Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2019-1010296: Integer Overflow or Wraparound (CWE-190)
value: Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Code execution in context of TEE core (kernel). The component is: optee_os. The fixed version is: 3.4.0 and later.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 9.8
Published: 2019-07-15T18:15Z
Repository: https://github.com/OP-TEE/optee_os
Language: C
Files changed: core/tee/tee_svc_cryp.c
Commit date: 2019-01-21 18:28:37 +0100
Commit message: svc: check for allocation overflow in syscall_cryp_obj_populate

Without checking for overflow there is a risk of allocating a buffer
with size smaller than anticipated and as a consequence of that it might
lead to a heap based overflow with attacker controlled data written
outside the boundaries of the buffer.

Fixes: OP-TEE-2018-0009: "Integer overflow in crypto system calls"

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (QEMU v7, v8)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reported-by: Riscure <inforequest@riscure.com>
Reported-by: Alyssa Milburn <a.a.milburn@vu.nl>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

Diff: diff --git a/core/tee/tee_svc_cryp.c b/core/tee/tee_svc_cryp.c
index b47a45dda..6fac66610 100644
--- a/core/tee/tee_svc_cryp.c
+++ b/core/tee/tee_svc_cryp.c
@@ -2,10 +2,11 @@
 /*
  * Copyright (c) 2014, STMicroelectronics International N.V.
  */
 
 #include <assert.h>
+#include <compiler.h>
 #include <crypto/crypto.h>
 #include <kernel/tee_ta_manager.h>
 #include <mm/tee_mmu.h>
 #include <string_ext.h>
 #include <string.h>
@@ -1545,13 +1546,19 @@ TEE_Result syscall_cryp_obj_populate(unsigned long obj,
 
 	type_props = tee_svc_find_type_props(o->info.objectType);
 	if (!type_props)
 		return TEE_ERROR_NOT_IMPLEMENTED;
 
-	attrs = malloc(sizeof(TEE_Attribute) * attr_count);
+	size_t alloc_size = 0;
+
+	if (MUL_OVERFLOW(sizeof(TEE_Attribute), attr_count, &alloc_size))
+		return TEE_ERROR_OVERFLOW;
+
+	attrs = malloc(alloc_size);
 	if (!attrs)
 		return TEE_ERROR_OUT_OF_MEMORY;
+
 	res = copy_in_attrs(to_user_ta_ctx(sess->ctx), usr_attrs, attr_count,
 			    attrs);
 	if (res != TEE_SUCCESS)
 		goto out;
 

Vulnerable code: 	attrs = malloc(sizeof(TEE_Attribute) * attr_count);
Fixed code: #include <compiler.h>
	size_t alloc_size = 0;

	if (MUL_OVERFLOW(sizeof(TEE_Attribute), attr_count, &alloc_size))
		return TEE_ERROR_OVERFLOW;

	attrs = malloc(alloc_size);
CVE-2019-1010296: Out-of-bounds Write (CWE-787)
value: Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Code execution in context of TEE core (kernel). The component is: optee_os. The fixed version is: 3.4.0 and later.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2019-07-15T18:15Z
Repository: https://github.com/OP-TEE/optee_os
Language: C
Files changed: core/tee/tee_svc_cryp.c
Commit date: 2019-01-21 18:28:37 +0100
Commit message: svc: check for allocation overflow in syscall_cryp_obj_populate

Without checking for overflow there is a risk of allocating a buffer
with size smaller than anticipated and as a consequence of that it might
lead to a heap based overflow with attacker controlled data written
outside the boundaries of the buffer.

Fixes: OP-TEE-2018-0009: "Integer overflow in crypto system calls"

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (QEMU v7, v8)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reported-by: Riscure <inforequest@riscure.com>
Reported-by: Alyssa Milburn <a.a.milburn@vu.nl>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

Diff: diff --git a/core/tee/tee_svc_cryp.c b/core/tee/tee_svc_cryp.c
index b47a45dda..6fac66610 100644
--- a/core/tee/tee_svc_cryp.c
+++ b/core/tee/tee_svc_cryp.c
@@ -2,10 +2,11 @@
 /*
  * Copyright (c) 2014, STMicroelectronics International N.V.
  */
 
 #include <assert.h>
+#include <compiler.h>
 #include <crypto/crypto.h>
 #include <kernel/tee_ta_manager.h>
 #include <mm/tee_mmu.h>
 #include <string_ext.h>
 #include <string.h>
@@ -1545,13 +1546,19 @@ TEE_Result syscall_cryp_obj_populate(unsigned long obj,
 
 	type_props = tee_svc_find_type_props(o->info.objectType);
 	if (!type_props)
 		return TEE_ERROR_NOT_IMPLEMENTED;
 
-	attrs = malloc(sizeof(TEE_Attribute) * attr_count);
+	size_t alloc_size = 0;
+
+	if (MUL_OVERFLOW(sizeof(TEE_Attribute), attr_count, &alloc_size))
+		return TEE_ERROR_OVERFLOW;
+
+	attrs = malloc(alloc_size);
 	if (!attrs)
 		return TEE_ERROR_OUT_OF_MEMORY;
+
 	res = copy_in_attrs(to_user_ta_ctx(sess->ctx), usr_attrs, attr_count,
 			    attrs);
 	if (res != TEE_SUCCESS)
 		goto out;
 

Vulnerable code: 	attrs = malloc(sizeof(TEE_Attribute) * attr_count);
Fixed code: #include <compiler.h>
	size_t alloc_size = 0;

	if (MUL_OVERFLOW(sizeof(TEE_Attribute), attr_count, &alloc_size))
		return TEE_ERROR_OVERFLOW;

	attrs = malloc(alloc_size);
CVE-2019-1010297: Out-of-bounds Write (CWE-787)
value: Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Execution of code in TEE core (kernel) context. The component is: optee_os. The fixed version is: 3.4.0 and later.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2019-07-15T18:15Z
Repository: https://github.com/OP-TEE/optee_os
Language: C
Files changed: core/tee/tee_svc_cryp.c
Commit date: 2019-01-21 18:28:37 +0100
Commit message: svc: check for allocation overflow in crypto calls

Without checking for overflow there is a risk of allocating a buffer
with size smaller than anticipated and as a consequence of that it might
lead to a heap based overflow with attacker controlled data written
outside the boundaries of the buffer.

