Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2016-7413: Use After Free (CWE-416)
value: Use-after-free vulnerability in the wddx_stack_destroy function in ext/wddx/wddx.c in PHP before 5.6.26 and 7.x before 7.0.11 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a wddxPacket XML document that lacks an end-tag for a recordset field element, leading to mishandling in a wddx_deserialize call.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 9.8
Published: 2016-09-17T21:59Z
Repository: https://github.com/php/php-src
Language: C
Files changed: ext/wddx/tests/bug72860.phpt, ext/wddx/wddx.c
Commit date: 2016-09-12 21:04:23 -0700
Commit message: Fix bug #72860: wddx_deserialize use-after-free

Diff: diff --git a/ext/wddx/tests/bug72860.phpt b/ext/wddx/tests/bug72860.phpt
new file mode 100644
index 00000000000..6385457e8ee
--- /dev/null
+++ b/ext/wddx/tests/bug72860.phpt
@@ -0,0 +1,27 @@
+--TEST--
+Bug #72860: wddx_deserialize use-after-free
+--SKIPIF--
+<?php
+if (!extension_loaded('wddx')) {
+    die('skip. wddx not available');
+}
+?>
+--FILE--
+<?php
+
+$xml=<<<XML
+<?xml version='1.0'?>
+<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
+<wddxPacket version='1.0'>
+       <recordset fieldNames='F'>
+               <field name='F'>
+       </recordset>
+</wddxPacket>
+XML;
+
+var_dump(wddx_deserialize($xml));
+?>
+DONE
+--EXPECT--
+NULL
+DONE
\ No newline at end of file
diff --git a/ext/wddx/wddx.c b/ext/wddx/wddx.c
index d7bd295832c..b02d2f07ded 100644
--- a/ext/wddx/wddx.c
+++ b/ext/wddx/wddx.c
@@ -228,11 +228,12 @@ static int wddx_stack_destroy(wddx_stack *stack)
 {
 	register int i;
 
 	if (stack->elements) {
 		for (i = 0; i < stack->top; i++) {
-			if (((st_entry *)stack->elements[i])->data)	{
+			if (((st_entry *)stack->elements[i])->data
+					&& ((st_entry *)stack->elements[i])->type != ST_FIELD)	{
 				zval_ptr_dtor(&((st_entry *)stack->elements[i])->data);
 			}
 			if (((st_entry *)stack->elements[i])->varname) {
 				efree(((st_entry *)stack->elements[i])->varname);
 			}

Vulnerable code: 			if (((st_entry *)stack->elements[i])->data)	{
Fixed code: --TEST--
Bug #72860: wddx_deserialize use-after-free
--SKIPIF--
<?php
if (!extension_loaded('wddx')) {
    die('skip. wddx not available');
}
?>
--FILE--
<?php

$xml=<<<XML
<?xml version='1.0'?>
<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
<wddxPacket version='1.0'>
       <recordset fieldNames='F'>
               <field name='F'>
       </recordset>
</wddxPacket>
XML;

var_dump(wddx_deserialize($xml));
?>
DONE
--EXPECT--
NULL
DONE
			if (((st_entry *)stack->elements[i])->data
					&& ((st_entry *)stack->elements[i])->type != ST_FIELD)	{
CVE-2016-7416: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: ext/intl/msgformat/msgformat_format.c in PHP before 5.6.26 and 7.x before 7.0.11 does not properly restrict the locale length provided to the Locale class in the ICU library, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a MessageFormatter::formatMessage call with a long first argument.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.5
Published: 2016-09-17T21:59Z
Repository: https://github.com/php/php-src
Language: C
Files changed: ext/intl/msgformat/msgformat_format.c
Commit date: 2016-09-12 21:04:23 -0700
Commit message: Fix bug #73007: add locale length check

Diff: diff --git a/ext/intl/msgformat/msgformat_format.c b/ext/intl/msgformat/msgformat_format.c
index 25c9619133d..9b6df38ee39 100644
--- a/ext/intl/msgformat/msgformat_format.c
+++ b/ext/intl/msgformat/msgformat_format.c
@@ -115,10 +115,12 @@ PHP_FUNCTION( msgfmt_format_message )
 			"msgfmt_format_message: unable to parse input params", 0 TSRMLS_CC );
 
 		RETURN_FALSE;
 	}
 
+	INTL_CHECK_LOCALE_LEN(slocale_len);
+
 	msgformat_data_init(&mfo->mf_data TSRMLS_CC);
 
 	if(pattern && pattern_len) {
 		intl_convert_utf8_to_utf16(&spattern, &spattern_len, pattern, pattern_len, &INTL_DATA_ERROR_CODE(mfo));
 		if( U_FAILURE(INTL_DATA_ERROR_CODE((mfo))) )

Fixed code: 	INTL_CHECK_LOCALE_LEN(slocale_len);
CVE-2016-7480: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12 does not verify that a key is an object, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access) via crafted serialized data.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 9.8
Published: 2017-01-11T07:59Z
Repository: https://github.com/php/php-src
Language: C
Files changed: ext/spl/spl_observer.c
Commit date: 2016-10-10 22:54:29 -0700
Commit message: Fix bug #73257 and bug #73258 - SplObjectStorage unserialize allows use of non-object as key

Diff: diff --git a/ext/spl/spl_observer.c b/ext/spl/spl_observer.c
index c1892058796..ad7887bd287 100644
--- a/ext/spl/spl_observer.c
+++ b/ext/spl/spl_observer.c
@@ -770,10 +770,13 @@ SPL_METHOD(SplObjectStorage, unserialize)
 	}
 
 	--p; /* for ';' */
 	count = Z_LVAL_P(pcount);
 
