Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2021-23406: Insufficient Information (NVD-CWE-noinfo)
value: This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. **NOTE:** The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2021-08-24T08:15Z
Repository: https://github.com/TooTallNate/node-degenerator
Language: TypeScript
Files changed: src/index.ts, test/test.ts
Commit date: 2021-07-12 14:26:21 -0700
Commit message: Fix return `undefined`

Diff: diff --git a/src/index.ts b/src/index.ts
index 8030c3c..9f5c83f 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -145,11 +145,11 @@ namespace degenerator {
 			);
 		}
 		const r = function (this: any, ...args: A): Promise<R> {
 			try {
 				const p = fn.apply(this, args);
-				if (typeof p.then === 'function') {
+				if (typeof p?.then === 'function') {
 					return p;
 				}
 				return Promise.resolve(p);
 			} catch (err) {
 				return Promise.reject(err);
diff --git a/test/test.ts b/test/test.ts
index 2fb9b87..e42fa72 100644
--- a/test/test.ts
+++ b/test/test.ts
@@ -134,11 +134,11 @@ describe('degenerator()', () => {
 			assert.equal(
 				err.message,
 				'Expected a "function" to be returned for `foo`, but got "number"'
 			);
 		});
-		it('should be compile if branches', () => {
+		it('should compile if branches', () => {
 			function ifA(): string {
 				if (a()) {
 					return 'foo';
 				}
 				return 'bar';
@@ -171,7 +171,14 @@ describe('degenerator()', () => {
 			} catch(_err) {
 				err = _err;
 			}
 			assert.equal(err.message,'process is not defined')
 		});
+		it('should allow to return synchronous undefined', () => {
+			function u() {}
+			const fn = compile(`${u}`, 'u', ['']);
+			return fn().then(val => {
+				assert.strictEqual(val, undefined);
+			});
+		});
 	});
 });

Vulnerable code: 				if (typeof p.then === 'function') {
		it('should be compile if branches', () => {
Fixed code: 				if (typeof p?.then === 'function') {
		it('should compile if branches', () => {
		it('should allow to return synchronous undefined', () => {
			function u() {}
			const fn = compile(`${u}`, 'u', ['']);
			return fn().then(val => {
				assert.strictEqual(val, undefined);
			});
		});
CVE-2022-24065: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2022-06-08T08:15Z
Repository: https://github.com/cookiecutter/cookiecutter
Language: Unknown
Commit date: 2022-06-01 07:34:38 +0200
Commit message: Merge pull request #1689 from cookiecutter/sanitize-mercurial-checkout

Sanitize Mercurial branch information before checkout.
CVE-2014-0086: Improper Input Validation (CWE-20)
value: The doFilter function in webapp/PushHandlerFilter.java in JBoss RichFaces 4.3.4, 4.3.5, and 5.x allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a large number of malformed atmosphere push requests.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Published: 2014-03-31T14:58Z
Repository: https://github.com/pslegr/core-1
Language: Java
Files changed: impl/src/main/java/org/richfaces/webapp/PushHandlerFilter.java
Commit date: 2014-02-24 08:24:04 +0100
Commit message: RF-13250: applying patch
Diff: diff --git a/impl/src/main/java/org/richfaces/webapp/PushHandlerFilter.java b/impl/src/main/java/org/richfaces/webapp/PushHandlerFilter.java
index 256ab26..8b88e3b 100644
--- a/impl/src/main/java/org/richfaces/webapp/PushHandlerFilter.java
+++ b/impl/src/main/java/org/richfaces/webapp/PushHandlerFilter.java
@@ -76,12 +76,10 @@ public class PushHandlerFilter implements Filter, Serializable {
         if (request instanceof HttpServletRequest && response instanceof HttpServletResponse) {
             HttpServletRequest httpReq = (HttpServletRequest) request;
             HttpServletResponse httpResp = (HttpServletResponse) response;
 
             if ("GET".equals(httpReq.getMethod())) {
-                Meteor meteor = Meteor.build(httpReq, SCOPE.REQUEST, Collections.<BroadcastFilter>emptyList(), null);
-
                 String pushSessionId = httpReq.getParameter(PUSH_SESSION_ID_PARAM);
 
                 Session session = null;
 
                 if (pushSessionId != null) {
@@ -98,10 +96,12 @@ public class PushHandlerFilter implements Filter, Serializable {
                     return;
                 }
 
                 httpResp.setContentType("text/plain");
 
+                Meteor meteor = Meteor.build(httpReq, SCOPE.REQUEST, Collections.<BroadcastFilter>emptyList(), null);
+
                 try {
                     Request pushRequest = new RequestImpl(meteor, session);
 
                     httpReq.setAttribute(SESSION_ATTRIBUTE_NAME, session);
                     httpReq.setAttribute(REQUEST_ATTRIBUTE_NAME, pushRequest);

