Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2018-10364: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: BigTree before 4.2.22 has XSS in the Users management page via the name or company field.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2018-04-30T21:29Z
Repository: https://github.com/bigtreecms/BigTree-CMS
Language: PHP
Files changed: core/inc/bigtree/admin.php
Commit date: 2018-04-06 10:43:18 -0400
Commit message: Fixing XSS injection via user profile editing -- thanks zhzzhz:
https://github.com/bigtreecms/BigTree-CMS/issues/332

Diff: diff --git a/core/inc/bigtree/admin.php b/core/inc/bigtree/admin.php
index ecddc0d79..7e39b1a35 100755
--- a/core/inc/bigtree/admin.php
+++ b/core/inc/bigtree/admin.php
@@ -8417,16 +8417,13 @@
 		*/
 
 		function updateProfile($data) {
 			global $bigtree;
 
-			foreach ($data as $key => $val) {
-				if (substr($key,0,1) != "_" && !is_array($val)) {
-					$$key = sqlescape($val);
-				}
-			}
-
+			$name = sqlescape(htmlspecialchars($data["name"]));
+			$company = sqlescape(htmlspecialchars($data["company"]));
+			$daily_digest = $data["daily_digest"] ? "on" : "";
 			$id = sqlescape($this->ID);
 
 			if ($data["password"]) {
 				$phpass = new PasswordHash($bigtree["config"]["password_depth"], TRUE);
 				$password = sqlescape($phpass->HashPassword($data["password"]));

Vulnerable code: 			foreach ($data as $key => $val) {
				if (substr($key,0,1) != "_" && !is_array($val)) {
					$$key = sqlescape($val);
				}
			}

Fixed code: 			$name = sqlescape(htmlspecialchars($data["name"]));
			$company = sqlescape(htmlspecialchars($data["company"]));
			$daily_digest = $data["daily_digest"] ? "on" : "";
CVE-2018-10574: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: site/index.php/admin/trees/add/ in BigTree 4.2.22 and earlier allows remote attackers to upload and execute arbitrary PHP code because the BigTreeStorage class in core/inc/bigtree/apis/storage.php does not prevent uploads of .htaccess files.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 9.8
Published: 2018-04-30T20:29Z
Repository: https://github.com/bigtreecms/BigTree-CMS
Language: PHP
Files changed: core/inc/bigtree/apis/storage.php
Commit date: 2018-04-30 14:07:31 -0400
Commit message: Rejecting htaccess files:
https://github.com/bigtreecms/BigTree-CMS/issues/335

Diff: diff --git a/core/inc/bigtree/apis/storage.php b/core/inc/bigtree/apis/storage.php
index e6d4bcb94b..582bb7e4dd 100755
--- a/core/inc/bigtree/apis/storage.php
+++ b/core/inc/bigtree/apis/storage.php
@@ -6,11 +6,11 @@
 
 	class BigTreeStorage {
 
 		var $AutoJPEG = false;
 		var $DisabledFileError = false;
-		var $DisabledExtensionRegEx = '/\\.(exe|com|bat|php|rb|py|cgi|pl|sh|asp|aspx|phtml|pht)/i';
+		var $DisabledExtensionRegEx = '/\\.(exe|com|bat|php|rb|py|cgi|pl|sh|asp|aspx|phtml|pht|htaccess)/i';
 		var $Service = "";
 		var $Cloud = false;
 		var $Settings;
 
 		/*

Vulnerable code: 		var $DisabledExtensionRegEx = '/\\.(exe|com|bat|php|rb|py|cgi|pl|sh|asp|aspx|phtml|pht)/i';
Fixed code: 		var $DisabledExtensionRegEx = '/\\.(exe|com|bat|php|rb|py|cgi|pl|sh|asp|aspx|phtml|pht|htaccess)/i';
CVE-2023-5810: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability, which was classified as problematic, has been found in flusity CMS. This issue affects the function loadPostAddForm of the file core/tools/posts.php. The manipulation of the argument edit_post_id leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The identifier of the patch is 6943991c62ed87c7a57989a0cb7077316127def8. It is recommended to apply a patch to fix this issue. The identifier VDB-243641 was assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2023-10-27T01:15Z
Repository: https://github.com/flusity/flusity-CMS
Language: PHP
Files changed: core/tools/posts.php
Commit date: 2023-10-24 13:49:20 +0300
Commit message: Update posts.php

pataisyta kodo vieta 274 eilutė core/tools/posts.php 

Signed-off-by: Darius Jakaitis <105962203+flusity@users.noreply.github.com>
Diff: diff --git a/core/tools/posts.php b/core/tools/posts.php
index 1b3aa73..f23138c 100644
--- a/core/tools/posts.php
+++ b/core/tools/posts.php
@@ -270,16 +270,20 @@ $('#confirm-delete-post-btn').on('click', function () {
   });
 
 </script>
 <?php
 if (isset($_GET['edit_post_id'])) {
-    $edit_post_id = $_GET['edit_post_id'];
-    echo "<script>loadPostEditForm($edit_post_id);</script>";
+    $edit_post_id = filter_input(INPUT_GET, 'edit_post_id', FILTER_SANITIZE_NUMBER_INT);
+    $safe_edit_post_id = htmlspecialchars($edit_post_id, ENT_QUOTES, 'UTF-8');
+    echo "<script>loadPostEditForm($safe_edit_post_id);</script>";
 }
+
 if (isset($_GET['menu_id'])) {
-    $menu_id = $_GET['menu_id'];
-    echo "<script>loadPostAddForm($menu_id);</script>";
+    $menu_id = filter_input(INPUT_GET, 'menu_id', FILTER_SANITIZE_NUMBER_INT);
+    $safe_menu_id = htmlspecialchars($menu_id, ENT_QUOTES, 'UTF-8');
+    echo "<script>loadPostAddForm($safe_menu_id);</script>";
 }
+
 ?>
 <script src="js/admin-post-edit.js"></script>
 
