Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2012-4396: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file names to apps/user_ldap/settings.php; (2) url or (3) title parameter to apps/bookmarks/ajax/editBookmark.php; (4) tag or (5) page parameter to apps/bookmarks/ajax/updateList.php; (6) identity to apps/user_openid/settings.php; (7) stack name in apps/gallery/lib/tiles.php; (8) root parameter to apps/gallery/templates/index.php; (9) calendar displayname in apps/calendar/templates/part.import.php; (10) calendar uri in apps/calendar/templates/part.choosecalendar.rowfields.php; (11) title, (12) location, or (13) description parameter in apps/calendar/lib/object.php; (14) certain vectors in core/js/multiselect.js; or (15) artist, (16) album, or (17) title comments parameter in apps/media/lib_scanner.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2012-09-05T23:55Z
Repository: https://github.com/owncloud/core
Language: PHP
Files changed: apps/calendar/templates/part.import.php
Commit date: 2012-06-09 16:44:48 +0200
Commit message: fix another XSS

Diff: diff --git a/apps/calendar/templates/part.import.php b/apps/calendar/templates/part.import.php
index e93ea1af4..3850ddde5 100644
--- a/apps/calendar/templates/part.import.php
+++ b/apps/calendar/templates/part.import.php
@@ -6,10 +6,13 @@
 <p style="text-align:center;"><b><?php echo $l->t('Please choose the calendar'); ?></b></p>
 <select style="width:100%;" id="calendar" name="calendar">
 <?php
 $calendar_options = OC_Calendar_Calendar::allCalendars(OCP\USER::getUser());
 $calendar_options[] = array('id'=>'newcal', 'displayname'=>$l->t('create a new calendar'));
+for($i = 0;$i<count($calendar_options);$i++){
+	$calendar_options[$i]['displayname'] = htmlspecialchars($calendar_options[$i]['displayname']);
+}
 echo OCP\html_select_options($calendar_options, $calendar_options[0]['id'], array('value'=>'id', 'label'=>'displayname'));
 ?>
 </select>
 <div id="newcalform" style="display: none;">
 	<input type="text" style="width: 97%;" placeholder="<?php echo $l->t('Name of new calendar'); ?>" id="newcalendar" name="newcalendar">

Fixed code: for($i = 0;$i<count($calendar_options);$i++){
	$calendar_options[$i]['displayname'] = htmlspecialchars($calendar_options[$i]['displayname']);
}
CVE-2012-4396: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file names to apps/user_ldap/settings.php; (2) url or (3) title parameter to apps/bookmarks/ajax/editBookmark.php; (4) tag or (5) page parameter to apps/bookmarks/ajax/updateList.php; (6) identity to apps/user_openid/settings.php; (7) stack name in apps/gallery/lib/tiles.php; (8) root parameter to apps/gallery/templates/index.php; (9) calendar displayname in apps/calendar/templates/part.import.php; (10) calendar uri in apps/calendar/templates/part.choosecalendar.rowfields.php; (11) title, (12) location, or (13) description parameter in apps/calendar/lib/object.php; (14) certain vectors in core/js/multiselect.js; or (15) artist, (16) album, or (17) title comments parameter in apps/media/lib_scanner.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2012-09-05T23:55Z
Repository: https://github.com/owncloud/core
Language: PHP
Files changed: apps/user_ldap/settings.php
Commit date: 2012-06-11 11:56:54 +0200
Commit message: Sanitzing user input

Diff: diff --git a/apps/user_ldap/settings.php b/apps/user_ldap/settings.php
index 9c0620578..f1a474ff2 100644
--- a/apps/user_ldap/settings.php
+++ b/apps/user_ldap/settings.php
@@ -45,11 +45,11 @@ if ($_POST) {
 }
 
 // fill template
 $tmpl = new OCP\Template( 'user_ldap', 'settings');
 foreach($params as $param){
-		$value = OCP\Config::getAppValue('user_ldap', $param,'');
+		$value = htmlentities(OCP\Config::getAppValue('user_ldap', $param,''));
 		$tmpl->assign($param, $value);
 }
 
 // settings with default values
 $tmpl->assign( 'ldap_port', OCP\Config::getAppValue('user_ldap', 'ldap_port', '389'));

Vulnerable code: 		$value = OCP\Config::getAppValue('user_ldap', $param,'');
Fixed code: 		$value = htmlentities(OCP\Config::getAppValue('user_ldap', $param,''));
CVE-2012-4396: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file names to apps/user_ldap/settings.php; (2) url or (3) title parameter to apps/bookmarks/ajax/editBookmark.php; (4) tag or (5) page parameter to apps/bookmarks/ajax/updateList.php; (6) identity to apps/user_openid/settings.php; (7) stack name in apps/gallery/lib/tiles.php; (8) root parameter to apps/gallery/templates/index.php; (9) calendar displayname in apps/calendar/templates/part.import.php; (10) calendar uri in apps/calendar/templates/part.choosecalendar.rowfields.php; (11) title, (12) location, or (13) description parameter in apps/calendar/lib/object.php; (14) certain vectors in core/js/multiselect.js; or (15) artist, (16) album, or (17) title comments parameter in apps/media/lib_scanner.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2012-09-05T23:55Z
Repository: https://github.com/owncloud/core
Language: PHP
Files changed: apps/user_openid/settings.php
Commit date: 2012-06-11 11:54:45 +0200
Commit message: Sanitize user input

Diff: diff --git a/apps/user_openid/settings.php b/apps/user_openid/settings.php
index 921fa371d..062322f6f 100644
--- a/apps/user_openid/settings.php
+++ b/apps/user_openid/settings.php
@@ -1,10 +1,10 @@
 <?php
 
 $tmpl = new OCP\Template( 'user_openid', 'settings');
 $identity=OCP\Config::getUserValue(OCP\USER::getUser(),'user_openid','identity','');
-$tmpl->assign('identity',$identity);
+$tmpl->assign('identity',htmlentities($identity));
 
 OCP\Util::addscript('user_openid','settings');
 
 return $tmpl->fetchPage();
 ?>
\ No newline at end of file

Vulnerable code: $tmpl->assign('identity',$identity);
Fixed code: $tmpl->assign('identity',htmlentities($identity));
CVE-2012-4397: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) calendar displayname to part.choosecalendar.rowfields.php or (2) part.choosecalendar.rowfields.shared.php in apps/calendar/templates/; or (3) unspecified vectors to apps/contacts/lib/vcard.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2012-09-05T23:55Z
Repository: https://github.com/owncloud/core
Language: PHP
Files changed: apps/contacts/lib/vcard.php
Commit date: 2012-05-21 21:49:35 +0200
Commit message: Contacts: Backport XSS fix.