Fixes: OP-TEE-2018-0010: "Integer overflow in crypto system calls (x2)"

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (QEMU v7, v8)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reported-by: Riscure <inforequest@riscure.com>
Reported-by: Alyssa Milburn <a.a.milburn@vu.nl>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

Diff: diff --git a/core/tee/tee_svc_cryp.c b/core/tee/tee_svc_cryp.c
index 6fac66610..a5beb339c 100644
--- a/core/tee/tee_svc_cryp.c
+++ b/core/tee/tee_svc_cryp.c
@@ -1757,11 +1757,16 @@ TEE_Result syscall_obj_generate_key(unsigned long obj, unsigned long key_size,
 	if (key_size < type_props->min_size)
 		return TEE_ERROR_NOT_SUPPORTED;
 	if (key_size > type_props->max_size)
 		return TEE_ERROR_NOT_SUPPORTED;
 
-	params = malloc(sizeof(TEE_Attribute) * param_count);
+	size_t alloc_size = 0;
+
+	if (MUL_OVERFLOW(sizeof(TEE_Attribute), param_count, &alloc_size))
+		return TEE_ERROR_OVERFLOW;
+
+	params = malloc(alloc_size);
 	if (!params)
 		return TEE_ERROR_OUT_OF_MEMORY;
 	res = copy_in_attrs(to_user_ta_ctx(sess->ctx), usr_params, param_count,
 			    params);
 	if (res != TEE_SUCCESS)
@@ -2666,11 +2671,16 @@ TEE_Result syscall_cryp_derive_key(unsigned long state,
 
 	res = tee_svc_cryp_get_state(sess, tee_svc_uref_to_vaddr(state), &cs);
 	if (res != TEE_SUCCESS)
 		return res;
 
-	params = malloc(sizeof(TEE_Attribute) * param_count);
+	size_t alloc_size = 0;
+
+	if (MUL_OVERFLOW(sizeof(TEE_Attribute), param_count, &alloc_size))
+		return TEE_ERROR_OVERFLOW;
+
+	params = malloc(alloc_size);
 	if (!params)
 		return TEE_ERROR_OUT_OF_MEMORY;
 	res = copy_in_attrs(utc, usr_params, param_count, params);
 	if (res != TEE_SUCCESS)
 		goto out;

Vulnerable code: 	params = malloc(sizeof(TEE_Attribute) * param_count);
	params = malloc(sizeof(TEE_Attribute) * param_count);
Fixed code: 	size_t alloc_size = 0;

	if (MUL_OVERFLOW(sizeof(TEE_Attribute), param_count, &alloc_size))
		return TEE_ERROR_OVERFLOW;

	params = malloc(alloc_size);
	size_t alloc_size = 0;

	if (MUL_OVERFLOW(sizeof(TEE_Attribute), param_count, &alloc_size))
		return TEE_ERROR_OVERFLOW;

	params = malloc(alloc_size);
CVE-2019-1010298: Out-of-bounds Write (CWE-787)
value: Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Code execution in the context of TEE core (kernel). The component is: optee_os. The fixed version is: 3.4.0 and later.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2019-07-15T18:15Z
Repository: https://github.com/OP-TEE/optee_os
Language: C
Files changed: core/tee/tee_svc_cryp.c
Commit date: 2019-01-21 18:28:37 +0100
Commit message: svc: check for allocation overflow in crypto calls part 2

Without checking for overflow there is a risk of allocating a buffer
with size smaller than anticipated and as a consequence of that it might
lead to a heap based overflow with attacker controlled data written
outside the boundaries of the buffer.

Fixes: OP-TEE-2018-0011: "Integer overflow in crypto system calls (x2)"

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (QEMU v7, v8)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reported-by: Riscure <inforequest@riscure.com>
Reported-by: Alyssa Milburn <a.a.milburn@vu.nl>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

Diff: diff --git a/core/tee/tee_svc_cryp.c b/core/tee/tee_svc_cryp.c
index a5beb339c..f60f3d248 100644
--- a/core/tee/tee_svc_cryp.c
+++ b/core/tee/tee_svc_cryp.c
@@ -3272,11 +3272,16 @@ TEE_Result syscall_asymm_operate(unsigned long state,
 			TEE_MEMORY_ACCESS_ANY_OWNER,
 		(uaddr_t) dst_data, dlen);
 	if (res != TEE_SUCCESS)
 		return res;
 
-	params = malloc(sizeof(TEE_Attribute) * num_params);
+	size_t alloc_size = 0;
+
+	if (MUL_OVERFLOW(sizeof(TEE_Attribute), num_params, &alloc_size))
+		return TEE_ERROR_OVERFLOW;
+
+	params = malloc(alloc_size);
 	if (!params)
 		return TEE_ERROR_OUT_OF_MEMORY;
 	res = copy_in_attrs(utc, usr_params, num_params, params);
 	if (res != TEE_SUCCESS)
 		goto out;
@@ -3434,11 +3439,16 @@ TEE_Result syscall_asymm_verify(unsigned long state,
 					  TEE_MEMORY_ACCESS_ANY_OWNER,
 					  (uaddr_t)sig, sig_len);
 	if (res != TEE_SUCCESS)
 		return res;
 
-	params = malloc(sizeof(TEE_Attribute) * num_params);
+	size_t alloc_size = 0;
+
+	if (MUL_OVERFLOW(sizeof(TEE_Attribute), num_params, &alloc_size))
+		return TEE_ERROR_OVERFLOW;
+
+	params = malloc(alloc_size);
 	if (!params)
 		return TEE_ERROR_OUT_OF_MEMORY;
 	res = copy_in_attrs(utc, usr_params, num_params, params);
 	if (res != TEE_SUCCESS)
 		goto out;