+	ZVAL_UNDEF(&entry);
+	ZVAL_UNDEF(&inf);
+
 	while (count-- > 0) {
 		spl_SplObjectStorageElement *pelement;
 		zend_string *hash;
 
 		if (*p != ';') {
@@ -785,22 +788,21 @@ SPL_METHOD(SplObjectStorage, unserialize)
 		}
 		/* store reference to allow cross-references between different elements */
 		if (!php_var_unserialize(&entry, &p, s + buf_len, &var_hash)) {
 			goto outexcept;
 		}
-		if (Z_TYPE(entry) != IS_OBJECT) {
-			zval_ptr_dtor(&entry);
-			goto outexcept;
-		}
 		if (*p == ',') { /* new version has inf */
 			++p;
 			if (!php_var_unserialize(&inf, &p, s + buf_len, &var_hash)) {
 				zval_ptr_dtor(&entry);
 				goto outexcept;
 			}
-		} else {
-			ZVAL_UNDEF(&inf);
+		}
+		if (Z_TYPE(entry) != IS_OBJECT) {
+			zval_ptr_dtor(&entry);
+			zval_ptr_dtor(&inf);
+			goto outexcept;
 		}
 
 		hash = spl_object_storage_get_hash(intern, getThis(), &entry);
 		if (!hash) {
 			zval_ptr_dtor(&entry);

Vulnerable code: 		if (Z_TYPE(entry) != IS_OBJECT) {
			zval_ptr_dtor(&entry);
			goto outexcept;
		}
		} else {
			ZVAL_UNDEF(&inf);
Fixed code: 	ZVAL_UNDEF(&entry);
	ZVAL_UNDEF(&inf);

		}
		if (Z_TYPE(entry) != IS_OBJECT) {
			zval_ptr_dtor(&entry);
			zval_ptr_dtor(&inf);
			goto outexcept;
CVE-2016-9933: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Stack consumption vulnerability in the gdImageFillToBorder function in gd.c in the GD Graphics Library (aka libgd) before 2.2.2, as used in PHP before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (segmentation violation) via a crafted imagefilltoborder call that triggers use of a negative color value.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.5
Published: 2017-01-04T20:59Z
Repository: https://github.com/php/php-src
Language: C
Files changed: ext/gd/libgd/gd.c, ext/gd/tests/bug72696.phpt
Commit date: 2016-10-30 14:31:29 -0700
Commit message: Fix #72696: imagefilltoborder stackoverflow on truecolor images

We must not allow negative color values be passed to
gdImageFillToBorder(), because that can lead to infinite recursion
since the recursion termination condition will not necessarily be met.

Diff: diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c
index 058f1c97598..3e7d27a3730 100644
--- a/ext/gd/libgd/gd.c
+++ b/ext/gd/libgd/gd.c
@@ -1745,11 +1745,11 @@ void gdImageFillToBorder (gdImagePtr im, int x, int y, int border, int color)
 	int lastBorder;
 	/* Seek left */
 	int leftLimit = -1, rightLimit;
 	int i, restoreAlphaBlending = 0;
 
-	if (border < 0) {
+	if (border < 0 || color < 0) {
 		/* Refuse to fill to a non-solid border */
 		return;
 	}
 
 	if (!im->trueColor) {
diff --git a/ext/gd/tests/bug72696.phpt b/ext/gd/tests/bug72696.phpt
new file mode 100644
index 00000000000..4f0d9e7f1d2
--- /dev/null
+++ b/ext/gd/tests/bug72696.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #72696 (imagefilltoborder stackoverflow on truecolor images)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$im = imagecreatetruecolor(10, 10);
+imagefilltoborder($im, 0, 0, 1, -2);
+?>
+===DONE===
+--EXPECT--
+===DONE===

Vulnerable code: 	if (border < 0) {
Fixed code: 	if (border < 0 || color < 0) {
--TEST--
Bug #72696 (imagefilltoborder stackoverflow on truecolor images)
--SKIPIF--
<?php
if (!extension_loaded('gd')) die('skip gd extension not available');
?>
--FILE--
<?php
$im = imagecreatetruecolor(10, 10);
imagefilltoborder($im, 0, 0, 1, -2);
?>
===DONE===
--EXPECT--
===DONE===
CVE-2017-11142: Uncontrolled Resource Consumption (CWE-400)
value: In PHP before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a CPU consumption denial of service attack by injecting long form variables, related to main/php_variables.c.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 7.5
Published: 2017-07-10T14:29Z
Repository: https://github.com/php/php-src
Language: Other
Files changed: NEWS, main/php_variables.c
Commit date: 2017-02-02 18:06:15 +0100
Commit message: Fix bug #73807

Diff: diff --git a/NEWS b/NEWS
index 690c7638a3f..3d402c67989 100644
--- a/NEWS
+++ b/NEWS
@@ -1,9 +1,13 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2017 PHP 7.0.17
 
+- Core:
+  . Fixed bug #73807 (Performance problem with processing large post request).
+    (Nikita)
+
 - OpenSSL:
   . Fixed bug #74022 (PHP Fast CGI crashes when reading from a pfx file).
     (Anatol)
 
 - Standard:
diff --git a/main/php_variables.c b/main/php_variables.c
index dc4390c6c82..aa6e426ba38 100644
--- a/main/php_variables.c
+++ b/main/php_variables.c
@@ -237,25 +237,30 @@ PHPAPI void php_register_variable_ex(char *var_name, zval *val, zval *track_vars
 typedef struct post_var_data {
 	smart_str str;
 	char *ptr;
 	char *end;
 	uint64_t cnt;
+
+	/* Bytes in ptr that have already been scanned for '&' */
+	size_t already_scanned;
 } post_var_data_t;
 
 static zend_bool add_post_var(zval *arr, post_var_data_t *var, zend_bool eof)
 {
-	char *ksep, *vsep, *val;
+	char *start, *ksep, *vsep, *val;
 	size_t klen, vlen;
 	size_t new_vlen;
 
 	if (var->ptr >= var->end) {
 		return 0;
 	}
 
-	vsep = memchr(var->ptr, '&', var->end - var->ptr);
+	start = var->ptr + var->already_scanned;
+	vsep = memchr(start, '&', var->end - start);
 	if (!vsep) {
 		if (!eof) {
+			var->already_scanned = var->end - var->ptr;
 			return 0;
 		} else {
 			vsep = var->end;
 		}
 	}
@@ -284,10 +289,11 @@ static zend_bool add_post_var(zval *arr, post_var_data_t *var, zend_bool eof)
 		php_register_variable_safe(var->ptr, val, new_vlen, arr);
 	}
 	efree(val);
 
 	var->ptr = vsep + (vsep != var->end);
+	var->already_scanned = 0;
 	return 1;
 }
 
 static inline int add_post_vars(zval *arr, post_var_data_t *vars, zend_bool eof)
 {

