQL schema would be required to construct such a query.

The possibility of small queries resulting in stack overflow is a potential denial of service vulnerability. This potentially affects all applications using Grackle which have untrusted users. Both stack overflow issues have been resolved in the v0.18.0 release of Grackle. As a workaround, users could interpose a sanitizing layer in between untrusted input and Grackle query processing.
CWE description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
CVSS v3 base score: 7.5
Published: 2023-12-22T21:15Z
Repository: https://github.com/typelevel/grackle
Language: Unknown
Commit date: 2023-12-18 13:58:16 -0800
Commit message: Merge pull request from GHSA-g56x-7j6w-g8r8

Add limits to parser; improve variable and fragment validation
CVE-2023-23941: Insufficient Information (NVD-CWE-noinfo)
value: SwagPayPal is a PayPal integration for shopware/platform. If JavaScript-based PayPal checkout methods are used (PayPal Plus, Smart Payment Buttons, SEPA, Pay Later, Venmo, Credit card), the amount and item list sent to PayPal may not be identical to the one in the created order. The problem has been fixed with version 5.4.4. As a workaround, disable the aforementioned payment methods or use the Security Plugin in version >= 1.0.21.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2023-02-03T21:15Z
Repository: https://github.com/shopware/SwagPayPal
Language: Markdown
Files changed: CHANGELOG.md, CHANGELOG_de-DE.md
Commit date: 2023-02-02 09:46:05 +0000
Commit message: Update changelog
Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5b84be0c..a42678bc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,8 +1,9 @@
 # 5.4.4
 - PPI-734 - Fixes an issue, where some payment methods were not displayed in after order process
 - PPI-735 - Fixes an issue, where payment details were not shown on orders, where PayPal was not the first chosen payment method
+- PPI-737 - Fixes an issue, where the order / payment details were not correctly transferred to PayPal
 
 # 5.4.3
 - PPI-654 - Fixes an issue, where Zettle sync errors were not displayed
 - PPI-661 - Small performance improvements
 - PPI-718 - Fixes an issue, where onboarding for specific Sales Channel configurations could not be completed
diff --git a/CHANGELOG_de-DE.md b/CHANGELOG_de-DE.md
index 179c0ecc..3c25dbc2 100644
--- a/CHANGELOG_de-DE.md
+++ b/CHANGELOG_de-DE.md
@@ -1,8 +1,9 @@
 # 5.4.4
 - PPI-734 - Behebt ein Problem, bei dem Zahlungsarten beim Zahlartwechsel nach Bestellabschluss nicht angezeigt wurden
 - PPI-735 - Behebt ein Problem, bei dem Zahlungsdetails nicht angezeigt wurden, wenn PayPal nicht die erstgewählte Zahlungsart war
+- PPI-737 - Behebt ein Problem, bei dem die Bestell-/Zahlungsdetails nicht korrekt an PayPal übertragen wurden
 
 # 5.4.3
 - PPI-654 - Behebt ein Problem, bei dem Zettle Synchronisationsfehler nicht angezeigt wurden
 - PPI-661 - Kleine Performance-Verbesserungen
 - PPI-718 - Behebt ein Problem, bei dem das Onboarding für Sales-Channel-spezifischen Konfigurationen nicht abgeschlossen werden konnte

Fixed code: - PPI-737 - Fixes an issue, where the order / payment details were not correctly transferred to PayPal
- PPI-737 - Behebt ein Problem, bei dem die Bestell-/Zahlungsdetails nicht korrekt an PayPal übertragen wurden
CVE-2019-16967: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: An issue was discovered in Manager 13.x before 13.0.2.6 and 15.x before 15.0.6 before FreePBX 14.0.10.3. In the Manager module form (html\admin\modules\manager\views\form.php), an unsanitized managerdisplay variable coming from the URL is reflected in HTML, leading to XSS. It can be requested via GET request to /config.php?type=tool&display=manager.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-10-21T20:15Z
Repository: https://github.com/FreePBX/manager
Language: PHP
Files changed: Manager.class.php, views/form.php
Commit date: 2019-09-03 14:46:11 +0000
Commit message: FREEPBX-20436 XSS vulnerability in manager module

Diff: diff --git a/Manager.class.php b/Manager.class.php
index 6d81463..f9ba215 100644
--- a/Manager.class.php
+++ b/Manager.class.php
@@ -65,11 +65,11 @@ class Manager implements \BMO {
 	public function restore($backup) {
 	}
 	public function doConfigPageInit($page) {
 		$action = isset($_REQUEST['action'])?$_REQUEST['action']:'';
 		//the extension we are currently displaying
-		$managerdisplay = isset($_REQUEST['managerdisplay'])?$_REQUEST['managerdisplay']:'';
+		$managerdisplay = isset($_REQUEST['managerdisplay'])?htmlentities($_REQUEST['managerdisplay'], ENT_QUOTES):'';
 		$name = isset($_REQUEST['name'])?$_REQUEST['name']:'';
 		$secret = isset($_REQUEST['secret'])?$_REQUEST['secret']:'';
 		$deny = isset($_REQUEST['deny'])?$_REQUEST['deny']:'0.0.0.0/0.0.0.0';
 		$permit = isset($_REQUEST['permit'])?$_REQUEST['permit']:'127.0.0.1/255.255.255.0';
 		$engineinfo = engine_getinfo();
diff --git a/views/form.php b/views/form.php
index b9705c6..49094a1 100644
--- a/views/form.php
+++ b/views/form.php
@@ -1,9 +1,9 @@
 <?php
 
 if (isset($_REQUEST['managerdisplay'])){
-  $managerdisplay = $_REQUEST['managerdisplay'];
+  $managerdisplay = htmlentities($_REQUEST['managerdisplay'], ENT_QUOTES);
   $subhead = '<h2>'._("Manager").' '.$managerdisplay.'</h2>';
   $delURL = '?display=manager&amp;managerdisplay='.$managerdisplay.'&amp;action=delete';
   //get details for this manager
   $thisManager = manager_get($managerdisplay);
   //create variables