Vulnerable code: 	params = malloc(sizeof(TEE_Attribute) * num_params);
	params = malloc(sizeof(TEE_Attribute) * num_params);
Fixed code: 	size_t alloc_size = 0;

	if (MUL_OVERFLOW(sizeof(TEE_Attribute), num_params, &alloc_size))
		return TEE_ERROR_OVERFLOW;

	params = malloc(alloc_size);
	size_t alloc_size = 0;

	if (MUL_OVERFLOW(sizeof(TEE_Attribute), num_params, &alloc_size))
		return TEE_ERROR_OVERFLOW;

	params = malloc(alloc_size);
CVE-2022-46152: Improper Validation of Array Index (CWE-129)
value: OP-TEE Trusted OS is the secure side implementation of OP-TEE project, a Trusted Execution Environment. Versions prior to 3.19.0, contain an Improper Validation of Array Index vulnerability. The function `cleanup_shm_refs()` is called by both `entry_invoke_command()` and `entry_open_session()`. The commands `OPTEE_MSG_CMD_OPEN_SESSION` and `OPTEE_MSG_CMD_INVOKE_COMMAND` can be executed from the normal world via an OP-TEE SMC. This function is not validating the `num_params` argument, which is only limited to `OPTEE_MSG_MAX_NUM_PARAMS` (127) in the function `get_cmd_buffer()`. Therefore, an attacker in the normal world can craft an SMC call that will cause out-of-bounds reading in `cleanup_shm_refs` and potentially freeing of fake-objects in the function `mobj_put()`. A normal-world attacker with permission to execute SMC instructions may exploit this flaw. Maintainers believe this problem permits local privilege escalation from the normal world to the secure world. Version 3.19.0 contains a fix for this issue. There are no known workarounds.
CWE description: The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
CVSS v3 base score: 8.8
Published: 2022-11-29T17:15Z
Repository: https://github.com/OP-TEE/optee_os
Language: C
Files changed: core/tee/entry_std.c
Commit date: 2022-10-06 11:15:43 +0200
Commit message: core: tee_entry: fix array out of bounds check in cleanup_shm_refs()

cleanup_shm_refs() can be called with num_params larger than what has
been used by copy_in_params(). If num_params is larger than
TEE_NUM_PARAMS copy_in_params() will return an error and
cleanup_shm_refs() is called to clean up.

This leads to accessing uint64_t saved_attr[TEE_NUM_PARAMS] in
entry_invoke_command() or entry_open_session() out of bounds and
possibly also the u[TEE_NUM_PARAMS] array in struct tee_ta_param.

So fix this by capping num_params TEE_NUM_PARAMS in cleanup_shm_refs().

Fixes: b05cd886e06d ("core: enable non-contiguous temporary reference parameters")
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

Diff: diff --git a/core/tee/entry_std.c b/core/tee/entry_std.c
index 0ec47e427..d933d54d5 100644
--- a/core/tee/entry_std.c
+++ b/core/tee/entry_std.c
@@ -252,11 +252,11 @@ static TEE_Result copy_in_params(const struct optee_msg_param *params,
 static void cleanup_shm_refs(const uint64_t *saved_attr,
 			     struct tee_ta_param *param, uint32_t num_params)
 {
 	size_t n;
 
-	for (n = 0; n < num_params; n++) {
+	for (n = 0; n < MIN((unsigned int)TEE_NUM_PARAMS, num_params); n++) {
 		switch (saved_attr[n]) {
 		case OPTEE_MSG_ATTR_TYPE_TMEM_INPUT:
 		case OPTEE_MSG_ATTR_TYPE_TMEM_OUTPUT:
 		case OPTEE_MSG_ATTR_TYPE_TMEM_INOUT:
 #ifdef CFG_CORE_DYN_SHM

Vulnerable code: 	for (n = 0; n < num_params; n++) {
Fixed code: 	for (n = 0; n < MIN((unsigned int)TEE_NUM_PARAMS, num_params); n++) {
CVE-2022-0776: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - DOM in GitHub repository hakimel/reveal.js prior to 4.3.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-03-01T09:15Z
Repository: https://github.com/hakimel/reveal.js
Language: HTML
Files changed: plugin/notes/speaker-view.html
Commit date: 2022-02-26 17:16:18 +0530
Commit message: Fix DOM XSS

Diff: diff --git a/plugin/notes/speaker-view.html b/plugin/notes/speaker-view.html
index 3cf492d..0c77390 100644
--- a/plugin/notes/speaker-view.html
+++ b/plugin/notes/speaker-view.html
@@ -366,10 +366,14 @@
 					connectionStatus.innerHTML = 'Error connecting to main window.<br>Please try closing and reopening the speaker view.';
 				}, 5000 );
 
 				window.addEventListener( 'message', function( event ) {
 
+					if (window.location.origin !== event.origin){
+						return;
+					}
+
 					clearTimeout( connectionTimeout );
 					connectionStatus.style.display = 'none';
 
 					var data = JSON.parse( event.data );
 

Fixed code: 					if (window.location.origin !== event.origin){
						return;
					}
CVE-2018-13818: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: Twig before 2.4.4 allows Server-Side Template Injection (SSTI) via the search search_key parameter. NOTE: the vendor points out that Twig itself is not a web application and states that it is the responsibility of web applications using Twig to properly wrap input to it
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 9.8
Published: 2018-07-10T14:29Z
Repository: https://github.com/twigphp/Twig
Language: Other
Files changed: CHANGELOG, lib/Twig/Environment.php
Commit date: 2017-09-27 11:10:31 -0700
Commit message: prepared the 2.4.4 release