Vulnerable code: 	char *ksep, *vsep, *val;
	vsep = memchr(var->ptr, '&', var->end - var->ptr);
Fixed code: - Core:
  . Fixed bug #73807 (Performance problem with processing large post request).
    (Nikita)


	/* Bytes in ptr that have already been scanned for '&' */
	size_t already_scanned;
	char *start, *ksep, *vsep, *val;
	start = var->ptr + var->already_scanned;
	vsep = memchr(start, '&', var->end - start);
			var->already_scanned = var->end - var->ptr;
	var->already_scanned = 0;
CVE-2017-11142: Uncontrolled Resource Consumption (CWE-400)
value: In PHP before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a CPU consumption denial of service attack by injecting long form variables, related to main/php_variables.c.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 7.5
Published: 2017-07-10T14:29Z
Repository: https://github.com/php/php-src
Language: C
Files changed: main/php_variables.c
Commit date: 2017-06-20 00:23:44 -0700
Commit message: Fix bug #73807

Diff: diff --git a/main/php_variables.c b/main/php_variables.c
index 018e9065824..6da79bddc33 100644
--- a/main/php_variables.c
+++ b/main/php_variables.c
@@ -235,26 +235,31 @@ PHPAPI void php_register_variable_ex(char *var_name, zval *val, zval *track_vars
 typedef struct post_var_data {
 	smart_str str;
 	char *ptr;
 	char *end;
 	uint64_t cnt;
+
+	/* Bytes in ptr that have already been scanned for '&' */
+	size_t already_scanned;
 } post_var_data_t;
 
 static zend_bool add_post_var(zval *arr, post_var_data_t *var, zend_bool eof TSRMLS_DC)
 {
-	char *ksep, *vsep, *val;
+	char *start, *ksep, *vsep, *val;
 	size_t klen, vlen;
 	/* FIXME: string-size_t */
 	unsigned int new_vlen;
 
 	if (var->ptr >= var->end) {
 		return 0;
 	}
 
-	vsep = memchr(var->ptr, '&', var->end - var->ptr);
+	start = var->ptr + var->already_scanned;
+	vsep = memchr(start, '&', var->end - start);
 	if (!vsep) {
 		if (!eof) {
+			var->already_scanned = var->end - var->ptr;
 			return 0;
 		} else {
 			vsep = var->end;
 		}
 	}
@@ -283,10 +288,11 @@ static zend_bool add_post_var(zval *arr, post_var_data_t *var, zend_bool eof TSR
 		php_register_variable_safe(var->ptr, val, new_vlen, arr TSRMLS_CC);
 	}
 	efree(val);
 
 	var->ptr = vsep + (vsep != var->end);
+	var->already_scanned = 0;
 	return 1;
 }
 
 static inline int add_post_vars(zval *arr, post_var_data_t *vars, zend_bool eof TSRMLS_DC)
 {
@@ -302,11 +308,11 @@ static inline int add_post_vars(zval *arr, post_var_data_t *vars, zend_bool eof
 					max_vars);
 			return FAILURE;
 		}
 	}
 
-	if (!eof) {
+	if (!eof && vars->str.c != vars->ptr) {
 		memmove(vars->str.c, vars->ptr, vars->str.len = vars->end - vars->ptr);
 	}
 	return SUCCESS;
 }
 

Vulnerable code: 	char *ksep, *vsep, *val;
	vsep = memchr(var->ptr, '&', var->end - var->ptr);
	if (!eof) {
Fixed code: 
	/* Bytes in ptr that have already been scanned for '&' */
	size_t already_scanned;
	char *start, *ksep, *vsep, *val;
	start = var->ptr + var->already_scanned;
	vsep = memchr(start, '&', var->end - start);
			var->already_scanned = var->end - var->ptr;
	var->already_scanned = 0;
	if (!eof && vars->str.c != vars->ptr) {
CVE-2017-5340: Integer Overflow or Wraparound (CWE-190)
value: Zend/zend_hash.c in PHP before 7.0.15 and 7.1.x before 7.1.1 mishandles certain cases that require large array allocations, which allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow, uninitialized memory access, and use of arbitrary destructor function pointers) via crafted serialized data.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 9.8
Published: 2017-01-11T06:59Z
Repository: https://github.com/php/php-src
Language: C
Files changed: Zend/zend_hash.c
Commit date: 2017-01-02 20:14:05 -0800
Commit message: Fix #73832 - leave the table in a safe state if the size is too big.

Diff: diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
index 322422da155..8b54a3932d0 100644
--- a/Zend/zend_hash.c
+++ b/Zend/zend_hash.c
@@ -173,18 +173,18 @@ static const uint32_t uninitialized_bucket[-HT_MIN_MASK] =
 ZEND_API void ZEND_FASTCALL _zend_hash_init(HashTable *ht, uint32_t nSize, dtor_func_t pDestructor, zend_bool persistent ZEND_FILE_LINE_DC)
 {
 	GC_REFCOUNT(ht) = 1;
 	GC_TYPE_INFO(ht) = IS_ARRAY;
 	ht->u.flags = (persistent ? HASH_FLAG_PERSISTENT : 0) | HASH_FLAG_APPLY_PROTECTION | HASH_FLAG_STATIC_KEYS;
-	ht->nTableSize = zend_hash_check_size(nSize);
 	ht->nTableMask = HT_MIN_MASK;
 	HT_SET_DATA_ADDR(ht, &uninitialized_bucket);
 	ht->nNumUsed = 0;
 	ht->nNumOfElements = 0;
 	ht->nInternalPointer = HT_INVALID_IDX;
 	ht->nNextFreeElement = 0;
 	ht->pDestructor = pDestructor;
+	ht->nTableSize = zend_hash_check_size(nSize);
 }
 
 static void ZEND_FASTCALL zend_hash_packed_grow(HashTable *ht)
 {
 	HT_ASSERT(GC_REFCOUNT(ht) == 1);

Vulnerable code: 	ht->nTableSize = zend_hash_check_size(nSize);
Fixed code: 	ht->nTableSize = zend_hash_check_size(nSize);
CVE-2018-15132: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: An issue was discovered in ext/standard/link_win32.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8. The linkinfo function on Windows doesn't implement the open_basedir check. This could be abused to find files on paths outside of the allowed directories.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 7.5
Published: 2018-08-07T15:29Z
Repository: https://github.com/php/php-src
Language: C
Files changed: ext/standard/link_win32.c
Commit date: 2018-07-16 15:11:56 -0700
Commit message: Fixed bug #76459 windows linkinfo lacks openbasedir check