Vulnerable code: 		$managerdisplay = isset($_REQUEST['managerdisplay'])?$_REQUEST['managerdisplay']:'';
  $managerdisplay = $_REQUEST['managerdisplay'];
Fixed code: 		$managerdisplay = isset($_REQUEST['managerdisplay'])?htmlentities($_REQUEST['managerdisplay'], ENT_QUOTES):'';
  $managerdisplay = htmlentities($_REQUEST['managerdisplay'], ENT_QUOTES);
CVE-2023-37907: Improper Privilege Management (CWE-269)
value: Cryptomator is data encryption software for users who store their files in the cloud. Prior to version 1.9.2, the MSI installer provided on the homepage allows local privilege escalation (LPE) for low privileged users, if already installed. The problem occurs as the repair function of the MSI spawns two administrative CMDs. A simple LPE is possible via a breakout. Version 1.9.2 fixes this issue.
CWE description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CVSS v3 base score: 7.8
Published: 2023-07-25T21:15Z
Repository: https://github.com/cryptomator/cryptomator
Language: Unknown
Commit date: 2023-07-24 16:23:23 +0200
Commit message: Merge pull request from GHSA-9c9p-c3mg-hpjq

Fix LPE in win installer
CVE-2023-39520: Improper Privilege Management (CWE-269)
value: Cryptomator encrypts data being stored on cloud infrastructure. The MSI installer provided on the homepage for Cryptomator version 1.9.2 allows local privilege escalation for low privileged users, via the `repair` function. The problem occurs as the repair function of the MSI is spawning an SYSTEM Powershell without the `-NoProfile` parameter. Therefore the profile of the user starting the repair will be loaded. Version 1.9.3 contains a fix for this issue. Adding a `-NoProfile` to the powershell is a possible workaround.
CWE description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CVSS v3 base score: 7.8
Published: 2023-08-07T20:15Z
Repository: https://github.com/cryptomator/cryptomator
Language: Unknown
Commit date: 2023-08-07 10:14:45 +0200
Commit message: Merge pull request from GHSA-62gx-54j7-mjh3

Add -NoProfile option to powershell scripts run during windows installer
CVE-2022-21671: Other (NVD-CWE-Other)
value: @replit/crosis is a JavaScript client that speaks Replit's container protocol. A vulnerability that involves exposure of sensitive information exists in versions prior to 7.3.1. When using this library as a way to programmatically communicate with Replit in a standalone fashion, if there are multiple failed attempts to contact Replit through a WebSocket, the library will attempt to communicate using a fallback poll-based proxy. The URL of the proxy has changed, so any communication done to the previous URL could potentially reach a server that is outside of Replit's control and the token used to connect to the Repl could be obtained by an attacker, leading to full compromise of that Repl (not of the account). This was patched in version 7.3.1 by updating the address of the fallback WebSocket polling proxy to the new one. As a workaround, a user may specify the new address for the polling host (`gp-v2.replit.com`) in the `ConnectArgs`. More information about this workaround is available in the GitHub Security Advisory.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 6.5
Published: 2022-01-11T15:15Z
Repository: https://github.com/replit/crosis
Language: TypeScript
Files changed: CHANGELOG.md, src/util/helpers.ts
Commit date: 2022-01-07 14:04:31 -0800
Commit message: Change the default polling host to `gp-v2.replit.com` (#113)

We switched the host a few days ago, so it's better to reflect reality.

This changes the default polling host to `gp-v2.replit.com`.
Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7a9e056..2060e69 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
+#### v7.3.1
+
+Changed the default polling host to gp-v2.replit.com.
+
 #### v7.3.0
 
 Added an optional `pollingHost` field to `ConnectOptions`. This allows callers to override the polling host from gp-v2.herokuapp.com to something else when the polling fallback is used.
 
 #### v7.2.0
diff --git a/src/util/helpers.ts b/src/util/helpers.ts
index d88af79..0c67474 100644
--- a/src/util/helpers.ts
+++ b/src/util/helpers.ts
@@ -59,11 +59,11 @@ export function getConnectionStr(
   isPolling: boolean,
   pollingHost?: string,
 ): string {
   const gurl = urllib.parse(connectionMetadata.gurl);
   if (isPolling) {
-    const host = pollingHost ?? 'gp-v2.herokuapp.com';
+    const host = pollingHost ?? 'gp-v2.replit.com';
     gurl.hostname = host;
     gurl.host = host;
     gurl.pathname = `/wsv2/${connectionMetadata.token}/${encodeURIComponent(
       connectionMetadata.gurl,
     )}`;

Vulnerable code:     const host = pollingHost ?? 'gp-v2.herokuapp.com';
Fixed code: #### v7.3.1

Changed the default polling host to gp-v2.replit.com.