 <?php require_once ROOT_PATH . 'core/template/admin-footer.php';?>

Vulnerable code:     $edit_post_id = $_GET['edit_post_id'];
    echo "<script>loadPostEditForm($edit_post_id);</script>";
    $menu_id = $_GET['menu_id'];
    echo "<script>loadPostAddForm($menu_id);</script>";
Fixed code:     $edit_post_id = filter_input(INPUT_GET, 'edit_post_id', FILTER_SANITIZE_NUMBER_INT);
    $safe_edit_post_id = htmlspecialchars($edit_post_id, ENT_QUOTES, 'UTF-8');
    echo "<script>loadPostEditForm($safe_edit_post_id);</script>";

    $menu_id = filter_input(INPUT_GET, 'menu_id', FILTER_SANITIZE_NUMBER_INT);
    $safe_menu_id = htmlspecialchars($menu_id, ENT_QUOTES, 'UTF-8');
    echo "<script>loadPostAddForm($safe_menu_id);</script>";
CVE-2023-5811: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability, which was classified as problematic, was found in flusity CMS. Affected is the function loadPostAddForm of the file core/tools/posts.php. The manipulation of the argument menu_id leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as 6943991c62ed87c7a57989a0cb7077316127def8. It is recommended to apply a patch to fix this issue. VDB-243642 is the identifier assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2023-10-27T01:15Z
Repository: https://github.com/flusity/flusity-CMS
Language: PHP
Files changed: core/tools/posts.php
Commit date: 2023-10-24 13:49:20 +0300
Commit message: Update posts.php

pataisyta kodo vieta 274 eilutė core/tools/posts.php 

Signed-off-by: Darius Jakaitis <105962203+flusity@users.noreply.github.com>
Diff: diff --git a/core/tools/posts.php b/core/tools/posts.php
index 1b3aa73..f23138c 100644
--- a/core/tools/posts.php
+++ b/core/tools/posts.php
@@ -270,16 +270,20 @@ $('#confirm-delete-post-btn').on('click', function () {
   });
 
 </script>
 <?php
 if (isset($_GET['edit_post_id'])) {
-    $edit_post_id = $_GET['edit_post_id'];
-    echo "<script>loadPostEditForm($edit_post_id);</script>";
+    $edit_post_id = filter_input(INPUT_GET, 'edit_post_id', FILTER_SANITIZE_NUMBER_INT);
+    $safe_edit_post_id = htmlspecialchars($edit_post_id, ENT_QUOTES, 'UTF-8');
+    echo "<script>loadPostEditForm($safe_edit_post_id);</script>";
 }
+
 if (isset($_GET['menu_id'])) {
-    $menu_id = $_GET['menu_id'];
-    echo "<script>loadPostAddForm($menu_id);</script>";
+    $menu_id = filter_input(INPUT_GET, 'menu_id', FILTER_SANITIZE_NUMBER_INT);
+    $safe_menu_id = htmlspecialchars($menu_id, ENT_QUOTES, 'UTF-8');
+    echo "<script>loadPostAddForm($safe_menu_id);</script>";
 }
+
 ?>
 <script src="js/admin-post-edit.js"></script>
 
 <?php require_once ROOT_PATH . 'core/template/admin-footer.php';?>

Vulnerable code:     $edit_post_id = $_GET['edit_post_id'];
    echo "<script>loadPostEditForm($edit_post_id);</script>";
    $menu_id = $_GET['menu_id'];
    echo "<script>loadPostAddForm($menu_id);</script>";
Fixed code:     $edit_post_id = filter_input(INPUT_GET, 'edit_post_id', FILTER_SANITIZE_NUMBER_INT);
    $safe_edit_post_id = htmlspecialchars($edit_post_id, ENT_QUOTES, 'UTF-8');
    echo "<script>loadPostEditForm($safe_edit_post_id);</script>";

    $menu_id = filter_input(INPUT_GET, 'menu_id', FILTER_SANITIZE_NUMBER_INT);
    $safe_menu_id = htmlspecialchars($menu_id, ENT_QUOTES, 'UTF-8');
    echo "<script>loadPostAddForm($safe_menu_id);</script>";
CVE-2023-47129: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: Statmic is a core Laravel content management system Composer package. Prior to versions 3.4.13 and 4.33.0, on front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded. This only affects forms using the "Forms" feature and not just _any_ arbitrary form. This does not affect the control panel. This issue has been patched in 3.4.13 and 4.33.0.

CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 9.8
Published: 2023-11-10T19:15Z
Repository: https://github.com/statamic/cms
Language: PHP
Files changed: src/Http/Controllers/FormController.php
Commit date: 2023-11-10 10:11:25 -0500
Commit message: [4.x] Front-end form asset field php file validation (#8968)


Diff: diff --git a/src/Http/Controllers/FormController.php b/src/Http/Controllers/FormController.php
index 2d8391edb..1fb0adc8e 100644
--- a/src/Http/Controllers/FormController.php
+++ b/src/Http/Controllers/FormController.php
@@ -175,11 +175,15 @@ class FormController extends Controller
         $assetFieldRules = $fields->all()
             ->filter(function ($field) {
                 return $field->fieldtype()->handle() === 'assets';
             })
             ->mapWithKeys(function ($field) {
-                return [$field->handle().'.*' => 'file'];
+                return [$field->handle().'.*' => ['file', function ($attribute, $value, $fail) {
+                    if (in_array(trim(strtolower($value->getClientOriginalExtension())), ['php', 'php3', 'php4', 'php5', 'phtml'])) {
+                        $fail(__('validation.uploaded'));
+                    }
+                }]];
             })
             ->all();
 