Diff: diff --git a/ext/standard/link_win32.c b/ext/standard/link_win32.c
index 13ee88dfade..0068a3edb1c 100644
--- a/ext/standard/link_win32.c
+++ b/ext/standard/link_win32.c
@@ -85,24 +85,35 @@ PHP_FUNCTION(readlink)
 /* {{{ proto int linkinfo(string filename)
    Returns the st_dev field of the UNIX C stat structure describing the link */
 PHP_FUNCTION(linkinfo)
 {
 	char *link;
+	char *dirname;
 	size_t link_len;
 	zend_stat_t sb;
 	int ret;
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "p", &link, &link_len) == FAILURE) {
 		return;
 	}
 
+	dirname = estrndup(link, link_len);
+	php_dirname(dirname, link_len);
+
+	if (php_check_open_basedir(dirname)) {
+		efree(dirname);
+		RETURN_FALSE;
+	}
+
 	ret = VCWD_STAT(link, &sb);
 	if (ret == -1) {
 		php_error_docref(NULL, E_WARNING, "%s", strerror(errno));
+		efree(dirname);
 		RETURN_LONG(Z_L(-1));
 	}
 
+	efree(dirname);
 	RETURN_LONG((zend_long) sb.st_dev);
 }
 /* }}} */
 
 /* {{{ proto int symlink(string target, string link)

Fixed code: 	char *dirname;
	dirname = estrndup(link, link_len);
	php_dirname(dirname, link_len);

	if (php_check_open_basedir(dirname)) {
		efree(dirname);
		RETURN_FALSE;
	}

		efree(dirname);
	efree(dirname);
CVE-2018-17082: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a "Transfer-Encoding: chunked" request, because the bucket brigade is mishandled in the php_handler function in sapi/apache2handler/sapi_apache2.c.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2018-09-16T15:29Z
Repository: https://github.com/php/php-src
Language: C
Files changed: sapi/apache2handler/sapi_apache2.c
Commit date: 2018-09-09 11:45:14 -0700
Commit message: Fix for bug #76582

The brigade seems to end up in a messed up state if something fails
in shutdown, so we clean it up.

Diff: diff --git a/sapi/apache2handler/sapi_apache2.c b/sapi/apache2handler/sapi_apache2.c
index 6fa2521c3847..0ebca9bca863 100644
--- a/sapi/apache2handler/sapi_apache2.c
+++ b/sapi/apache2handler/sapi_apache2.c
@@ -676,10 +676,11 @@ zend_first_try {
 } zend_end_try();
 
 	if (!parent_req) {
 		php_apache_request_dtor(r TSRMLS_CC);
 		ctx->request_processed = 1;
+		apr_brigade_cleanup(brigade);
 		bucket = apr_bucket_eos_create(r->connection->bucket_alloc);
 		APR_BRIGADE_INSERT_TAIL(brigade, bucket);
 
 		rv = ap_pass_brigade(r->output_filters, brigade);
 		if (rv != APR_SUCCESS || r->connection->aborted) {

Fixed code: 		apr_brigade_cleanup(brigade);
CVE-2022-45129: Files or Directories Accessible to External Parties (CWE-552)
value: Payara before 2022-11-04, when deployed to the root context, allows attackers to visit META-INF and WEB-INF, a different vulnerability than CVE-2022-37422. This affects Payara Platform Community before 4.1.2.191.38, 5.x before 5.2022.4, and 6.x before 6.2022.1, and Payara Platform Enterprise before 5.45.0.
CWE description: The product makes files or directories accessible to unauthorized actors, even though they should not be.
CVSS v3 base score: 7.5
Published: 2022-11-10T06:15Z
Repository: https://github.com/payara/Payara
Language: Unknown
Commit date: 2022-10-24 16:26:02 +0100
Commit message: Merge pull request #5989 from luiseufrasio/FISH-6603

Fish-6603 New 0-day vulnerability exploit using ROOT context root deployments
CVE-2022-23538: Insufficiently Protected Credentials (CWE-522)
value: github.com/sylabs/scs-library-client is the Go client for the Singularity Container Services (SCS) Container Library Service. When the scs-library-client is used to pull a container image, with authentication, the HTTP Authorization header sent by the client to the library service may be incorrectly leaked to an S3 backing storage provider. This occurs in a specific flow, where the library service redirects the client to a backing S3 storage server, to perform a multi-part concurrent download. Depending on site configuration, the S3 service may be provided by a third party. An attacker with access to the S3 service may be able to extract user credentials, allowing them to impersonate the user. The vulnerable multi-part concurrent download flow, with redirect to S3, is only used when communicating with a Singularity Enterprise 1.x installation, or third party server implementing this flow. Interaction with Singularity Enterprise 2.x, and Singularity Container Services (cloud.sylabs.io), does not trigger the vulnerable flow. We encourage all users to update. Users who interact with a Singularity Enterprise 1.x installation, using a 3rd party S3 storage service, are advised to revoke and recreate their authentication tokens within Singularity Enterprise. There is no workaround available at this time.
CWE description: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CVSS v3 base score: 7.6
Published: 2023-01-17T21:15Z
Repository: https://github.com/sylabs/scs-library-client
Language: Unknown
Commit date: 2023-01-17 11:50:52 +0000
Commit message: Merge pull request from GHSA-7p8m-22h4-9pj7

Add Authorization header when applicable
CVE-2015-6563: Improper Input Validation (CWE-20)
value: The monitor component in sshd in OpenSSH before 7.0 on non-OpenBSD platforms accepts extraneous username data in MONITOR_REQ_PAM_INIT_CTX requests, which allows local users to conduct impersonation attacks by leveraging any SSH login access in conjunction with control of the sshd uid to send a crafted MONITOR_REQ_PWNAM request, related to monitor.c and monitor_wrap.c.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Published: 2015-08-24T01:59Z
Repository: https://github.com/openssh/openssh-portable
Language: C
Files changed: monitor.c, monitor_wrap.c
Commit date: 2015-08-11 13:36:00 +1000
Commit message: Don't resend username to PAM; it already has it.

