Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2018-1999014: Out-of-bounds Read (CWE-125)
value: FFmpeg before commit bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75 contains an out of array access vulnerability in MXF format demuxer that can result in DoS. This attack appear to be exploitable via specially crafted MXF file which has to be provided as input. This vulnerability appears to have been fixed in bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75 and later.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2018-07-23T15:29Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavformat/mxfdec.c
Commit date: 2018-07-05 19:52:42 +0200
Commit message: avformat/mxfdec: Fix av_log context

Fixes: out of array access
Fixes: mxf-crash-1c2e59bf07a34675bfb3ada5e1ec22fa9f38f923

Found-by: Paul Ch <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Diff: diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
index b76beb962f4a..3a8e76e51ce2 100644
--- a/libavformat/mxfdec.c
+++ b/libavformat/mxfdec.c
@@ -2153,11 +2153,11 @@ static int mxf_parse_structural_metadata(MXFContext *mxf)
 
             for (k = 0; k < mxf->essence_container_data_count; k++) {
                 MXFEssenceContainerData *essence_data;
 
                 if (!(essence_data = mxf_resolve_strong_ref(mxf, &mxf->essence_container_data_refs[k], EssenceContainerData))) {
-                    av_log(mxf, AV_LOG_TRACE, "could not resolve essence container data strong ref\n");
+                    av_log(mxf->fc, AV_LOG_TRACE, "could not resolve essence container data strong ref\n");
                     continue;
                 }
                 if (!memcmp(component->source_package_ul, essence_data->package_ul, sizeof(UID)) && !memcmp(component->source_package_uid, essence_data->package_uid, sizeof(UID))) {
                     source_track->body_sid = essence_data->body_sid;
                     source_track->index_sid = essence_data->index_sid;

Vulnerable code:                     av_log(mxf, AV_LOG_TRACE, "could not resolve essence container data strong ref\n");
Fixed code:                     av_log(mxf->fc, AV_LOG_TRACE, "could not resolve essence container data strong ref\n");
CVE-2019-11339: Out-of-bounds Read (CWE-125)
value: The studio profile decoder in libavcodec/mpeg4videodec.c in FFmpeg 4.0 before 4.0.4 and 4.1 before 4.1.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impact via crafted MPEG-4 video data.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.8
Published: 2019-04-19T00:29Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavcodec/mpeg4videodec.c
Commit date: 2019-03-12 00:48:56 +0100
Commit message: avcodec/mpeg4videodec: Check idx in mpeg4_decode_studio_block()

Fixes: Out of array access
Fixes: 13500/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5769760178962432

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Kieran Kunhya <kierank@obe.tv>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Diff: diff --git a/libavcodec/mpeg4videodec.c b/libavcodec/mpeg4videodec.c
index 99b1e1062075..b6f2ae7b7b52 100644
--- a/libavcodec/mpeg4videodec.c
+++ b/libavcodec/mpeg4videodec.c
@@ -1897,18 +1897,24 @@ static int mpeg4_decode_studio_block(MpegEncContext *s, int32_t block[64], int n
             code = get_bits(&s->gb, additional_code_len);
             sign = code & 1;
             code >>= 1;
             run = (1 << (additional_code_len - 1)) + code;
             idx += run;
+            if (idx > 63)
+                return AVERROR_INVALIDDATA;
             j = scantable[idx++];
             block[j] = sign ? 1 : -1;
         } else if (group >= 13 && group <= 20) {
             /* Level value (Table B.49) */
+            if (idx > 63)
+                return AVERROR_INVALIDDATA;
             j = scantable[idx++];
             block[j] = get_xbits(&s->gb, additional_code_len);
         } else if (group == 21) {
             /* Escape */
+            if (idx > 63)
+                return AVERROR_INVALIDDATA;
             j = scantable[idx++];
             additional_code_len = s->avctx->bits_per_raw_sample + s->dct_precision + 4;
             flc = get_bits(&s->gb, additional_code_len);
             if (flc >> (additional_code_len-1))
                 block[j] = -1 * (( flc ^ ((1 << additional_code_len) -1)) + 1);

Fixed code:             if (idx > 63)
                return AVERROR_INVALIDDATA;
            if (idx > 63)
                return AVERROR_INVALIDDATA;
            if (idx > 63)
                return AVERROR_INVALIDDATA;
CVE-2019-11339: Out-of-bounds Read (CWE-125)
value: The studio profile decoder in libavcodec/mpeg4videodec.c in FFmpeg 4.0 before 4.0.4 and 4.1 before 4.1.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impact via crafted MPEG-4 video data.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.8
Published: 2019-04-19T00:29Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavcodec/mpeg4videodec.c
Commit date: 2019-02-16 19:56:57 +0100
Commit message: avcodec/mpeg4videodec: Clear interlaced_dct for studio profile

Fixes: Out of array access
Fixes: 13090/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5408668986638336

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Kieran Kunhya <kierank@obe.tv>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Diff: diff --git a/libavcodec/mpeg4videodec.c b/libavcodec/mpeg4videodec.c
index f44ee76bd419..ecd028a87c77 100644
--- a/libavcodec/mpeg4videodec.c
+++ b/libavcodec/mpeg4videodec.c
@@ -3055,10 +3055,11 @@ static int decode_studio_vop_header(Mpeg4DecContext *ctx, GetBitContext *gb)
 
     if (get_bits_left(gb) <= 32)
         return 0;
 
     s->partitioned_frame = 0;
+    s->interlaced_dct = 0;
     s->decode_mb = mpeg4_decode_studio_mb;
 
     decode_smpte_tc(ctx, gb);
 
     skip_bits(gb, 10); /* temporal_reference */

Fixed code:     s->interlaced_dct = 0;
CVE-2019-12730: Use of Uninitialized Resource (CWE-908)
value: aa_read_header in libavformat/aadec.c in FFmpeg before 3.2.14 and 4.x before 4.1.4 does not check for sscanf failure and consequently allows use of uninitialized variables.
CWE description: The product uses or accesses a resource that has not been initialized.
CVSS v3 base score: 9.8
Published: 2019-06-04T14:29Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavformat/aadec.c
Commit date: 2019-04-24 17:05:02 +0200
Commit message: avformat/aadec: Check for scanf() failure

