Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2023-35160: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the resubmit template to perform a XSS, e.g. by using URL such as: > xwiki/bin/view/XWiki/Main xpage=resubmit&resubmit=javascript:alert(document.domain)&xback=javascript:alert(document.domain). This vulnerability exists since XWiki 2.5-milestone-2. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-06-23T19:15Z
Repository: https://github.com/xwiki/xwiki-platform
Language: Other
Files changed: xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/resubmit.vm
Commit date: 2023-02-03 17:09:31 +0100
Commit message: XWIKI-20343: Sanitize template URLs

Diff: diff --git a/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/resubmit.vm b/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/resubmit.vm
index 5b174e67aa5c3..e9f3870e1e4fa 100644
--- a/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/resubmit.vm
+++ b/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/resubmit.vm
@@ -27,12 +27,12 @@ $response.setStatus(401)##
 $response.addHeader( "X-FRAME-OPTIONS", "DENY" )
 #template("startpage.vm")
 <div class="main layoutsubsection">
 <div id="mainContentArea">
 #xwikimessageboxstart($services.localization.render('warning') $services.localization.render('csrf.confirmation'))
-#set($resubmit = "$!{escapetool.xml($request.getParameter('resubmit'))}")
-#set($xback = "$!{escapetool.xml($request.getParameter('xback'))}")
+#getSanitizedURLAttributeValue('form','action', $request.getParameter('resubmit'), '', $resubmit)
+#getSanitizedURLAttributeValue('a','href', $request.getParameter('xback'), $doc.getURL(), $xback)
 <form action="$resubmit" method="post">
   <div class="hidden">
     ## Valid CSRF token
     <input type="hidden" name="form_token" value="$!{services.csrf.getToken()}" />
   </div>

Vulnerable code: #set($resubmit = "$!{escapetool.xml($request.getParameter('resubmit'))}")
#set($xback = "$!{escapetool.xml($request.getParameter('xback'))}")
Fixed code: #getSanitizedURLAttributeValue('form','action', $request.getParameter('resubmit'), '', $resubmit)
#getSanitizedURLAttributeValue('a','href', $request.getParameter('xback'), $doc.getURL(), $xback)
CVE-2023-35161: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the DeleteApplication page to perform a XSS, e.g. by using URL such as: > xwiki/bin/view/AppWithinMinutes/DeleteApplication?appName=Menu&resolve=true&xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 6.2-milestone-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.

CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-06-23T19:15Z
Repository: https://github.com/xwiki/xwiki-platform
Language: XML
Files changed: xwiki-platform-core/xwiki-platform-appwithinminutes/xwiki-platform-appwithinminutes-ui/src/main/resources/AppWithinMinutes/DeleteApplication.xml
Commit date: 2023-02-03 16:47:46 +0100
Commit message: XWIKI-20614: Sanitize template URLs

Diff: diff --git a/xwiki-platform-core/xwiki-platform-appwithinminutes/xwiki-platform-appwithinminutes-ui/src/main/resources/AppWithinMinutes/DeleteApplication.xml b/xwiki-platform-core/xwiki-platform-appwithinminutes/xwiki-platform-appwithinminutes-ui/src/main/resources/AppWithinMinutes/DeleteApplication.xml
index a753afec57e93..b616181d17542 100644
--- a/xwiki-platform-core/xwiki-platform-appwithinminutes/xwiki-platform-appwithinminutes-ui/src/main/resources/AppWithinMinutes/DeleteApplication.xml
+++ b/xwiki-platform-core/xwiki-platform-appwithinminutes/xwiki-platform-appwithinminutes-ui/src/main/resources/AppWithinMinutes/DeleteApplication.xml
@@ -90,12 +90,13 @@
     'scope': $scope,
     'confirm': 1,
     'form_token': $services.csrf.token
   })
   #if ("$!request.xredirect" != '')
-    #set ($cancelURL = $request.xredirect)
-    #set ($confirmParams.xredirect = $cancelURL)
+    #getSanitizedURLAttributeValue('a','href',$request.xredirect,$doc.getURL(),$cancelURL)
+    ## We don't sanitize those parameters as the sanitation will be handled server side.
+    #set ($confirmParams.xredirect = $request.xredirect)
   #end
   #set ($confirmURL = $doc.getURL($xcontext.action, $escapetool.url($confirmParams)))
   {{html}}
   #xwikimessagebox($services.localization.render('core.delete') $confirmationMessage $confirmURL
     $escapetool.xml($cancelURL) $services.localization.render('yes') $services.localization.render('no'))

Vulnerable code:     #set ($cancelURL = $request.xredirect)
    #set ($confirmParams.xredirect = $cancelURL)
Fixed code:     #getSanitizedURLAttributeValue('a','href',$request.xredirect,$doc.getURL(),$cancelURL)
    ## We don't sanitize those parameters as the sanitation will be handled server side.
    #set ($confirmParams.xredirect = $request.xredirect)
CVE-2023-46732: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to reflected cross-site scripting (RXSS) via the `rev` parameter that is used in the content of the content menu without escaping. If an attacker can convince a user to visit a link with a crafted parameter, this allows the attacker to execute arbitrary actions in the name of the user, including remote code (Groovy) execution in the case of a user with programming right, compromising the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 15.6 RC1, 15.5.1 and 14.10.14. The patch in commit `04e325d57` can be manually applied without upgrading (or restarting) the instance. Users are advised to upgrade or to manually apply the patch. There are no known workarounds for this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-11-06T19:15Z
Repository: https://github.com/xwiki/xwiki-platform
Language: Other
Files changed: xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/menus_content.vm
Commit date: 2023-07-10 13:39:11 +0200
Commit message: XWIKI-21095: Improve revision handling in code viewer menu item