Diff: diff --git a/CHANGELOG b/CHANGELOG
index d35cddfc..1725c308 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,6 +1,6 @@
-* 2.4.4 (2017-XX-XX)
+* 2.4.4 (2017-09-27)
 
  * added Twig_Profiler_Profile::reset()
  * fixed use TokenParser to return an empty Node
  * added RuntimeExtensionInterface
  * added circular reference detection when loading templates
diff --git a/lib/Twig/Environment.php b/lib/Twig/Environment.php
index 15c9470b..7658ccaf 100644
--- a/lib/Twig/Environment.php
+++ b/lib/Twig/Environment.php
@@ -14,16 +14,16 @@
  *
  * @author Fabien Potencier <fabien@symfony.com>
  */
 class Twig_Environment
 {
-    const VERSION = '2.4.4-DEV';
+    const VERSION = '2.4.4';
     const VERSION_ID = 20404;
     const MAJOR_VERSION = 2;
     const MINOR_VERSION = 4;
     const RELEASE_VERSION = 4;
-    const EXTRA_VERSION = 'DEV';
+    const EXTRA_VERSION = '';
 
     private $charset;
     private $loader;
     private $debug;
     private $autoReload;

Vulnerable code: * 2.4.4 (2017-XX-XX)
    const VERSION = '2.4.4-DEV';
    const EXTRA_VERSION = 'DEV';
Fixed code: * 2.4.4 (2017-09-27)
    const VERSION = '2.4.4';
    const EXTRA_VERSION = '';
CVE-2022-23614: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions. In affected versions this constraint was not properly enforced and could lead to code injection of arbitrary PHP code. Patched versions now disallow calling non Closure in the `sort` filter as is the case for some other filters. Users are advised to upgrade.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 9.8
Published: 2022-02-04T23:15Z
Repository: https://github.com/twigphp/Twig
Language: Unknown
Commit date: 2022-02-04 07:54:44 +0100
Commit message: bug #3641 Disallow non closures in `sort` filter when the sanbox mode is enabled (fabpot)

This PR was merged into the 2.x branch.

Discussion
----------

Disallow non closures in `sort` filter when the sanbox mode is enabled

Commits
-------

2eb33080 Disallow non closures in `sort` filter when the sanbox mode is enabled
CVE-2022-39261: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the `source` or `include` statement to read arbitrary files from outside the templates' directory when using a namespace like `@somewhere/../some.file`. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2022-09-28T14:15Z
Repository: https://github.com/twigphp/Twig
Language: Unknown
Commit date: 2022-09-28 10:36:08 +0200
Commit message: security #cve- Fix a security issue on filesystem loader (possibility to load a template outside a configured directory) (fabpot)

This PR was merged into the 1.x branch.
CVE-2023-29416: Out-of-bounds Write (CWE-787)
value: An issue was discovered in libbzip3.a in bzip3 before 1.3.0. A bz3_decode_block out-of-bounds write can occur with a crafted archive because bzip3 does not follow the required procedure for interacting with libsais.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2023-04-06T05:15Z
Repository: https://github.com/kspalaiologos/bzip3
Language: C
Files changed: include/common.h, src/libbz3.c
Commit date: 2023-03-26 08:02:46 +0200
Commit message: tentative libsais safety patches


Diff: diff --git a/include/common.h b/include/common.h
index 179bae1..afa28e0 100644
--- a/include/common.h
+++ b/include/common.h
@@ -20,10 +20,11 @@
 #ifndef _COMMON_H
 #define _COMMON_H
 
 #define KiB(x) ((x)*1024)
 #define MiB(x) ((x)*1024 * 1024)
+#define BWT_BOUND(x) ((x) + 128)
 
 #include <inttypes.h>
 #include <stdint.h>
 
 typedef uint8_t u8;
diff --git a/src/libbz3.c b/src/libbz3.c
index 2b1ba25..5424502 100644
--- a/src/libbz3.c
+++ b/src/libbz3.c
@@ -500,12 +500,12 @@ BZIP3_API struct bz3_state * bz3_new(s32 block_size) {
     }
 
     bz3_state->cm_state = malloc(sizeof(state));
 
     bz3_state->swap_buffer = malloc(bz3_bound(block_size));
-    bz3_state->sais_array = malloc((block_size + 128) * sizeof(s32));
-    memset(bz3_state->sais_array, 0, sizeof(s32) * (block_size + 128));
+    bz3_state->sais_array = malloc(BWT_BOUND(block_size) * sizeof(s32));
+    memset(bz3_state->sais_array, 0, sizeof(s32) * BWT_BOUND(block_size));
 
     bz3_state->lzp_lut = calloc(1 << LZP_DICTIONARY, sizeof(s32));
 
     if (!bz3_state->cm_state || !bz3_state->swap_buffer || !bz3_state->sais_array || !bz3_state->lzp_lut) {
         if (bz3_state->cm_state) free(bz3_state->cm_state);
@@ -680,10 +680,12 @@ BZIP3_API s32 bz3_decode_block(struct bz3_state * state, u8 * buffer, s32 data_s
         state->last_error = BZ3_ERR_MALFORMED_HEADER;
         return -1;
     }
 
     // Undo BWT
+    memset(state->sais_array, 0, sizeof(s32) * BWT_BOUND(state->block_size));
+    memset(b2, 0, size_src);
     if (libsais_unbwt(b1, b2, state->sais_array, size_src, NULL, bwt_idx) < 0) {
         state->last_error = BZ3_ERR_BWT;
         return -1;
     }
     swap(b1, b2);