Fixes: use of uninitialized variables
Fixes: blank.aa

Found-by: Chamal De Silva <chamal.desilva@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Diff: diff --git a/libavformat/aadec.c b/libavformat/aadec.c
index dc94061dcf11..b9dd51ebfc3d 100644
--- a/libavformat/aadec.c
+++ b/libavformat/aadec.c
@@ -83,10 +83,11 @@ static int aa_read_header(AVFormatContext *s)
     uint32_t header_key_part[4];
     uint8_t header_key[16] = {0};
     AADemuxContext *c = s->priv_data;
     AVIOContext *pb = s->pb;
     AVStream *st;
+    int ret;
 
     /* parse .aa header */
     avio_skip(pb, 4); // file size
     avio_skip(pb, 4); // magic string
     toc_size = avio_rb32(pb); // TOC size
@@ -116,12 +117,16 @@ static int aa_read_header(AVFormatContext *s)
         } else if (!strcmp(key, "HeaderSeed")) {
             av_log(s, AV_LOG_DEBUG, "HeaderSeed is <%s>\n", val);
             header_seed = atoi(val);
         } else if (!strcmp(key, "HeaderKey")) { // this looks like "1234567890 1234567890 1234567890 1234567890"
             av_log(s, AV_LOG_DEBUG, "HeaderKey is <%s>\n", val);
-            sscanf(val, "%"SCNu32"%"SCNu32"%"SCNu32"%"SCNu32,
+
+            ret = sscanf(val, "%"SCNu32"%"SCNu32"%"SCNu32"%"SCNu32,
                    &header_key_part[0], &header_key_part[1], &header_key_part[2], &header_key_part[3]);
+            if (ret != 4)
+                return AVERROR_INVALIDDATA;
+
             for (idx = 0; idx < 4; idx++) {
                 AV_WB32(&header_key[idx * 4], header_key_part[idx]); // convert each part to BE!
             }
             av_log(s, AV_LOG_DEBUG, "Processed HeaderKey is ");
             for (i = 0; i < 16; i++)

Vulnerable code:             sscanf(val, "%"SCNu32"%"SCNu32"%"SCNu32"%"SCNu32,
Fixed code:     int ret;

            ret = sscanf(val, "%"SCNu32"%"SCNu32"%"SCNu32"%"SCNu32,
            if (ret != 4)
                return AVERROR_INVALIDDATA;
CVE-2019-17539: NULL Pointer Dereference (CWE-476)
value: In FFmpeg before 4.2, avcodec_open2 in libavcodec/utils.c allows a NULL pointer dereference and possibly unspecified other impact when there is no valid close function pointer.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 9.8
Published: 2019-10-14T02:15Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavcodec/utils.c
Commit date: 2019-07-21 12:39:42 +0200
Commit message: avcodec/utils: Check close before calling it

Fixes: NULL pointer dereference
Fixes: 15733/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IDF_fuzzer-5658616977162240

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Diff: diff --git a/libavcodec/utils.c b/libavcodec/utils.c
index 9ff9628f7ffd..66c68d1cf5ff 100644
--- a/libavcodec/utils.c
+++ b/libavcodec/utils.c
@@ -1022,11 +1022,11 @@ end:
         *options = tmp;
     }
 
     return ret;
 free_and_end:
-    if (avctx->codec &&
+    if (avctx->codec && avctx->codec->close &&
         (codec_init_ok ||
          (avctx->codec->caps_internal & FF_CODEC_CAP_INIT_CLEANUP)))
         avctx->codec->close(avctx);
 
     if (codec->priv_class && codec->priv_data_size)

Vulnerable code:     if (avctx->codec &&
Fixed code:     if (avctx->codec && avctx->codec->close &&
CVE-2019-17542: Out-of-bounds Write (CWE-787)
value: FFmpeg before 4.2 has a heap-based buffer overflow in vqa_decode_chunk because of an out-of-array access in vqa_decode_init in libavcodec/vqavideo.c.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2019-10-14T02:15Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavcodec/vqavideo.c
Commit date: 2019-08-05 18:43:45 +0200
Commit message: avcodec/vqavideo: Set video size

Fixes: out of array access
Fixes: 15919/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VQA_fuzzer-5657368257363968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Diff: diff --git a/libavcodec/vqavideo.c b/libavcodec/vqavideo.c
index 0e70be1000a1..b9743abda95d 100644
--- a/libavcodec/vqavideo.c
+++ b/libavcodec/vqavideo.c
@@ -145,11 +145,11 @@ static av_cold int vqa_decode_init(AVCodecContext *avctx)
         avpriv_request_sample(avctx, "VQA Version %i", s->vqa_version);
         return AVERROR_PATCHWELCOME;
     }
     s->width = AV_RL16(&s->avctx->extradata[6]);
     s->height = AV_RL16(&s->avctx->extradata[8]);
-    if ((ret = av_image_check_size(s->width, s->height, 0, avctx)) < 0) {
+    if ((ret = ff_set_dimensions(avctx, s->width, s->height)) < 0) {
         s->width= s->height= 0;
         return ret;
     }
     s->vector_width = s->avctx->extradata[10];
     s->vector_height = s->avctx->extradata[11];