    const host = pollingHost ?? 'gp-v2.replit.com';
CVE-2020-26297: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: mdBook is a utility to create modern online books from Markdown files and is written in Rust. In mdBook before version 0.4.5, there is a vulnerability affecting the search feature of mdBook, which could allow an attacker to execute arbitrary JavaScript code on the page. The search feature of mdBook (introduced in version 0.1.4) was affected by a cross site scripting vulnerability that allowed an attacker to execute arbitrary JavaScript code on an user's browser by tricking the user into typing a malicious search query, or tricking the user into clicking a link to the search page with the malicious search query prefilled. mdBook 0.4.5 fixes the vulnerability by properly escaping the search query. Owners of websites built with mdBook have to upgrade to mdBook 0.4.5 or greater and rebuild their website contents with it.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-01-04T19:15Z
Repository: https://github.com/rust-lang/mdBook
Language: JavaScript
Files changed: src/theme/searcher/searcher.js
Commit date: 2021-01-04 07:14:57 -0800
Commit message: fix xss in the search page

Thanks to Kamil Vavra for responsibly disclosing the vulnerability
according to Rust's Security Policy.

Diff: diff --git a/src/theme/searcher/searcher.js b/src/theme/searcher/searcher.js
index e1cc806..acf3d50 100644
--- a/src/theme/searcher/searcher.js
+++ b/src/theme/searcher/searcher.js
@@ -143,10 +143,15 @@ window.search = window.search || {};
         var url = doc_urls[result.ref].split("#");
         if (url.length == 1) { // no anchor found
             url.push("");
         }
 
+        // encodeURIComponent escapes all chars that could allow an XSS except
+        // for '. Due to that we also manually replace ' with its url-encoded
+        // representation (%27).
+        var searchterms = encodeURIComponent(searchterms.join(" ")).replace(/\'/g, "%27");
+
         return '<a href="' + path_to_root + url[0] + '?' + URL_MARK_PARAM + '=' + searchterms + '#' + url[1]
             + '" aria-details="teaser_' + teaser_count + '">' + result.doc.breadcrumbs + '</a>'
             + '<span class="teaser" id="teaser_' + teaser_count + '" aria-label="Search Result Teaser">' 
             + teaser + '</span>';
     }

Fixed code:         // encodeURIComponent escapes all chars that could allow an XSS except
        // for '. Due to that we also manually replace ' with its url-encoded
        // representation (%27).
        var searchterms = encodeURIComponent(searchterms.join(" ")).replace(/\'/g, "%27");
CVE-2023-22461: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: The `sanitize-svg` package, a small SVG sanitizer to prevent cross-site scripting attacks, uses a deny-list-pattern to sanitize SVGs to prevent XSS. In doing so, literal `<script>`-tags and on-event handlers were detected in versions prior to 0.4.0. As a result, downstream software that relies on `sanitize-svg` and expects resulting SVGs to be safe, may be vulnerable to cross-site scripting. This vulnerability was addressed in v0.4.0. There are no known workarounds


CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-01-04T15:15Z
Repository: https://github.com/mattkrick/sanitize-svg
Language: Unknown
Commit date: 2022-12-15 14:48:10 -0500
Commit message: Merge pull request from GHSA-h857-2g56-468g

Mount under a template tag instead of div
CVE-2023-22461: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CWE-80)
value: The `sanitize-svg` package, a small SVG sanitizer to prevent cross-site scripting attacks, uses a deny-list-pattern to sanitize SVGs to prevent XSS. In doing so, literal `<script>`-tags and on-event handlers were detected in versions prior to 0.4.0. As a result, downstream software that relies on `sanitize-svg` and expects resulting SVGs to be safe, may be vulnerable to cross-site scripting. This vulnerability was addressed in v0.4.0. There are no known workarounds


CWE description: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
CVSS v3 base score: 6.1
Published: 2023-01-04T15:15Z
Repository: https://github.com/mattkrick/sanitize-svg
Language: Unknown
Commit date: 2022-12-15 14:48:10 -0500
Commit message: Merge pull request from GHSA-h857-2g56-468g

Mount under a template tag instead of div
CVE-2014-3571: Other (NVD-CWE-Other)
value: OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted DTLS message that is processed with a different read operation for the handshake header than for the handshake body, related to the dtls1_get_record function in d1_pkt.c and the ssl3_read_n function in s3_pkt.c.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Published: 2015-01-09T02:59Z
Repository: https://github.com/openssl/openssl
Language: C
Files changed: ssl/d1_pkt.c
Commit date: 2015-01-08 15:49:27 +0000
Commit message: Follow on from CVE-2014-3571. This fixes the code that was the original source
of the crash due to p being NULL. Steve's fix prevents this situation from
occuring - however this is by no means obvious by looking at the code for
dtls1_get_record. This fix just makes things look a bit more sane.

Reviewed-by: Dr Stephen Henson <steve@openssl.org>

Diff: diff --git a/ssl/d1_pkt.c b/ssl/d1_pkt.c
index 9badc5e3f..1028e41b5 100644
--- a/ssl/d1_pkt.c
+++ b/ssl/d1_pkt.c
@@ -677,11 +677,12 @@ again:
 		 * a ClientHello. They can look as if they're replayed,
 		 * since they arrive from different connections and
 		 * would be dropped unnecessarily.
 		 */
 		if (!(s->d1->listen && rr->type == SSL3_RT_HANDSHAKE &&
-		    *p == SSL3_MT_CLIENT_HELLO) &&
+		    s->packet_length > DTLS1_RT_HEADER_LENGTH &&
+		    s->packet[DTLS1_RT_HEADER_LENGTH] == SSL3_MT_CLIENT_HELLO) &&
 		    !dtls1_record_replay_check(s, bitmap))
 			{
 			rr->length = 0;
 			s->packet_length=0; /* dump this record */
 			goto again;     /* get another record */