         return $assetFieldRules;
     }

Vulnerable code:                 return [$field->handle().'.*' => 'file'];
Fixed code:                 return [$field->handle().'.*' => ['file', function ($attribute, $value, $fail) {
                    if (in_array(trim(strtolower($value->getClientOriginalExtension())), ['php', 'php3', 'php4', 'php5', 'phtml'])) {
                        $fail(__('validation.uploaded'));
                    }
                }]];
CVE-2019-17383: Incorrect Default Permissions (CWE-276)
value: The netaddr gem before 2.0.4 for Ruby has misconfigured file permissions, such that a gem install may result in 0777 permissions in the target filesystem.
CWE description: During installation, installed file permissions are set to allow anyone to modify those files.
CVSS v3 base score: 9.8
Published: 2019-10-09T16:15Z
Repository: https://github.com/dspinhirne/netaddr-rb
Language: Unknown
Commit date: 2019-10-03 08:55:42 -0500
Commit message: Merge pull request #20 from infakt-HNP/master

FIX for file permissions - using too high causes that gem install set 777 on files installed in system
CVE-2022-35411: Insufficiently Protected Credentials (CWE-522)
value: rpc.py through 0.6.0 allows Remote Code Execution because an unpickle occurs when the "serializer: pickle" HTTP header is sent. In other words, although JSON (not Pickle) is the default data format, an unauthenticated client can cause the data to be processed with unpickle.
CWE description: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CVSS v3 base score: 9.8
Published: 2022-07-08T19:15Z
Repository: https://github.com/abersheeran/rpc.py
Language: Python
Files changed: rpcpy/serializers.py
Commit date: 2022-07-06 12:55:59 +0800
Commit message: PickleSerializer is turned off by default
Diff: diff --git a/rpcpy/serializers.py b/rpcpy/serializers.py
index 4ae3eac..742998b 100644
--- a/rpcpy/serializers.py
+++ b/rpcpy/serializers.py
@@ -106,20 +106,25 @@ class CBORSerializer(BaseSerializer):
 
     def decode(self, data: bytes) -> typing.Any:
         return cbor.loads(data)
 
 
+# Since the release of pickle to the external network may lead to
+# arbitrary code execution vulnerabilities, this serialization
+# method is not enabled by default. It is recommended to turn it on
+# when there is physical isolation from the outside.
+
 SERIALIZER_NAMES = {
     JSONSerializer.name: JSONSerializer(),
-    PickleSerializer.name: PickleSerializer(),
+    # PickleSerializer.name: PickleSerializer(),
     MsgpackSerializer.name: MsgpackSerializer(),
     CBORSerializer.name: CBORSerializer(),
 }
 
 SERIALIZER_TYPES = {
     JSONSerializer.content_type: JSONSerializer(),
-    PickleSerializer.content_type: PickleSerializer(),
+    # PickleSerializer.content_type: PickleSerializer(),
     MsgpackSerializer.content_type: MsgpackSerializer(),
     CBORSerializer.content_type: CBORSerializer(),
 }
 
 

Vulnerable code:     PickleSerializer.name: PickleSerializer(),
    PickleSerializer.content_type: PickleSerializer(),
Fixed code: # Since the release of pickle to the external network may lead to
# arbitrary code execution vulnerabilities, this serialization
# method is not enabled by default. It is recommended to turn it on
# when there is physical isolation from the outside.

    # PickleSerializer.name: PickleSerializer(),
    # PickleSerializer.content_type: PickleSerializer(),
CVE-2021-37524: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross Site Scripting (XSS) vulnerability in FusionPBX 4.5.26 allows remote unauthenticated users to inject arbitrary web script or HTML via an unsanitized "path" parameter in resources/login.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-07-01T18:15Z
Repository: https://github.com/fusionpbx/fusionpbx
Language: PHP
Files changed: resources/login.php
Commit date: 2021-07-25 13:59:10 -0600
Commit message: Fix XSS on login page by removing $_REQUEST[path]

Diff: diff --git a/resources/login.php b/resources/login.php
index 03f2ddaa9..8c743553f 100644
--- a/resources/login.php
+++ b/resources/login.php
@@ -240,15 +240,10 @@
 	$msg = isset($_GET["msg"]) ? $_GET["msg"] : null;
 
 //set variable if not set
 	if (!isset($_SESSION['login']['domain_name_visible']['boolean'])) { $_SESSION['login']['domain_name_visible']['boolean'] = null; }
 
-//set the requested destination after login
-	if (!empty($_REQUEST['path'])) {
-		$_SESSION['login']['destination']['url'] = $_REQUEST['path'];
-	}
-
 //set a default login destination
 	if (strlen($_SESSION['login']['destination']['url']) == 0) {
 		$_SESSION['login']['destination']['url'] = PROJECT_PATH."/core/user_settings/user_dashboard.php";
 	}
 

Vulnerable code: //set the requested destination after login
	if (!empty($_REQUEST['path'])) {
		$_SESSION['login']['destination']['url'] = $_REQUEST['path'];
	}
CVE-2021-43406: Improper Input Validation (CWE-20)
value: An issue was discovered in FusionPBX before 4.5.30. The fax_post_size may have risky characters (it is not constrained to preset values).
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 8.8
Published: 2021-11-05T18:15Z
Repository: https://github.com/fusionpbx/fusionpbx
Language: PHP
Files changed: app/fax/fax_send.php
Commit date: 2021-11-03 09:38:01 -0600
Commit message: Force the fax_page_size to only preset allowed values.
Diff: diff --git a/app/fax/fax_send.php b/app/fax/fax_send.php
index 9e1c651f4f..451db849d0 100644
--- a/app/fax/fax_send.php
+++ b/app/fax/fax_send.php
@@ -308,13 +308,17 @@ if (!function_exists('fax_split_dtmf')) {
 			case 'legal' :
 				$page_width = 8.5; //in
 				$page_height = 14; //in
 				break;
 			case 'letter' :
+				$page_width = 8.5; //in
+				$page_height = 11; //in
+				break;
 			default	:
 				$page_width = 8.5; //in
 				$page_height = 11; //in
+				$fax_page_size = 'letter';
 		}
 