Diff: diff --git a/xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/menus_content.vm b/xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/menus_content.vm
index 675882009c6b2..995b3a74a9270 100644
--- a/xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/menus_content.vm
+++ b/xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/menus_content.vm
@@ -433,11 +433,11 @@
         #submenuheader('core.menu.actions.viewers')
         ##
         ## VIEW SOURCE
         ##
         #if ("$!request.rev" != '')
-          #set ($revisionParameter = "&rev=$request.rev")
+          #set ($revisionParameter = "&rev=$escapetool.url($request.rev)")
         #end
         #submenuitem($doc.getURL('view', "viewer=code$!{revisionParameter}") $services.localization.render('core.menu.view.source') 'tmViewSource', '', 'search', $extraAttributes)
         $viewersContent
         ## Display Viewers menu UIX..
         #displaySecureUIX('org.xwiki.platform.template.menu.viewers', [])

Vulnerable code:           #set ($revisionParameter = "&rev=$request.rev")
Fixed code:           #set ($revisionParameter = "&rev=$escapetool.url($request.rev)")
CVE-2023-50732: Incorrect Authorization (CWE-863)
value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute a Velocity script without script right through the document tree. This has been patched in XWiki 14.10.7 and 15.2RC1.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 6.3
Published: 2023-12-21T20:15Z
Repository: https://github.com/xwiki/xwiki-platform
Language: XML
Files changed: xwiki-platform-core/xwiki-platform-index/xwiki-platform-index-tree/xwiki-platform-index-tree-macro/src/main/resources/XWiki/DocumentTreeMacros.xml
Commit date: 2023-03-08 16:49:30 +0100
Commit message: XWIKI-20625: Improve document title display in the document tree

Diff: diff --git a/xwiki-platform-core/xwiki-platform-index/xwiki-platform-index-tree/xwiki-platform-index-tree-macro/src/main/resources/XWiki/DocumentTreeMacros.xml b/xwiki-platform-core/xwiki-platform-index/xwiki-platform-index-tree/xwiki-platform-index-tree-macro/src/main/resources/XWiki/DocumentTreeMacros.xml
index 59d980ac0350d..8fe0ec89c4aab 100644
--- a/xwiki-platform-core/xwiki-platform-index/xwiki-platform-index-tree/xwiki-platform-index-tree-macro/src/main/resources/XWiki/DocumentTreeMacros.xml
+++ b/xwiki-platform-core/xwiki-platform-index/xwiki-platform-index-tree/xwiki-platform-index-tree-macro/src/main/resources/XWiki/DocumentTreeMacros.xml
@@ -352,14 +352,10 @@
   #set ($canViewDoc = $services.security.authorization.hasAccess('view', $documentReference))
   #set ($canDeleteDoc = $services.security.authorization.hasAccess('delete', $documentReference))
   #if ($canViewDoc &amp;&amp; $docTreeConfig.showDocumentTitle)
     ## Display the translated title.
     #set ($translatedDocument = $xwiki.getDocument($documentReference).translatedDocument)
-    ## Make sure the displayed title is not affected by the sheet request parameter (e.g. when $translatedDocument is
-    ## the current document). By setting the title (even if we don't change it) the internal document instance is cloned
-    ## so it's going to be different than the current document instance (which is the target of the sheet parameter).
-    #set ($discard = $translatedDocument.setTitle($translatedDocument.title))
     #set ($plainTitle = $translatedDocument.plainTitle)
     #if (!$stringtool.isBlank($plainTitle))
       #set ($label = $plainTitle)
     #end
   #end

Vulnerable code:     ## Make sure the displayed title is not affected by the sheet request parameter (e.g. when $translatedDocument is
    ## the current document). By setting the title (even if we don't change it) the internal document instance is cloned
    ## so it's going to be different than the current document instance (which is the target of the sheet parameter).
    #set ($discard = $translatedDocument.setTitle($translatedDocument.title))
CVE-2024-31984: Insufficient Information (NVD-CWE-noinfo)
value: XWiki Platform is a generic wiki platform. Starting in version 7.2-rc-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, by creating a document with a specially crafted title, it is possible to trigger remote code execution in the (Solr-based) search in XWiki. This allows any user who can edit the title of a space (all users by default) to execute any Groovy code in the XWiki installation which compromises the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 14.10.20, 15.5.4 and 15.10 RC1. As a workaround, manually apply the patch to the `Main.SolrSpaceFacet` page.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-10T20:15Z
Repository: https://github.com/xwiki/xwiki-platform
Language: XML
Files changed: xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/pom.xml
Commit date: 2023-11-09 11:22:03 +0100
Commit message: XWIKI-21471: Improve Maven profile filtering

Diff: diff --git a/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/pom.xml b/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/pom.xml
index 9b41fddfccbff..0aa2793b7e469 100644
--- a/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/pom.xml
+++ b/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/pom.xml
@@ -37,18 +37,13 @@
     <!-- Don't run Checkstyle in test modules -->
     <xwiki.checkstyle.skip>true</xwiki.checkstyle.skip>
   </properties>
   <modules>
     <module>xwiki-platform-search-solr-test-pageobjects</module>
+    <module>xwiki-platform-search-solr-test-utils</module>
   </modules>
   <profiles>
-    <profile>
-      <id>integration-tests</id>
-      <modules>
-        <module>xwiki-platform-search-solr-test-utils</module>
-      </modules>
-    </profile>
     <profile>
       <id>docker</id>
       <modules>
         <module>xwiki-platform-search-solr-test-docker</module>
       </modules>