Vulnerable code:     bz3_state->sais_array = malloc((block_size + 128) * sizeof(s32));
    memset(bz3_state->sais_array, 0, sizeof(s32) * (block_size + 128));
Fixed code: #define BWT_BOUND(x) ((x) + 128)
    bz3_state->sais_array = malloc(BWT_BOUND(block_size) * sizeof(s32));
    memset(bz3_state->sais_array, 0, sizeof(s32) * BWT_BOUND(block_size));
    memset(state->sais_array, 0, sizeof(s32) * BWT_BOUND(state->block_size));
    memset(b2, 0, size_src);
CVE-2023-29419: Out-of-bounds Read (CWE-125)
value: An issue was discovered in libbzip3.a in bzip3 before 1.2.3. There is a bz3_decode_block out-of-bounds read.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2023-04-06T05:15Z
Repository: https://github.com/kspalaiologos/bzip3
Language: C
Files changed: src/libbz3.c
Commit date: 2023-03-22 13:56:28 +0100
Commit message: mRLE: decoding bounds


Diff: diff --git a/src/libbz3.c b/src/libbz3.c
index fdcafe6..836286e 100644
--- a/src/libbz3.c
+++ b/src/libbz3.c
@@ -255,32 +255,37 @@ static s32 mrlec(u8 * in, s32 inlen, u8 * out) {
     } while (c != -1);
 
     return op;
 }
 
-static void mrled(u8 * RESTRICT in, u8 * RESTRICT out, s32 outlen) {
+static int mrled(u8 * RESTRICT in, u8 * RESTRICT out, s32 outlen, s32 maxin) {
     s32 op = 0, ip = 0;
 
     s32 c, pc = -1;
     s32 t[256] = { 0 };
     s32 run = 0;
 
+    if(maxin < 32)
+        return 1;
+
     for (s32 i = 0; i < 32; ++i) {
         c = in[ip++];
         for (s32 j = 0; j < 8; ++j) t[i * 8 + j] = (c >> j) & 1;
     }
 
-    while (op < outlen) {
+    while (op < outlen && ip < maxin) {
         c = in[ip++];
         if (t[c]) {
-            for (run = 0; (pc = in[ip++]) == 255; run += 255)
+            for (run = 0; (pc = in[ip++]) == 255 && ip < maxin; run += 255)
                 ;
             run += pc + 1;
             for (; run > 0 && op < outlen; --run) out[op++] = c;
         } else
             out[op++] = c;
     }
+
+    return op != outlen;
 }
 
 /* The entropy coder. Uses an arithmetic coder implementation outlined in Matt Mahoney's DCE. */
 
 typedef struct {
@@ -692,11 +697,15 @@ BZIP3_API s32 bz3_decode_block(struct bz3_state * state, u8 * buffer, s32 data_s
         }
         swap(b1, b2);
     }
 
     if (model & 4) {
-        mrled(b1, b2, orig_size);
+        int err = mrled(b1, b2, orig_size, size_src);
+        if(err) {
+            state->last_error = BZ3_ERR_CRC;
+            return -1;
+        }
         size_src = orig_size;
         swap(b1, b2);
     }
 
     state->last_error = BZ3_OK;

Vulnerable code: static void mrled(u8 * RESTRICT in, u8 * RESTRICT out, s32 outlen) {
    while (op < outlen) {
            for (run = 0; (pc = in[ip++]) == 255; run += 255)
        mrled(b1, b2, orig_size);
Fixed code: static int mrled(u8 * RESTRICT in, u8 * RESTRICT out, s32 outlen, s32 maxin) {
    if(maxin < 32)
        return 1;

    while (op < outlen && ip < maxin) {
            for (run = 0; (pc = in[ip++]) == 255 && ip < maxin; run += 255)

    return op != outlen;
        int err = mrled(b1, b2, orig_size, size_src);
        if(err) {
            state->last_error = BZ3_ERR_CRC;
            return -1;
        }
CVE-2023-29420: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: An issue was discovered in libbzip3.a in bzip3 before 1.2.3. There is a crash caused by an invalid memmove in bz3_decode_block.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 6.5
Published: 2023-04-06T05:15Z
Repository: https://github.com/kspalaiologos/bzip3
Language: C
Files changed: src/libbz3.c
Commit date: 2023-03-22 13:58:25 +0100
Commit message: store mode: check for truncation


Diff: diff --git a/src/libbz3.c b/src/libbz3.c
index 836286e..be896e2 100644
--- a/src/libbz3.c
+++ b/src/libbz3.c
@@ -618,11 +618,11 @@ BZIP3_API s32 bz3_decode_block(struct bz3_state * state, u8 * buffer, s32 data_s
         state->last_error = BZ3_ERR_MALFORMED_HEADER;
         return -1;
     }
 
     if (bwt_idx == -1) {
-        if (data_size - 8 > 64) {
+        if (data_size - 8 > 64 || data_size < 8) {
             state->last_error = BZ3_ERR_MALFORMED_HEADER;
             return -1;
         }
 
         memmove(buffer, buffer + 8, data_size - 8);

Vulnerable code:         if (data_size - 8 > 64) {
Fixed code:         if (data_size - 8 > 64 || data_size < 8) {
CVE-2020-15156: Cross-Site Request Forgery (CSRF) (CWE-352)
value: In nodebb-plugin-blog-comments before version 0.7.0, a logged in user is vulnerable to an XSS attack which could allow a third party to post on their behalf on the forum. This is due to lack of CSRF validation.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.1
Published: 2020-08-26T19:15Z
Repository: https://github.com/psychobunny/nodebb-plugin-blog-comments
Language: JavaScript
Files changed: library.js
Commit date: 2020-08-20 01:11:57 -0400
Commit message: fix: CSRF issues

Diff: diff --git a/library.js b/library.js
index 7786830..7960b48 100644
--- a/library.js
+++ b/library.js
@@ -246,12 +246,12 @@
 		fs.readFile(path.resolve(__dirname, './public/templates/comments/comments.tpl'), function (err, data) {
 			Comments.template = data.toString();
 		});
 
 		app.get('/comments/get/:id/:pagination?', middleware.applyCSRF, Comments.getCommentData);
-		app.post('/comments/reply', Comments.replyToComment);
-		app.post('/comments/publish', Comments.publishArticle);
+		app.post('/comments/reply', middleware.applyCSRF, Comments.replyToComment);
+		app.post('/comments/publish', middleware.applyCSRF, Comments.publishArticle);
 
 		app.get('/admin/blog-comments', middleware.admin.buildHeader, renderAdmin);
 		app.get('/api/admin/blog-comments', renderAdmin);
 
 		callback();