Vulnerable code:     if ((ret = av_image_check_size(s->width, s->height, 0, avctx)) < 0) {
Fixed code:     if ((ret = ff_set_dimensions(avctx, s->width, s->height)) < 0) {
CVE-2020-12284: Out-of-bounds Write (CWE-787)
value: cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling because of a missing length check.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2020-04-28T06:15Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavcodec/cbs_jpeg.c
Commit date: 2020-03-12 00:14:10 +0100
Commit message: avcodec/cbs_jpeg: Check length for SOS

Fixes: out of array access
Fixes: 19734/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-5673507031875584
Fixes: 19353/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-5703944462663680

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Diff: diff --git a/libavcodec/cbs_jpeg.c b/libavcodec/cbs_jpeg.c
index 6bbce5f89b7c..89512a26bbf1 100644
--- a/libavcodec/cbs_jpeg.c
+++ b/libavcodec/cbs_jpeg.c
@@ -195,10 +195,13 @@ static int cbs_jpeg_split_fragment(CodedBitstreamContext *ctx,
         }
 
         if (marker == JPEG_MARKER_SOS) {
             length = AV_RB16(frag->data + start);
 
+            if (length > end - start)
+                return AVERROR_INVALIDDATA;
+
             data_ref = NULL;
             data     = av_malloc(end - start +
                                  AV_INPUT_BUFFER_PADDING_SIZE);
             if (!data)
                 return AVERROR(ENOMEM);

Fixed code:             if (length > end - start)
                return AVERROR_INVALIDDATA;
CVE-2020-35965: Out-of-bounds Write (CWE-787)
value: decode_frame in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds write because of errors in calculations of when to perform memset zero operations.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2021-01-04T02:15Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavcodec/exr.c
Commit date: 2020-11-22 17:45:17 +0100
Commit message: avcodec/exr: Check ymin vs. h

Fixes: out of array access
Fixes: 26532/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5613925708857344
Fixes: 27443/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5631239813595136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Diff: diff --git a/libavcodec/exr.c b/libavcodec/exr.c
index e907c5c46401..8b701d1cd298 100644
--- a/libavcodec/exr.c
+++ b/libavcodec/exr.c
@@ -1828,11 +1828,11 @@ static int decode_frame(AVCodecContext *avctx, void *data,
     s->buf_size = avpkt->size;
 
     // Zero out the start if ymin is not 0
     for (i = 0; i < planes; i++) {
         ptr = picture->data[i];
-        for (y = 0; y < s->ymin; y++) {
+        for (y = 0; y < FFMIN(s->ymin, s->h); y++) {
             memset(ptr, 0, out_line_size);
             ptr += picture->linesize[i];
         }
     }
 

Vulnerable code:         for (y = 0; y < s->ymin; y++) {
Fixed code:         for (y = 0; y < FFMIN(s->ymin, s->h); y++) {
CVE-2020-35965: Out-of-bounds Write (CWE-787)
value: decode_frame in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds write because of errors in calculations of when to perform memset zero operations.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2021-01-04T02:15Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavcodec/exr.c
Commit date: 2020-11-22 17:45:17 +0100
Commit message: avcodec/exr: skip bottom clearing loop when its outside the image

Fixes: signed integer overflow: 1633771809 * 32960 cannot be represented in type 'int'
Fixes: 26532/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5613925708857344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Diff: diff --git a/libavcodec/exr.c b/libavcodec/exr.c
index 8b701d1cd298..d233dd43fbd6 100644
--- a/libavcodec/exr.c
+++ b/libavcodec/exr.c
@@ -1840,17 +1840,18 @@ static int decode_frame(AVCodecContext *avctx, void *data,
 
     avctx->execute2(avctx, decode_block, s->thread_data, NULL, nb_blocks);
 
     ymax = FFMAX(0, s->ymax + 1);
     // Zero out the end if ymax+1 is not h
-    for (i = 0; i < planes; i++) {
-        ptr = picture->data[i] + (ymax * picture->linesize[i]);
-        for (y = ymax; y < avctx->height; y++) {
-            memset(ptr, 0, out_line_size);
-            ptr += picture->linesize[i];
+    if (ymax < avctx->height)
+        for (i = 0; i < planes; i++) {
+            ptr = picture->data[i] + (ymax * picture->linesize[i]);
+            for (y = ymax; y < avctx->height; y++) {
+                memset(ptr, 0, out_line_size);
+                ptr += picture->linesize[i];
+            }
         }
-    }
 
     picture->pict_type = AV_PICTURE_TYPE_I;
     *got_frame = 1;
 
     return avpkt->size;

Vulnerable code:     for (i = 0; i < planes; i++) {
        ptr = picture->data[i] + (ymax * picture->linesize[i]);
        for (y = ymax; y < avctx->height; y++) {
            memset(ptr, 0, out_line_size);
            ptr += picture->linesize[i];
    }
Fixed code:     if (ymax < avctx->height)
        for (i = 0; i < planes; i++) {
            ptr = picture->data[i] + (ymax * picture->linesize[i]);
            for (y = ymax; y < avctx->height; y++) {
                memset(ptr, 0, out_line_size);
                ptr += picture->linesize[i];
            }
CVE-2020-36138: NULL Pointer Dereference (CWE-476)
value: An issue was discovered in decode_frame in libavcodec/tiff.c in FFmpeg version 4.3, allows remote attackers to cause a denial of service (DoS).
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2023-08-11T14:15Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavcodec/tiff.c
Commit date: 2020-12-28 19:36:57 +0100
Commit message: avcodec/tiff: Disallow striped and tiled tiffs except for DNG

strips + tiles is not allowed in TIFF
DNG uses a separate codepath

Regression since da5b3d002862d1e105002a6dc1567e6551860896.