Vulnerable code: 		    *p == SSL3_MT_CLIENT_HELLO) &&
Fixed code: 		    s->packet_length > DTLS1_RT_HEADER_LENGTH &&
		    s->packet[DTLS1_RT_HEADER_LENGTH] == SSL3_MT_CLIENT_HELLO) &&
CVE-2014-3571: Other (NVD-CWE-Other)
value: OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted DTLS message that is processed with a different read operation for the handshake header than for the handshake body, related to the dtls1_get_record function in d1_pkt.c and the ssl3_read_n function in s3_pkt.c.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Published: 2015-01-09T02:59Z
Repository: https://github.com/openssl/openssl
Language: C
Files changed: ssl/d1_pkt.c, ssl/s3_pkt.c
Commit date: 2015-01-08 11:18:16 +0000
Commit message: Fix crash in dtls1_get_record whilst in the listen state where you get two
separate reads performed - one for the header and one for the body of the
handshake record.

CVE-2014-3571

Reviewed-by: Matt Caswell <matt@openssl.org>

Diff: diff --git a/ssl/d1_pkt.c b/ssl/d1_pkt.c
index 208d244fc..9badc5e3f 100644
--- a/ssl/d1_pkt.c
+++ b/ssl/d1_pkt.c
@@ -643,12 +643,10 @@ again:
 	if (rr->length > s->packet_length-DTLS1_RT_HEADER_LENGTH)
 		{
 		/* now s->packet_length == DTLS1_RT_HEADER_LENGTH */
 		i=rr->length;
 		n=ssl3_read_n(s,i,i,1);
-		if (n <= 0) return(n); /* error or non-blocking io */
-
 		/* this packet contained a partial record, dump it */
 		if ( n != i)
 			{
 			rr->length = 0;
 			s->packet_length = 0;
diff --git a/ssl/s3_pkt.c b/ssl/s3_pkt.c
index 2de10d644..3d8f821f9 100644
--- a/ssl/s3_pkt.c
+++ b/ssl/s3_pkt.c
@@ -195,10 +195,12 @@ int ssl3_read_n(SSL *s, int n, int max, int extend)
 	/* For DTLS/UDP reads should not span multiple packets
 	 * because the read operation returns the whole packet
 	 * at once (as long as it fits into the buffer). */
 	if (SSL_IS_DTLS(s))
 		{
+		if (left == 0 && extend)
+			return 0;
 		if (left > 0 && n > left)
 			n = left;
 		}
 
 	/* if there is enough in the buffer from a previous read, take some */

Vulnerable code: 		if (n <= 0) return(n); /* error or non-blocking io */

Fixed code: 		if (left == 0 && extend)
			return 0;
CVE-2014-8176: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h frees data structures without considering that application data can arrive between a ChangeCipherSpec message and a Finished message, which allows remote DTLS peers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unexpected application data.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Published: 2015-06-12T19:59Z
Repository: https://github.com/openssl/openssl
Language: C
Files changed: ssl/d1_lib.c
Commit date: 2014-06-02 23:55:55 +0100
Commit message: Free up s->d1->buffered_app_data.q properly.

PR#3286

Diff: diff --git a/ssl/d1_lib.c b/ssl/d1_lib.c
index 2287ba6fa..7d9d91ff2 100644
--- a/ssl/d1_lib.c
+++ b/ssl/d1_lib.c
@@ -200,13 +200,16 @@ static void dtls1_clear_queues(SSL *s)
         pitem_free(item);
         }
 
 	while ( (item = pqueue_pop(s->d1->buffered_app_data.q)) != NULL)
 		{
-		frag = (hm_fragment *)item->data;
-		OPENSSL_free(frag->fragment);
-		OPENSSL_free(frag);
+		rdata = (DTLS1_RECORD_DATA *) item->data;
+		if (rdata->rbuf.buf)
+			{
+			OPENSSL_free(rdata->rbuf.buf);
+			}
+		OPENSSL_free(item->data);
 		pitem_free(item);
 		}
 	}
 
 void dtls1_free(SSL *s)

Vulnerable code: 		frag = (hm_fragment *)item->data;
		OPENSSL_free(frag->fragment);
		OPENSSL_free(frag);
Fixed code: 		rdata = (DTLS1_RECORD_DATA *) item->data;
		if (rdata->rbuf.buf)
			{
			OPENSSL_free(rdata->rbuf.buf);
			}
		OPENSSL_free(item->data);
CVE-2014-8275: Cryptographic Issues (CWE-310)
value: OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion, related to crypto/asn1/a_verify.c, crypto/dsa/dsa_asn1.c, crypto/ecdsa/ecs_vrf.c, and crypto/x509/x_all.c.
CWE description: Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
Published: 2015-01-09T02:59Z
Repository: https://github.com/openssl/openssl
Language: C
Files changed: crypto/asn1/a_verify.c
Commit date: 2015-01-06 21:03:50 +0000
Commit message: use correct function name

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>

Diff: diff --git a/crypto/asn1/a_verify.c b/crypto/asn1/a_verify.c
index fdeeef676..e85d4d2b7 100644
--- a/crypto/asn1/a_verify.c
+++ b/crypto/asn1/a_verify.c
@@ -156,11 +156,11 @@ int ASN1_item_verify(const ASN1_ITEM *it, X509_ALGOR *a,
 		return -1;
 		}
 
 	if (signature->type == V_ASN1_BIT_STRING && signature->flags & 0x7)
 		{
-		ASN1err(ASN1_F_ASN1_VERIFY, ASN1_R_INVALID_BIT_STRING_BITS_LEFT);
+		ASN1err(ASN1_F_ASN1_ITEM_VERIFY, ASN1_R_INVALID_BIT_STRING_BITS_LEFT);
 		return -1;
 		}
 