Pointed out by Moritz Jodeit; ok dtucker@

Diff: diff --git a/monitor.c b/monitor.c
index b4109657..f1b873dc 100644
--- a/monitor.c
+++ b/monitor.c
@@ -1082,13 +1082,11 @@ static void *sshpam_ctxt, *sshpam_authok;
 extern KbdintDevice sshpam_device;
 
 int
 mm_answer_pam_init_ctx(int sock, Buffer *m)
 {
-
 	debug3("%s", __func__);
-	authctxt->user = buffer_get_string(m, NULL);
 	sshpam_ctxt = (sshpam_device.init_ctx)(authctxt);
 	sshpam_authok = NULL;
 	buffer_clear(m);
 	if (sshpam_ctxt != NULL) {
 		monitor_permit(mon_dispatch, MONITOR_REQ_PAM_FREE_CTX, 1);
diff --git a/monitor_wrap.c b/monitor_wrap.c
index e6217b3d..eac421ba 100644
--- a/monitor_wrap.c
+++ b/monitor_wrap.c
@@ -612,11 +612,10 @@ mm_sshpam_init_ctx(Authctxt *authctxt)
 	Buffer m;
 	int success;
 
 	debug3("%s", __func__);
 	buffer_init(&m);
-	buffer_put_cstring(&m, authctxt->user);
 	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PAM_INIT_CTX, &m);
 	debug3("%s: waiting for MONITOR_ANS_PAM_INIT_CTX", __func__);
 	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_PAM_INIT_CTX, &m);
 	success = buffer_get_int(&m);
 	if (success == 0) {

Vulnerable code: 
	authctxt->user = buffer_get_string(m, NULL);
	buffer_put_cstring(&m, authctxt->user);
CVE-2015-6564: Permissions, Privileges, and Access Controls (CWE-264)
value: Use-after-free vulnerability in the mm_answer_pam_free_ctx function in monitor.c in sshd in OpenSSH before 7.0 on non-OpenBSD platforms might allow local users to gain privileges by leveraging control of the sshd uid to send an unexpectedly early MONITOR_REQ_PAM_FREE_CTX request.
CWE description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Published: 2015-08-24T01:59Z
Repository: https://github.com/openssh/openssh-portable
Language: C
Files changed: monitor.c
Commit date: 2015-08-11 13:36:00 +1000
Commit message: set sshpam_ctxt to NULL after free

Avoids use-after-free in monitor when privsep child is compromised.
Reported by Moritz Jodeit; ok dtucker@

Diff: diff --git a/monitor.c b/monitor.c
index f1b873dc4..a91420983 100644
--- a/monitor.c
+++ b/monitor.c
@@ -1164,18 +1164,20 @@ mm_answer_pam_respond(int sock, Buffer *m)
 }
 
 int
 mm_answer_pam_free_ctx(int sock, Buffer *m)
 {
+	int r = sshpam_authok != NULL && sshpam_authok == sshpam_ctxt;
 
 	debug3("%s", __func__);
 	(sshpam_device.free_ctx)(sshpam_ctxt);
+	sshpam_ctxt = sshpam_authok = NULL;
 	buffer_clear(m);
 	mm_request_send(sock, MONITOR_ANS_PAM_FREE_CTX, m);
 	auth_method = "keyboard-interactive";
 	auth_submethod = "pam";
-	return (sshpam_authok == sshpam_ctxt);
+	return r;
 }
 #endif
 
 int
 mm_answer_keyallowed(int sock, Buffer *m)

Vulnerable code: 	return (sshpam_authok == sshpam_ctxt);
Fixed code: 	int r = sshpam_authok != NULL && sshpam_authok == sshpam_ctxt;
	sshpam_ctxt = sshpam_authok = NULL;
	return r;
CVE-2016-6515: Improper Input Validation (CWE-20)
value: The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 7.5
Published: 2016-08-07T21:59Z
Repository: https://github.com/openssh/openssh-portable
Language: C
Files changed: auth-passwd.c
Commit date: 2016-07-22 13:36:40 +1000
Commit message: upstream commit

Skip passwords longer than 1k in length so clients can't
easily DoS sshd by sending very long passwords, causing it to spend CPU
hashing them. feedback djm@, ok markus@.

Brought to our attention by tomas.kuthan at oracle.com, shilei-c at
360.cn and coredump at autistici.org

Upstream-ID: d0af7d4a2190b63ba1d38eec502bc4be0be9e333

Diff: diff --git a/auth-passwd.c b/auth-passwd.c
index 530b5d4f7..996c2cf71 100644
--- a/auth-passwd.c
+++ b/auth-passwd.c
@@ -1,6 +1,6 @@
-/* $OpenBSD: auth-passwd.c,v 1.44 2014/07/15 15:54:14 millert Exp $ */
+/* $OpenBSD: auth-passwd.c,v 1.45 2016/07/21 01:39:35 dtucker Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
  * Password authentication.  This file contains the functions to check whether
@@ -64,10 +64,12 @@ extern login_cap_t *lc;
 
 
 #define DAY		(24L * 60 * 60) /* 1 day in seconds */
 #define TWO_WEEKS	(2L * 7 * DAY)	/* 2 weeks in seconds */
 
+#define MAX_PASSWORD_LEN	1024
+
 void
 disable_forwarding(void)
 {
 	no_port_forwarding_flag = 1;
 	no_agent_forwarding_flag = 1;
@@ -85,10 +87,13 @@ auth_password(Authctxt *authctxt, const char *password)
 	int result, ok = authctxt->valid;
 #if defined(USE_SHADOW) && defined(HAS_SHADOW_EXPIRE)
 	static int expire_checked = 0;
 #endif
 
+	if (strlen(password) > MAX_PASSWORD_LEN)
+		return 0;
+
 #ifndef HAVE_CYGWIN
 	if (pw->pw_uid == 0 && options.permit_root_login != PERMIT_YES)
 		ok = 0;
 #endif
 	if (*password == '\0' && options.permit_empty_passwd == 0)