Vulnerable code:                 Meteor meteor = Meteor.build(httpReq, SCOPE.REQUEST, Collections.<BroadcastFilter>emptyList(), null);

Fixed code:                 Meteor meteor = Meteor.build(httpReq, SCOPE.REQUEST, Collections.<BroadcastFilter>emptyList(), null);
CVE-2015-10081: Cross-Site Request Forgery (CSRF) (CWE-352)
value: A vulnerability was found in arnoldle submitByMailPlugin 1.0b2.9 and classified as problematic. This issue affects some unknown processing of the file edit_list.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.0b2.9a is able to address this issue. The patch is named a739f680a1623d22f52ff1371e86ca472e63756f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-221495.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2023-02-20T17:15Z
Repository: https://github.com/arnoldle/phplist-plugin-submitByMailPlugin
Language: PHP
Files changed: plugins/submitByMailPlugin.php, plugins/submitByMailPlugin/edit_list.php
Commit date: 2015-06-30 10:35:30 -0500
Commit message: Added csrf prevention to edit_list.php

Diff: diff --git a/plugins/submitByMailPlugin.php b/plugins/submitByMailPlugin.php
index ef26a28..18ca009 100644
--- a/plugins/submitByMailPlugin.php
+++ b/plugins/submitByMailPlugin.php
@@ -1,9 +1,9 @@
 <?php
 
 /**
- * submitByMail plugin version 1.0b2.9
+ * submitByMail plugin version 1.0b2.9a
  * 
  *
  * @category  phplist
  * @package   submitByMail Plugin
  * @author    Arnold V. Lesikar
@@ -38,11 +38,11 @@ require_once dirname(__FILE__) . "/submitByMailPlugin/PEAR/Mail/mimeDecode.php";
 
 class submitByMailPlugin extends phplistPlugin
 {
     // Parent properties overridden here
     public $name = 'Submit by Mail Plugin';
-    public $version = '1.0b2.9';
+    public $version = '1.0b2.9a';
     public $enabled = false;
     public $authors = 'Arnold Lesikar';
     public $description = 'Allows messages to be submitted to mailing lists by email';
     public $coderoot; 	// coderoot relative to the phplist admin directory
     public $DBstruct =array (	//For creation of the required tables by Phplist
diff --git a/plugins/submitByMailPlugin/edit_list.php b/plugins/submitByMailPlugin/edit_list.php
index 27534eb..ace6e2e 100644
--- a/plugins/submitByMailPlugin/edit_list.php
+++ b/plugins/submitByMailPlugin/edit_list.php
@@ -36,10 +36,12 @@ if (!defined('PHPLISTINIT')) die(); ## avoid pages being loaded directly
 if (!isSuperUser()){
 	print ("<p>You do not have sufficient privileges to view this page.</p>");
 	return;
 }
 
+verifyCsrfGetToken();	// Prevent cross-site request forgery
+
 $sbm = $GLOBALS['plugins']['submitByMailPlugin'];
 
 $editid = $_GET['eid'];
 $listArray = $sbm->getTheLists();
 $adrsList = array();

Vulnerable code:  * submitByMail plugin version 1.0b2.9
    public $version = '1.0b2.9';
Fixed code:  * submitByMail plugin version 1.0b2.9a
    public $version = '1.0b2.9a';
verifyCsrfGetToken();	// Prevent cross-site request forgery
CVE-2022-0936: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository autolab/autolab prior to 2.8.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-04-11T07:15Z
Repository: https://github.com/autolab/autolab
Language: Ruby
Files changed: app/controllers/attachments_controller.rb
Commit date: 2022-04-10 16:52:02 -0400
Commit message: Force download of attachments (#1490)

* Rubocop fix

* resolve merge

* restore gemfile

* restore nl
Diff: diff --git a/app/controllers/attachments_controller.rb b/app/controllers/attachments_controller.rb
index 0c7e35f..a3ae988 100755
--- a/app/controllers/attachments_controller.rb
+++ b/app/controllers/attachments_controller.rb
@@ -42,12 +42,13 @@ class AttachmentsController < ApplicationController
                         " attachment #{@attachment.name}")
 
       flash[:error] = "Error loading #{@attachment.name} from #{@attachment.filename}"
       redirect_to([@course, :attachments]) && return
     end
+    # Set to application/octet-stream to force download
     send_file(filename, disposition: "inline",
-                        type: @attachment.mime_type, filename: @attachment.filename) && return
+                        type: "application/octet-stream", filename: @attachment.filename) && return
   end
 