 	EVP_MD_CTX_init(&ctx);
 

Vulnerable code: 		ASN1err(ASN1_F_ASN1_VERIFY, ASN1_R_INVALID_BIT_STRING_BITS_LEFT);
Fixed code: 		ASN1err(ASN1_F_ASN1_ITEM_VERIFY, ASN1_R_INVALID_BIT_STRING_BITS_LEFT);
CVE-2015-0205: Cryptographic Issues (CWE-310)
value: The ssl3_get_cert_verify function in s3_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k accepts client authentication with a Diffie-Hellman (DH) certificate without requiring a CertificateVerify message, which allows remote attackers to obtain access without knowledge of a private key via crafted TLS Handshake Protocol traffic to a server that recognizes a Certification Authority with DH support.
CWE description: Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
Published: 2015-01-09T02:59Z
Repository: https://github.com/openssl/openssl
Language: C
Files changed: ssl/s3_srvr.c
Commit date: 2015-01-08 15:49:45 +0000
Commit message: Unauthenticated DH client certificate fix.

Fix to prevent use of DH client certificates without sending
certificate verify message.

If we've used a client certificate to generate the premaster secret
ssl3_get_client_key_exchange returns 2 and ssl3_get_cert_verify is
never called.

We can only skip the certificate verify message in
ssl3_get_cert_verify if the client didn't send a certificate.

Thanks to Karthikeyan Bhargavan for reporting this issue.
CVE-2015-0205
Reviewed-by: Matt Caswell <matt@openssl.org>

Diff: diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c
index 90e95d6bc..8550c1b78 100644
--- a/ssl/s3_srvr.c
+++ b/ssl/s3_srvr.c
@@ -3054,11 +3054,11 @@ int ssl3_get_cert_verify(SSL *s)
 		}
 
 	if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_VERIFY)
 		{
 		s->s3->tmp.reuse_message=1;
-		if ((peer != NULL) && (type & EVP_PKT_SIGN))
+		if (peer != NULL)
 			{
 			al=SSL_AD_UNEXPECTED_MESSAGE;
 			SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_MISSING_VERIFY_MESSAGE);
 			goto f_err;
 			}

Vulnerable code: 		if ((peer != NULL) && (type & EVP_PKT_SIGN))
Fixed code: 		if (peer != NULL)
CVE-2015-1788: Resource Management Errors (CWE-399)
value: The BN_GF2m_mod_inv function in crypto/bn/bn_gf2m.c in OpenSSL before 0.9.8s, 1.0.0 before 1.0.0e, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b does not properly handle ECParameters structures in which the curve is over a malformed binary polynomial field, which allows remote attackers to cause a denial of service (infinite loop) via a session that uses an Elliptic Curve algorithm, as demonstrated by an attack against a server that supports client authentication.
CWE description: Weaknesses in this category are related to improper management of system resources.
Published: 2015-06-12T19:59Z
Repository: https://github.com/openssl/openssl
Language: C
Files changed: crypto/bn/bn_gf2m.c
Commit date: 2015-06-11 13:34:13 +0200
Commit message: bn/bn_gf2m.c: avoid infinite loop wich malformed ECParamters.

CVE-2015-1788

Reviewed-by: Matt Caswell <matt@openssl.org>

Diff: diff --git a/crypto/bn/bn_gf2m.c b/crypto/bn/bn_gf2m.c
index 73e1e8f11b..cd137c3649 100644
--- a/crypto/bn/bn_gf2m.c
+++ b/crypto/bn/bn_gf2m.c
@@ -689,13 +689,14 @@ int BN_GF2m_mod_inv(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
         if (!BN_GF2m_add(b, b, c))
             goto err;
     }
 # else
     {
-        int i, ubits = BN_num_bits(u), vbits = BN_num_bits(v), /* v is copy
-                                                                * of p */
-            top = p->top;
+        int i;
+        int ubits = BN_num_bits(u);
+        int vbits = BN_num_bits(v); /* v is copy of p */
+        int top = p->top;
         BN_ULONG *udp, *bdp, *vdp, *cdp;
 
         bn_wexpand(u, top);
         udp = u->d;
         for (i = u->top; i < top; i++)
@@ -735,12 +736,16 @@ int BN_GF2m_mod_inv(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
                 udp[i] = u0 >> 1;
                 bdp[i] = b0 >> 1;
                 ubits--;
             }
 
-            if (ubits <= BN_BITS2 && udp[0] == 1)
-                break;
+            if (ubits <= BN_BITS2) {
+                if (udp[0] == 0) /* poly was reducible */
+                    goto err;
+                if (udp[0] == 1)
+                    break;
+            }
 
             if (ubits < vbits) {
                 i = ubits;
                 ubits = vbits;
                 vbits = i;

Vulnerable code:         int i, ubits = BN_num_bits(u), vbits = BN_num_bits(v), /* v is copy
                                                                * of p */
            top = p->top;
            if (ubits <= BN_BITS2 && udp[0] == 1)
                break;
Fixed code:         int i;
        int ubits = BN_num_bits(u);
        int vbits = BN_num_bits(v); /* v is copy of p */
        int top = p->top;
            if (ubits <= BN_BITS2) {
                if (udp[0] == 0) /* poly was reducible */
                    goto err;
                if (udp[0] == 1)
                    break;
            }
CVE-2016-2180: Out-of-bounds Read (CWE-125)
value: The TS_OBJ_print_bio function in crypto/ts/ts_lib.c in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation in OpenSSL through 1.0.2h allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted time-stamp file that is mishandled by the "openssl ts" command.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2016-08-01T02:59Z
Repository: https://github.com/openssl/openssl
Language: C
Files changed: crypto/ts/ts_lib.c
Commit date: 2016-07-22 15:15:17 +0100
Commit message: Fix OOB read in TS_OBJ_print_bio().