Diff: diff --git a/apps/contacts/lib/vcard.php b/apps/contacts/lib/vcard.php
index 91ae3a751..2414efe67 100644
--- a/apps/contacts/lib/vcard.php
+++ b/apps/contacts/lib/vcard.php
@@ -186,10 +186,13 @@ class OC_Contacts_VCard{
 		foreach($vcard->children as &$property){
 			// Decode string properties and remove obsolete properties.
 			if($upgrade && in_array($property->name, $stringprops)) {
 				self::decodeProperty($property);
 			}
+			if(in_array($property->name, $stringprops)) {
+				$property->value = strip_tags($property->value);
+			}
 			// Fix format of type parameters.
 			if($upgrade && in_array($property->name, $typeprops)) {
 				OCP\Util::writeLog('contacts','OC_Contacts_VCard::updateValuesFromAdd. before: '.$property->serialize(),OCP\Util::DEBUG);
 				self::formatPropertyTypes($property);
 				OCP\Util::writeLog('contacts','OC_Contacts_VCard::updateValuesFromAdd. after: '.$property->serialize(),OCP\Util::DEBUG);

Fixed code: 			if(in_array($property->name, $stringprops)) {
				$property->value = strip_tags($property->value);
			}
CVE-2012-4752: Permissions, Privileges, and Access Controls (CWE-264)
value: appconfig.php in ownCloud before 4.0.6 does not properly restrict access, which allows remote authenticated users to edit app configurations via unspecified vectors.  NOTE: this can be leveraged by unauthenticated remote attackers using CVE-2012-4393.
CWE description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Published: 2012-09-05T23:55Z
Repository: https://github.com/owncloud/core
Language: PHP
Files changed: core/ajax/appconfig.php
Commit date: 2012-07-26 00:06:51 +0200
Commit message: Check for admin user

Diff: diff --git a/core/ajax/appconfig.php b/core/ajax/appconfig.php
index f815d7106..de91d458e 100644
--- a/core/ajax/appconfig.php
+++ b/core/ajax/appconfig.php
@@ -4,10 +4,11 @@
  * This file is licensed under the Affero General Public License version 3 or later.
  * See the COPYING-README file.
  */
 
 require_once ("../../lib/base.php");
+OC_Util::checkAdminUser();
 OC_JSON::checkLoggedIn();
 $action=isset($_POST['action'])?$_POST['action']:$_GET['action'];
 $result=false;
 switch($action){
 	case 'getValue':

Fixed code: OC_Util::checkAdminUser();
CVE-2015-1039: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in user/login.phtml in ZF-Commons ZfcUser before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2015-01-15T15:59Z
Repository: https://github.com/ZF-Commons/ZfcUser
Language: Other
Files changed: view/zfc-user/user/login.phtml
Commit date: 2015-01-08 14:18:45 +0100
Commit message: Fix XSS vulnerability

Diff: diff --git a/view/zfc-user/user/login.phtml b/view/zfc-user/user/login.phtml
index 3d1df3b..66dbfd6 100644
--- a/view/zfc-user/user/login.phtml
+++ b/view/zfc-user/user/login.phtml
@@ -26,7 +26,7 @@ $form->setAttribute('method', 'post');
     </dl>
 
 <?php echo $this->form()->closeTag() ?>
 
 <?php if ($this->enableRegistration) : ?>
-<?php echo $this->translate('Not registered?'); ?> <a href="<?php echo $this->url('zfcuser/register') . ($this->redirect ? '?redirect='.$this->redirect : '') ?>"><?php echo $this->translate('Sign up!'); ?></a>
+<?php echo $this->translate('Not registered?'); ?> <a href="<?php echo $this->url('zfcuser/register') . ($this->redirect ? '?redirect='.$this->escapeUrl($this->redirect) : '') ?>"><?php echo $this->translate('Sign up!'); ?></a>
 <?php endif; ?>

Vulnerable code: <?php echo $this->translate('Not registered?'); ?> <a href="<?php echo $this->url('zfcuser/register') . ($this->redirect ? '?redirect='.$this->redirect : '') ?>"><?php echo $this->translate('Sign up!'); ?></a>
Fixed code: <?php echo $this->translate('Not registered?'); ?> <a href="<?php echo $this->url('zfcuser/register') . ($this->redirect ? '?redirect='.$this->escapeUrl($this->redirect) : '') ?>"><?php echo $this->translate('Sign up!'); ?></a>
CVE-2024-29862: Insufficient Information (NVD-CWE-noinfo)
value: The Kerlink firewall in ChirpStack chirpstack-mqtt-forwarder before 4.2.1 and chirpstack-gateway-bridge before 4.0.11 wrongly accepts certain TCP packets when a connection is not in the ESTABLISHED state.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-21T04:15Z
Repository: https://github.com/chirpstack/chirpstack-gateway-bridge
Language: Other
Files changed: packaging/vendor/kerlink/keros-gws/files/chirpstack-gateway-bridge.init
Commit date: 2024-03-11 11:52:12 +0000
Commit message: Fix Kerlink firewall rule security issue.

This limits accepting incoming TCP packets from the --sport for
ESTABLISHED connections only.