   action_auth_level :edit, :instructor
   def edit; end
 

Vulnerable code:                         type: @attachment.mime_type, filename: @attachment.filename) && return
Fixed code:     # Set to application/octet-stream to force download
                        type: "application/octet-stream", filename: @attachment.filename) && return
CVE-2021-3839: Out-of-bounds Read (CWE-125)
value: A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate `msg->payload.inflight.num_queues`, possibly causing out-of-bounds memory read/write. Any software using DPDK vhost library may crash as a result of this vulnerability.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2022-08-23T16:15Z
Repository: https://github.com/DPDK/dpdk
Language: C
Files changed: lib/vhost/vhost_user.c
Commit date: 2022-03-10 14:03:43 +0100
Commit message: vhost: fix queue number check when setting inflight FD

In function vhost_user_set_inflight_fd, queue number in inflight
message is used to access virtqueue. However, queue number could
be larger than VHOST_MAX_VRING and cause write OOB as this number
will be used to write inflight info in virtqueue structure. This
patch checks the queue number to avoid the issue and also make
sure virtqueues are allocated before setting inflight information.

Fixes: ad0a4ae491fe ("vhost: checkout resubmit inflight information")
Cc: stable@dpdk.org

Reported-by: Wenxiang Qian <leonwxqian@gmail.com>
Signed-off-by: Chenbo Xia <chenbo.xia@intel.com>
Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>

Diff: diff --git a/lib/vhost/vhost_user.c b/lib/vhost/vhost_user.c
index 589b950458..1ec4357bee 100644
--- a/lib/vhost/vhost_user.c
+++ b/lib/vhost/vhost_user.c
@@ -2881,10 +2881,13 @@ vhost_user_check_and_alloc_queue_pair(struct virtio_net *dev,
 		vring_idx = ctx->msg.payload.state.index;
 		break;
 	case VHOST_USER_SET_VRING_ADDR:
 		vring_idx = ctx->msg.payload.addr.index;
 		break;
+	case VHOST_USER_SET_INFLIGHT_FD:
+		vring_idx = ctx->msg.payload.inflight.num_queues - 1;
+		break;
 	default:
 		return 0;
 	}
 
 	if (vring_idx >= VHOST_MAX_VRING) {

Fixed code: 	case VHOST_USER_SET_INFLIGHT_FD:
		vring_idx = ctx->msg.payload.inflight.num_queues - 1;
		break;
CVE-2021-3839: Out-of-bounds Write (CWE-787)
value: A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate `msg->payload.inflight.num_queues`, possibly causing out-of-bounds memory read/write. Any software using DPDK vhost library may crash as a result of this vulnerability.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2022-08-23T16:15Z
Repository: https://github.com/DPDK/dpdk
Language: C
Files changed: lib/vhost/vhost_user.c
Commit date: 2022-03-10 14:03:43 +0100
Commit message: vhost: fix queue number check when setting inflight FD

In function vhost_user_set_inflight_fd, queue number in inflight
message is used to access virtqueue. However, queue number could
be larger than VHOST_MAX_VRING and cause write OOB as this number
will be used to write inflight info in virtqueue structure. This
patch checks the queue number to avoid the issue and also make
sure virtqueues are allocated before setting inflight information.

Fixes: ad0a4ae491fe ("vhost: checkout resubmit inflight information")
Cc: stable@dpdk.org

Reported-by: Wenxiang Qian <leonwxqian@gmail.com>
Signed-off-by: Chenbo Xia <chenbo.xia@intel.com>
Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>

Diff: diff --git a/lib/vhost/vhost_user.c b/lib/vhost/vhost_user.c
index 589b950458..1ec4357bee 100644
--- a/lib/vhost/vhost_user.c
+++ b/lib/vhost/vhost_user.c
@@ -2881,10 +2881,13 @@ vhost_user_check_and_alloc_queue_pair(struct virtio_net *dev,
 		vring_idx = ctx->msg.payload.state.index;
 		break;
 	case VHOST_USER_SET_VRING_ADDR:
 		vring_idx = ctx->msg.payload.addr.index;
 		break;
+	case VHOST_USER_SET_INFLIGHT_FD:
+		vring_idx = ctx->msg.payload.inflight.num_queues - 1;
+		break;
 	default:
 		return 0;
 	}
 
 	if (vring_idx >= VHOST_MAX_VRING) {

Fixed code: 	case VHOST_USER_SET_INFLIGHT_FD:
		vring_idx = ctx->msg.payload.inflight.num_queues - 1;
		break;
CVE-2022-0669: Insufficient Information (NVD-CWE-noinfo)
value: A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected number of fds as ancillary data to VHOST_USER_GET_INFLIGHT_FD / VHOST_USER_SET_INFLIGHT_FD messages that are not closed by the vhost-user slave. By sending such messages continuously, the vhost-user master exhausts available fd in the vhost-user slave process, leading to a denial of service.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 6.5
Published: 2022-08-29T15:15Z
Repository: https://github.com/DPDK/dpdk
Language: C
Files changed: lib/vhost/vhost_user.c
Commit date: 2022-03-10 14:03:48 +0100
Commit message: vhost: fix FD leak with inflight messages

Even if unlikely, a buggy vhost-user master might attach fds to inflight
messages. Add checks like for other types of vhost-user messages.