TS_OBJ_print_bio() misuses OBJ_txt2obj: it should print the result
as a null terminated buffer. The length value returned is the total
length the complete text reprsentation would need not the amount of
data written.

CVE-2016-2180

Thanks to Shi Lei for reporting this bug.

Reviewed-by: Matt Caswell <matt@openssl.org>

Diff: diff --git a/crypto/ts/ts_lib.c b/crypto/ts/ts_lib.c
index bde1bd75e4..e18f1f3f7e 100644
--- a/crypto/ts/ts_lib.c
+++ b/crypto/ts/ts_lib.c
@@ -38,13 +38,12 @@ int TS_ASN1_INTEGER_print_bio(BIO *bio, const ASN1_INTEGER *num)
 
 int TS_OBJ_print_bio(BIO *bio, const ASN1_OBJECT *obj)
 {
     char obj_txt[128];
 
-    int len = OBJ_obj2txt(obj_txt, sizeof(obj_txt), obj, 0);
-    BIO_write(bio, obj_txt, len);
-    BIO_write(bio, "\n", 1);
+    OBJ_obj2txt(obj_txt, sizeof(obj_txt), obj, 0);
+    BIO_printf(bio, "%s\n", obj_txt);
 
     return 1;
 }
 
 int TS_ext_print_bio(BIO *bio, const STACK_OF(X509_EXTENSION) *extensions)

Vulnerable code:     int len = OBJ_obj2txt(obj_txt, sizeof(obj_txt), obj, 0);
    BIO_write(bio, obj_txt, len);
    BIO_write(bio, "\n", 1);
Fixed code:     OBJ_obj2txt(obj_txt, sizeof(obj_txt), obj, 0);
    BIO_printf(bio, "%s\n", obj_txt);
CVE-2016-15005: Cross-Site Request Forgery (CSRF) (CWE-352)
value: CSRF tokens are generated using math/rand, which is not a cryptographically secure random number generator, allowing an attacker to predict values and bypass CSRF protections with relatively few requests.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2022-12-27T22:15Z
Repository: https://github.com/dinever/golf
Language: Unknown
Commit date: 2016-06-10 22:17:45 -0400
Commit message: Merge pull request #24 from bentranter/use-crypto-rand-for-xsrf

Use crypto/rand for XSRF token generation
CVE-2022-1430: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - DOM in GitHub repository octoprint/octoprint prior to 1.8.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 7.5
Published: 2022-05-18T14:15Z
Repository: https://github.com/octoprint/octoprint
Language: Python
Files changed: src/octoprint/server/views.py
Commit date: 2022-05-11 13:02:52 +0200
Commit message: 🔒️ Sanitize and validate login redirect

Fixes an XSS and an open redirect issue.

Diff: diff --git a/src/octoprint/server/views.py b/src/octoprint/server/views.py
index 235e15f01..d1db66b26 100644
--- a/src/octoprint/server/views.py
+++ b/src/octoprint/server/views.py
@@ -6,10 +6,11 @@ import base64
 import datetime
 import logging
 import os
 import re
 from collections import defaultdict
+from urllib.parse import urlparse
 
 from flask import (
     Response,
     abort,
     g,
@@ -168,11 +169,20 @@ def _add_additional_assets(hook):
 @app.route("/login")
 @app.route("/login/")
 def login():
     from flask_login import current_user
 
-    redirect_url = request.args.get("redirect", request.script_root + url_for("index"))
+    default_redirect_url = request.script_root + url_for("index")
+    redirect_url = request.args.get("redirect", default_redirect_url)
+
+    parsed = urlparse(redirect_url)  # check if redirect url is valid
+    if parsed.scheme != "" or parsed.netloc != "":
+        _logger.warning(
+            f"Got an invalid redirect URL with the login attempt, misconfiguration or attack attempt: {redirect_url}"
+        )
+        redirect_url = default_redirect_url
+
     permissions = sorted(
         filter(
             lambda x: x is not None and isinstance(x, OctoPrintPermission),
             map(
                 lambda x: getattr(Permissions, x.strip()),

Vulnerable code:     redirect_url = request.args.get("redirect", request.script_root + url_for("index"))
Fixed code: from urllib.parse import urlparse
    default_redirect_url = request.script_root + url_for("index")
    redirect_url = request.args.get("redirect", default_redirect_url)

    parsed = urlparse(redirect_url)  # check if redirect url is valid
    if parsed.scheme != "" or parsed.netloc != "":
        _logger.warning(
            f"Got an invalid redirect URL with the login attempt, misconfiguration or attack attempt: {redirect_url}"
        )
        redirect_url = default_redirect_url
CVE-2022-3068: Improper Privilege Management (CWE-269)
value: Improper Privilege Management in GitHub repository octoprint/octoprint prior to 1.8.3.
CWE description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CVSS v3 base score: 8.8
Published: 2022-09-21T12:15Z
Repository: https://github.com/octoprint/octoprint
Language: Python
Files changed: src/octoprint/plugins/pluginmanager/__init__.py
Commit date: 2022-08-24 10:52:48 +0200
Commit message: 🔒️ Fix a wrong permission role