Diff: diff --git a/packaging/vendor/kerlink/keros-gws/files/chirpstack-gateway-bridge.init b/packaging/vendor/kerlink/keros-gws/files/chirpstack-gateway-bridge.init
index eb67cfb..a290129 100755
--- a/packaging/vendor/kerlink/keros-gws/files/chirpstack-gateway-bridge.init
+++ b/packaging/vendor/kerlink/keros-gws/files/chirpstack-gateway-bridge.init
@@ -8,11 +8,11 @@ DAEMON_PID=/var/run/$NAME.pid
 
 function iptables_accept {
     [ -n "${1}" ] || exit 1
     local RULE="OUTPUT -t filter -p tcp --dport ${1} -j ACCEPT"
     iptables -C ${RULE} 2> /dev/null || iptables -I ${RULE}
-    local RULE="INPUT -t filter -p tcp --sport ${1} -j ACCEPT"
+    local RULE="INPUT -t filter -p tcp --sport ${1} -m conntrack --ctstate ESTABLISHED -j ACCEPT"
     iptables -C ${RULE} 2> /dev/null || iptables -I ${RULE}
 }
 
 function do_start {
     echo "Starting $NAME"

Vulnerable code:     local RULE="INPUT -t filter -p tcp --sport ${1} -j ACCEPT"
Fixed code:     local RULE="INPUT -t filter -p tcp --sport ${1} -m conntrack --ctstate ESTABLISHED -j ACCEPT"
CVE-2023-22480: Incorrect Authorization (CWE-863)
value: KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters. In KubeOperator versions 3.16.3 and below, API interfaces with unauthorized entities and can leak sensitive information. This vulnerability could be used to take over the cluster under certain conditions. This issue has been patched in version 3.16.4.

CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 9.8
Published: 2023-01-14T01:15Z
Repository: https://github.com/KubeOperator/KubeOperator
Language: Go
Files changed: pkg/router/v1/v1api.go
Commit date: 2023-01-12 11:36:37 +0800
Commit message: fix: 解决K8s配置下载漏洞

Diff: diff --git a/pkg/router/v1/v1api.go b/pkg/router/v1/v1api.go
index 1a3b9cbc1..d159e9566 100644
--- a/pkg/router/v1/v1api.go
+++ b/pkg/router/v1/v1api.go
@@ -64,12 +64,12 @@ func V1(parent iris.Party) {
 	mvc.New(AuthScope.Party("/ldap")).HandleError(ErrorHandler).Handle(controller.NewLdapController())
 	mvc.New(AuthScope.Party("/msg/accounts")).HandleError(ErrorHandler).Handle(controller.NewMessageAccountController())
 	mvc.New(AuthScope.Party("/msg/subscribes")).HandleError(ErrorHandler).Handle(controller.NewMessageSubscribeController())
 	mvc.New(AuthScope.Party("/user/messages")).HandleError(ErrorHandler).Handle(controller.NewUserMsgController())
 	mvc.New(AuthScope.Party("/user/settings")).HandleError(ErrorHandler).Handle(controller.NewUserSettingController())
+	AuthScope.Get("/clusters/kubeconfig/{name}", downloadKubeconfig)
 	WhiteScope = v1.Party("/")
-	WhiteScope.Get("/clusters/kubeconfig/{name}", downloadKubeconfig)
 	WhiteScope.Get("/captcha", generateCaptcha)
 	mvc.New(WhiteScope.Party("/theme")).HandleError(ErrorHandler).Handle(controller.NewThemeController())
 
 }
 

Vulnerable code: 	WhiteScope.Get("/clusters/kubeconfig/{name}", downloadKubeconfig)
Fixed code: 	AuthScope.Get("/clusters/kubeconfig/{name}", downloadKubeconfig)
CVE-2022-27650: Incorrect Default Permissions (CWE-276)
value: A flaw was found in crun where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.
CWE description: During installation, installed file permissions are set to allow anyone to modify those files.
CVSS v3 base score: 7.5
Published: 2022-04-04T20:15Z
Repository: https://github.com/containers/crun
Language: C
Files changed: src/exec.c
Commit date: 2022-03-23 09:12:55 +0100
Commit message: exec: --cap do not set inheritable capabilities

Closes: CVE-2022-27650

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Diff: diff --git a/src/exec.c b/src/exec.c
index 7a8931e..c876ecd 100644
--- a/src/exec.c
+++ b/src/exec.c
@@ -302,12 +302,12 @@ crun_command_exec (struct crun_global_arguments *global_args, int argc, char **a
               = xmalloc (sizeof (runtime_spec_schema_config_schema_process_capabilities));
 
           capabilities->effective = exec_options.cap;
           capabilities->effective_len = exec_options.cap_size;
 
-          capabilities->inheritable = dup_array (exec_options.cap, exec_options.cap_size);
-          capabilities->inheritable_len = exec_options.cap_size;
+          capabilities->inheritable = NULL;
+          capabilities->inheritable_len = 0;
 
           capabilities->bounding = dup_array (exec_options.cap, exec_options.cap_size);
           capabilities->bounding_len = exec_options.cap_size;
 
           capabilities->ambient = dup_array (exec_options.cap, exec_options.cap_size);

Vulnerable code:           capabilities->inheritable = dup_array (exec_options.cap, exec_options.cap_size);
          capabilities->inheritable_len = exec_options.cap_size;
Fixed code:           capabilities->inheritable = NULL;
          capabilities->inheritable_len = 0;
CVE-2024-39906: Insufficient Information (NVD-CWE-noinfo)
value: A command injection vulnerability was found in the IndieAuth functionality of the Ruby on Rails based Haven blog web application. The affected functionality requires authentication, but an attacker can craft a link that they can pass to a logged in administrator of the blog software. This leads to the immediate execution of the provided commands when the link is accessed by the authenticated administrator. This issue may lead to Remote Code Execution (RCE) and has been addressed by commit `c52f07c`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-07-19T20:15Z
Repository: https://github.com/havenweb/haven
Language: Ruby
Files changed: lib/indie_auth_client.rb
Commit date: 2024-07-05 10:14:54 -0500
Commit message: add URI validation to indieauth flow

Diff: diff --git a/lib/indie_auth_client.rb b/lib/indie_auth_client.rb
index ec2e90d..5d29f93 100644
--- a/lib/indie_auth_client.rb
+++ b/lib/indie_auth_client.rb
@@ -26,11 +26,11 @@ class IndieAuthClient
     @logo = "/warning.svg"
     @url = @client_id
     @redirects = []
     if should_fetch?
       begin
-        URI.open(client_id) do |f|
+        URI(client_id).open do |f|
           doc = Nokogiri::HTML(f.read)
 
           url = ""
           doc.xpath("//div[@class='h-app']//a[contains(@class, 'u-url')]/@href").each {|u| url = u.value}
           @url = client_id.chomp("/") + url if url.start_with? "/"
@@ -64,10 +64,11 @@ class IndieAuthClient
   private
 
   def should_fetch?
     clean_host = parse_hostname(@client_id)
     begin
+      client_id_uri = URI.parse(@client_id) #for validation only
       ip = Resolv.getaddress(clean_host)
       return safe_ip? ip
     rescue
       return false
     end