Fixes: NULL pointer dereference
Fixes: poc1
Fixes: Ticket8960

Found-by: 1vanChen of NSFOCUS Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Diff: diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c
index fa1f44ce1dac..f68f9818ad4c 100644
--- a/libavcodec/tiff.c
+++ b/libavcodec/tiff.c
@@ -1921,18 +1921,21 @@ again:
 
     has_tile_bits  = s->is_tiled || s->tile_byte_counts_offset || s->tile_offsets_offset || s->tile_width || s->tile_length || s->tile_count;
     has_strip_bits = s->strippos || s->strips || s->stripoff || s->rps || s->sot || s->sstype || s->stripsize || s->stripsizesoff;
 
     if (has_tile_bits && has_strip_bits) {
-        av_log(avctx, AV_LOG_WARNING, "Tiled TIFF is not allowed to strip\n");
+        int tiled_dng = s->is_tiled && is_dng;
+        av_log(avctx, tiled_dng ? AV_LOG_WARNING : AV_LOG_ERROR, "Tiled TIFF is not allowed to strip\n");
+        if (!tiled_dng)
+            return AVERROR_INVALIDDATA;
     }
 
     /* now we have the data and may start decoding */
     if ((ret = init_image(s, &frame)) < 0)
         return ret;
 
-    if (!s->is_tiled) {
+    if (!s->is_tiled || has_strip_bits) {
         if (s->strips == 1 && !s->stripsize) {
             av_log(avctx, AV_LOG_WARNING, "Image data size missing\n");
             s->stripsize = avpkt->size - s->stripoff;
         }
 

Vulnerable code:         av_log(avctx, AV_LOG_WARNING, "Tiled TIFF is not allowed to strip\n");
    if (!s->is_tiled) {
Fixed code:         int tiled_dng = s->is_tiled && is_dng;
        av_log(avctx, tiled_dng ? AV_LOG_WARNING : AV_LOG_ERROR, "Tiled TIFF is not allowed to strip\n");
        if (!tiled_dng)
            return AVERROR_INVALIDDATA;
    if (!s->is_tiled || has_strip_bits) {
CVE-2021-33815: Improper Validation of Array Index (CWE-129)
value: dwa_uncompress in libavcodec/exr.c in FFmpeg 4.4 allows an out-of-bounds array access because dc_count is not strictly checked.
CWE description: The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
CVSS v3 base score: 8.8
Published: 2021-06-03T17:15Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavcodec/exr.c
Commit date: 2021-05-27 17:43:40 +0200
Commit message: avcodec/exr: More strictly check dc_count

Fixes: out of array access
Fixes: exr/deneme

Found-by: Burak Çarıkçı <burakcarikci@crypttech.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Diff: diff --git a/libavcodec/exr.c b/libavcodec/exr.c
index 9377a8916936..4648ed7d6226 100644
--- a/libavcodec/exr.c
+++ b/libavcodec/exr.c
@@ -1057,15 +1057,15 @@ static int dwa_uncompress(EXRContext *s, const uint8_t *src, int compressed_size
         }
 
         bytestream2_skip(&gb, ac_size);
     }
 
-    if (dc_size > 0) {
+    {
         unsigned long dest_len = dc_count * 2LL;
         GetByteContext agb = gb;
 
-        if (dc_count > (6LL * td->xsize * td->ysize + 63) / 64)
+        if (dc_count != dc_w * dc_h * 3)
             return AVERROR_INVALIDDATA;
 
         av_fast_padded_malloc(&td->dc_data, &td->dc_size, FFALIGN(dest_len, 64) * 2);
         if (!td->dc_data)
             return AVERROR(ENOMEM);

Vulnerable code:     if (dc_size > 0) {
        if (dc_count > (6LL * td->xsize * td->ysize + 63) / 64)
Fixed code:     {
        if (dc_count != dc_w * dc_h * 3)
CVE-2021-3566: Insufficient Information (NVD-CWE-noinfo)
value: Prior to ffmpeg version 4.3, the tty demuxer did not have a 'read_probe' function assigned to it. By crafting a legitimate "ffconcat" file that references an image, followed by a file the triggers the tty demuxer, the contents of the second file will be copied into the output file verbatim (as long as the `-vcodec copy` option is passed to ffmpeg).
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.5
Published: 2021-08-05T21:15Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavformat/tty.c
Commit date: 2020-01-29 21:55:47 +0100
Commit message: avformat/tty: add probe function

Diff: diff --git a/libavformat/tty.c b/libavformat/tty.c
index 8d48f2c45c12..60f7e9f87ee7 100644
--- a/libavformat/tty.c
+++ b/libavformat/tty.c
@@ -32,18 +32,36 @@
 #include "libavutil/parseutils.h"
 #include "avformat.h"
 #include "internal.h"
 #include "sauce.h"
 
+static int isansicode(int x)
+{
+    return x == 0x1B || x == 0x0A || x == 0x0D || (x >= 0x20 && x < 0x7f);
+}
+
+static const char tty_extensions[31] = "ans,art,asc,diz,ice,nfo,txt,vt";
+
 typedef struct TtyDemuxContext {
     AVClass *class;
     int chars_per_frame;
     uint64_t fsize;  /**< file size less metadata buffer */
     int width, height; /**< Set by a private option. */
     AVRational framerate; /**< Set by a private option. */
 } TtyDemuxContext;
 
+static int read_probe(const AVProbeData *p)
+{
+    int cnt = 0;
+
+    for (int i = 0; i < p->buf_size; i++)
+        cnt += !!isansicode(p->buf[i]);
+
+    return (cnt * 100LL / p->buf_size) * (cnt > 400) *
+        !!av_match_ext(p->filename, tty_extensions);
+}
+
 /**
  * Parse EFI header
  */
 static int efi_read(AVFormatContext *avctx, uint64_t start_pos)
 {
@@ -151,10 +169,11 @@ static const AVClass tty_demuxer_class = {
 