Fixes: d87f1a1cb7b6 ("vhost: support inflight info sharing")
Cc: stable@dpdk.org

Signed-off-by: David Marchand <david.marchand@redhat.com>
Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>

Diff: diff --git a/lib/vhost/vhost_user.c b/lib/vhost/vhost_user.c
index 1ec4357bee..1d390677fa 100644
--- a/lib/vhost/vhost_user.c
+++ b/lib/vhost/vhost_user.c
@@ -1600,10 +1600,13 @@ vhost_user_get_inflight_fd(struct virtio_net **pdev,
 	struct virtio_net *dev = *pdev;
 	int fd, i, j;
 	int numa_node = SOCKET_ID_ANY;
 	void *addr;
 
+	if (validate_msg_fds(dev, ctx, 0) != 0)
+		return RTE_VHOST_MSG_RESULT_ERR;
+
 	if (ctx->msg.size != sizeof(ctx->msg.payload.inflight)) {
 		VHOST_LOG_CONFIG(ERR, "(%s) invalid get_inflight_fd message size is %d\n",
 			dev->ifname, ctx->msg.size);
 		return RTE_VHOST_MSG_RESULT_ERR;
 	}
@@ -1697,10 +1700,13 @@ vhost_user_set_inflight_fd(struct virtio_net **pdev,
 	struct vhost_virtqueue *vq;
 	void *addr;
 	int fd, i;
 	int numa_node = SOCKET_ID_ANY;
 
+	if (validate_msg_fds(dev, ctx, 1) != 0)
+		return RTE_VHOST_MSG_RESULT_ERR;
+
 	fd = ctx->fds[0];
 	if (ctx->msg.size != sizeof(ctx->msg.payload.inflight) || fd < 0) {
 		VHOST_LOG_CONFIG(ERR, "(%s) invalid set_inflight_fd message size is %d,fd is %d\n",
 			dev->ifname, ctx->msg.size, fd);
 		return RTE_VHOST_MSG_RESULT_ERR;

Fixed code: 	if (validate_msg_fds(dev, ctx, 0) != 0)
		return RTE_VHOST_MSG_RESULT_ERR;

	if (validate_msg_fds(dev, ctx, 1) != 0)
		return RTE_VHOST_MSG_RESULT_ERR;
CVE-2021-36219: Access of Uninitialized Pointer (CWE-824)
value: An issue was discovered in SKALE sgxwallet 1.58.3. The provided input for ECALL 14 triggers a branch in trustedEcdsaSign that frees a non-initialized pointer from the stack. An attacker can chain multiple enclave calls to prepare a stack that contains a valid address. This address is then freed, resulting in compromised integrity of the enclave. This was resolved after v1.58.3 and not reproducible in sgxwallet v1.77.0.
CWE description: The product accesses or uses a pointer that has not been initialized.
CVSS v3 base score: 9.8
Published: 2021-09-27T14:15Z
Repository: https://github.com/skalenetwork/sgxwallet
Language: Unknown
Commit date: 2020-05-19 21:36:19 +0300
Commit message: Merge branch 'develop' into SKALE-1180-VERIFY-ECDSA

# Conflicts:
#	SGXWALLET_VERSION

Diff: diff --cc secure_enclave/secure_enclave.c
index 0ea6cd3,32f373a..5943bcd
--- a/secure_enclave/secure_enclave.c
+++ b/secure_enclave/secure_enclave.c
@@@ -665,16 -643,14 +665,14 @@@ void trustedGetEncryptedSecretShare(in
      char skey[ECDSA_SKEY_LEN];
      char pub_key_x[BUF_LEN];
      memset(pub_key_x, 0, BUF_LEN);
      char pub_key_y[BUF_LEN];
      memset(pub_key_y, 0, BUF_LEN);
-     //char *pub_key_x = (char *)calloc(1024, 1);
-     // char *pub_key_y = (char *)calloc(1024, 1);
  
      uint32_t enc_len;
  
 -    trustedGenerateEcdsaKey(errStatus, err_string, encrypted_skey, &enc_len, pub_key_x, pub_key_y);
 +    trustedGenerateEcdsaKey(errStatus, errString, encrypted_skey, &enc_len, pub_key_x, pub_key_y);
      if (*errStatus != 0) {
          return;
      }
  