Vulnerable code:         URI.open(client_id) do |f|
Fixed code:         URI(client_id).open do |f|
      client_id_uri = URI.parse(@client_id) #for validation only
CVE-2020-36649: Inefficient Regular Expression Complexity (CWE-1333)
value: A vulnerability was found in mholt PapaParse up to 5.1.x. It has been classified as problematic. Affected is an unknown function of the file papaparse.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 5.2.0 is able to address this issue. The name of the patch is 235a12758cd77266d2e98fd715f53536b34ad621. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218004.
CWE description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CVSS v3 base score: 7.5
Published: 2023-01-11T15:15Z
Repository: https://github.com/mholt/PapaParse
Language: JavaScript
Files changed: papaparse.js
Commit date: 2020-04-02 15:12:02 +0200
Commit message: Avoid ReDOS on float dynamic typing (#779)

Fixes #777 
Diff: diff --git a/papaparse.js b/papaparse.js
index 7380a88..6c358e9 100755
--- a/papaparse.js
+++ b/papaparse.js
@@ -1004,11 +1004,11 @@ License: MIT
 	function ParserHandle(_config)
 	{
 		// One goal is to minimize the use of regular expressions...
 		var MAX_FLOAT = Math.pow(2, 53);
 		var MIN_FLOAT = -MAX_FLOAT;
-		var FLOAT = /^\s*-?(\d*\.?\d+|\d+\.?\d*)(e[-+]?\d+)?\s*$/i;
+		var FLOAT = /^\s*-?(\d+\.?|\.\d+|\d+\.\d+)(e[-+]?\d+)?\s*$/;
 		var ISO_DATE = /(\d{4}-[01]\d-[0-3]\dT[0-2]\d:[0-5]\d:[0-5]\d\.\d+([+-][0-2]\d:[0-5]\d|Z))|(\d{4}-[01]\d-[0-3]\dT[0-2]\d:[0-5]\d:[0-5]\d([+-][0-2]\d:[0-5]\d|Z))|(\d{4}-[01]\d-[0-3]\dT[0-2]\d:[0-5]\d([+-][0-2]\d:[0-5]\d|Z))/;
 		var self = this;
 		var _stepCounter = 0;	// Number of times step was called (number of rows parsed)
 		var _rowCounter = 0;	// Number of rows that have been parsed so far
 		var _input;				// The input being parsed

Vulnerable code: 		var FLOAT = /^\s*-?(\d*\.?\d+|\d+\.?\d*)(e[-+]?\d+)?\s*$/i;
Fixed code: 		var FLOAT = /^\s*-?(\d+\.?|\.\d+|\d+\.\d+)(e[-+]?\d+)?\s*$/;
CVE-2017-6390: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: An issue was discovered in whatanime.ga before c334dd8499a681587dd4199e90b0aa0eba814c1d. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "whatanime.ga-master/index.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-03-02T06:59Z
Repository: https://github.com/soruly/whatanime.ga
Language: PHP
Files changed: index.php
Commit date: 2017-02-28 11:41:22 +0800
Commit message: Fix #8 XSS issue

Diff: diff --git a/index.php b/index.php
index 90ae205..524fa31 100755
--- a/index.php
+++ b/index.php
@@ -119,11 +119,11 @@ Official Telegram Bot available <a href="https://telegram.me/WhatAnimeBot">@What
 <script src="/jquery-2.1.1.min.js"></script>
 <script src="/js/bootstrap.min.js"></script>
 <script src="/jquery.html5uploader.min.js"></script>
 <script src="/index.js"></script>
 <?php
-if(isset($_GET["url"])){
+if(isset($_GET["url"]) && filter_var($_GET["url"], FILTER_VALIDATE_URL)){
 echo '<script>
 document.querySelector("#autoSearch").checked = true;
 document.querySelector("#messageText").classList.remove("error");
 document.querySelector("#messageText").classList.remove("success");
 document.querySelector("#messageText").innerHTML = \'<span class="glyphicon glyphicon-repeat spinning"></span>\';

Vulnerable code: if(isset($_GET["url"])){
Fixed code: if(isset($_GET["url"]) && filter_var($_GET["url"], FILTER_VALIDATE_URL)){
CVE-2024-39313: Insufficient Information (NVD-CWE-noinfo)
value: toy-blog is a headless content management system implementation. Starting in version 0.5.4 and prior to version 0.6.1, articles with private visibility can be read if the reader does not set credentials for the request. Users should upgrade to 0.6.1 or later to receive a patch. No known workarounds are available.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-07-01T22:15Z
Repository: https://github.com/KisaragiEffective/toy-blog
Language: Rust
Files changed: packages/toy-blog/src/service/rest/api/article.rs, packages/toy-blog/src/service/rest/repository.rs
Commit date: 2024-07-02 00:00:32 +0900
Commit message: fix: `GET /article/{id}` に認証トークンを与えないと非公開の記事を閲覧できてしまうバグを修正

Diff: diff --git a/packages/toy-blog/src/service/rest/api/article.rs b/packages/toy-blog/src/service/rest/api/article.rs
index 66707e4..48da92a 100644
--- a/packages/toy-blog/src/service/rest/api/article.rs
+++ b/packages/toy-blog/src/service/rest/api/article.rs
@@ -89,12 +89,12 @@ pub async fn fetch(path: Path<String>, auth: Option<BearerAuth>) -> impl Respond
             Ok(content) => content,
             Err(e) => return Res::Internal(UnhandledError::new(e))
         };
 