 AVInputFormat ff_tty_demuxer = {
     .name           = "tty",
     .long_name      = NULL_IF_CONFIG_SMALL("Tele-typewriter"),
     .priv_data_size = sizeof(TtyDemuxContext),
+    .read_probe     = read_probe,
     .read_header    = read_header,
     .read_packet    = read_packet,
-    .extensions     = "ans,art,asc,diz,ice,nfo,txt,vt",
+    .extensions     = tty_extensions,
     .priv_class     = &tty_demuxer_class,
 };

Vulnerable code:     .extensions     = "ans,art,asc,diz,ice,nfo,txt,vt",
Fixed code: static int isansicode(int x)
{
    return x == 0x1B || x == 0x0A || x == 0x0D || (x >= 0x20 && x < 0x7f);
}

static const char tty_extensions[31] = "ans,art,asc,diz,ice,nfo,txt,vt";

static int read_probe(const AVProbeData *p)
{
    int cnt = 0;

    for (int i = 0; i < p->buf_size; i++)
        cnt += !!isansicode(p->buf[i]);

    return (cnt * 100LL / p->buf_size) * (cnt > 400) *
        !!av_match_ext(p->filename, tty_extensions);
}

    .read_probe     = read_probe,
    .extensions     = tty_extensions,
CVE-2021-38171: Unchecked Return Value (CWE-252)
value: adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4 does not check the init_get_bits return value, which is a necessary step because the second argument to init_get_bits can be crafted.
CWE description: The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
CVSS v3 base score: 9.8
Published: 2021-08-21T17:15Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavformat/adtsenc.c
Commit date: 2021-08-06 21:04:43 +0200
Commit message: avformat/adtsenc: return value check for init_get_bits in adts_decode_extradata

As the second argument for init_get_bits (buf) can be crafted, a return value check for this function call is necessary.
'buf' is  part of  'AVPacket pkt'.
replace init_get_bits with init_get_bits8.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Diff: diff --git a/libavformat/adtsenc.c b/libavformat/adtsenc.c
index ba15c0a72494e..3924e678d917d 100644
--- a/libavformat/adtsenc.c
+++ b/libavformat/adtsenc.c
@@ -51,13 +51,15 @@ typedef struct ADTSContext {
 static int adts_decode_extradata(AVFormatContext *s, ADTSContext *adts, const uint8_t *buf, int size)
 {
     GetBitContext gb;
     PutBitContext pb;
     MPEG4AudioConfig m4ac;
-    int off;
+    int off, ret;
 
-    init_get_bits(&gb, buf, size * 8);
+    ret = init_get_bits8(&gb, buf, size);
+    if (ret < 0)
+        return ret;
     off = avpriv_mpeg4audio_get_config2(&m4ac, buf, size, 1, s);
     if (off < 0)
         return off;
     skip_bits_long(&gb, off);
     adts->objecttype        = m4ac.object_type - 1;

Vulnerable code:     int off;
    init_get_bits(&gb, buf, size * 8);
Fixed code:     int off, ret;
    ret = init_get_bits8(&gb, buf, size);
    if (ret < 0)
        return ret;
CVE-2022-3109: NULL Pointer Dereference (CWE-476)
value: An issue was discovered in the FFmpeg package, where vp3_decode_frame in libavcodec/vp3.c lacks check of the return value of av_malloc() and will cause a null pointer dereference, impacting availability.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2022-12-16T15:15Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavcodec/vp3.c
Commit date: 2022-02-18 16:54:11 +1100
Commit message: avcodec/vp3: Add missing check for av_malloc

Since the av_malloc() may fail and return NULL pointer,
it is needed that the 's->edge_emu_buffer' should be checked
whether the new allocation is success.

Fixes: d14723861b ("VP3: fix decoding of videos with stride > 2048")
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>

Diff: diff --git a/libavcodec/vp3.c b/libavcodec/vp3.c
index e9ab54d736773..e2418eb6fa041 100644
--- a/libavcodec/vp3.c
+++ b/libavcodec/vp3.c
@@ -2677,12 +2677,17 @@ static int vp3_decode_frame(AVCodecContext *avctx,
     s->current_frame.f->key_frame = s->keyframe;
     if ((ret = ff_thread_get_ext_buffer(avctx, &s->current_frame,
                                         AV_GET_BUFFER_FLAG_REF)) < 0)
         goto error;
 
-    if (!s->edge_emu_buffer)
+    if (!s->edge_emu_buffer) {
         s->edge_emu_buffer = av_malloc(9 * FFABS(s->current_frame.f->linesize[0]));
+        if (!s->edge_emu_buffer) {
+            ret = AVERROR(ENOMEM);
+            goto error;
+        }
+    }
 
     if (s->keyframe) {
         if (!s->theora) {
             skip_bits(&gb, 4); /* width code */
             skip_bits(&gb, 4); /* height code */

Vulnerable code:     if (!s->edge_emu_buffer)
Fixed code:     if (!s->edge_emu_buffer) {
        if (!s->edge_emu_buffer) {
            ret = AVERROR(ENOMEM);
            goto error;
        }
    }
CVE-2022-3341: NULL Pointer Dereference (CWE-476)
value: A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c file. The flaw occurs because the function lacks check of the return value of avformat_new_stream() and triggers the null pointer dereference error, causing an application to crash.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.3
Published: 2023-01-12T15:15Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavformat/nutdec.c
Commit date: 2022-02-23 14:13:16 +0100
Commit message: avformat/nutdec: Add check for avformat_new_stream