 		//set resolution
 		switch ($fax_resolution) {
 			case 'fine':

Fixed code: 				$page_width = 8.5; //in
				$page_height = 11; //in
				break;
				$fax_page_size = 'letter';
CVE-2016-9888: NULL Pointer Dereference (CWE-476)
value: An error within the "tar_directory_for_file()" function (gsf-infile-tar.c) in GNOME Structured File Library before 1.14.41 can be exploited to trigger a Null pointer dereference and subsequently cause a crash via a crafted TAR file.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2016-12-08T08:59Z
Repository: https://github.com/GNOME/libgsf
Language: Other
Files changed: ChangeLog, NEWS, gsf/gsf-infile-tar.c
Commit date: 2016-12-02 22:19:54 -0500
Commit message: tar: fix crash on broken tar file.

Diff: diff --git a/ChangeLog b/ChangeLog
index c891943..18508ec 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
+2016-11-30  Morten Welinder  <terra@gnome.org>
+
+	* gsf/gsf-infile-tar.c (tar_directory_for_file): Handle the case
+	where what we expected to be a directory is a file.  (That implies
+	a corrupted tar file.)  Thanks to Behzad Najjarpour Jabbari,
+	Secunia Research at Flexera Software for discovering this.
+
 2016-08-20  Morten Welinder <terra@gnome.org>
 
 	* configure.ac: Post-release bump.
 
 2016-08-20  Morten Welinder <terra@gnome.org>
diff --git a/NEWS b/NEWS
index 01cc67a..cfc1e43 100644
--- a/NEWS
+++ b/NEWS
@@ -1,7 +1,10 @@
 libgsf 1.14.41
 
+Morten:
+	* Fix corrupted-tar-file crash.
+
 --------------------------------------------------------------------------
 libgsf 1.14.40
 
 Morten:
 	* Avoid gnome-common dependency
diff --git a/gsf/gsf-infile-tar.c b/gsf/gsf-infile-tar.c
index 271595d..17513fe 100644
--- a/gsf/gsf-infile-tar.c
+++ b/gsf/gsf-infile-tar.c
@@ -179,13 +179,15 @@ tar_directory_for_file (GsfInfileTar *dir, const char *name, gboolean last)
 		if (strcmp (dirname, ".") != 0) {
 			GsfInput *subdir =
 				gsf_infile_child_by_name (GSF_INFILE (dir),
 							  dirname);
 			if (subdir) {
+				dir = GSF_IS_INFILE_TAR (subdir)
+					? GSF_INFILE_TAR (subdir)
+					: dir;
 				/* Undo the ref. */
 				g_object_unref (subdir);
-				dir = GSF_INFILE_TAR (subdir);
 			} else
 				dir = tar_create_dir (dir, dirname);
 		}
 
 		g_free (dirname);

Vulnerable code: 				dir = GSF_INFILE_TAR (subdir);
Fixed code: 2016-11-30  Morten Welinder  <terra@gnome.org>

	* gsf/gsf-infile-tar.c (tar_directory_for_file): Handle the case
	where what we expected to be a directory is a file.  (That implies
	a corrupted tar file.)  Thanks to Behzad Najjarpour Jabbari,
	Secunia Research at Flexera Software for discovering this.

Morten:
	* Fix corrupted-tar-file crash.

				dir = GSF_IS_INFILE_TAR (subdir)
					? GSF_INFILE_TAR (subdir)
					: dir;
CVE-2021-32740: Uncontrolled Resource Consumption (CWE-400)
value: Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical usage, templates would not normally be read from untrusted user input, but nonetheless, no previous security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected. The vulnerability is patched in version 2.8.0. As a workaround, only create Template objects from trusted sources that have been validated not to produce catastrophic backtracking.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 7.5
Published: 2021-07-06T15:15Z
Repository: https://github.com/sporkmonger/addressable
Language: Markdown
Files changed: CHANGELOG.md
Commit date: 2021-07-02 21:10:39 -0700
Commit message: Adding note about ReDoS vulnerability

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 53de839..4a9f866 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,7 @@
 # Addressable 2.8.0
+- fixes ReDoS vulnerability in Addressable::Template#match
 - no longer replaces `+` with spaces in queries for non-http(s) schemes
 - fixed encoding ipv6 literals
 - the `:compacted` flag for `normalized_query` now dedupes parameters
 - fix broken `escape_component` alias
 - dropping support for Ruby 2.0 and 2.1

Fixed code: - fixes ReDoS vulnerability in Addressable::Template#match
CVE-2020-15261: Unquoted Search Path or Element (CWE-428)
value: On Windows the Veyon Service before version 4.4.2 contains an unquoted service path vulnerability, allowing locally authenticated users with administrative privileges to run malicious executables with LocalSystem privileges. Since Veyon users (both students and teachers) usually don't have administrative privileges, this vulnerability is only dangerous in anyway unsafe setups. The problem has been fixed in version 4.4.2. As a workaround, the exploitation of the vulnerability can be prevented by revoking administrative privileges from all potentially untrustworthy users.
CWE description: The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.
CVSS v3 base score: 6.7
Published: 2020-10-19T22:15Z
Repository: https://github.com/veyon/veyon
Language: C++
Files changed: plugins/platform/windows/WindowsServiceControl.cpp
Commit date: 2020-09-01 10:09:31 +0200
Commit message: WindowsServiceControl: quote service binary path

Fix unquoted service path vulnerability.