         // Visibility::Restricted, Visibility::Publicは検証不要
-        if let (Visibility::Private, Some(auth)) = (content.visibility, auth) {
-            if is_wrong_token(auth.token()) {
+        if content.visibility == Visibility::Private {
+            if auth.map_or(true, |auth| is_wrong_token(auth.token())) {
                 return Res::General(GetArticleError::NoSuchArticleFoundById)
             }
             // now, private article can see from permitted user!
         }
 
diff --git a/packages/toy-blog/src/service/rest/repository.rs b/packages/toy-blog/src/service/rest/repository.rs
index bd62193..d87bb52 100644
--- a/packages/toy-blog/src/service/rest/repository.rs
+++ b/packages/toy-blog/src/service/rest/repository.rs
@@ -1,5 +1,6 @@
+use std::collections::HashMap;
 use once_cell::sync::OnceCell;
 use crate::service::persistence::ArticleRepository;
 
 // FIXME: OnceCell
 pub static GLOBAL_ARTICLE_REPOSITORY: OnceCell<ArticleRepository> = OnceCell::new();

Vulnerable code:         if let (Visibility::Private, Some(auth)) = (content.visibility, auth) {
            if is_wrong_token(auth.token()) {
Fixed code:         if content.visibility == Visibility::Private {
            if auth.map_or(true, |auth| is_wrong_token(auth.token())) {
use std::collections::HashMap;
CVE-2024-5569: Uncontrolled Resource Consumption (CWE-400)
value: A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the third-party zipp library are later merged into CPython, and the affected code is identical in both projects. The infinite loop can be initiated through the use of functions affecting the `Path` module in both zipp and zipfile, such as `joinpath`, the overloaded division operator, and `iterdir`. Although the infinite loop is not resource exhaustive, it prevents the application from responding. The vulnerability was addressed in version 3.19.1 of jaraco/zipp.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Published: 2024-07-09T00:15Z
Repository: https://github.com/jaraco/zipp
Language: Unknown
Commit date: 2024-05-31 12:31:40 -0400
Commit message: Merge pull request #120 from jaraco/bugfix/119-malformed-paths

Sanitize malformed paths
CVE-2019-10776: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: In "index.js" file line 240, the run command executes the git command with a user controlled variable called remoteUrl. This affects git-diff-apply all versions prior to 0.22.2.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2020-01-07T19:15Z
Repository: https://github.com/kellyselden/git-diff-apply
Language: JavaScript
Files changed: src/index.js
Commit date: 2020-01-06 12:23:18 +0000
Commit message: spawn git clone

to prevent injecting a command

Diff: diff --git a/src/index.js b/src/index.js
index a0d19aa..d02f754 100644
--- a/src/index.js
+++ b/src/index.js
@@ -16,10 +16,11 @@ const checkOutTag = require('./check-out-tag');
 const convertToObj = require('./convert-to-obj');
 const resolveConflicts = require('./resolve-conflicts');
 const commitAndTag = require('./commit-and-tag');
 const gitRemoveAll = require('./git-remove-all');
 const createCustomRemote = require('./create-custom-remote');
+const { runWithSpawn } = require('./run');
 
 const { isGitClean } = gitStatus;
 const { gitConfigInit } = gitInit;
 
 const tempBranchName = uuidv1();
@@ -220,11 +221,11 @@ module.exports = async function gitDiffApply({
     }
 
     _tmpDir = await tmpDir();
     tmpWorkingDir = _tmpDir;
 
-    await utils.run(`git clone ${remoteUrl} ${_tmpDir}`);
+    await runWithSpawn('git', ['clone', remoteUrl, _tmpDir]);
 
     // needed because we are going to be committing in here
     await gitConfigInit({ cwd: _tmpDir });
 
     returnObject = await buildReturnObject();

Vulnerable code:     await utils.run(`git clone ${remoteUrl} ${_tmpDir}`);
Fixed code: const { runWithSpawn } = require('./run');
    await runWithSpawn('git', ['clone', remoteUrl, _tmpDir]);
CVE-2016-5851: Improper Restriction of XML External Entity Reference (CWE-611)
value: python-docx before 0.8.6 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted document.
CWE description: The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVSS v3 base score: 8.8
Published: 2016-12-21T22:59Z
Repository: https://github.com/python-openxml/python-docx
Language: Python
Files changed: docx/opc/oxml.py, docx/oxml/__init__.py
Commit date: 2016-04-09 18:31:57 -0700
Commit message: oxml: don't resolve XML entities in oxml_parser

Resolving entities in the XML is not required by the Open XML standard
and represents a security vulnerability. Turn off entity resolution in
both the opc (package) parser and the part parser.

Diff: diff --git a/docx/opc/oxml.py b/docx/opc/oxml.py
index 0c09312..494b31d 100644
--- a/docx/opc/oxml.py
+++ b/docx/opc/oxml.py
@@ -14,11 +14,11 @@ from lxml import etree
 from .constants import NAMESPACE as NS, RELATIONSHIP_TARGET_MODE as RTM
 
 
 # configure XML parser
 element_class_lookup = etree.ElementNamespaceClassLookup()
-oxml_parser = etree.XMLParser(remove_blank_text=True)
+oxml_parser = etree.XMLParser(remove_blank_text=True, resolve_entities=False)
 oxml_parser.set_element_class_lookup(element_class_lookup)
 
 nsmap = {
     'ct': NS.OPC_CONTENT_TYPES,
     'pr': NS.OPC_RELATIONSHIPS,
diff --git a/docx/oxml/__init__.py b/docx/oxml/__init__.py
index 3e320a2..a96cfc1 100644
--- a/docx/oxml/__init__.py
+++ b/docx/oxml/__init__.py
@@ -12,11 +12,11 @@ from lxml import etree
 from .ns import NamespacePrefixedTag, nsmap
 
 
 # configure XML parser
 element_class_lookup = etree.ElementNamespaceClassLookup()
-oxml_parser = etree.XMLParser(remove_blank_text=True)
+oxml_parser = etree.XMLParser(remove_blank_text=True, resolve_entities=False)
 oxml_parser.set_element_class_lookup(element_class_lookup)
 
 
 def parse_xml(xml):
     """

Vulnerable code: oxml_parser = etree.XMLParser(remove_blank_text=True)
oxml_parser = etree.XMLParser(remove_blank_text=True)
Fixed code: oxml_parser = etree.XMLParser(remove_blank_text=True, resolve_entities=False)
oxml_parser = etree.XMLParser(remove_blank_text=True, resolve_entities=False)
CVE-2013-4118: NULL Pointer Dereference (CWE-476)
value: FreeRDP before 1.1.0-beta1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2016-10-03T21:59Z
Repository: https://github.com/FreeRDP/FreeRDP
Language: C
Files changed: libfreerdp/core/rdp.c, libfreerdp/core/security.c
Commit date: 2013-03-05 15:08:03 +0800
Commit message: security: add a NULL pointer check to fix a server crash.