Check for failure of avformat_new_stream() and propagate
the error code.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Diff: diff --git a/libavformat/nutdec.c b/libavformat/nutdec.c
index 0a8a700acfa09..f9ad2c0af12f7 100644
--- a/libavformat/nutdec.c
+++ b/libavformat/nutdec.c
@@ -349,12 +349,16 @@ static int decode_main_header(NUTContext *nut)
     nut->stream = av_calloc(stream_count, sizeof(StreamContext));
     if (!nut->stream) {
         ret = AVERROR(ENOMEM);
         goto fail;
     }
-    for (i = 0; i < stream_count; i++)
-        avformat_new_stream(s, NULL);
+    for (i = 0; i < stream_count; i++) {
+        if (!avformat_new_stream(s, NULL)) {
+            ret = AVERROR(ENOMEM);
+            goto fail;
+        }
+    }
 
     return 0;
 fail:
     av_freep(&nut->time_base);
     for (i = 1; i < nut->header_count; i++) {
@@ -798,23 +802,27 @@ static int nut_read_close(AVFormatContext *s)
 static int nut_read_header(AVFormatContext *s)
 {
     NUTContext *nut = s->priv_data;
     AVIOContext *bc = s->pb;
     int64_t pos;
-    int initialized_stream_count;
+    int initialized_stream_count, ret;
 
     nut->avf = s;
 
     /* main header */
     pos = 0;
+    ret = 0;
     do {
+        if (ret == AVERROR(ENOMEM))
+            return ret;
+
         pos = find_startcode(bc, MAIN_STARTCODE, pos) + 1;
         if (pos < 0 + 1) {
             av_log(s, AV_LOG_ERROR, "No main startcode found.\n");
             return AVERROR_INVALIDDATA;
         }
-    } while (decode_main_header(nut) < 0);
+    } while ((ret = decode_main_header(nut)) < 0);
 
     /* stream headers */
     pos = 0;
     for (initialized_stream_count = 0; initialized_stream_count < s->nb_streams;) {
         pos = find_startcode(bc, STREAM_STARTCODE, pos) + 1;

Vulnerable code:     for (i = 0; i < stream_count; i++)
        avformat_new_stream(s, NULL);
    int initialized_stream_count;
    } while (decode_main_header(nut) < 0);
Fixed code:     for (i = 0; i < stream_count; i++) {
        if (!avformat_new_stream(s, NULL)) {
            ret = AVERROR(ENOMEM);
            goto fail;
        }
    }
    int initialized_stream_count, ret;
    ret = 0;
        if (ret == AVERROR(ENOMEM))
            return ret;

    } while ((ret = decode_main_header(nut)) < 0);
CVE-2023-50008: Insufficient Information (NVD-CWE-noinfo)
value: Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the av_malloc function in libavutil/mem.c:105:9 component.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-19T17:15Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavfilter/vf_colorcorrect.c
Commit date: 2023-11-27 12:10:26 +0100
Commit message: avfilter/vf_colorcorrect: fix memory leaks

Diff: diff --git a/libavfilter/vf_colorcorrect.c b/libavfilter/vf_colorcorrect.c
index 1c4dea531bfc9..6bdec2c9d8dbd 100644
--- a/libavfilter/vf_colorcorrect.c
+++ b/libavfilter/vf_colorcorrect.c
@@ -495,10 +495,12 @@ static av_cold int config_input(AVFilterLink *inlink)
 static av_cold void uninit(AVFilterContext *ctx)
 {
     ColorCorrectContext *s = ctx->priv;
 
     av_freep(&s->analyzeret);
+    av_freep(&s->uhistogram);
+    av_freep(&s->vhistogram);
 }
 
 static const AVFilterPad colorcorrect_inputs[] = {
     {
         .name           = "default",

Fixed code:     av_freep(&s->uhistogram);
    av_freep(&s->vhistogram);
CVE-2024-22860: Integer Overflow or Wraparound (CWE-190)
value: Integer overflow vulnerability in FFmpeg before n6.1, allows remote attackers to execute arbitrary code via the jpegxl_anim_read_packet component in the JPEG XL Animation decoder.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 9.8
Published: 2024-01-27T06:15Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavformat/jpegxl_anim_dec.c
Commit date: 2023-09-14 22:00:17 +0200
Commit message: avformat/jpegxl_anim_dec: Check that size fits within argument

Fixes: out of array access
Fixes: 61991/clusterfuzz-testcase-minimized-ffmpeg_dem_JPEGXL_ANIM_fuzzer-5524679648215040
Fixes: 62181/clusterfuzz-testcase-minimized-ffmpeg_dem_JPEGXL_ANIM_fuzzer-5504964305485824
Fixes: 62214/clusterfuzz-testcase-minimized-ffmpeg_dem_JPEGXL_ANIM_fuzzer-4782972823535616

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Diff: diff --git a/libavformat/jpegxl_anim_dec.c b/libavformat/jpegxl_anim_dec.c
index fc95a1781f669..54cd6e4e9d6bd 100644
--- a/libavformat/jpegxl_anim_dec.c
+++ b/libavformat/jpegxl_anim_dec.c
@@ -150,10 +150,12 @@ static int jpegxl_anim_read_packet(AVFormatContext *s, AVPacket *pkt)
     size_t offset = 0;
 
     size = avio_size(pb);
     if (size < 0)
         return size;
+    if (size > INT_MAX)
+        return AVERROR(EDOM);
     if (size == 0)
         size = 4096;
 
     if (ctx->initial && size < ctx->initial->size)
         size = ctx->initial->size;

Fixed code:     if (size > INT_MAX)
        return AVERROR(EDOM);
CVE-2024-22861: Integer Overflow or Wraparound (CWE-190)
value: Integer overflow vulnerability in FFmpeg before n6.1, allows attackers to cause a denial of service (DoS) via the avcodec/osq module.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 7.5
Published: 2024-01-27T07:15Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavcodec/osq.c
Commit date: 2023-09-04 14:16:56 +0200
Commit message: avcodec/osq: fix type of nb_samples

Fixes crash caused by signed integer overflow.