Vulnerable code: /* $OpenBSD: auth-passwd.c,v 1.44 2014/07/15 15:54:14 millert Exp $ */
Fixed code: /* $OpenBSD: auth-passwd.c,v 1.45 2016/07/21 01:39:35 dtucker Exp $ */
#define MAX_PASSWORD_LEN	1024

	if (strlen(password) > MAX_PASSWORD_LEN)
		return 0;
CVE-2016-8858: Resource Management Errors (CWE-399)
value: The kex_input_kexinit function in kex.c in OpenSSH 6.x and 7.x through 7.3 allows remote attackers to cause a denial of service (memory consumption) by sending many duplicate KEXINIT requests.  NOTE: a third party reports that "OpenSSH upstream does not consider this as a security issue."
CWE description: Weaknesses in this category are related to improper management of system resources.
CVSS v3 base score: 7.5
Published: 2016-12-09T11:59Z
Repository: https://github.com/openssh/openssh-portable
Language: C
Files changed: kex.c
Commit date: 2016-10-13 18:55:25 +1100
Commit message: upstream commit

Unregister the KEXINIT handler after message has been
received. Otherwise an unauthenticated peer can repeat the KEXINIT and cause
allocation of up to 128MB -- until the connection is closed. Reported by
shilei-c at 360.cn

Upstream-ID: 43649ae12a27ef94290db16d1a98294588b75c05

Diff: diff --git a/kex.c b/kex.c
index 3f97f8c00..6a94bc535 100644
--- a/kex.c
+++ b/kex.c
@@ -1,6 +1,6 @@
-/* $OpenBSD: kex.c,v 1.126 2016/09/28 21:44:52 djm Exp $ */
+/* $OpenBSD: kex.c,v 1.127 2016/10/10 19:28:48 markus Exp $ */
 /*
  * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -479,10 +479,11 @@ kex_input_kexinit(int type, u_int32_t seq, void *ctxt)
 
 	debug("SSH2_MSG_KEXINIT received");
 	if (kex == NULL)
 		return SSH_ERR_INVALID_ARGUMENT;
 
+	ssh_dispatch_set(ssh, SSH2_MSG_KEXINIT, NULL);
 	ptr = sshpkt_ptr(ssh, &dlen);
 	if ((r = sshbuf_put(kex->peer, ptr, dlen)) != 0)
 		return r;
 
 	/* discard packet */

Vulnerable code: /* $OpenBSD: kex.c,v 1.126 2016/09/28 21:44:52 djm Exp $ */
Fixed code: /* $OpenBSD: kex.c,v 1.127 2016/10/10 19:28:48 markus Exp $ */
	ssh_dispatch_set(ssh, SSH2_MSG_KEXINIT, NULL);
CVE-2018-20685: Incorrect Authorization (CWE-863)
value: In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 5.3
Published: 2019-01-10T21:29Z
Repository: https://github.com/openssh/openssh-portable
Language: C
Files changed: scp.c
Commit date: 2018-11-16 14:04:35 +1100
Commit message: upstream: disallow empty incoming filename or ones that refer to the

current directory; based on report/patch from Harry Sintonen

OpenBSD-Commit-ID: f27651b30eaee2df49540ab68d030865c04f6de9

Diff: diff --git a/scp.c b/scp.c
index 60682c687..4f3fdcd3d 100644
--- a/scp.c
+++ b/scp.c
@@ -1,6 +1,6 @@
-/* $OpenBSD: scp.c,v 1.197 2018/06/01 04:31:48 dtucker Exp $ */
+/* $OpenBSD: scp.c,v 1.198 2018/11/16 03:03:10 djm Exp $ */
 /*
  * scp - secure remote copy.  This is basically patched BSD rcp which
  * uses ssh to do the data transfer (instead of using rcmd).
  *
  * NOTE: This version should NOT be suid root.  (This uses ssh to
@@ -1104,11 +1104,12 @@ sink(int argc, char **argv)
 			SCREWUP("size not delimited");
 		if (TYPE_OVERFLOW(off_t, ull))
 			SCREWUP("size out of range");
 		size = (off_t)ull;
 
-		if ((strchr(cp, '/') != NULL) || (strcmp(cp, "..") == 0)) {
+		if (*cp == '\0' || strchr(cp, '/') != NULL ||
+		    strcmp(cp, ".") == 0 || strcmp(cp, "..") == 0) {
 			run_err("error: unexpected filename: %s", cp);
 			exit(1);
 		}
 		if (targisdir) {
 			static char *namebuf;

Vulnerable code: /* $OpenBSD: scp.c,v 1.197 2018/06/01 04:31:48 dtucker Exp $ */
		if ((strchr(cp, '/') != NULL) || (strcmp(cp, "..") == 0)) {
Fixed code: /* $OpenBSD: scp.c,v 1.198 2018/11/16 03:03:10 djm Exp $ */
		if (*cp == '\0' || strchr(cp, '/') != NULL ||
		    strcmp(cp, ".") == 0 || strcmp(cp, "..") == 0) {
CVE-2020-12062: Improper Input Validation (CWE-20)
value: The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client's download directory by creating a crafted subdirectory anywhere on the remote server. The victim must use the command scp -rp to download a file hierarchy containing, anywhere inside, this crafted subdirectory. NOTE: the vendor points out that "this attack can achieve no more than a hostile peer is already able to achieve within the scp protocol" and "utimes does not fail under normal circumstances.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 7.5
Published: 2020-06-01T16:15Z
Repository: https://github.com/openssh/openssh-portable
Language: C
Files changed: scp.c
Commit date: 2020-05-07 15:39:00 +1000
Commit message: upstream: another case where a utimes() failure could make scp send

a desynchronising error; reminded by Aymeric Vincent ok deraadt markus

OpenBSD-Commit-ID: 2ea611d34d8ff6d703a7a8bf858aa5dbfbfa7381

Diff: diff --git a/scp.c b/scp.c
index 4390259804..b4492a0620 100644
--- a/scp.c
+++ b/scp.c
@@ -1,6 +1,6 @@
-/* $OpenBSD: scp.c,v 1.209 2020/05/01 06:31:42 djm Exp $ */
+/* $OpenBSD: scp.c,v 1.210 2020/05/06 20:57:38 djm Exp $ */
 /*
  * scp - secure remote copy.  This is basically patched BSD rcp which
  * uses ssh to do the data transfer (instead of using rcmd).
  *
  * NOTE: This version should NOT be suid root.  (This uses ssh to
@@ -1425,13 +1425,11 @@ sink(int argc, char **argv, const char *src)
 			}
 			vect[0] = xstrdup(np);
 			sink(1, vect, src);
 			if (setimes) {
 				setimes = 0;
-				if (utimes(vect[0], tv) == -1)
-					run_err("%s: set times: %s",
-					    vect[0], strerror(errno));
+				(void) utimes(vect[0], tv);
 			}
 			if (mod_flag)
 				(void) chmod(vect[0], mode);
 			free(vect[0]);
 			continue;