Vulnerable code:     <profile>
      <id>integration-tests</id>
      <modules>
        <module>xwiki-platform-search-solr-test-utils</module>
      </modules>
    </profile>
Fixed code:     <module>xwiki-platform-search-solr-test-utils</module>
CVE-2022-4891: Inefficient Regular Expression Complexity (CWE-1333)
value: A vulnerability has been found in Sisimai up to 4.25.14p11 and classified as problematic. This vulnerability affects the function to_plain of the file lib/sisimai/string.rb. The manipulation leads to inefficient regular expression complexity. The exploit has been disclosed to the public and may be used. Upgrading to version 4.25.14p12 is able to address this issue. The name of the patch is 51fe2e6521c9c02b421b383943dc9e4bbbe65d4e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218452.
CWE description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CVSS v3 base score: 7.5
Published: 2023-01-17T20:15Z
Repository: https://github.com/sisimai/rb-sisimai
Language: Ruby
Files changed: lib/sisimai/string.rb
Commit date: 2022-11-28 20:07:49 +0000
Commit message: Prevent Regex Denial of Service in Sisimai::String.to_plain

Diff: diff --git a/lib/sisimai/string.rb b/lib/sisimai/string.rb
index 107db0ff..d3d993ac 100644
--- a/lib/sisimai/string.rb
+++ b/lib/sisimai/string.rb
@@ -64,12 +64,12 @@ module Sisimai
           # 1. Remove <head>...</head>
           # 2. Remove <style>...</style>
           # 3. <a href = 'http://...'>...</a> to " http://... "
           # 4. <a href = 'mailto:...'>...</a> to " Value <mailto:...> "
           plain.scrub!('?')
-          plain.gsub!(%r|<head>.+</head>|im, '')
-          plain.gsub!(%r|<style.+?>.+</style>|im, '')
+          plain.gsub!(%r|<head>.*?</head>|im, '')
+          plain.gsub!(%r|<style.*?>.*?</style>|im, '')
           plain.gsub!(%r|<a\s+href\s*=\s*['"](https?://.+?)['"].*?>(.*?)</a>|i, '[\2](\1)')
           plain.gsub!(%r|<a\s+href\s*=\s*["']mailto:([^\s]+?)["']>(.*?)</a>|i, '[\2](mailto:\1)')
 
           plain = plain.gsub(/<[^<@>]+?>\s*/, ' ')              # Delete HTML tags except <neko@example.jp>
           plain = plain.gsub(/&lt;/, '<').gsub(/&gt;/, '>')     # Convert to angle brackets

Vulnerable code:           plain.gsub!(%r|<head>.+</head>|im, '')
          plain.gsub!(%r|<style.+?>.+</style>|im, '')
Fixed code:           plain.gsub!(%r|<head>.*?</head>|im, '')
          plain.gsub!(%r|<style.*?>.*?</style>|im, '')
CVE-2023-38688: Missing Encryption of Sensitive Data (CWE-311)
value: twitch-tui provides Twitch chat in a terminal. Prior to version 2.4.1, the connection is not using TLS for communication. In the configuration of the irc connection, the software disables TLS, which makes all communication to Twitch IRC servers unencrypted. As a result, communication, including auth tokens, can be sniffed. Version 2.4.1 has a patch for this issue.
CWE description: The product does not encrypt sensitive or critical information before storage or transmission.
CVSS v3 base score: 7.5
Published: 2023-08-04T17:15Z
Repository: https://github.com/Xithrius/twitch-tui
Language: Rust
Files changed: src/twitch/connection.rs
Commit date: 2023-07-29 12:50:55 -0700
Commit message: Enable SSL for the Twitch IRC connection.

Diff: diff --git a/src/twitch/connection.rs b/src/twitch/connection.rs
index d9d9b18..a77fc02 100644
--- a/src/twitch/connection.rs
+++ b/src/twitch/connection.rs
@@ -17,12 +17,12 @@ async fn create_client_stream(config: CompleteConfig) -> Result<(Client, ClientS
     let irc_config = Config {
         nickname: Some(config.twitch.username.clone()),
         server: Some(config.twitch.server.clone()),
         channels: vec![format!("#{}", config.twitch.channel)],
         password: config.twitch.token.clone(),
-        port: Some(6667),
-        use_tls: Some(false),
+        port: Some(6697),
+        use_tls: Some(true),
         ping_timeout: Some(10),
         ping_time: Some(10),
         ..Default::default()
     };
 

Vulnerable code:         port: Some(6667),
        use_tls: Some(false),
Fixed code:         port: Some(6697),
        use_tls: Some(true),
CVE-2022-24912: Observable Discrepancy (CWE-203)
value: The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate the webhook secret. It can allow an attacker to recover this secret as an attacker and then forge webhook events.
CWE description: The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
CVSS v3 base score: 7.5
Published: 2022-07-29T10:15Z
Repository: https://github.com/runatlantis/atlantis
Language: Go
Files changed: server/controllers/events/gitlab_request_parser_validator.go
Commit date: 2022-07-15 09:54:36 -0700
Commit message: fix: use constant time comparison of webhook secret in gitlab event validator (#2392)


Diff: diff --git a/server/controllers/events/gitlab_request_parser_validator.go b/server/controllers/events/gitlab_request_parser_validator.go
index 9755bd5d..b92fd4df 100644
--- a/server/controllers/events/gitlab_request_parser_validator.go
+++ b/server/controllers/events/gitlab_request_parser_validator.go
@@ -12,10 +12,11 @@
 // Modified hereafter by contributors to runatlantis/atlantis.
 