Diff: diff --git a/libavcodec/osq.c b/libavcodec/osq.c
index 47587cd8122eb..ac091ebc3d558 100644
--- a/libavcodec/osq.c
+++ b/libavcodec/osq.c
@@ -50,11 +50,11 @@ typedef struct OSQContext {
     size_t max_framesize;
     size_t bitstream_size;
 
     int decorrelate;
     int frame_samples;
-    int64_t nb_samples;
+    uint64_t nb_samples;
 
     int32_t *decode_buffer[2];
 
     AVPacket *pkt;
     int pkt_offset;

Vulnerable code:     int64_t nb_samples;
Fixed code:     uint64_t nb_samples;
CVE-2024-22862: Integer Overflow or Wraparound (CWE-190)
value: Integer overflow vulnerability in FFmpeg before n6.1, allows remote attackers to execute arbitrary code via the JJPEG XL Parser.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 9.8
Published: 2024-01-27T06:15Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavcodec/jpegxl_parser.c
Commit date: 2023-09-14 22:00:17 +0200
Commit message: avcodec/jpegxl_parser: Check for ctx->skip overflow

Fixes: out of array access
Fixes: 62113/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5025082076168192

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Diff: diff --git a/libavcodec/jpegxl_parser.c b/libavcodec/jpegxl_parser.c
index 4010bc713a801..6656ed35c5142 100644
--- a/libavcodec/jpegxl_parser.c
+++ b/libavcodec/jpegxl_parser.c
@@ -1324,11 +1324,11 @@ static int skip_boxes(JXLParseContext *ctx, const uint8_t *buf, int buf_size)
             head_size = 12;
         }
         if (!size)
             return AVERROR_INVALIDDATA;
         /* invalid ISOBMFF size */
-        if (size <= head_size + 4)
+        if (size <= head_size + 4 || size > INT_MAX - ctx->skip)
             return AVERROR_INVALIDDATA;
 
         ctx->skip += size;
         bytestream2_skip(&gb, size - head_size);
         if (bytestream2_get_bytes_left(&gb) <= 0)

Vulnerable code:         if (size <= head_size + 4)
Fixed code:         if (size <= head_size + 4 || size > INT_MAX - ctx->skip)
CVE-2021-3820: Other (NVD-CWE-Other)
value: inflect is vulnerable to Inefficient Regular Expression Complexity
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 7.5
Published: 2021-09-27T13:15Z
Repository: https://github.com/pksunkara/inflect
Language: JavaScript
Files changed: lib/methods.js
Commit date: 2021-09-21 16:19:42 +0530
Commit message: Fix CVE-2021-3820

Diff: diff --git a/lib/methods.js b/lib/methods.js
index 00f83ce..450e63f 100644
--- a/lib/methods.js
+++ b/lib/methods.js
@@ -59,11 +59,11 @@ inflect.camelize = function (lower_case_and_underscored_word, first_letter_in_up
 //
 //     "SSLError".underscore().camelize() // => "SslError"
 inflect.underscore = function (camel_cased_word) {
   var self;
   self = util.string.gsub(camel_cased_word, /\./, '/');
-  self = util.string.gsub(self, /([A-Z]+)([A-Z][a-z])/, '$1_$2');
+  self = util.string.gsub(self, /([A-Z])([A-Z][a-z])/, '$1_$2');
   self = util.string.gsub(self, /([a-z\d])([A-Z])/, '$1_$2');
   self = util.string.gsub(self, /-/, '_');
   return self.toLowerCase();
 };
 
@@ -228,7 +228,7 @@ inflect.tableize = function (class_name) {
 //
 // Singular names are not handled correctly:
 //
 //     "business".classify()       // => "Busines"
 inflect.classify = function (table_name) {
-  return inflect.camelize(inflect.singularize(util.string.gsub(table_name, /.*\./, '')));
+  return inflect.camelize(inflect.singularize(util.string.gsub(table_name, /^.*\./, '')));
 };

Vulnerable code:   self = util.string.gsub(self, /([A-Z]+)([A-Z][a-z])/, '$1_$2');
  return inflect.camelize(inflect.singularize(util.string.gsub(table_name, /.*\./, '')));
Fixed code:   self = util.string.gsub(self, /([A-Z])([A-Z][a-z])/, '$1_$2');
  return inflect.camelize(inflect.singularize(util.string.gsub(table_name, /^.*\./, '')));
CVE-2018-20164: Incorrect Regular Expression (CWE-185)
value: An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0. A Regular Expression Denial of Service (ReDoS) issue allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to a value containing a long digit string. (The UAP-Core project contains the vulnerability, propagating to all implementations.)
CWE description: The product specifies a regular expression in a way that causes data to be improperly matched or compared.
CVSS v3 base score: 5.3
Published: 2019-02-13T14:29Z
Repository: https://github.com/ua-parser/uap-core
Language: Unknown
Commit date: 2018-12-14 08:07:56 +0100
Commit message: Merge pull request #363 from commenthol/safe-regex

regexes update
CVE-2018-20164: Incorrect Regular Expression (CWE-185)
value: An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0. A Regular Expression Denial of Service (ReDoS) issue allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to a value containing a long digit string. (The UAP-Core project contains the vulnerability, propagating to all implementations.)
CWE description: The product specifies a regular expression in a way that causes data to be improperly matched or compared.
CVSS v3 base score: 5.3
Published: 2019-02-13T14:29Z
Repository: https://github.com/ua-parser/uap-core
Language: JSON
Files changed: package.json
Commit date: 2018-12-14 08:19:47 +0100
Commit message: 0.6.0