Closes #657.

Diff: diff --git a/plugins/platform/windows/WindowsServiceControl.cpp b/plugins/platform/windows/WindowsServiceControl.cpp
index be047a99..ea505d8f 100644
--- a/plugins/platform/windows/WindowsServiceControl.cpp
+++ b/plugins/platform/windows/WindowsServiceControl.cpp
@@ -156,20 +156,22 @@ bool WindowsServiceControl::stop()
 
 
 
 bool WindowsServiceControl::install( const QString& filePath, const QString& displayName  )
 {
+	const auto binaryPath = QStringLiteral("\"%1\"").arg( QString( filePath ).replace( QLatin1Char('"'), QString() ) );
+
 	m_serviceHandle = CreateService(
 				m_serviceManager,		// SCManager database
 				WindowsCoreFunctions::toConstWCharArray( m_name ),	// name of service
 				WindowsCoreFunctions::toConstWCharArray( displayName ),// name to display
 				SERVICE_ALL_ACCESS,	// desired access
 				SERVICE_WIN32_OWN_PROCESS,
 				// service type
 				SERVICE_AUTO_START,	// start type
 				SERVICE_ERROR_NORMAL,	// error control type
-				WindowsCoreFunctions::toConstWCharArray( filePath ),		// service's binary
+				WindowsCoreFunctions::toConstWCharArray( binaryPath ),		// service's binary
 				nullptr,			// no load ordering group
 				nullptr,			// no tag identifier
 				L"Tcpip\0RpcSs\0\0",		// dependencies
 				nullptr,			// LocalSystem account
 				nullptr );			// no password

Vulnerable code: 				WindowsCoreFunctions::toConstWCharArray( filePath ),		// service's binary
Fixed code: 	const auto binaryPath = QStringLiteral("\"%1\"").arg( QString( filePath ).replace( QLatin1Char('"'), QString() ) );

				WindowsCoreFunctions::toConstWCharArray( binaryPath ),		// service's binary
CVE-2023-26153: Deserialization of Untrusted Data (CWE-502)
value: Versions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geo_location' cookie. This issue can be exploited remotely via a malicious cookie value.**Note:** An attacker can use this vulnerability to execute commands on the host system.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 9.8
Published: 2023-10-06T05:15Z
Repository: https://github.com/geokit/geokit-rails
Language: Markdown
Files changed: CHANGELOG.md
Commit date: 2023-01-21 03:18:23 -0600
Commit message: Re-enabled and fixed up tests and removed YAML support.

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index f4c73bc..85912a8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,10 @@
+## 2.5.0
+
+* Fixed dangerous YAML loading vulnerability
+* Rebuilt integration tests
+
 ## 2.3.2
 
 * Fix sqlite3 adapter error
 
 ## 2.3.1

Fixed code: ## 2.5.0

* Fixed dangerous YAML loading vulnerability
* Rebuilt integration tests
CVE-2023-26153: Deserialization of Untrusted Data (CWE-502)
value: Versions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geo_location' cookie. This issue can be exploited remotely via a malicious cookie value.**Note:** An attacker can use this vulnerability to execute commands on the host system.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 9.8
Published: 2023-10-06T05:15Z
Repository: https://github.com/geokit/geokit-rails
Language: Unknown
Commit date: 2023-01-21 03:19:58 -0600
Commit message: Merge pull request #159 from geokit/tests2023

Tests 2023
CVE-2018-16733: Improper Input Validation (CWE-20)
value: In Go Ethereum (aka geth) before 1.8.14, TraceChain in eth/api_tracer.go does not verify that the end block is after the start block.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 7.5
Published: 2018-09-08T15:29Z
Repository: https://github.com/ethereum/go-ethereum
Language: Go
Files changed: eth/api_tracer.go
Commit date: 2018-08-21 09:48:53 +0200
Commit message: eth: ensure from<to when tracing chain (credits Chen Nan via bugbounty)

Diff: diff --git a/eth/api_tracer.go b/eth/api_tracer.go
index 722e2a6e3..704a6cdba 100644
--- a/eth/api_tracer.go
+++ b/eth/api_tracer.go
@@ -117,10 +117,13 @@ func (api *PrivateDebugAPI) TraceChain(ctx context.Context, start, end rpc.Block
 		return nil, fmt.Errorf("starting block #%d not found", start)
 	}
 	if to == nil {
 		return nil, fmt.Errorf("end block #%d not found", end)
 	}
+	if from.Number().Cmp(to.Number()) >= 0 {
+		return nil, fmt.Errorf("end block (#%d) needs to come after start block (#%d)", end, start)
+	}
 	return api.traceChain(ctx, from, to, config)
 }
 
 // traceChain configures a new tracer according to the provided configuration, and
 // executes all the transactions contained within. The return value will be one item

Fixed code: 	if from.Number().Cmp(to.Number()) >= 0 {
		return nil, fmt.Errorf("end block (#%d) needs to come after start block (#%d)", end, start)
	}
CVE-2020-26240: Incorrect Calculation (CWE-682)
value: Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. An ethash mining DAG generation flaw in Geth before version 1.9.24 could cause miners to erroneously calculate PoW in an upcoming epoch (estimated early January, 2021). This happened on the ETC chain on 2020-11-06. This issue is relevant only for miners, non-mining nodes are unaffected. This issue is fixed as of 1.9.24
CWE description: The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.
CVSS v3 base score: 7.5
Published: 2020-11-25T02:15Z
Repository: https://github.com/ethereum/go-ethereum
Language: Go
Files changed: consensus/ethash/algorithm.go
Commit date: 2020-11-11 21:13:12 +0100
Commit message: consensus/ethash: use 64bit indexes for the DAG generation (#21793)