Vulnerable code: 		app.post('/comments/reply', Comments.replyToComment);
		app.post('/comments/publish', Comments.publishArticle);
Fixed code: 		app.post('/comments/reply', middleware.applyCSRF, Comments.replyToComment);
		app.post('/comments/publish', middleware.applyCSRF, Comments.publishArticle);
CVE-2020-10990: Improper Restriction of XML External Entity Reference (CWE-611)
value: An XXE issue exists in Accenture Mercury before 1.12.28 because of the platformlambda/core/serializers/SimpleXmlParser.java component.
CWE description: The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVSS v3 base score: 9.8
Published: 2020-03-27T00:15Z
Repository: https://github.com/Accenture/mercury
Language: Unknown
Commit date: 2020-01-08 11:34:49 -0800
Commit message: Merge pull request #14 from Accenture/security/xml-xxe-1-2020

v1.12.28 with rest-automation improvements and XXE patch
CVE-2024-28864: Insufficient Information (NVD-CWE-noinfo)
value: SecureProps is a PHP library designed to simplify the encryption and decryption of property data in objects. A vulnerability in SecureProps version 1.2.0 and 1.2.1 involves a regex failing to detect tags during decryption of encrypted data. This occurs when the encrypted data has been encoded with `NullEncoder` and passed to `TagAwareCipher`, and contains special characters such as `\n`. As a result, the decryption process is skipped since the tags are not detected. This causes the encrypted data to be returned in plain format.  The vulnerability affects users who implement `TagAwareCipher` with any base cipher that has `NullEncoder` (not default). The patch for the issue has been released. Users are advised to update to version 1.2.2. As a workaround, one may use the default `Base64Encoder` with the base cipher decorated with `TagAwareCipher` to prevent special characters in the encrypted string from interfering with regex tag detection logic.  This workaround is safe but may involve double encoding since `TagAwareCipher` uses `NullEncoder` by default.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-18T22:15Z
Repository: https://github.com/IlicMiljan/Secure-Props
Language: Unknown
Commit date: 2024-03-16 18:28:01 +0100
Commit message: Merge pull request #21 from IlicMiljan/fix-parsing-tagged-encrypted-data

Fix Parsing Tagged Encrypted Data
CVE-2017-20188: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability has been found in Zimbra zm-ajax up to 8.8.1 and classified as problematic. Affected by this vulnerability is the function XFormItem.prototype.setError of the file WebRoot/js/ajax/dwt/xforms/XFormItem.js. The manipulation of the argument message leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 8.8.2 is able to address this issue. The identifier of the patch is 8d039d6efe80780adc40c6f670c06d21de272105. It is recommended to upgrade the affected component. The identifier VDB-249421 was assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.7
Published: 2024-01-02T15:15Z
Repository: https://github.com/Zimbra/zm-ajax
Language: JavaScript
Files changed: WebRoot/js/ajax/dwt/xforms/XFormItem.js
Commit date: 2017-07-24 23:26:24 +0530
Commit message: ZCS-1795 Persistent XSS happens on textbox

Issue:
- Error text in form fields were executing text in dom, which can be used for XSS attacks

Resolution:
- Before adding error to DOM, html encode the text to make sure it is not executed in browser
- This is done at a generic place so it will affect error display for all form fields

Diff: diff --git a/WebRoot/js/ajax/dwt/xforms/XFormItem.js b/WebRoot/js/ajax/dwt/xforms/XFormItem.js
index 1eb97e94..de37d34b 100644
--- a/WebRoot/js/ajax/dwt/xforms/XFormItem.js
+++ b/WebRoot/js/ajax/dwt/xforms/XFormItem.js
@@ -686,11 +686,11 @@ XFormItem.prototype.setError = function(message, childError) {
 		return;
 	}
 	this.getForm().addErrorItem(this);
 	this.__errorState = XFormItem.ERROR_STATE_ERROR;
 	var container = this.getErrorContainer(true);
-	if (container) container.innerHTML = message;
+	if (container) container.innerHTML = AjxStringUtil.htmlEncode(message);
 };
 
 /** 
  * Clears the error message for this form item. 
  * This will clear the error for this item, or 

Vulnerable code: 	if (container) container.innerHTML = message;
Fixed code: 	if (container) container.innerHTML = AjxStringUtil.htmlEncode(message);
CVE-2017-18239: Insufficient Information (NVD-CWE-noinfo)
value: A time-sensitive equality check on the JWT signature in the JsonWebToken.validate method in main/scala/authentikat/jwt/JsonWebToken.scala in authentikat-jwt (aka com.jason-goodwin/authentikat-jwt) version 0.4.5 and earlier allows the supplier of a JWT token to guess bit after bit of the signature by repeating validation requests.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2018-03-18T03:29Z
Repository: https://github.com/jasongoodwin/authentikat-jwt
Language: Scala
Files changed: src/main/scala/authentikat/jwt/JsonWebToken.scala
Commit date: 2017-11-04 18:59:55 -0700
Commit message: Use constant-time string comparison for sigs

Fixed #12

Diff: diff --git a/src/main/scala/authentikat/jwt/JsonWebToken.scala b/src/main/scala/authentikat/jwt/JsonWebToken.scala
index 788de69..3084cdf 100644
--- a/src/main/scala/authentikat/jwt/JsonWebToken.scala
+++ b/src/main/scala/authentikat/jwt/JsonWebToken.scala
@@ -82,11 +82,11 @@ object JsonWebToken extends JsonMethods {
         val header = JwtHeader.fromJsonStringOpt(headerJsonString).getOrElse(JwtHeader(None, None, None))
 
         val signature = encodeBase64URLSafeString(
           JsonWebSignature(header.algorithm.getOrElse("none"), providedHeader + "." + providedClaims, key))
 