 package events
 
 import (
+	"crypto/subtle"
 	"encoding/json"
 	"fmt"
 	"io"
 	"net/http"
 
@@ -59,12 +60,11 @@ func (d *DefaultGitlabRequestParserValidator) ParseAndValidate(r *http.Request,
 	const mergeEventHeader = "Merge Request Hook"
 	const noteEventHeader = "Note Hook"
 
 	// Validate secret if specified.
 	headerSecret := r.Header.Get(secretHeader)
-	secretStr := string(secret)
-	if len(secret) != 0 && headerSecret != secretStr {
+	if len(secret) != 0 && subtle.ConstantTimeCompare(secret, []byte(headerSecret)) != 1 {
 		return nil, fmt.Errorf("header %s=%s did not match expected secret", secretHeader, headerSecret)
 	}
 
 	// Parse request into a gitlab object based on the object type specified
 	// in the gitlabHeader.

Vulnerable code: 	secretStr := string(secret)
	if len(secret) != 0 && headerSecret != secretStr {
Fixed code: 	"crypto/subtle"
	if len(secret) != 0 && subtle.ConstantTimeCompare(secret, []byte(headerSecret)) != 1 {
CVE-2024-37160: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Formwork is a flat file-based Content Management System (CMS). An attackers (requires administrator privilege) to execute arbitrary web scripts by modifying site options via /panel/options/site. This type of attack is suitable for persistence, affecting visitors across all pages (except the dashboard). This vulnerability is fixed in 1.13.1.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2024-06-07T14:15Z
Repository: https://github.com/getformwork/formwork
Language: PHP
Files changed: site/templates/partials/meta.php
Commit date: 2024-06-07 11:30:16 +0200
Commit message: Escape meta attributes to avoid XSS injection

Diff: diff --git a/site/templates/partials/meta.php b/site/templates/partials/meta.php
index 6adc076d..cb7b72a7 100644
--- a/site/templates/partials/meta.php
+++ b/site/templates/partials/meta.php
@@ -1,9 +1,9 @@
 <?php foreach ($page->metadata() as $meta) : ?>
     <?php if ($meta->isCharset()) : ?>
-        <meta charset="<?= $meta->content() ?>">
+        <meta charset="<?= $this->escapeAttr($meta->content()) ?>">
     <?php elseif ($meta->isHTTPEquiv()) : ?>
-        <meta http-equiv="<?= $meta->name() ?>" content="<?= $meta->content() ?>">
+        <meta http-equiv="<?= $this->escapeAttr($meta->name()) ?>" content="<?= $this->escapeAttr($meta->content()) ?>">
     <?php else : ?>
-        <meta <?= $meta->prefix() === 'og' ? 'property' : 'name' ?>="<?= $meta->name() ?>" content="<?= $meta->content() ?>">
+        <meta <?= $meta->prefix() === 'og' ? 'property' : 'name' ?>="<?= $this->escapeAttr($meta->name()) ?>" content="<?= $this->escapeAttr($meta->content()) ?>">
     <?php endif ?>
 <?php endforeach ?>
\ No newline at end of file

Vulnerable code:         <meta charset="<?= $meta->content() ?>">
        <meta http-equiv="<?= $meta->name() ?>" content="<?= $meta->content() ?>">
        <meta <?= $meta->prefix() === 'og' ? 'property' : 'name' ?>="<?= $meta->name() ?>" content="<?= $meta->content() ?>">
Fixed code:         <meta charset="<?= $this->escapeAttr($meta->content()) ?>">
        <meta http-equiv="<?= $this->escapeAttr($meta->name()) ?>" content="<?= $this->escapeAttr($meta->content()) ?>">
        <meta <?= $meta->prefix() === 'og' ? 'property' : 'name' ?>="<?= $this->escapeAttr($meta->name()) ?>" content="<?= $this->escapeAttr($meta->content()) ?>">
CVE-2020-7795: Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
value: The package get-npm-package-version before 1.0.7 are vulnerable to Command Injection via main function in index.js.
CWE description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2022-08-02T14:15Z
Repository: https://github.com/hoperyy/get-npm-package-version
Language: JavaScript
Files changed: index.js
Commit date: 2021-01-26 11:48:05 +0800
Commit message: feat: add defence to Command Injection

add defence to Command Injection
Diff: diff --git a/index.js b/index.js
index a207f28..2e4b490 100644
--- a/index.js
+++ b/index.js
@@ -1,7 +1,10 @@
 module.exports = function (packageName, { registry = '', timeout = null } = {}) {
     try {
+        if (/[`$&{}[;|]/g.test(packageName) || /[`$&{}[;|]/g.test(registry)) {
+            return null
+        }
         let version;
 
         const config = {
             stdio: ['pipe', 'pipe', 'ignore']
         };

Fixed code:         if (/[`$&{}[;|]/g.test(packageName) || /[`$&{}[;|]/g.test(registry)) {
            return null
        }
CVE-2021-43838: Inefficient Regular Expression Complexity (CWE-1333)
value: jsx-slack is a library for building JSON objects for Slack Block Kit surfaces from JSX. In versions prior to 4.5.1 users are vulnerable to a regular expression denial-of-service (ReDoS) attack. If attacker can put a lot of JSX elements into `<blockquote>` tag, an internal regular expression for escaping characters may consume an excessive amount of computing resources. jsx-slack v4.5.1 has patched to a regex for escaping blockquote characters. Users are advised to upgrade as soon as possible.
CWE description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CVSS v3 base score: 7.5
Published: 2021-12-17T19:15Z
Repository: https://github.com/yhatt/jsx-slack
Language: Unknown
Commit date: 2021-12-17 09:12:51 +0900
Commit message: Merge pull request from GHSA-55xv-f85c-248q