* Bit boundary fix for the DAG generation routine

* Fix unnecessary conversion warnings

Co-authored-by: Sergey Pavlov <spavlov@gmail.com>
Diff: diff --git a/consensus/ethash/algorithm.go b/consensus/ethash/algorithm.go
index e79c702dc..47d7e51b5 100644
--- a/consensus/ethash/algorithm.go
+++ b/consensus/ethash/algorithm.go
@@ -302,20 +302,20 @@ func generateDataset(dest []uint32, epoch uint64, cache []uint32) {
 
 			// Create a hasher to reuse between invocations
 			keccak512 := makeHasher(sha3.NewLegacyKeccak512())
 
 			// Calculate the data segment this thread should generate
-			batch := uint32((size + hashBytes*uint64(threads) - 1) / (hashBytes * uint64(threads)))
-			first := uint32(id) * batch
+			batch := (size + hashBytes*uint64(threads) - 1) / (hashBytes * uint64(threads))
+			first := uint64(id) * batch
 			limit := first + batch
-			if limit > uint32(size/hashBytes) {
-				limit = uint32(size / hashBytes)
+			if limit > size/hashBytes {
+				limit = size / hashBytes
 			}
 			// Calculate the dataset segment
 			percent := size / hashBytes / 100
 			for index := first; index < limit; index++ {
-				item := generateDatasetItem(cache, index, keccak512)
+				item := generateDatasetItem(cache, uint32(index), keccak512)
 				if swapped {
 					swap(item)
 				}
 				copy(dataset[index*hashBytes:], item)
 

Vulnerable code: 			batch := uint32((size + hashBytes*uint64(threads) - 1) / (hashBytes * uint64(threads)))
			first := uint32(id) * batch
			if limit > uint32(size/hashBytes) {
				limit = uint32(size / hashBytes)
				item := generateDatasetItem(cache, index, keccak512)
Fixed code: 			batch := (size + hashBytes*uint64(threads) - 1) / (hashBytes * uint64(threads))
			first := uint64(id) * batch
			if limit > size/hashBytes {
				limit = size / hashBytes
				item := generateDatasetItem(cache, uint32(index), keccak512)
CVE-2020-26264: Uncontrolled Resource Consumption (CWE-400)
value: Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. In Geth before version 1.9.25 a denial-of-service vulnerability can make a LES server crash via malicious GetProofsV2 request from a connected LES client. This vulnerability only concerns users explicitly enabling les server; disabling les prevents the exploit. The vulnerability was patched in version 1.9.25.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 6.5
Published: 2020-12-11T17:15Z
Repository: https://github.com/ethereum/go-ethereum
Language: Go
Files changed: les/server_handler.go
Commit date: 2020-11-24 10:55:17 +0100
Commit message: les: fix GetProofsV2 bug (#21896)


Diff: diff --git a/les/server_handler.go b/les/server_handler.go
index d3e2c956b3..c0600b3686 100644
--- a/les/server_handler.go
+++ b/les/server_handler.go
@@ -608,10 +608,11 @@ func (h *serverHandler) handleMsg(p *clientPeer, wg *sync.WaitGroup) error {
 		}
 		// Gather state data until the fetch or network limits is reached
 		var (
 			lastBHash common.Hash
 			root      common.Hash
+			header    *types.Header
 		)
 		reqCnt := len(req.Reqs)
 		if accept(req.ReqID, uint64(reqCnt), MaxProofsFetch) {
 			wg.Add(1)
 			go func() {
@@ -622,14 +623,10 @@ func (h *serverHandler) handleMsg(p *clientPeer, wg *sync.WaitGroup) error {
 					if i != 0 && !task.waitOrStop() {
 						sendResponse(req.ReqID, 0, nil, task.servingTime)
 						return
 					}
 					// Look up the root hash belonging to the request
-					var (
-						header *types.Header
-						trie   state.Trie
-					)
 					if request.BHash != lastBHash {
 						root, lastBHash = common.Hash{}, request.BHash
 
 						if header = h.blockchain.GetHeaderByHash(request.BHash); header == nil {
 							p.Log().Warn("Failed to retrieve header for proof", "hash", request.BHash)
@@ -652,10 +649,11 @@ func (h *serverHandler) handleMsg(p *clientPeer, wg *sync.WaitGroup) error {
 						continue
 					}
 					// Open the account or storage trie for the request
 					statedb := h.blockchain.StateCache()
 
+					var trie state.Trie
 					switch len(request.AccKey) {
 					case 0:
 						// No account key specified, open an account trie
 						trie, err = statedb.OpenTrie(root)
 						if trie == nil || err != nil {

Vulnerable code: 					var (
						header *types.Header
						trie   state.Trie
					)
Fixed code: 			header    *types.Header
					var trie state.Trie
CVE-2019-14452: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Sigil before 0.9.16 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2019-07-31T02:15Z
Repository: https://github.com/Sigil-Ebook/Sigil
Language: C++
Files changed: src/Importers/ImportEPUB.cpp
Commit date: 2019-06-26 14:33:01 -0400
Commit message: do not allow zip files to have upward relative path sections

Diff: diff --git a/src/Importers/ImportEPUB.cpp b/src/Importers/ImportEPUB.cpp
index 722815ad..501f49f8 100644
--- a/src/Importers/ImportEPUB.cpp
+++ b/src/Importers/ImportEPUB.cpp
@@ -422,10 +422,18 @@ void ImportEPUB::ExtractContainer()
                 cp437_file_name = cp437->toUnicode(file_name);
             }
 