-        providedSignature.contentEquals(signature)
+        java.security.MessageDigest.isEqual(providedSignature.getBytes(), signature.getBytes())
       case _ ⇒
         false
     }
   }
 

Vulnerable code:         providedSignature.contentEquals(signature)
Fixed code:         java.security.MessageDigest.isEqual(providedSignature.getBytes(), signature.getBytes())
CVE-2019-16774: Deserialization of Untrusted Data (CWE-502)
value: In phpfastcache before 5.1.3, there is a possible object injection vulnerability in cookie driver.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 9.8
Published: 2019-12-12T23:15Z
Repository: https://github.com/PHPSocialNetwork/phpfastcache
Language: PHP
Files changed: src/phpFastCache/Drivers/Cookie/Driver.php
Commit date: 2016-12-30 09:40:00 +0100
Commit message: Fixed critical vulnerability on cookie driver

Diff: diff --git a/src/phpFastCache/Drivers/Cookie/Driver.php b/src/phpFastCache/Drivers/Cookie/Driver.php
index d9045d7..9d006c5 100644
--- a/src/phpFastCache/Drivers/Cookie/Driver.php
+++ b/src/phpFastCache/Drivers/Cookie/Driver.php
@@ -97,11 +97,11 @@ class Driver extends DriverAbstract
     {
         $this->driverConnect();
         // return null if no caching
         // return value if in caching
         $keyword = self::PREFIX . $item->getKey();
-        $x = isset($_COOKIE[ $keyword ]) ? $this->decode(json_decode($_COOKIE[ $keyword ], true)) : false;
+        $x = isset($_COOKIE[ $keyword ]) ? json_decode($_COOKIE[ $keyword ], true) : false;
 
         if ($x == false) {
             return null;
         } else {
             if (!is_scalar($this->driverUnwrapData($x)) && !is_null($this->driverUnwrapData($x))) {

Vulnerable code:         $x = isset($_COOKIE[ $keyword ]) ? $this->decode(json_decode($_COOKIE[ $keyword ], true)) : false;
Fixed code:         $x = isset($_COOKIE[ $keyword ]) ? json_decode($_COOKIE[ $keyword ], true) : false;
CVE-2021-37704: Exposure of Resource to Wrong Sphere (CWE-668)
value: PhpFastCache is a high-performance backend cache system (packagist package phpfastcache/phpfastcache). In versions before 6.1.5, 7.1.2, and 8.0.7 the `phpinfo()` can be exposed if the `/vendor` is not protected from public access. This is a rare situation today since the vendor directory is often located outside the web directory or protected via server rule (.htaccess, etc). Only the v6, v7 and v8 will be patched respectively in 8.0.7, 7.1.2, 6.1.5. Older versions such as v5, v4 are not longer supported and will **NOT** be patched. As a workaround, protect the `/vendor` directory from public access.
CWE description: The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
CVSS v3 base score: 4.3
Published: 2021-08-12T20:15Z
Repository: https://github.com/PHPSocialNetwork/phpfastcache
Language: Unknown
Commit date: 2021-08-12 13:40:37 +0200
Commit message: Merge pull request #813 from Geolim4/master

[V8] Fixed vulnerability issue that cause exposed phpinfo() in some situations
CVE-2016-7545: Improper Access Control (CWE-284)
value: SELinux policycoreutils allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call.
CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVSS v3 base score: 8.8
Published: 2017-01-19T20:59Z
Repository: https://github.com/SELinuxProject/selinux
Language: Other
Files changed: policycoreutils/sandbox/sandbox
Commit date: 2016-09-23 15:49:57 -0400
Commit message: sandbox: create a new session for sandboxed processes

It helps to prevent sandboxed processes to inject arbitrary commands
into the parent.

Signed-off-by: Petr Lautrbach <plautrba@redhat.com>

Diff: diff --git a/policycoreutils/sandbox/sandbox b/policycoreutils/sandbox/sandbox
index 9cc13c2..07c340c 100644
--- a/policycoreutils/sandbox/sandbox
+++ b/policycoreutils/sandbox/sandbox
@@ -469,14 +469,19 @@ sandbox [-h] [-l level ] [-[X|M] [-H homedir] [-T tempdir]] [-I includefile ] [-
                     cmds += ["--", SANDBOXSH, self.__options.windowsize, dpi]
                 else:
                     cmds += ["--"] + self.__paths
                 return subprocess.Popen(cmds).wait()
 
-            selinux.setexeccon(self.__execcon)
-            rc = subprocess.Popen(self.__cmds).wait()
-            selinux.setexeccon(None)
-            return rc
+            pid = os.fork()
+            if pid == 0:
+                rc = os.setsid()
+                if rc:
+                    return rc
+                selinux.setexeccon(self.__execcon)
+                os.execv(self.__cmds[0], self.__cmds)
+            rc = os.waitpid(pid, 0)
+            return os.WEXITSTATUS(rc[1])
 
         finally:
             for i in self.__paths:
                 if i not in SAVE_FILES:
                     continue

Vulnerable code:             selinux.setexeccon(self.__execcon)
            rc = subprocess.Popen(self.__cmds).wait()
            selinux.setexeccon(None)
            return rc
Fixed code:             pid = os.fork()
            if pid == 0:
                rc = os.setsid()
                if rc:
                    return rc
                selinux.setexeccon(self.__execcon)
                os.execv(self.__cmds[0], self.__cmds)
            rc = os.waitpid(pid, 0)
            return os.WEXITSTATUS(rc[1])
CVE-2021-36085: Use After Free (CWE-416)
value: The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __verify_map_perm_classperms and hashtab_map).
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 3.3
Published: 2021-07-01T03:15Z
Repository: https://github.com/SELinuxProject/selinux
Language: C
Files changed: libsepol/cil/src/cil_reset_ast.c
Commit date: 2021-04-19 10:40:33 -0400
Commit message: libsepol/cil: Destroy classperm list when resetting map perms

Map perms share the same struct as regular perms, but only the
map perms use the classperms field. This field is a pointer to a
list of classperms that is created and added to when resolving
classmapping rules, so the map permission doesn't own any of the
data in the list and this list should be destroyed when the AST is
reset.