Fix performance issues of tags in blockquote
CVE-2017-17042: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2017-11-28T20:29Z
Repository: https://github.com/lsegal/yard
Language: Ruby
Files changed: lib/yard/core_ext/file.rb, spec/core_ext/file_spec.rb
Commit date: 2017-11-23 13:34:33 -0800
Commit message: Disallow relative paths that start with ../

Fixes a potential arbitrary file read vulnerability in yard server.
Thanks to ztz <ztz@ztz.me> for discovery of this security issue.

Diff: diff --git a/lib/yard/core_ext/file.rb b/lib/yard/core_ext/file.rb
index 3902f2bd..a0b983e9 100644
--- a/lib/yard/core_ext/file.rb
+++ b/lib/yard/core_ext/file.rb
@@ -38,10 +38,12 @@ class File
     path = path.inject([]) do |acc, comp|
       next acc if comp == RELATIVE_SAMEDIR
       if comp == RELATIVE_PARENTDIR && !acc.empty? && acc.last != RELATIVE_PARENTDIR
         acc.pop
         next acc
+      elsif comp == RELATIVE_PARENTDIR && acc.empty?
+        next acc
       end
       acc << comp
     end
     File.join(*path)
   end
diff --git a/spec/core_ext/file_spec.rb b/spec/core_ext/file_spec.rb
index f61081f6..15806360 100644
--- a/spec/core_ext/file_spec.rb
+++ b/spec/core_ext/file_spec.rb
@@ -39,16 +39,16 @@ RSpec.describe File do
 
     it "cleans a path ending in .." do
       expect(File.cleanpath('A/B/C/D/..')).to eq "A/B/C"
     end
 
-    it "passes the initial directory" do
-      expect(File.cleanpath('C/../../D')).to eq "../D"
+    it "does not allow relative path above root" do
+      expect(File.cleanpath('A/../../../../../D')).to eq "D"
     end
 
     it "does not remove multiple '../' at the beginning" do
-      expect(File.cleanpath('../../A/B')).to eq '../../A/B'
+      expect(File.cleanpath('../../A/B')).to eq 'A/B'
     end
   end
 
   describe ".open!" do
     it "creates the path before opening" do

Vulnerable code:     it "passes the initial directory" do
      expect(File.cleanpath('C/../../D')).to eq "../D"
      expect(File.cleanpath('../../A/B')).to eq '../../A/B'
Fixed code:       elsif comp == RELATIVE_PARENTDIR && acc.empty?
        next acc
    it "does not allow relative path above root" do
      expect(File.cleanpath('A/../../../../../D')).to eq "D"
      expect(File.cleanpath('../../A/B')).to eq 'A/B'
CVE-2024-27285: Insufficient Information (NVD-CWE-noinfo)
value: YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.  This vulnerability is fixed in 0.9.36.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-02-28T20:15Z
Repository: https://github.com/lsegal/yard
Language: Unknown
Commit date: 2024-02-28 10:03:58 -0800
Commit message: Merge pull request from GHSA-8mq4-9jjh-9xrc

Patch XSS and Open-Redirect in frames.erb
CVE-2024-27285: Insufficient Information (NVD-CWE-noinfo)
value: YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.  This vulnerability is fixed in 0.9.36.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-02-28T20:15Z
Repository: https://github.com/lsegal/yard
Language: Unknown
Commit date: 2024-02-29 14:15:39 -0800
Commit message: Merge pull request #1538 from RedYetiDev/patch-2

Update frames.erb for better XSS check
CVE-2018-1000501: Weak Password Recovery Mechanism for Forgotten Password (CWE-640)
value: Instant Update CMS contains a Password Reset Vulnerability vulnerability in /iu-application/controllers/administration/auth.php that can result in Account Tackover. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in v0.3.3.
CWE description: The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
CVSS v3 base score: 9.8
Published: 2018-06-26T16:29Z
Repository: https://github.com/InstantUpdate/CMS
Language: PHP
Files changed: iu-application/controllers/administration/auth.php
Commit date: 2018-04-19 22:09:49 +0200
Commit message: fix(auth): Send password reset emails to user's email stored in the db
Diff: diff --git a/iu-application/controllers/administration/auth.php b/iu-application/controllers/administration/auth.php
index d505ebb..4bbe2da 100644
--- a/iu-application/controllers/administration/auth.php
+++ b/iu-application/controllers/administration/auth.php
@@ -261,11 +261,11 @@ class Auth extends CS_Controller {
 		$template = __($template, null, 'email');
 		$template .= "<br />\n<br />\n<br />\n" . __(file_get_contents(APPPATH . "templates/signature.html"), null, 'email');
 		$template = parse_template($template, $vars);
 
 		//send email
-		$this->email->to("$email");
+		$this->email->to($u->email);
 		$this->email->subject(__("%s password reset", Setting::value('website_title', CS_PRODUCT_NAME), 'email'));
 		$this->email->message($template);
 		$this->email->set_alt_message(strip_tags($template));
 
 		$from = Setting::value("default_email", false);
@@ -342,6 +342,6 @@ class Auth extends CS_Controller {
 