      *dec_len = enc_len;
CVE-2024-28113: Insufficient Information (NVD-CWE-noinfo)
value: Peering Manager is a BGP session management tool. In Peering Manager <=1.8.2, it is possible to redirect users to an arbitrary page using a crafted url. As a result users can be redirected to an unexpected location. This issue has been addressed in version 1.8.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-12T20:15Z
Repository: https://github.com/peering-manager/peering-manager
Language: Python
Files changed: utils/views.py
Commit date: 2024-01-26 01:12:59 +0100
Commit message: Make sure URL is not absolute before redirecting

Diff: diff --git a/utils/views.py b/utils/views.py
index 94276e28..38788c08 100644
--- a/utils/views.py
+++ b/utils/views.py
@@ -1,5 +1,7 @@
+from urllib.parse import urlparse
+
 from django.conf import settings
 from django.contrib.auth.mixins import (
     PermissionRequiredMixin as _PermissionRequiredMixin,
 )
 from django.urls import reverse
@@ -35,13 +37,13 @@ class GetReturnURLMixin:
 
     default_return_url = None
 
     def get_return_url(self, request, instance=None):
         # Check if `return_url` was specified as a query parameter or form
-        # data, use this URL only if it's safe
+        # data, use this URL only if it's not absolute
         return_url = request.GET.get("return_url") or request.POST.get("return_url")
-        if return_url and return_url.startswith("/"):
+        if return_url and not bool(urlparse(return_url).netloc):
             return return_url
 
         # Check if the object being modified (if any) has an absolute URL
         if (
             instance is not None

Vulnerable code:         # data, use this URL only if it's safe
        if return_url and return_url.startswith("/"):
Fixed code: from urllib.parse import urlparse

        # data, use this URL only if it's not absolute
        if return_url and not bool(urlparse(return_url).netloc):
CVE-2024-28114: Insufficient Information (NVD-CWE-noinfo)
value: Peering Manager is a BGP session management tool. There is a Server Side Template Injection vulnerability that leads to Remote Code Execution in Peering Manager <=1.8.2. As a result arbitrary commands can be executed on the operating system that is running Peering Manager. This issue has been addressed in version 1.8.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-12T20:15Z
Repository: https://github.com/peering-manager/peering-manager
Language: Python
Files changed: docs/templating/index.md, peering_manager/jinja2/__init__.py
Commit date: 2024-01-25 19:04:36 +0100
Commit message: Run Jinja2 code in sandboxed environment

Also warn user in the documentation about security risks when using code
from others.

Diff: diff --git a/docs/templating/index.md b/docs/templating/index.md
index 1a98722f..2f1dc9c6 100644
--- a/docs/templating/index.md
+++ b/docs/templating/index.md
@@ -1,10 +1,16 @@
 # Templating
 
 Peering Manager comes with a built-in templating feature. This feature can be
 used to generate configuration for routers as well as e-mails.
 
+!!! warning
+    Even though Peering Manager uses a sandboxed environment to run Jinja2
+    logic, the language is powerful enough to do things that can potentially
+    leak confidential details or even harm the machine. Be extremely careful
+    when using code from someone else.
+
 ## Jinja2
 
 The templating feature is based on
 [Jinja2](https://jinja.palletsprojects.com/). To simplify template writing,
 Peering Manager exposes [variables](variables.md) and [filters](filters.md).
diff --git a/peering_manager/jinja2/__init__.py b/peering_manager/jinja2/__init__.py
index 6f09459e..eec98576 100644
--- a/peering_manager/jinja2/__init__.py
+++ b/peering_manager/jinja2/__init__.py
@@ -8,13 +8,14 @@ def render_jinja2(template, context, trim=False, lstrip=False):
     Render the template using Jinja2.
     """
     import traceback
 
     from django.conf import settings
-    from jinja2 import Environment, TemplateSyntaxError
+    from jinja2 import TemplateSyntaxError
+    from jinja2.sandbox import SandboxedEnvironment
 
-    environment = Environment(
+    environment = SandboxedEnvironment(
         loader=PeeringManagerLoader(), trim_blocks=trim, lstrip_blocks=lstrip
     )
     environment.add_extension(IncludeTemplateExtension)
     for extension in settings.JINJA2_TEMPLATE_EXTENSIONS:
         environment.add_extension(extension)

Vulnerable code:     from jinja2 import Environment, TemplateSyntaxError
    environment = Environment(
Fixed code: !!! warning
    Even though Peering Manager uses a sandboxed environment to run Jinja2
    logic, the language is powerful enough to do things that can potentially
    leak confidential details or even harm the machine. Be extremely careful
    when using code from someone else.