Diff: diff --git a/libfreerdp/core/rdp.c b/libfreerdp/core/rdp.c
index 544a9dd9..7eecc688 100644
--- a/libfreerdp/core/rdp.c
+++ b/libfreerdp/core/rdp.c
@@ -715,11 +715,12 @@ BOOL rdp_decrypt(rdpRdp* rdp, STREAM* s, int length, UINT16 securityFlags)
 	if (stream_get_left(s) < 8)
 		return FALSE;
 
 	stream_read(s, wmac, sizeof(wmac));
 	length -= sizeof(wmac);
-	security_decrypt(s->p, length, rdp);
+	if (!security_decrypt(s->p, length, rdp))
+		return FALSE;
 
 	if (securityFlags & SEC_SECURE_CHECKSUM)
 		security_salted_mac_signature(rdp, s->p, length, FALSE, cmac);
 	else
 		security_mac_signature(rdp, s->p, length, cmac);
diff --git a/libfreerdp/core/security.c b/libfreerdp/core/security.c
index 8511d8d0..83298fdd 100644
--- a/libfreerdp/core/security.c
+++ b/libfreerdp/core/security.c
@@ -490,10 +490,12 @@ BOOL security_encrypt(BYTE* data, int length, rdpRdp* rdp)
 	return TRUE;
 }
 
 BOOL security_decrypt(BYTE* data, int length, rdpRdp* rdp)
 {
+	if (rdp->rc4_decrypt_key == NULL)
+		return FALSE;
 	if (rdp->decrypt_use_count >= 4096)
 	{
 		security_key_update(rdp->decrypt_key, rdp->decrypt_update_key, rdp->rc4_key_len);
 		crypto_rc4_free(rdp->rc4_decrypt_key);
 		rdp->rc4_decrypt_key = crypto_rc4_init(rdp->decrypt_key, rdp->rc4_key_len);

Vulnerable code: 	security_decrypt(s->p, length, rdp);
Fixed code: 	if (!security_decrypt(s->p, length, rdp))
		return FALSE;
	if (rdp->rc4_decrypt_key == NULL)
		return FALSE;
CVE-2018-8786: Incorrect Conversion between Numeric Types (CWE-681)
value: FreeRDP prior to version 2.0.0-rc4 contains an Integer Truncation that leads to a Heap-Based Buffer Overflow in function update_read_bitmap_update() and results in a memory corruption and probably even a remote code execution.
CWE description: When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
CVSS v3 base score: 9.8
Published: 2018-11-29T18:29Z
Repository: https://github.com/FreeRDP/FreeRDP
Language: C
Files changed: libfreerdp/core/update.c
Commit date: 2018-11-20 11:08:31 +0100
Commit message: Fixed CVE-2018-8786

Thanks to Eyal Itkin from Check Point Software Technologies.

Diff: diff --git a/libfreerdp/core/update.c b/libfreerdp/core/update.c
index 5e0757dcb..c2ca42cc4 100644
--- a/libfreerdp/core/update.c
+++ b/libfreerdp/core/update.c
@@ -206,15 +206,13 @@ BITMAP_UPDATE* update_read_bitmap_update(rdpUpdate* update, wStream* s)
 	Stream_Read_UINT16(s, bitmapUpdate->number); /* numberRectangles (2 bytes) */
 	WLog_Print(update->log, WLOG_TRACE, "BitmapUpdate: %"PRIu32"", bitmapUpdate->number);
 
 	if (bitmapUpdate->number > bitmapUpdate->count)
 	{
-		UINT16 count;
-		BITMAP_DATA* newdata;
-		count = bitmapUpdate->number * 2;
-		newdata = (BITMAP_DATA*) realloc(bitmapUpdate->rectangles,
-		                                 sizeof(BITMAP_DATA) * count);
+		UINT32 count = bitmapUpdate->number * 2;
+		BITMAP_DATA* newdata = (BITMAP_DATA*) realloc(bitmapUpdate->rectangles,
+		                       sizeof(BITMAP_DATA) * count);
 
 		if (!newdata)
 			goto fail;
 
 		bitmapUpdate->rectangles = newdata;

Vulnerable code: 		UINT16 count;
		BITMAP_DATA* newdata;
		count = bitmapUpdate->number * 2;
		newdata = (BITMAP_DATA*) realloc(bitmapUpdate->rectangles,
		                                 sizeof(BITMAP_DATA) * count);
Fixed code: 		UINT32 count = bitmapUpdate->number * 2;
		BITMAP_DATA* newdata = (BITMAP_DATA*) realloc(bitmapUpdate->rectangles,
		                       sizeof(BITMAP_DATA) * count);
CVE-2018-8786: Out-of-bounds Write (CWE-787)
value: FreeRDP prior to version 2.0.0-rc4 contains an Integer Truncation that leads to a Heap-Based Buffer Overflow in function update_read_bitmap_update() and results in a memory corruption and probably even a remote code execution.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2018-11-29T18:29Z
Repository: https://github.com/FreeRDP/FreeRDP
Language: C
Files changed: libfreerdp/core/update.c
Commit date: 2018-11-20 11:08:31 +0100
Commit message: Fixed CVE-2018-8786

Thanks to Eyal Itkin from Check Point Software Technologies.