 	}
 
 }
 
-?>
\ No newline at end of file
+?>

Vulnerable code: 		$this->email->to("$email");
?>
Fixed code: 		$this->email->to($u->email);
?>
CVE-2023-27475: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Goutil is a collection of miscellaneous functionality for the go language. In versions prior to 0.6.0 when users use fsutil.Unzip to unzip zip files from a malicious attacker, they may be vulnerable to path traversal. This vulnerability is known as a ZipSlip. This issue has been fixed in version 0.6.0, users are advised to upgrade. There are no known workarounds for this issue.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 8.8
Published: 2023-03-07T18:15Z
Repository: https://github.com/gookit/goutil
Language: Go
Files changed: fsutil/operate.go
Commit date: 2022-11-14 23:38:23 +0800
Commit message: fix zipslip

Diff: diff --git a/fsutil/operate.go b/fsutil/operate.go
index c4352a4..4574128 100644
--- a/fsutil/operate.go
+++ b/fsutil/operate.go
@@ -1,14 +1,16 @@
 package fsutil
 
 import (
 	"archive/zip"
+	"fmt"
 	"io"
 	"io/ioutil"
 	"os"
 	"path"
 	"path/filepath"
+	"strings"
 )
 
 // Mkdir alias of os.MkdirAll()
 func Mkdir(dirPath string, perm os.FileMode) error {
 	return os.MkdirAll(dirPath, perm)
@@ -315,11 +317,17 @@ func Unzip(archive, targetDir string) (err error) {
 	if err = os.MkdirAll(targetDir, DefaultDirPerm); err != nil {
 		return
 	}
 
 	for _, file := range reader.File {
+
+		if strings.Contains(file.Name, "..") {
+			return fmt.Errorf("illegal file path in zip: %v", file.Name)
+		}
+
 		fullPath := filepath.Join(targetDir, file.Name)
+
 		if file.FileInfo().IsDir() {
 			err = os.MkdirAll(fullPath, file.Mode())
 			if err != nil {
 				return err
 			}

Fixed code: 	"fmt"
	"strings"

		if strings.Contains(file.Name, "..") {
			return fmt.Errorf("illegal file path in zip: %v", file.Name)
		}
CVE-2020-26225: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In PrestaShop Product Comments before version 4.2.0, an attacker could inject malicious web code into the users' web browsers by creating a malicious link. The problem was introduced in version 4.0.0 and is fixed in 4.2.0
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2020-11-16T22:15Z
Repository: https://github.com/PrestaShop/productcomments
Language: Unknown
Commit date: 2020-11-16 14:13:36 +0100
Commit message: Merge pull request from GHSA-58w4-w77w-qv3w

Make sure ajax requests are sent in application/json format
CVE-2020-26248: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: In the PrestaShop module "productcomments" before version 4.2.1, an attacker can use a Blind SQL injection to retrieve data or stop the MySQL service. The problem is fixed in 4.2.1 of the module.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 8.2
Published: 2020-12-03T21:15Z
Repository: https://github.com/PrestaShop/productcomments
Language: Unknown
Commit date: 2020-12-03 10:48:18 +0100
Commit message: Merge pull request from GHSA-5v44-7647-xfw9

Cast ids into int
CVE-2022-35933: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: This package is a PrestaShop module that allows users to post reviews and rate products. There is a vulnerability where the attacker could steal an administrator's cookie. The issue is fixed in version 5.0.2.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-09-02T20:15Z
Repository: https://github.com/PrestaShop/productcomments
Language: Unknown
Commit date: 2022-08-31 14:20:40 +0200
Commit message: Merge pull request from GHSA-prrh-qvhf-x788

Escape username
CVE-2016-10928: Use of Hard-coded Credentials (CWE-798)
value: The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users.
CWE description: The product contains hard-coded credentials, such as a password or cryptographic key.
CVSS v3 base score: 7.5
Published: 2019-08-22T20:15Z
Repository: https://github.com/onelogin/wordpress-saml
Language: PHP
Files changed: onelogin-saml-sso/php/functions.php
Commit date: 2016-01-20 20:27:13 +0100
Commit message: Generate random password for provisioned users

Diff: diff --git a/onelogin-saml-sso/php/functions.php b/onelogin-saml-sso/php/functions.php
index 1470cd0..7e54bda 100644
--- a/onelogin-saml-sso/php/functions.php
+++ b/onelogin-saml-sso/php/functions.php
@@ -272,11 +272,11 @@ function saml_acs() {
 	} else if (get_option('onelogin_saml_autocreate')) {
 		if (!validate_username($username)) {
 			echo __("The username provided by the IdP"). ' "'. $username. '" '. __("is not valid and can't create the user at wordpress");
 			exit();
 		}
-		$userdata['user_pass'] = '@@@nopass@@@';
+		$userdata['user_pass'] = wp_generate_password();
 		$user_id = wp_insert_user($userdata);
 	} else {
 		echo __("User provided by the IdP "). ' "'. $matcherValue. '" '. __("does not exist in wordpress and auto-provisioning is disabled.");
 		exit();
 	}

Vulnerable code: 		$userdata['user_pass'] = '@@@nopass@@@';
Fixed code: 		$userdata['user_pass'] = wp_generate_password();
CVE-2021-43138: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 7.8
Published: 2022-04-06T17:15Z
Repository: https://github.com/caolan/async
Language: JavaScript
Files changed: lib/internal/iterator.js, test/mapValues.js
Commit date: 2021-10-27 20:14:00 -0700
Commit message: Fix prototype pollution vulnerability