A wrong role assigned to PluginManager LIST permission as
introduced in 1.8.0 causes a privilege escalation,
allowing read-only and user group the same rights as
the MANAGE permission:

- enabling/disabling plugins
- uninstalling plugins
- listing installed plugins incl. their details
- retrieving plugin notices
- deleting orphaned plugin settings

Diff: diff --git a/src/octoprint/plugins/pluginmanager/__init__.py b/src/octoprint/plugins/pluginmanager/__init__.py
index 4b338e6688..5137995c1e 100644
--- a/src/octoprint/plugins/pluginmanager/__init__.py
+++ b/src/octoprint/plugins/pluginmanager/__init__.py
@@ -226,11 +226,11 @@ class PluginManagerPlugin(
             {
                 "key": "LIST",
                 "name": "List plugins",
                 "description": gettext("Allows to list installed plugins."),
                 "default_groups": [READONLY_GROUP, USER_GROUP, ADMIN_GROUP],
-                "roles": ["manage"],
+                "roles": ["list"],
             },
             {
                 "key": "MANAGE",
                 "name": "Manage plugins",
                 "description": gettext(

Vulnerable code:                 "roles": ["manage"],
Fixed code:                 "roles": ["list"],
CVE-2018-25054: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in shred cilla. It has been classified as problematic. Affected is an unknown function of the file cilla-xample/src/main/webapp/WEB-INF/jsp/view/search.jsp of the component Search Handler. The manipulation of the argument details leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is d345e6bc7798bd717a583ec7f545ca387819d5c7. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216960.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-12-28T12:15Z
Repository: https://github.com/shred/cilla
Language: Other
Files changed: cilla-xample/src/main/webapp/WEB-INF/jsp/view/search.jsp
Commit date: 2018-10-28 16:26:05 +0100
Commit message: Fix XSS flaw on example search

Diff: diff --git a/cilla-xample/src/main/webapp/WEB-INF/jsp/view/search.jsp b/cilla-xample/src/main/webapp/WEB-INF/jsp/view/search.jsp
index 43f57ec..cf2931c 100644
--- a/cilla-xample/src/main/webapp/WEB-INF/jsp/view/search.jsp
+++ b/cilla-xample/src/main/webapp/WEB-INF/jsp/view/search.jsp
@@ -24,10 +24,11 @@
  --%>
 <%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
 <%@ taglib prefix="fmt" uri="http://java.sun.com/jsp/jstl/fmt" %>
 <%@ taglib prefix="cilla" uri="http://cilla.shredzone.org/taglib/cilla" %>
 <%@ taglib prefix="sz" tagdir="/WEB-INF/tags/sz" %>
+<%@ taglib prefix="fn" uri="http://java.sun.com/jsp/jstl/functions" %>
 <fmt:setBundle basename="messages"/>
 <c:set var="headTitle" value="${search.title}" scope="request"/>
 <c:import url="/WEB-INF/jsp/design/header.jspf"/>
 <c:import url="/WEB-INF/jsp/design/sidebar-left.jsp"/>
 
@@ -39,11 +40,11 @@
   </div>
 
   <c:if test="${not empty message}">
     <p>
       <fmt:message key="${message}">
-        <fmt:param value="${details}"/>
+        <fmt:param value="${fn:escapeXml(details)}"/>
       </fmt:message>
     </p>
   </c:if>
 
   <c:if test="${empty result.pages and empty message}">

Vulnerable code:         <fmt:param value="${details}"/>
Fixed code: <%@ taglib prefix="fn" uri="http://java.sun.com/jsp/jstl/functions" %>
        <fmt:param value="${fn:escapeXml(details)}"/>
CVE-2019-19502: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: Code injection in pluginconfig.php in Image Uploader and Browser for CKEditor before 4.1.9 allows remote authenticated users to execute arbitrary PHP code.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 9.8
Published: 2019-12-02T16:15Z
Repository: https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor
Language: Unknown
Commit date: 2019-11-30 15:16:24 +0100
Commit message: Merge pull request #11 from mvisat/security-fix

Fix security issue
CVE-2020-27788: Out-of-bounds Read (CWE-125)
value: An out-of-bounds read access vulnerability was discovered in UPX in PackLinuxElf64::canPack() function of p_lx_elf.cpp file. An attacker with a crafted input file could trigger this issue that could cause a crash leading to a denial of service.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2022-08-18T20:15Z
Repository: https://github.com/upx/upx
Language: C++
Files changed: src/p_lx_elf.cpp
Commit date: 2020-01-13 17:26:31 -0800
Commit message: Detect bad e_shstrtab better.

https://github.com/upx/upx/issues/332
	modified:   p_lx_elf.cpp

Diff: diff --git a/src/p_lx_elf.cpp b/src/p_lx_elf.cpp
index ef58eee8..96f5838d 100644
--- a/src/p_lx_elf.cpp
+++ b/src/p_lx_elf.cpp
@@ -2037,15 +2037,16 @@ bool PackLinuxElf32::canPack()
             }
 
             if (sec_strndx) {
                 unsigned const sh_name = get_te32(&sec_strndx->sh_name);
                 if (Elf32_Shdr::SHT_STRTAB != get_te32(&sec_strndx->sh_type)
-                || (u32_t)file_size <= sh_name  // FIXME: weak
+                || (u32_t)file_size <= (sizeof(".shstrtab")
+                    + sh_name + (shstrtab - (const char *)&file_image[0]))
                 || (sh_name
                   && 0!=strcmp((char const *)".shstrtab", &shstrtab[sh_name]))
                 ) {
-                    throwCantPack("bad e_shstrndx");
+                    throwCantPack("bad e_shstrtab");
                 }
             }
         }
 