Diff: diff --git a/libfreerdp/core/update.c b/libfreerdp/core/update.c
index 5e0757dcb..c2ca42cc4 100644
--- a/libfreerdp/core/update.c
+++ b/libfreerdp/core/update.c
@@ -206,15 +206,13 @@ BITMAP_UPDATE* update_read_bitmap_update(rdpUpdate* update, wStream* s)
 	Stream_Read_UINT16(s, bitmapUpdate->number); /* numberRectangles (2 bytes) */
 	WLog_Print(update->log, WLOG_TRACE, "BitmapUpdate: %"PRIu32"", bitmapUpdate->number);
 
 	if (bitmapUpdate->number > bitmapUpdate->count)
 	{
-		UINT16 count;
-		BITMAP_DATA* newdata;
-		count = bitmapUpdate->number * 2;
-		newdata = (BITMAP_DATA*) realloc(bitmapUpdate->rectangles,
-		                                 sizeof(BITMAP_DATA) * count);
+		UINT32 count = bitmapUpdate->number * 2;
+		BITMAP_DATA* newdata = (BITMAP_DATA*) realloc(bitmapUpdate->rectangles,
+		                       sizeof(BITMAP_DATA) * count);
 
 		if (!newdata)
 			goto fail;
 
 		bitmapUpdate->rectangles = newdata;

Vulnerable code: 		UINT16 count;
		BITMAP_DATA* newdata;
		count = bitmapUpdate->number * 2;
		newdata = (BITMAP_DATA*) realloc(bitmapUpdate->rectangles,
		                                 sizeof(BITMAP_DATA) * count);
Fixed code: 		UINT32 count = bitmapUpdate->number * 2;
		BITMAP_DATA* newdata = (BITMAP_DATA*) realloc(bitmapUpdate->rectangles,
		                       sizeof(BITMAP_DATA) * count);
CVE-2018-8787: Integer Overflow or Wraparound (CWE-190)
value: FreeRDP prior to version 2.0.0-rc4 contains an Integer Overflow that leads to a Heap-Based Buffer Overflow in function gdi_Bitmap_Decompress() and results in a memory corruption and probably even a remote code execution.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 9.8
Published: 2018-11-29T18:29Z
Repository: https://github.com/FreeRDP/FreeRDP
Language: C
Files changed: libfreerdp/gdi/graphics.c
Commit date: 2018-11-20 11:08:31 +0100
Commit message: Fixed CVE-2018-8787

Thanks to Eyal Itkin from Check Point Software Technologies.

Diff: diff --git a/libfreerdp/gdi/graphics.c b/libfreerdp/gdi/graphics.c
index 4afae48d1..159198756 100644
--- a/libfreerdp/gdi/graphics.c
+++ b/libfreerdp/gdi/graphics.c
@@ -139,13 +139,21 @@ static BOOL gdi_Bitmap_Decompress(rdpContext* context, rdpBitmap* bitmap,
                                   UINT32 bpp, UINT32 length, BOOL compressed,
                                   UINT32 codecId)
 {
 	UINT32 SrcSize = length;
 	rdpGdi* gdi = context->gdi;
+	UINT32 size = DstWidth * DstHeight;
 	bitmap->compressed = FALSE;
 	bitmap->format = gdi->dstFormat;
-	bitmap->length = DstWidth * DstHeight * GetBytesPerPixel(bitmap->format);
+
+	if ((GetBytesPerPixel(bitmap->format) == 0) ||
+	    (DstWidth == 0) || (DstHeight == 0) || (DstWidth > UINT32_MAX / DstHeight) ||
+	    (size > (UINT32_MAX / GetBytesPerPixel(bitmap->format))))
+		return FALSE;
+
+	size *= GetBytesPerPixel(bitmap->format);
+	bitmap->length = size;
 	bitmap->data = (BYTE*) _aligned_malloc(bitmap->length, 16);
 
 	if (!bitmap->data)
 		return FALSE;
 

Vulnerable code: 	bitmap->length = DstWidth * DstHeight * GetBytesPerPixel(bitmap->format);
Fixed code: 	UINT32 size = DstWidth * DstHeight;

	if ((GetBytesPerPixel(bitmap->format) == 0) ||
	    (DstWidth == 0) || (DstHeight == 0) || (DstWidth > UINT32_MAX / DstHeight) ||
	    (size > (UINT32_MAX / GetBytesPerPixel(bitmap->format))))
		return FALSE;

	size *= GetBytesPerPixel(bitmap->format);
	bitmap->length = size;
CVE-2018-8787: Out-of-bounds Write (CWE-787)
value: FreeRDP prior to version 2.0.0-rc4 contains an Integer Overflow that leads to a Heap-Based Buffer Overflow in function gdi_Bitmap_Decompress() and results in a memory corruption and probably even a remote code execution.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2018-11-29T18:29Z
Repository: https://github.com/FreeRDP/FreeRDP
Language: C
Files changed: libfreerdp/gdi/graphics.c
Commit date: 2018-11-20 11:08:31 +0100
Commit message: Fixed CVE-2018-8787

Thanks to Eyal Itkin from Check Point Software Technologies.

Diff: diff --git a/libfreerdp/gdi/graphics.c b/libfreerdp/gdi/graphics.c
index 4afae48d1..159198756 100644
--- a/libfreerdp/gdi/graphics.c
+++ b/libfreerdp/gdi/graphics.c
@@ -139,13 +139,21 @@ static BOOL gdi_Bitmap_Decompress(rdpContext* context, rdpBitmap* bitmap,
                                   UINT32 bpp, UINT32 length, BOOL compressed,
                                   UINT32 codecId)
 {
 	UINT32 SrcSize = length;
 	rdpGdi* gdi = context->gdi;
+	UINT32 size = DstWidth * DstHeight;
 	bitmap->compressed = FALSE;
 	bitmap->format = gdi->dstFormat;
-	bitmap->length = DstWidth * DstHeight * GetBytesPerPixel(bitmap->format);
+
+	if ((GetBytesPerPixel(bitmap->format) == 0) ||
+	    (DstWidth == 0) || (DstHeight == 0) || (DstWidth > UINT32_MAX / DstHeight) ||
+	    (size > (UINT32_MAX / GetBytesPerPixel(bitmap->format))))
+		return FALSE;
+
+	size *= GetBytesPerPixel(bitmap->format);
+	bitmap->length = size;
 	bitmap->data = (BYTE*) _aligned_malloc(bitmap->length, 16);
 
 	if (!bitmap->data)
 		return FALSE;
 