             // If there is no file name then we can't do anything with it.
             if (!qfile_name.isEmpty()) {
+
+	        // for security reasons we need the file path to always be inside the 
+                // target folder and not outside, so we will remove all relative upward 
+                // paths segments ".." from the file path before prepending the target 
+                // folder to create the final target path
+	        qfile_name = qfile_name.replace("../","");
+                cp437_file_name = cp437_file_name.replace("../","");
+
                 // We use the dir object to create the path in the temporary directory.
                 // Unfortunately, we need a dir ojbect to do this as it's not a static function.
                 QDir dir(m_ExtractedFolderPath);
                 // Full file path in the temporary directory.
                 QString file_path = m_ExtractedFolderPath + "/" + qfile_name;

Fixed code: 
	        // for security reasons we need the file path to always be inside the 
                // target folder and not outside, so we will remove all relative upward 
                // paths segments ".." from the file path before prepending the target 
                // folder to create the final target path
	        qfile_name = qfile_name.replace("../","");
                cp437_file_name = cp437_file_name.replace("../","");
CVE-2023-3532: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository outline/outline prior to 0.70.1.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-07-07T03:15Z
Repository: https://github.com/outline/outline
Language: JSON
Files changed: package.json
Commit date: 2023-07-06 22:00:39 -0400
Commit message: 0.70.1

Diff: diff --git a/package.json b/package.json
index 60c6bb80..91816be3 100644
--- a/package.json
+++ b/package.json
@@ -336,7 +336,7 @@
     "js-yaml": "^3.14.1",
     "jpeg-js": "0.4.4",
     "qs": "6.9.7",
     "rollup": "^3.14.0"
   },
-  "version": "0.70.0"
+  "version": "0.70.1"
 }

Vulnerable code:   "version": "0.70.0"
Fixed code:   "version": "0.70.1"
CVE-2019-20909: NULL Pointer Dereference (CWE-476)
value: An issue was discovered in GNU LibreDWG through 0.9.3. There is a NULL pointer dereference in the function dwg_encode_LWPOLYLINE in dwg.spec.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2020-07-16T18:15Z
Repository: https://github.com/LibreDWG/libredwg
Language: C
Files changed: src/encode.c
Commit date: 2019-12-31 12:37:00 +0100
Commit message: encode: fix empty FIELD_2DD_VECTOR

Fixes GH #178 null_pointer1 case

Diff: diff --git a/src/encode.c b/src/encode.c
index 5e001337..a4d514dc 100644
--- a/src/encode.c
+++ b/src/encode.c
@@ -279,11 +279,12 @@ static bool env_var_checked_p;
       FIELD_2RD (nam[vcount], dxf);                                           \
     }
 
 #define FIELD_2DD_VECTOR(nam, size, dxf)                                      \
   OVERFLOW_CHECK (nam, _obj->size)                                            \
-  FIELD_2RD (nam[0], dxf);                                                    \
+  if (_obj->size)                                                             \
+    FIELD_2RD (nam[0], dxf);                                                  \
   for (vcount = 1; vcount < (BITCODE_BL)_obj->size; vcount++)                 \
     {                                                                         \
       FIELD_2DD (nam[vcount], FIELD_VALUE (nam[vcount - 1].x),                \
                  FIELD_VALUE (nam[vcount - 1].y), dxf);                       \
     }

Vulnerable code:   FIELD_2RD (nam[0], dxf);                                                    \
Fixed code:   if (_obj->size)                                                             \
    FIELD_2RD (nam[0], dxf);                                                  \
CVE-2019-20915: Out-of-bounds Read (CWE-125)
value: An issue was discovered in GNU LibreDWG through 0.9.3. Crafted input will lead to a heap-based buffer over-read in bit_write_TF in bits.c.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.1
Published: 2020-07-16T18:15Z
Repository: https://github.com/LibreDWG/libredwg
Language: C
Files changed: src/bits.c
Commit date: 2019-12-31 12:37:00 +0100
Commit message: encode: protect from stack under-flow

From GH #178 fuzzing

Diff: diff --git a/src/bits.c b/src/bits.c
index 014b04fe4..b8ccb3220 100644
--- a/src/bits.c
+++ b/src/bits.c
@@ -881,11 +881,11 @@ bit_write_MC (Bit_Chain *dat, BITCODE_MC val)
     }
   for (i = 0; i < 4; i++)
     if (byte[i] & 0x7f)
       break;
 
-  if (byte[i] & 0x40)
+  if (byte[i] & 0x40 && i > 0)
     i--;
   byte[i] &= 0x7f;
   if (negative)
     byte[i] |= 0x40;
   for (j = 4; j >= i; j--)
@@ -951,11 +951,11 @@ bit_write_UMC (Bit_Chain *dat, BITCODE_UMC val)
     }
   for (i = 0; i < 4; i++)
     if (byte[i] & 0x7f)
       break;
 
-  if (byte[i] & 0x40)
+  if (byte[i] & 0x40 && i > 0)
     i--;
   byte[i] &= 0x7f;
   for (j = 4; j >= i; j--)
     bit_write_RC (dat, byte[j]);
 }

Vulnerable code:   if (byte[i] & 0x40)
  if (byte[i] & 0x40)
Fixed code:   if (byte[i] & 0x40 && i > 0)
  if (byte[i] & 0x40 && i > 0)
CVE-2023-26157: Out-of-bounds Read (CWE-125)
value: Versions of the package libredwg before 0.12.5.6384 are vulnerable to Denial of Service (DoS) due to an out-of-bounds read involving section->num_pages in decode_r2007.c.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2024-01-02T05:15Z
Repository: https://github.com/LibreDWG/libredwg
Language: C
Files changed: src/decode_r2007.c
Commit date: 2023-10-05 15:21:41 +0200
Commit message: decode_r2007: fix fuzzing out-of-bounds