Vulnerable code: /* $OpenBSD: scp.c,v 1.209 2020/05/01 06:31:42 djm Exp $ */
				if (utimes(vect[0], tv) == -1)
					run_err("%s: set times: %s",
					    vect[0], strerror(errno));
Fixed code: /* $OpenBSD: scp.c,v 1.210 2020/05/06 20:57:38 djm Exp $ */
				(void) utimes(vect[0], tv);
CVE-2023-2848: Origin Validation Error (CWE-346)
value: Movim prior to version 0.22 is affected by a Cross-Site WebSocket Hijacking vulnerability. This was the result of a missing header validation.
CWE description: The product does not properly verify that the source of data or communication is valid.
CVSS v3 base score: 8.8
Published: 2023-09-14T12:15Z
Repository: https://github.com/movim/movim
Language: PHP
Files changed: src/Movim/Daemon/Core.php
Commit date: 2023-05-07 17:37:28 +0200
Commit message: Compare the Origin as a fallback of the Sec-Fetch-Site header is not present

Diff: diff --git a/src/Movim/Daemon/Core.php b/src/Movim/Daemon/Core.php
index 0869f00a6..1789429a2 100644
--- a/src/Movim/Daemon/Core.php
+++ b/src/Movim/Daemon/Core.php
@@ -304,9 +304,13 @@ class Core implements MessageComponentInterface
     private function isTrustedConnection(ConnectionInterface $conn): bool
     {
         $daemonKeyHeader = $conn->httpRequest->getHeader('MOVIM_DAEMON_KEY');
         $secFetchSiteHeader = $conn->httpRequest->getHeader('Sec-Fetch-Site');
 
+        $sameOrigin = (is_array($secFetchSiteHeader) && !empty($secFetchSiteHeader))
+            ? $secFetchSiteHeader[0] == 'same-origin'
+            : parse_url($conn->httpRequest->getHeader('Origin')[0], PHP_URL_HOST) == parse_url($this->baseuri, PHP_URL_HOST);
+
         return (is_array($daemonKeyHeader) && !empty($daemonKeyHeader) && $daemonKeyHeader[0] === $this->key)
-            || (is_array($secFetchSiteHeader) && !empty($secFetchSiteHeader) && $secFetchSiteHeader[0] == 'same-origin');
+            || $sameOrigin;
     }
 }

Vulnerable code:             || (is_array($secFetchSiteHeader) && !empty($secFetchSiteHeader) && $secFetchSiteHeader[0] == 'same-origin');
Fixed code:         $sameOrigin = (is_array($secFetchSiteHeader) && !empty($secFetchSiteHeader))
            ? $secFetchSiteHeader[0] == 'same-origin'
            : parse_url($conn->httpRequest->getHeader('Origin')[0], PHP_URL_HOST) == parse_url($this->baseuri, PHP_URL_HOST);

            || $sameOrigin;
CVE-2023-5835: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability classified as problematic was found in hu60t hu60wap6. Affected by this vulnerability is the function markdown of the file src/class/ubbparser.php. The manipulation leads to cross site scripting. The attack can be launched remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named a1cd9f12d7687243bfcb7ce295665acb83b9174e. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-243775.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-10-28T14:15Z
Repository: https://github.com/hu60t/hu60wap6
Language: PHP
Files changed: src/class/ubbparser.php
Commit date: 2023-05-23 10:29:57 +0800
Commit message: UBB解析：修复4个空格或一个tab开头的markdown代码块解析时的XSS漏洞

案例：

<div class="topic-actions" data-v-38b8ba66="">
  <!-- 打赏按钮 -->
  <form method="POST" action="reward.php" data-v-38b8ba66="">
    <input type="hidden" name="post\_id" value="<?php echo $postId; ?>" data-v-38b8ba66="">
    <input type="number" name="reward\_points" placeholder="请输入打赏积分数量" data-v-38b8ba66="">
    <button type="submit" data-v-38b8ba66="">打赏</button>
  </form>
</div>

旧版会让<input>直接以HTML显示出来，因为ubbparser认为它是代码块所以没有进行HTML转义，而Parsedown不认为它是代码块，因为<input>前面没有空行隔开。

Diff: diff --git a/src/class/ubbparser.php b/src/class/ubbparser.php
index 2063a207..b81aeeb9 100644
--- a/src/class/ubbparser.php
+++ b/src/class/ubbparser.php
@@ -185,11 +185,12 @@ class UbbParser extends XUBBP
             '!^(^|.*?\n+)\[html(=[^\]]*)?\](\n+.*?\n+)\[/html\](\n+.*|$)$!is' => array(array(1, 4), 'html', array(2, 3)),
             /* textbox 文本框（标记独占一行，高优先级）*/
             '!^(^|.*?\n+)\[text(?:=([^\]]*))?\](\n+.*?\n+)\[/text\](\n+.*|$)$!is' => array(array(1, 4), 'textbox', array(2, 3)),
 
             /* 4个空格或一个tab开头的markdown代码块 */
-            '!^(^|.*?\n+)((?:\t|    )[^\n]*(?:\n+(?:\t|    )[^\n]*)*)(\n+.*|$)$!is' => array(array(1, 3), 'mdpre', array(2)),
+            // 注意如果代码块前面有任何内容，就必须至少有一个空行隔开，否则Parsedown不认为它是代码块
+            '!^(^(?:\s*\n)*|.*?(?:\s*\n){2,})((?:\t|    )[^\n]*(?:\n+(?:\t|    )[^\n]*)*)(\n+.*|$)$!is' => array(array(1, 3), 'mdpre', array(2)),
 
             /*inline代码（优先级比上面的低）*/
             '!^(.*?)((`+).+?\3)(.*)$!is' => array(array(1, 4), 'mdpre', array(2)),
         ];
 