Diff: diff --git a/lib/internal/iterator.js b/lib/internal/iterator.js
index d167ff9..02526e0 100644
--- a/lib/internal/iterator.js
+++ b/lib/internal/iterator.js
@@ -24,10 +24,13 @@ function createObjectIterator(obj) {
     var okeys = obj ? Object.keys(obj) : [];
     var i = -1;
     var len = okeys.length;
     return function next() {
         var key = okeys[++i];
+        if (key === '__proto__') {
+            return next();
+        }
         return i < len ? {value: obj[key], key} : null;
     };
 }
 
 export default function createIterator(coll) {
diff --git a/test/mapValues.js b/test/mapValues.js
index 3264337..6d089fb 100644
--- a/test/mapValues.js
+++ b/test/mapValues.js
@@ -58,10 +58,21 @@ describe('mapValues', () => {
             setTimeout(() => {
                 expect(callOrder).to.eql([1, 'a', 2, 'b', 3, 'c']);
                 done();
             }, 50);
         });
+
+        it('prototype pollution', (done) => {
+            var input = JSON.parse('{"a": 1, "b": 2, "__proto__": { "exploit": true }}');
+
+            async.mapValues(input, (val, key, next) => {
+                next(null, val)
+            }, (err, result) => {
+                expect(result.exploit).to.equal(undefined)
+                done(err);
+            })
+        })
     });
 
     context('mapValues', () => {
         it('basics', (done) => {
             var running = 0;

Fixed code:         if (key === '__proto__') {
            return next();
        }

        it('prototype pollution', (done) => {
            var input = JSON.parse('{"a": 1, "b": 2, "__proto__": { "exploit": true }}');

            async.mapValues(input, (val, key, next) => {
                next(null, val)
            }, (err, result) => {
                expect(result.exploit).to.equal(undefined)
                done(err);
            })
        })
CVE-2017-12858: Double Free (CWE-415)
value: Double free vulnerability in the _zip_dirent_read function in zip_dirent.c in libzip allows attackers to have unspecified impact via unknown vectors.
CWE description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CVSS v3 base score: 9.8
Published: 2017-08-23T14:29Z
Repository: https://github.com/nih-at/libzip
Language: Other
Files changed: THANKS, lib/zip_dirent.c
Commit date: 2017-08-14 10:55:44 +0200
Commit message: Fix double free().

Found by Brian 'geeknik' Carpenter using AFL.

Diff: diff --git a/THANKS b/THANKS
index be0cca9..a80ee1d 100644
--- a/THANKS
+++ b/THANKS
@@ -10,10 +10,11 @@ Andrew Molyneux <andrew@molyneuxfamily.co.uk>
 Ankur Kothari <ankz.kothari@gmail.com>
 BALATON Zoltan <balaton@eik.bme.hu>
 Benjamin Gilbert <bgilbert@backtick.net>
 Boaz Stolk <bstolk@aweta.nl>
 Bogdan <bogiebog@gmail.com>
+Brian 'geeknik' Carpenter <geeknik@protonmail.ch>
 Chris Nehren <cnehren+libzip@pobox.com>
 Coverity <info@coverity.com>
 Dane Springmeyer <dane.springmeyer@gmail.com>
 David Demelier <demelier.david@gmail.com>
 Del Merritt <del@alum.mit.edu>
diff --git a/lib/zip_dirent.c b/lib/zip_dirent.c
index a369900..e5a7cc9 100644
--- a/lib/zip_dirent.c
+++ b/lib/zip_dirent.c
@@ -577,13 +577,10 @@ _zip_dirent_read(zip_dirent_t *zde, zip_source_t *src, zip_buffer_t *buffer, boo
 	zip_error_set(error, ZIP_ER_SEEK, EFBIG);
 	return -1;
     }
 
     if (!_zip_dirent_process_winzip_aes(zde, error)) {
-	if (!from_buffer) {
-	    _zip_buffer_free(buffer);
-	}
 	return -1;
     }
 
     zde->extra_fields = _zip_ef_remove_internal(zde->extra_fields);
 

Vulnerable code: 	if (!from_buffer) {
	    _zip_buffer_free(buffer);
	}
Fixed code: Brian 'geeknik' Carpenter <geeknik@protonmail.ch>
CVE-2017-14107: Allocation of Resources Without Limits or Throttling (CWE-770)
value: The _zip_read_eocd64 function in zip_open.c in libzip before 1.3.0 mishandles EOCD records, which allows remote attackers to cause a denial of service (memory allocation failure in _zip_cdir_grow in zip_dirent.c) via a crafted ZIP archive.
CWE description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
CVSS v3 base score: 6.5
Published: 2017-09-01T17:29Z
Repository: https://github.com/nih-at/libzip
Language: C
Files changed: lib/zip_open.c
Commit date: 2017-08-29 10:25:03 +0200
Commit message: Make eocd checks more consistent between zip and zip64 cases.