         Elf32_Phdr const *pload_x0(0);  // first eXecutable PT_LOAD
@@ -2386,15 +2387,16 @@ PackLinuxElf64::canPack()
             }
 
             if (sec_strndx) {
                 unsigned const sh_name = get_te32(&sec_strndx->sh_name);
                 if (Elf64_Shdr::SHT_STRTAB != get_te32(&sec_strndx->sh_type)
-                || (u32_t)file_size <= sh_name  // FIXME: weak
+                || (u32_t)file_size <= (sizeof(".shstrtab")
+                    + sh_name + (shstrtab - (const char *)&file_image[0]))
                 || (sh_name
                   && 0!=strcmp((char const *)".shstrtab", &shstrtab[sh_name]))
                 ) {
-                    throwCantPack("bad e_shstrndx");
+                    throwCantPack("bad e_shstrtab");
                 }
             }
         }
 
         Elf64_Phdr const *pload_x0(0);  // first eXecutable PT_LOAD

Vulnerable code:                 || (u32_t)file_size <= sh_name  // FIXME: weak
                    throwCantPack("bad e_shstrndx");
                || (u32_t)file_size <= sh_name  // FIXME: weak
                    throwCantPack("bad e_shstrndx");
Fixed code:                 || (u32_t)file_size <= (sizeof(".shstrtab")
                    + sh_name + (shstrtab - (const char *)&file_image[0]))
                    throwCantPack("bad e_shstrtab");
                || (u32_t)file_size <= (sizeof(".shstrtab")
                    + sh_name + (shstrtab - (const char *)&file_image[0]))
                    throwCantPack("bad e_shstrtab");
CVE-2023-23456: Out-of-bounds Write (CWE-787)
value: A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack() in p_tmt.cpp file. The flow allows an attacker to cause a denial of service (abort) via a crafted file.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2023-01-12T19:15Z
Repository: https://github.com/upx/upx
Language: C++
Files changed: src/p_tmt.cpp
Commit date: 2022-11-24 10:28:03 -0800
Commit message: p_tmt: more sanity of input, cleanup MemBuffer usage

https://github.com/upx/upx/issues/632
	modified:   src/p_tmt.cpp

Diff: diff --git a/src/p_tmt.cpp b/src/p_tmt.cpp
index e6f0ab3ab..21a8a0a00 100644
--- a/src/p_tmt.cpp
+++ b/src/p_tmt.cpp
@@ -137,11 +137,12 @@ int PackTmt::readFileHeader() {
     fi->readx(&ih, sizeof(ih));
     // FIXME: should add more checks for the values in 'ih'
     unsigned const imagesize = ih.imagesize;
     unsigned const entry = ih.entry;
     unsigned const relocsize = ih.relocsize;
-    if (!imagesize || file_size <= imagesize || file_size <= entry || file_size <= relocsize) {
+    if (imagesize < sizeof(ih) || entry < sizeof(ih) || file_size <= imagesize ||
+        file_size <= entry || file_size <= relocsize) {
         printWarn(getName(), "bad header; imagesize=%#x  entry=%#x  relocsize=%#x", imagesize,
                   entry, relocsize);
         return 0;
     }
 
@@ -170,19 +171,19 @@ void PackTmt::pack(OutputFile *fo) {
 
     ibuf.alloc(usize + rsize + 128);
     obuf.allocForCompression(usize + rsize + 128);
 
     MemBuffer mb_wrkmem;
-    mb_wrkmem.alloc(rsize + EXTRA_INFO); // relocations
+    mb_wrkmem.alloc(rsize + EXTRA_INFO + 4); // relocations + original entry point + relocsize
     SPAN_S_VAR(upx_byte, wrkmem, mb_wrkmem);
 
     fi->seek(adam_offset + sizeof(ih), SEEK_SET);
     fi->readx(ibuf, usize);
     fi->readx(wrkmem + 4, rsize);
     const unsigned overlay = file_size - fi->tell();
 
-    if (find_le32(ibuf, 128, get_le32("UPX ")) >= 0)
+    if (find_le32(ibuf, UPX_MIN(128u, usize), get_le32("UPX ")) >= 0)
         throwAlreadyPacked();
     if (rsize == 0)
         throwCantPack("file is already compressed with another packer");
 
     checkOverlay(overlay);

Vulnerable code:     if (!imagesize || file_size <= imagesize || file_size <= entry || file_size <= relocsize) {
    mb_wrkmem.alloc(rsize + EXTRA_INFO); // relocations
    if (find_le32(ibuf, 128, get_le32("UPX ")) >= 0)
Fixed code:     if (imagesize < sizeof(ih) || entry < sizeof(ih) || file_size <= imagesize ||
        file_size <= entry || file_size <= relocsize) {
    mb_wrkmem.alloc(rsize + EXTRA_INFO + 4); // relocations + original entry point + relocsize
    if (find_le32(ibuf, UPX_MIN(128u, usize), get_le32("UPX ")) >= 0)