reset invalid section->num_pages.
Fixes GH #850

Diff: diff --git a/src/decode_r2007.c b/src/decode_r2007.c
index 78610bb70..3d908fb6e 100644
--- a/src/decode_r2007.c
+++ b/src/decode_r2007.c
@@ -796,10 +796,16 @@ read_data_section (Bit_Chain *sec_dat, Bit_Chain *dat,
   sec_dat->from_version = dat->from_version;
 
   for (i = 0; i < (int)section->num_pages; i++)
     {
       r2007_section_page *section_page = section->pages[i];
+      if (!section_page)
+        {
+          free (decomp);
+          LOG_ERROR ("Failed to find section page %d", (int)i)
+          return DWG_ERR_PAGENOTFOUND;
+        }
       page = get_page (pages_map, section_page->id);
       if (page == NULL)
         {
           free (decomp);
           LOG_ERROR ("Failed to find page %d", (int)section_page->id)
@@ -952,16 +958,15 @@ read_sections_map (Bit_Chain *dat, int64_t size_comp, int64_t size_uncomp,
 #endif
       LOG_POS_DAT (&page)
       LOG_TRACE ("\n")
       section->type = dwg_section_wtype (section->name);
 
-      if (section->num_pages <= 0)
-        continue;
-      if (section->num_pages > 0xf0000)
+      if (section->num_pages <= 0 || section->num_pages > 0xf0000)
         {
           LOG_ERROR ("Invalid num_pages %zu, skip",
                      (size_t)section->num_pages);
+          section->num_pages = 0;
           continue;
         }
 
       section->pages = (r2007_section_page **)calloc (
           (size_t)section->num_pages, sizeof (r2007_section_page *));

Vulnerable code:       if (section->num_pages <= 0)
        continue;
      if (section->num_pages > 0xf0000)
Fixed code:       if (!section_page)
        {
          free (decomp);
          LOG_ERROR ("Failed to find section page %d", (int)i)
          return DWG_ERR_PAGENOTFOUND;
        }
      if (section->num_pages <= 0 || section->num_pages > 0xf0000)
          section->num_pages = 0;
CVE-2016-10746: 7PK - Security Features (CWE-254)
value: libvirt-domain.c in libvirt before 1.3.1 supports virDomainGetTime API calls by guest agents with an RO connection, even though an RW connection was supposed to be required, a different vulnerability than CVE-2019-3886.
CWE description: Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.
CVSS v3 base score: 7.5
Published: 2019-04-18T16:29Z
Repository: https://github.com/libvirt/libvirt
Language: C
Files changed: src/libvirt-domain.c
Commit date: 2016-01-11 13:36:19 +0100
Commit message: virDomainGetTime: Deny on RO connections

We have a policy that if API may end up talking to a guest agent
it should require RW connection. We don't obey the rule in
virDomainGetTime().

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>

Diff: diff --git a/src/libvirt-domain.c b/src/libvirt-domain.c
index 02fc4df45..949184575 100644
--- a/src/libvirt-domain.c
+++ b/src/libvirt-domain.c
@@ -10932,10 +10932,11 @@ virDomainGetTime(virDomainPtr dom,
                      seconds, nseconds, flags);
 
     virResetLastError();
 
     virCheckDomainReturn(dom, -1);
+    virCheckReadOnlyGoto(dom->conn->flags, error);
 
     if (dom->conn->driver->domainGetTime) {
         int ret = dom->conn->driver->domainGetTime(dom, seconds,
                                                    nseconds, flags);
         if (ret < 0)

Fixed code:     virCheckReadOnlyGoto(dom->conn->flags, error);
CVE-2021-3975: Use After Free (CWE-416)
value: A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function in qemuProcessHandleMonitorEOF is called using multiple threads without being adequately protected by a monitor lock. This flaw could be triggered by the virConnectGetAllDomainStats API when the guest is shutting down. An unprivileged client with a read-only connection could use this flaw to perform a denial of service attack by causing the libvirt daemon to crash.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 6.5
Published: 2022-08-23T20:15Z
Repository: https://github.com/libvirt/libvirt
Language: C
Files changed: src/qemu/qemu_process.c
Commit date: 2021-02-24 15:00:51 +0100
Commit message: qemu: Add missing lock in qemuProcessHandleMonitorEOF

qemuMonitorUnregister will be called in multiple threads (e.g. threads
in rpc worker pool and the vm event thread).  In some cases, it isn't
protected by the monitor lock, which may lead to call g_source_unref
more than one time and a use-after-free problem eventually.

Add the missing lock in qemuProcessHandleMonitorEOF (which is the only
position missing lock of monitor I found).

Suggested-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Peng Liang <liangpeng10@huawei.com>
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>

Diff: diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
index d930ff9a74..bfa742577f 100644
--- a/src/qemu/qemu_process.c
+++ b/src/qemu/qemu_process.c
@@ -316,11 +316,13 @@ qemuProcessHandleMonitorEOF(qemuMonitorPtr mon,
     }
 
     /* We don't want this EOF handler to be called over and over while the
      * thread is waiting for a job.
      */
+    virObjectLock(mon);
     qemuMonitorUnregister(mon);
+    virObjectUnlock(mon);
 
     /* We don't want any cleanup from EOF handler (or any other
      * thread) to enter qemu namespace. */
     qemuDomainDestroyNamespace(driver, vm);
 

Fixed code:     virObjectLock(mon);
    virObjectUnlock(mon);
CVE-2021-45470: Inefficient Regular Expression Complexity (CWE-1333)
value: lib/DatabaseLayer.py in cve-search before 4.1.0 allows regular expression injection, which can lead to ReDoS (regular expression denial of service) or other impacts.
CWE description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CVSS v3 base score: 7.5
Published: 2021-12-23T21:15Z
Repository: https://github.com/cve-search/cve-search
Language: Unknown
Commit date: 2021-03-23 20:12:48 +0100
Commit message: Merge pull request #629 from jorgectf/fix-regex-injection