When resetting a perm, destroy the classperms list without destroying
the data in the list.

Signed-off-by: James Carter <jwcart2@gmail.com>

Diff: diff --git a/libsepol/cil/src/cil_reset_ast.c b/libsepol/cil/src/cil_reset_ast.c
index db70a535..89f91e56 100644
--- a/libsepol/cil/src/cil_reset_ast.c
+++ b/libsepol/cil/src/cil_reset_ast.c
@@ -34,11 +34,11 @@ static void cil_reset_class(struct cil_class *class)
 	class->ordered = CIL_FALSE;
 }
 
 static void cil_reset_perm(struct cil_perm *perm)
 {
-	cil_reset_classperms_list(perm->classperms);
+	cil_list_destroy(&perm->classperms, CIL_FALSE);
 }
 
 static inline void cil_reset_classperms(struct cil_classperms *cp)
 {
 	if (cp == NULL) {

Vulnerable code: 	cil_reset_classperms_list(perm->classperms);
Fixed code: 	cil_list_destroy(&perm->classperms, CIL_FALSE);
CVE-2021-36086: Use After Free (CWE-416)
value: The CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from cil_reset_classperms_set and cil_reset_classperms_list).
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 3.3
Published: 2021-07-01T03:15Z
Repository: https://github.com/SELinuxProject/selinux
Language: C
Files changed: libsepol/cil/src/cil_reset_ast.c
Commit date: 2021-04-19 10:40:35 -0400
Commit message: libsepol/cil: cil_reset_classperms_set() should not reset classpermission

In struct cil_classperms_set, the set field is a pointer to a
struct cil_classpermission which is looked up in the symbol table.
Since the cil_classperms_set does not create the cil_classpermission,
it should not reset it.

Set the set field to NULL instead of resetting the classpermission
that it points to.

Signed-off-by: James Carter <jwcart2@gmail.com>

Diff: diff --git a/libsepol/cil/src/cil_reset_ast.c b/libsepol/cil/src/cil_reset_ast.c
index 89f91e568..1d9ca704e 100644
--- a/libsepol/cil/src/cil_reset_ast.c
+++ b/libsepol/cil/src/cil_reset_ast.c
@@ -57,11 +57,15 @@ static void cil_reset_classpermission(struct cil_classpermission *cp)
 	cil_list_destroy(&cp->classperms, CIL_FALSE);
 }
 
 static void cil_reset_classperms_set(struct cil_classperms_set *cp_set)
 {
-	cil_reset_classpermission(cp_set->set);
+	if (cp_set == NULL) {
+		return;
+	}
+
+	cp_set->set = NULL;
 }
 
 static inline void cil_reset_classperms_list(struct cil_list *cp_list)
 {
 	struct cil_list_item *curr;

Vulnerable code: 	cil_reset_classpermission(cp_set->set);
Fixed code: 	if (cp_set == NULL) {
		return;
	}

	cp_set->set = NULL;
CVE-2005-10002: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: A vulnerability, which was classified as critical, was found in almosteffortless secure-files Plugin up to 1.1 on WordPress. Affected is the function sf_downloads of the file secure-files.php. The manipulation of the argument downloadfile leads to path traversal. Upgrading to version 1.2 is able to address this issue. The name of the patch is cab025e5fc2bcdad8032d833ebc38e6bd2a13c92. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-243804.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 9.8
Published: 2023-10-29T15:15Z
Repository: https://github.com/wp-plugins/secure-files
Language: PHP
Files changed: secure-files.php
Commit date: 2005-10-03 05:40:29 +0000
Commit message: Fixed potential security exploit.

git-svn-id: https://plugins.svn.wordpress.org/secure-files/trunk@3641 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/secure-files.php b/secure-files.php
index c55fc3b..5cf7bfe 100755
--- a/secure-files.php
+++ b/secure-files.php
@@ -2,11 +2,11 @@
 /*
 Plugin Name: Secure Files
 Plugin URI: http://www.almosteffortless.com/wordpress/
 Description: This plugin allows you to upload and download files from outside of your web document root for security purposes. When used in conjunction with a plugin that requires a user to be logged in to see your site, you can restrict file downloads to users that are logged in. It can be found in Manage -> Secure Files.
 Author: Trevor Turk
-Version: 1.1
+Version: 1.2
 Author URI: http://www.almosteffortless.com/
 */ 
 
 /*  Copyright 2005  Trevor Turk  (email : trevorturk@yahoo.com)
 
@@ -65,11 +65,11 @@ Author URI: http://www.almosteffortless.com/
 	function sf_downloads() {
 		$sf_prefix = get_option('sf_prefix');
 		if (isset($_GET["$sf_prefix"])) {
 			$downloadfile = $_GET["$sf_prefix"];
 			$sf_directory = get_option('sf_directory');
-			$downloadfile = $sf_directory . $downloadfile;
+			$downloadfile = $sf_directory . basename($downloadfile);
 			if (is_file($downloadfile)) {
 				header('Content-Description: File Transfer'); 
 				header('Content-Type: application/force-download'); 
 				header('Content-Length: ' . filesize($downloadfile)); 
 				header('Content-Disposition: attachment; filename="' . basename($downloadfile).'"'); 

Vulnerable code: Version: 1.1
			$downloadfile = $sf_directory . $downloadfile;
Fixed code: Version: 1.2
			$downloadfile = $sf_directory . basename($downloadfile);