    from jinja2 import TemplateSyntaxError
    from jinja2.sandbox import SandboxedEnvironment
    environment = SandboxedEnvironment(
CVE-2022-2060: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository dolibarr/dolibarr prior to 16.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-06-13T09:15Z
Repository: https://github.com/dolibarr/dolibarr
Language: Unknown
Commit date: 2022-06-13 10:44:49 +0200
Commit message: Merge branch 'develop' of git@github.com:Dolibarr/dolibarr.git into develop
CVE-2023-32787: Uncontrolled Resource Consumption (CWE-400)
value: The OPC UA Legacy Java Stack before 6f176f2 enables an attacker to block OPC UA server applications via uncontrolled resource consumption so that they can no longer serve client applications.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 7.5
Published: 2023-05-15T15:15Z
Repository: https://github.com/OPCFoundation/UA-Java-Legacy
Language: Unknown
Commit date: 2023-04-28 13:59:55 +0300
Commit message: Merge pull request #229 from OPCFoundation/224-maxconnectioncount-should-be-limited

Fixed #224
CVE-2011-10002: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability classified as critical has been found in weblabyrinth 0.3.1. This affects the function Labyrinth of the file labyrinth.inc.php. The manipulation leads to sql injection. Upgrading to version 0.3.2 is able to address this issue. The identifier of the patch is 60793fd8c8c4759596d3510641e96ea40e7f60e9. It is recommended to upgrade the affected component. The identifier VDB-220221 was assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-02-07T17:15Z
Repository: https://github.com/rotelok/weblabyrinth
Language: PHP
Files changed: labyrinth.inc.php
Commit date: 2011-05-07 20:06:59 +0000
Commit message: Fixed SQLi bug described in https://code.google.com/p/weblabyrinth/issues/detail?id=1 -- Whoops...

Diff: diff --git a/labyrinth.inc.php b/labyrinth.inc.php
index b30d314..31c696f 100644
--- a/labyrinth.inc.php
+++ b/labyrinth.inc.php
@@ -43,15 +43,16 @@ class Labyrinth {
 
 	public function Labyrinth($ip,$useragent){
 		global $config;
 		mt_srand(Labyrinth::MakeSeed());
 
-		$this->crawler_ip = $ip;
-		$this->crawler_useragent = $useragent;
-
 		$this->dbhandle = new SQLiteDatabase($config['tracking_db']);
-		$this->crawler_info = $this->dbhandle->query("SELECT crawler_ip FROM crawlers WHERE crawler_ip='$ip' AND crawler_useragent='$useragent'");
+
+		$this->crawler_ip = sqlite_escape_string($ip);
+		$this->crawler_useragent = sqlite_escape_string($useragent);
+
+		$this->crawler_info = $this->dbhandle->query("SELECT crawler_ip FROM crawlers WHERE crawler_ip='$this->ip' AND crawler_useragent='$this->useragent'");
 	}
 
 	function CheckForSearchEngines(){
 		switch(true){
 			case preg_match("/Google/",$this->crawler_useragent):

Vulnerable code: 		$this->crawler_ip = $ip;
		$this->crawler_useragent = $useragent;

		$this->crawler_info = $this->dbhandle->query("SELECT crawler_ip FROM crawlers WHERE crawler_ip='$ip' AND crawler_useragent='$useragent'");
Fixed code: 
		$this->crawler_ip = sqlite_escape_string($ip);
		$this->crawler_useragent = sqlite_escape_string($useragent);

		$this->crawler_info = $this->dbhandle->query("SELECT crawler_ip FROM crawlers WHERE crawler_ip='$this->ip' AND crawler_useragent='$this->useragent'");
CVE-2021-21284: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escalation to real root. When using "--userns-remap", if the root user in the remapped namespace has access to the host filesystem they can modify files under "/var/lib/docker/<remapping>" that cause writing files with extended privileges. Versions 20.10.3 and 19.03.15 contain patches that prevent privilege escalation from remapped user.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 6.8
Published: 2021-02-02T18:15Z
Repository: https://github.com/moby/moby
Language: Unknown
Commit date: 2021-02-02 08:49:34 -0800
Commit message: Merge pull request #41964 from thaJeztah/CVE-2021-21284_master

[master] Fix Access to remapped root allows privilege escalation to real root (CVE-2021-21284)
CVE-2021-21285: Improper Check for Unusual or Exceptional Conditions (CWE-754)
value: In Docker before versions 9.03.15, 20.10.3 there is a vulnerability in which pulling an intentionally malformed Docker image manifest crashes the dockerd daemon. Versions 20.10.3 and 19.03.15 contain patches that prevent the daemon from crashing.
CWE description: The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
CVSS v3 base score: 6.5
Published: 2021-02-02T18:15Z
Repository: https://github.com/moby/moby
Language: Unknown
Commit date: 2021-02-02 09:16:18 -0800
Commit message: Merge pull request #41966 from thaJeztah/CVE-2021-21285_master