Vulnerable code: 	bitmap->length = DstWidth * DstHeight * GetBytesPerPixel(bitmap->format);
Fixed code: 	UINT32 size = DstWidth * DstHeight;

	if ((GetBytesPerPixel(bitmap->format) == 0) ||
	    (DstWidth == 0) || (DstHeight == 0) || (DstWidth > UINT32_MAX / DstHeight) ||
	    (size > (UINT32_MAX / GetBytesPerPixel(bitmap->format))))
		return FALSE;

	size *= GetBytesPerPixel(bitmap->format);
	bitmap->length = size;
CVE-2020-11042: Out-of-bounds Read (CWE-125)
value: In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info. It allows reading a attacker-defined amount of client memory (32bit unsigned -> 4GB) to an intermediate buffer. This can be used to crash the client or store information for later retrieval. This has been patched in 2.0.0.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.9
Published: 2020-05-07T19:15Z
Repository: https://github.com/FreeRDP/FreeRDP
Language: C
Files changed: libfreerdp/core/window.c
Commit date: 2020-04-02 17:34:02 +0200
Commit message: Fix #6010: Check length in read_icon_info

Diff: diff --git a/libfreerdp/core/window.c b/libfreerdp/core/window.c
index b56fc1bc2d..40a5ecc82e 100644
--- a/libfreerdp/core/window.c
+++ b/libfreerdp/core/window.c
@@ -134,13 +134,10 @@ static BOOL update_read_icon_info(wStream* s, ICON_INFO* iconInfo)
 		return FALSE;
 
 	Stream_Read_UINT16(s, iconInfo->cbBitsMask);  /* cbBitsMask (2 bytes) */
 	Stream_Read_UINT16(s, iconInfo->cbBitsColor); /* cbBitsColor (2 bytes) */
 
-	if (Stream_GetRemainingLength(s) < iconInfo->cbBitsMask + iconInfo->cbBitsColor)
-		return FALSE;
-
 	/* bitsMask */
 	newBitMask = (BYTE*)realloc(iconInfo->bitsMask, iconInfo->cbBitsMask);
 
 	if (!newBitMask)
 	{
@@ -148,10 +145,12 @@ static BOOL update_read_icon_info(wStream* s, ICON_INFO* iconInfo)
 		iconInfo->bitsMask = NULL;
 		return FALSE;
 	}
 
 	iconInfo->bitsMask = newBitMask;
+	if (Stream_GetRemainingLength(s) < iconInfo->cbBitsMask)
+		return FALSE;
 	Stream_Read(s, iconInfo->bitsMask, iconInfo->cbBitsMask);
 
 	/* colorTable */
 	if (iconInfo->colorTable == NULL)
 	{
@@ -182,11 +181,15 @@ static BOOL update_read_icon_info(wStream* s, ICON_INFO* iconInfo)
 		free(iconInfo->colorTable);
 		iconInfo->colorTable = NULL;
 	}
 
 	if (iconInfo->colorTable)
+	{
+		if (Stream_GetRemainingLength(s) < iconInfo->cbColorTable)
+			return FALSE;
 		Stream_Read(s, iconInfo->colorTable, iconInfo->cbColorTable);
+	}
 
 	/* bitsColor */
 	newBitMask = (BYTE*)realloc(iconInfo->bitsColor, iconInfo->cbBitsColor);
 
 	if (!newBitMask)
@@ -195,10 +198,12 @@ static BOOL update_read_icon_info(wStream* s, ICON_INFO* iconInfo)
 		iconInfo->bitsColor = NULL;
 		return FALSE;
 	}
 
 	iconInfo->bitsColor = newBitMask;
+	if (Stream_GetRemainingLength(s) < iconInfo->cbBitsColor)
+		return FALSE;
 	Stream_Read(s, iconInfo->bitsColor, iconInfo->cbBitsColor);
 	return TRUE;
 }
 
 static BOOL update_read_cached_icon_info(wStream* s, CACHED_ICON_INFO* cachedIconInfo)

Vulnerable code: 	if (Stream_GetRemainingLength(s) < iconInfo->cbBitsMask + iconInfo->cbBitsColor)
		return FALSE;

Fixed code: 	if (Stream_GetRemainingLength(s) < iconInfo->cbBitsMask)
		return FALSE;
	{
		if (Stream_GetRemainingLength(s) < iconInfo->cbColorTable)
			return FALSE;
	}
	if (Stream_GetRemainingLength(s) < iconInfo->cbBitsColor)
		return FALSE;
CVE-2020-11044: Double Free (CWE-415)
value: In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes the client application if corrupted data from a manipulated server is parsed. This has been patched in 2.0.0.
CWE description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CVSS v3 base score: 2.2
Published: 2020-05-07T19:15Z
Repository: https://github.com/FreeRDP/FreeRDP
Language: C
Files changed: libfreerdp/core/orders.c
Commit date: 2020-04-02 17:33:54 +0200
Commit message: Fixed #6013: Check new length is > 0

Diff: diff --git a/libfreerdp/core/orders.c b/libfreerdp/core/orders.c
index 3d338eb29a..fb8c3776e1 100644
--- a/libfreerdp/core/orders.c
+++ b/libfreerdp/core/orders.c
@@ -2159,11 +2159,11 @@ static CACHE_BITMAP_V3_ORDER* update_read_cache_bitmap_v3_order(rdpUpdate* updat
 	Stream_Read_UINT8(s, bitmapData->codecID); /* codecID (1 byte) */
 	Stream_Read_UINT16(s, bitmapData->width);  /* width (2 bytes) */
 	Stream_Read_UINT16(s, bitmapData->height); /* height (2 bytes) */
 	Stream_Read_UINT32(s, new_len);            /* length (4 bytes) */
 
-	if (Stream_GetRemainingLength(s) < new_len)
+	if ((new_len == 0) || (Stream_GetRemainingLength(s) < new_len))
 		goto fail;
 
 	new_data = (BYTE*)realloc(bitmapData->data, new_len);
 
 	if (!new_data)

Vulnerable code: 	if (Stream_GetRemainingLength(s) < new_len)
Fixed code: 	if ((new_len == 0) || (Stream_GetRemainingLength(s) < new_len))