Diff: diff --git a/package.json b/package.json
index b2e8616..f755375 100644
--- a/package.json
+++ b/package.json
@@ -1,9 +1,9 @@
 {
   "name": "uap-core",
   "description": "The regex file necessary to build language ports of Browserscope's user agent parser.",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "maintainers": [
     {
       "name": "Tobie Langel",
       "email": "tobie.langel@gmail.com",
       "web": "http://tobielangel.com"

Vulnerable code:   "version": "0.5.0",
Fixed code:   "version": "0.6.0",
CVE-2020-5243: Inefficient Regular Expression Complexity (CWE-1333)
value: uap-core before 0.7.3 is vulnerable to a denial of service attack when processing crafted User-Agent strings. Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings. This has been patched in uap-core 0.7.3.
CWE description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CVSS v3 base score: 7.5
Published: 2020-02-21T00:15Z
Repository: https://github.com/ua-parser/uap-core
Language: Unknown
Commit date: 2020-02-20 18:46:44 +0100
Commit message: Merge pull request from GHSA-cmcx-xhr8-3w9p

Advisory fix 1
CVE-2021-21317: Inefficient Regular Expression Complexity (CWE-1333)
value: uap-core in an open-source npm package which contains the core of BrowserScope's original user agent string parser. In uap-core before version 0.11.0, some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings. This is fixed in version 0.11.0. Downstream packages such as uap-python, uap-ruby etc which depend upon uap-core follow different version schemes.
CWE description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CVSS v3 base score: 5.3
Published: 2021-02-16T18:15Z
Repository: https://github.com/ua-parser/uap-core
Language: Unknown
Commit date: 2021-01-30 09:40:13 +0100
Commit message: Merge pull request from GHSA-p4pj-mg4r-x6v4

fix: redos
CVE-2018-6333: Improper Input Validation (CWE-20)
value: The hhvm-attach deep link handler in Nuclide did not properly sanitize the provided hostname parameter when rendering. As a result, a malicious URL could be used to render HTML and other content inside of the editor's context, which could potentially be chained to lead to code execution. This issue affected Nuclide prior to v0.290.0.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 9.8
Published: 2018-12-31T23:29Z
Repository: https://github.com/facebook/nuclide
Language: JavaScript
Files changed: pkg/nuclide-hhvm/lib/main.js
Commit date: 2018-03-16 16:22:29 -0700
Commit message: Ignore invalid hostnames in hhvm-attach deep link

Summary: Provide nicer handling and an error message when following a deep link requesting HHVM debugger attach that has a malformed host name.

Reviewed By: hansonw

Differential Revision: D7308417

fbshipit-source-id: 60bae4013444008980dda9cda8dec5f8ae20944f

Diff: diff --git a/pkg/nuclide-hhvm/lib/main.js b/pkg/nuclide-hhvm/lib/main.js
index d286489c5..d503a37b9 100644
--- a/pkg/nuclide-hhvm/lib/main.js
+++ b/pkg/nuclide-hhvm/lib/main.js
@@ -111,10 +111,21 @@ class Activation {
         remoteProjectsService.waitForRemoteProjectReload(resolve),
       );
     }
 
     const host = nuclideUri.getHostname(pathString);
+
+    // Allow only valid hostname characters, per RFC 952:
+    // https://tools.ietf.org/html/rfc952
+    const invalidMatch = host.match(/[^A-Za-z0-9\-._]+/);
+    if (invalidMatch != null) {
+      atom.notifications.addError(
+        'The specified host name contained invalid characters.',
+      );
+      return;
+    }
+
     const cwd = nuclideUri.createRemoteUri(host, hackRootString);
     const notification = atom.notifications.addInfo(
       startDebugger
         ? `Connecting to ${host} and attaching debugger...`
         : `Connecting to ${host}...`,

Fixed code: 
    // Allow only valid hostname characters, per RFC 952:
    // https://tools.ietf.org/html/rfc952
    const invalidMatch = host.match(/[^A-Za-z0-9\-._]+/);
    if (invalidMatch != null) {
      atom.notifications.addError(
        'The specified host name contained invalid characters.',
      );
      return;
    }
CVE-2024-40627: Insufficient Information (NVD-CWE-noinfo)
value: Fastapi OPA is an opensource fastapi middleware which includes auth flow. HTTP `OPTIONS` requests are always allowed by `OpaMiddleware`, even when they lack authentication, and are passed through directly to the application. `OpaMiddleware` allows all HTTP `OPTIONS` requests without evaluating it against any policy. If an application provides different responses to HTTP `OPTIONS` requests based on an entity existing (such as to indicate whether an entity is writable on a system level), an unauthenticated attacker could discover which entities exist within an application. This issue has been addressed in release version 2.0.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-07-15T20:15Z
Repository: https://github.com/busykoala/fastapi-opa
Language: Unknown
Commit date: 2024-07-15 11:44:41 +0200
Commit message: Merge pull request #73 from busykoala/options_auth

Authenticate OPTIONS requests to prevent information leaks
CVE-2019-16892: Insufficient Information (NVD-CWE-noinfo)
value: In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.5
Published: 2019-09-25T22:15Z
Repository: https://github.com/rubyzip/rubyzip
Language: Unknown
Commit date: 2019-09-25 19:56:00 +0100
Commit message: Merge pull request #403 from rubyzip/check-size

Validate entry sizes when extracting