[master] prevent an invalid image from crashing docker daemon (CVE-2021-21285)
CVE-2022-24769: Incorrect Permission Assignment for Critical Resource (CWE-732)
value: Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby (Docker Engine) prior to version 20.10.14 where containers were incorrectly started with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during `execve(2)`. Normally, when executable programs have specified permitted file capabilities, otherwise unprivileged users and processes can execute those programs and gain the specified file capabilities up to the bounding set. Due to this bug, containers which included executable programs with inheritable file capabilities allowed otherwise unprivileged users and processes to additionally gain these inheritable file capabilities up to the container's bounding set. Containers which use Linux users and groups to perform privilege separation inside the container are most directly impacted. This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set. This bug has been fixed in Moby (Docker Engine) 20.10.14. Running containers should be stopped, deleted, and recreated for the inheritable capabilities to be reset. This fix changes Moby (Docker Engine) behavior such that containers are started with a more typical Linux environment. As a workaround, the entry point of a container can be modified to use a utility like `capsh(1)` to drop inheritable capabilities prior to the primary process starting.
CWE description: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CVSS v3 base score: 5.9
Published: 2022-03-24T20:15Z
Repository: https://github.com/moby/moby
Language: Unknown
Commit date: 2022-03-23 22:10:17 +0100
Commit message: Merge pull request from GHSA-2mm7-x5h6-5pvq

oci: inheritable capability set should be empty
CVE-2022-36109: Other (NVD-CWE-Other)
value: Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. This bug is fixed in Moby (Docker Engine) 20.10.18. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade, this problem can be worked around by not using the `"USER $USERNAME"` Dockerfile instruction. Instead by calling `ENTRYPOINT ["su", "-", "user"]` the supplementary groups will be set up properly.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 6.3
Published: 2022-09-09T18:15Z
Repository: https://github.com/moby/moby
Language: Unknown
Commit date: 2022-09-08 21:29:35 +0200
Commit message: Merge pull request from GHSA-rc4r-wh2q-q6c4

AdditionalGids must include effective group ID
CVE-2024-24557: Origin Validation Error (CWE-346)
value: Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases.
CWE description: The product does not properly verify that the source of data or communication is valid.
CVSS v3 base score: 7.8
Published: 2024-02-01T17:15Z
Repository: https://github.com/moby/moby
Language: Unknown
Commit date: 2024-02-01 01:12:23 +0100
Commit message: Merge pull request from GHSA-xw73-rw38-6vjc

image/cache: Restrict cache candidates to locally built images
CVE-2021-41191: Improper Encoding or Escaping of Output (CWE-116)
value: Roblox-Purchasing-Hub is an open source Roblox product purchasing hub. A security risk in versions 1.0.1 and prior allowed people who have someone's API URL to get product files without an API key. This issue is fixed in version 1.0.2. As a workaround, add `@require_apikey` in `BOT/lib/cogs/website.py` under the route for `/v1/products`.
CWE description: The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CVSS v3 base score: 7.5
Published: 2021-10-27T21:15Z
Repository: https://github.com/Redon-Tech/Roblox-Purchasing-Hub
Language: Unknown
Commit date: 2021-10-18 12:36:36 -1000
Commit message: Merge pull request #8 from Redon-Tech/development

V1.0.2
CVE-2017-16642: Out-of-bounds Read (CWE-125)
value: In PHP before 5.6.32, 7.x before 7.0.25, and 7.1.x before 7.1.11, an error in the date extension's timelib_meridian handling of 'front of' and 'back of' directives could be used by attackers able to supply date strings to leak information from the interpreter, related to ext/date/lib/parse_date.c out-of-bounds reads affecting the php_parse_date function. NOTE: this is a different issue than CVE-2017-11145.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2017-11-07T21:29Z
Repository: https://github.com/derickr/timelib
Language: Other
Files changed: parse_date.re, tests/files/frontof.parse
Commit date: 2017-08-14 16:34:20 +0100
Commit message: Fix parser rule for 'backof' and 'frontof'