Vulnerable code:             '!^(^|.*?\n+)((?:\t|    )[^\n]*(?:\n+(?:\t|    )[^\n]*)*)(\n+.*|$)$!is' => array(array(1, 3), 'mdpre', array(2)),
Fixed code:             // 注意如果代码块前面有任何内容，就必须至少有一个空行隔开，否则Parsedown不认为它是代码块
            '!^(^(?:\s*\n)*|.*?(?:\s*\n){2,})((?:\t|    )[^\n]*(?:\n+(?:\t|    )[^\n]*)*)(\n+.*|$)$!is' => array(array(1, 3), 'mdpre', array(2)),
CVE-2024-28823: Insufficient Information (NVD-CWE-noinfo)
value: Amazon AWS aws-js-s3-explorer (aka AWS JavaScript S3 Explorer) 1.0.0 allows XSS via a crafted S3 bucket name to index.html.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-11T05:15Z
Repository: https://github.com/awslabs/aws-js-s3-explorer
Language: HTML
Files changed: index.html
Commit date: 2024-03-06 09:04:12 -0500
Commit message: Fixes #118

Escape the text input from bootbox prompt.

Related: [bootbox/issues/661](https://github.com/bootboxjs/bootbox/issues/661)
Diff: diff --git a/index.html b/index.html
index b99bccf..00f3dc0 100644
--- a/index.html
+++ b/index.html
@@ -484,11 +484,11 @@ permissions and limitations under the License.
     function promptForBucketInput() {
         bootbox.prompt("Please enter the S3 bucket name", function(result) {
             if (result !== null) {
                 resetDepth();
                 s3exp_config = {
-                    Bucket: result,
+                    Bucket: htmlEscape(result),
                     Delimiter: '/'
                 };
                 (s3exp_lister = s3list(s3exp_config, s3draw)).go();
             }
         });

Vulnerable code:                     Bucket: result,
Fixed code:                     Bucket: htmlEscape(result),
CVE-2021-3810: Inefficient Regular Expression Complexity (CWE-1333)
value: code-server is vulnerable to Inefficient Regular Expression Complexity
CWE description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CVSS v3 base score: 7.5
Published: 2021-09-17T07:15Z
Repository: https://github.com/cdr/code-server
Language: TypeScript
Files changed: src/node/util.ts
Commit date: 2021-09-11 18:40:47 +0530
Commit message: [Security] Fix ReDoS

Fix potential ReDoS
Diff: diff --git a/src/node/util.ts b/src/node/util.ts
index 1216601e..61e410be 100644
--- a/src/node/util.ts
+++ b/src/node/util.ts
@@ -18,11 +18,11 @@ export interface Paths {
   runtime: string
 }
 
 // From https://github.com/chalk/ansi-regex
 const pattern = [
-  "[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:[a-zA-Z\\d]*(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)*)?\\u0007)",
+  "[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]+)*|[a-zA-Z\\d]+(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)*)?\\u0007)",
   "(?:(?:\\d{1,4}(?:;\\d{0,4})*)?[\\dA-PR-TZcf-ntqry=><~]))",
 ].join("|")
 const re = new RegExp(pattern, "g")
 
 /**

Vulnerable code:   "[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:[a-zA-Z\\d]*(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)*)?\\u0007)",
Fixed code:   "[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]+)*|[a-zA-Z\\d]+(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)*)?\\u0007)",
CVE-2020-14354: Double Free (CWE-415)
value: A possible use-after-free and double-free in c-ares lib version 1.16.0 if ares_destroy() is called prior to ares_getaddrinfo() completing. This flaw possibly allows an attacker to crash the service that uses c-ares lib. The highest threat from this vulnerability is to this service availability.
CWE description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CVSS v3 base score: 3.3
Published: 2021-05-13T14:15Z
Repository: https://github.com/c-ares/c-ares
Language: C
Files changed: ares_getaddrinfo.c
Commit date: 2020-05-07 07:02:31 -0400
Commit message: Prevent possible double-free in ares_getaddrinfo() if ares_destroy() is called

In the event that ares_destroy() is called prior to ares_getaddrinfo() completing,
it would result in an invalid read and double-free due to calling end_hquery() twice.

Reported By: Jann Horn @ Google Project Zero

Diff: diff --git a/ares_getaddrinfo.c b/ares_getaddrinfo.c
index 316fa5a..be16806 100644
--- a/ares_getaddrinfo.c
+++ b/ares_getaddrinfo.c
@@ -546,10 +546,11 @@ static void host_callback(void *arg, int status, int timeouts,
       addinfostatus = ares__parse_into_addrinfo(abuf, alen, hquery->ai);
     }
   else if (status == ARES_EDESTRUCTION)
     {
       end_hquery(hquery, status);
+      return;
     }
 
   if (!hquery->remaining)
     {
       if (addinfostatus != ARES_SUCCESS)

Fixed code:       return;
CVE-2020-14354: Use After Free (CWE-416)
value: A possible use-after-free and double-free in c-ares lib version 1.16.0 if ares_destroy() is called prior to ares_getaddrinfo() completing. This flaw possibly allows an attacker to crash the service that uses c-ares lib. The highest threat from this vulnerability is to this service availability.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 3.3
Published: 2021-05-13T14:15Z
Repository: https://github.com/c-ares/c-ares
Language: C
Files changed: ares_getaddrinfo.c
Commit date: 2020-05-07 07:02:31 -0400
Commit message: Prevent possible double-free in ares_getaddrinfo() if ares_destroy() is called

In the event that ares_destroy() is called prior to ares_getaddrinfo() completing,
it would result in an invalid read and double-free due to calling end_hquery() twice.

Reported By: Jann Horn @ Google Project Zero

Diff: diff --git a/ares_getaddrinfo.c b/ares_getaddrinfo.c
index 316fa5a..be16806 100644
--- a/ares_getaddrinfo.c
+++ b/ares_getaddrinfo.c
@@ -546,10 +546,11 @@ static void host_callback(void *arg, int status, int timeouts,
       addinfostatus = ares__parse_into_addrinfo(abuf, alen, hquery->ai);
     }
   else if (status == ARES_EDESTRUCTION)
     {
       end_hquery(hquery, status);
+      return;
     }
 
   if (!hquery->remaining)
     {
       if (addinfostatus != ARES_SUCCESS)

Fixed code:       return;