Diff: diff --git a/lib/zip_open.c b/lib/zip_open.c
index 3bd593b1..9d3a4cbb 100644
--- a/lib/zip_open.c
+++ b/lib/zip_open.c
@@ -845,11 +845,16 @@ _zip_read_eocd64(zip_source_t *src, zip_buffer_t *buffer, zip_uint64_t buf_offse
 
     if (offset > ZIP_INT64_MAX || offset+size < offset) {
         zip_error_set(error, ZIP_ER_SEEK, EFBIG);
         return NULL;
     }
-    if ((flags & ZIP_CHECKCONS) && offset+size != eocd_offset) {
+    if (offset+size > buf_offset + eocd_offset) {
+	/* cdir spans past EOCD record */
+	zip_error_set(error, ZIP_ER_INCONS, 0);
+	return NULL;
+    }
+    if ((flags & ZIP_CHECKCONS) && offset+size != buf_offset + eocd_offset) {
 	zip_error_set(error, ZIP_ER_INCONS, 0);
 	return NULL;
     }
 
     if ((cd=_zip_cdir_new(nentry, error)) == NULL)

Vulnerable code:     if ((flags & ZIP_CHECKCONS) && offset+size != eocd_offset) {
Fixed code:     if (offset+size > buf_offset + eocd_offset) {
	/* cdir spans past EOCD record */
	zip_error_set(error, ZIP_ER_INCONS, 0);
	return NULL;
    }
    if ((flags & ZIP_CHECKCONS) && offset+size != buf_offset + eocd_offset) {
CVE-2019-17582: Use After Free (CWE-416)
value: A use-after-free in the _zip_dirent_read function of zip_dirent.c in libzip 1.2.0 allows attackers to have an unspecified impact by attempting to unzip a malformed ZIP archive. NOTE: the discoverer states "This use-after-free is triggered prior to the double free reported in CVE-2017-12858."
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 9.8
Published: 2021-02-09T19:15Z
Repository: https://github.com/nih-at/libzip
Language: Other
Files changed: THANKS, lib/zip_dirent.c
Commit date: 2017-08-14 10:55:44 +0200
Commit message: Fix double free().

Found by Brian 'geeknik' Carpenter using AFL.

Diff: diff --git a/THANKS b/THANKS
index be0cca93..a80ee1de 100644
--- a/THANKS
+++ b/THANKS
@@ -10,10 +10,11 @@ Andrew Molyneux <andrew@molyneuxfamily.co.uk>
 Ankur Kothari <ankz.kothari@gmail.com>
 BALATON Zoltan <balaton@eik.bme.hu>
 Benjamin Gilbert <bgilbert@backtick.net>
 Boaz Stolk <bstolk@aweta.nl>
 Bogdan <bogiebog@gmail.com>
+Brian 'geeknik' Carpenter <geeknik@protonmail.ch>
 Chris Nehren <cnehren+libzip@pobox.com>
 Coverity <info@coverity.com>
 Dane Springmeyer <dane.springmeyer@gmail.com>
 David Demelier <demelier.david@gmail.com>
 Del Merritt <del@alum.mit.edu>
diff --git a/lib/zip_dirent.c b/lib/zip_dirent.c
index a369900e..e5a7cc9d 100644
--- a/lib/zip_dirent.c
+++ b/lib/zip_dirent.c
@@ -577,13 +577,10 @@ _zip_dirent_read(zip_dirent_t *zde, zip_source_t *src, zip_buffer_t *buffer, boo
 	zip_error_set(error, ZIP_ER_SEEK, EFBIG);
 	return -1;
     }
 
     if (!_zip_dirent_process_winzip_aes(zde, error)) {
-	if (!from_buffer) {
-	    _zip_buffer_free(buffer);
-	}
 	return -1;
     }
 
     zde->extra_fields = _zip_ef_remove_internal(zde->extra_fields);
 

Vulnerable code: 	if (!from_buffer) {
	    _zip_buffer_free(buffer);
	}
Fixed code: Brian 'geeknik' Carpenter <geeknik@protonmail.ch>
CVE-2014-9491: Other (NVD-CWE-Other)
value: The devzvol_readdir function in illumos does not check the return value of a strchr call, which allows remote attackers to cause a denial of service (NULL pointer dereference and panic) via unspecified vectors.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Published: 2015-01-20T15:59Z
Repository: https://github.com/illumos/illumos-gate
Language: C
Files changed: usr/src/uts/common/fs/dev/sdev_zvolops.c
Commit date: 2014-12-08 19:47:24 -0800
Commit message: 5421 devzvol_readdir() needs to be more careful with strchr
Reviewed by: Keith Wesolowski <keith.wesolowski@joyent.com>
Reviewed by: Jerry Jelinek <jerry.jelinek@joyent.com>
Approved by: Dan McDonald <danmcd@omniti.com>

Diff: diff --git a/usr/src/uts/common/fs/dev/sdev_zvolops.c b/usr/src/uts/common/fs/dev/sdev_zvolops.c
index 6543504e97..e4c3acf787 100644
--- a/usr/src/uts/common/fs/dev/sdev_zvolops.c
+++ b/usr/src/uts/common/fs/dev/sdev_zvolops.c
@@ -790,11 +790,14 @@ devzvol_readdir(struct vnode *dvp, struct uio *uiop, struct cred *cred,
 		devzvol_create_pool_dirs(dvp);
 		rw_enter(&sdvp->sdev_contents, RW_READER);
 		return (devname_readdir_func(dvp, uiop, cred, eofp, 0));
 	}
 
-	ptr = strchr(ptr + 1, '/') + 1;
+	ptr = strchr(ptr + 1, '/');
+	if (ptr == NULL)
+		return (ENOENT);
+	ptr++;
 	rw_exit(&sdvp->sdev_contents);
 	sdev_iter_datasets(dvp, ZFS_IOC_DATASET_LIST_NEXT, ptr);
 	rw_enter(&sdvp->sdev_contents, RW_READER);
 	return (devname_readdir_func(dvp, uiop, cred, eofp, 0));
 }

Vulnerable code: 	ptr = strchr(ptr + 1, '/') + 1;
Fixed code: 	ptr = strchr(ptr + 1, '/');
	if (ptr == NULL)
		return (ENOENT);
	ptr++;