Diff: diff --git a/parse_date.re b/parse_date.re
index 2fef084..2246e98 100644
--- a/parse_date.re
+++ b/parse_date.re
@@ -945,12 +945,12 @@ mssqltime        = hour12 ":" minutelz ":" secondlz [:.] [0-9]+ meridian;
 isoweekday       = year4 "-"? "W" weekofyear "-"? [0-7];
 isoweek          = year4 "-"? "W" weekofyear;
 exif             = year4 ":" monthlz ":" daylz " " hour24lz ":" minutelz ":" secondlz;
 firstdayof       = 'first day of';
 lastdayof        = 'last day of';
-backof           = 'back of ' hour24 space? meridian?;
-frontof          = 'front of ' hour24 space? meridian?;
+backof           = 'back of ' hour24 (space? meridian)?;
+frontof          = 'front of ' hour24 (space? meridian)?;
 
 /* Common Log Format: 10/Oct/2000:13:55:36 -0700 */
 clf              = day "/" monthabbr "/" year4 ":" hour24lz ":" minutelz ":" secondlz space tzcorrection;
 
 /* Timestamp format: @1126396800 */
diff --git a/tests/files/frontof.parse b/tests/files/frontof.parse
new file mode 100644
index 0000000..b2f57b0
--- /dev/null
+++ b/tests/files/frontof.parse
@@ -0,0 +1,3 @@
+TS: 0 | -99999--99999--99999 -1:45:00 | frONt of 0 0
+TS: 0 | -99999--99999--99999 15:45:00 | frONt of 4pm
+TS: 0 | -99999--99999--99999 15:45:00 | frONt of 4 pm

Vulnerable code: backof           = 'back of ' hour24 space? meridian?;
frontof          = 'front of ' hour24 space? meridian?;
Fixed code: backof           = 'back of ' hour24 (space? meridian)?;
frontof          = 'front of ' hour24 (space? meridian)?;
TS: 0 | -99999--99999--99999 -1:45:00 | frONt of 0 0
TS: 0 | -99999--99999--99999 15:45:00 | frONt of 4pm
TS: 0 | -99999--99999--99999 15:45:00 | frONt of 4 pm
CVE-2018-25017: Out-of-bounds Write (CWE-787)
value: RawSpeed (aka librawspeed) 3.1 has a heap-based buffer overflow in TableLookUp::setTable.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2021-07-01T03:15Z
Repository: https://github.com/darktable-org/rawspeed
Language: C++
Files changed: src/librawspeed/common/TableLookUp.cpp
Commit date: 2018-01-11 22:03:09 +0300
Commit message: TableLookUp::setTable(): do actually check that the LUT is <2^16

Diff: diff --git a/src/librawspeed/common/TableLookUp.cpp b/src/librawspeed/common/TableLookUp.cpp
index ac5ef571..abaeec3a 100644
--- a/src/librawspeed/common/TableLookUp.cpp
+++ b/src/librawspeed/common/TableLookUp.cpp
@@ -38,10 +38,12 @@ TableLookUp::TableLookUp(int _ntables, bool _dither)
 
 void TableLookUp::setTable(int ntable, const std::vector<ushort16>& table) {
   assert(!table.empty());
 
   const int nfilled = table.size();
+  if (nfilled >= 65536)
+    ThrowRDE("Table lookup with %i entries is unsupported", nfilled);
 
   if (ntable > ntables) {
     ThrowRDE("Table lookup with number greater than number of tables.");
   }
   ushort16* t = &tables[ntable * TABLE_SIZE];

Fixed code:   if (nfilled >= 65536)
    ThrowRDE("Table lookup with %i entries is unsupported", nfilled);
CVE-2019-18792: Interpretation Conflict (CWE-436)
value: An issue was discovered in Suricata 5.0.0. It is possible to bypass/evade any tcp based signature by overlapping a TCP segment with a fake FIN packet. The fake FIN packet is injected just before the PUSH ACK packet we want to bypass. The PUSH ACK packet (containing the data) will be ignored by Suricata because it overlaps the FIN packet (the sequence and ack number are identical in the two packets). The client will ignore the fake FIN packet because the ACK flag is not set. Both linux and windows clients are ignoring the injected packet.
CWE description: Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
CVSS v3 base score: 9.1
Published: 2020-01-06T18:15Z
Repository: https://github.com/OISF/suricata
Language: C
Files changed: src/stream-tcp.c
Commit date: 2019-12-13 13:13:28 +0100
Commit message: stream: reject broken ACK packets

Fix evasion posibility by rejecting packets with a broken ACK field.
These packets have a non-0 ACK field, but do not have a ACK flag set.

Bug #3324.

Reported-by: Nicolas Adba

Diff: diff --git a/src/stream-tcp.c b/src/stream-tcp.c
index b38f40cd5..df392376b 100644
--- a/src/stream-tcp.c
+++ b/src/stream-tcp.c
@@ -4801,10 +4801,11 @@ int StreamTcpPacket (ThreadVars *tv, Packet *p, StreamTcpThread *stt,
     }
 
     /* broken TCP http://ask.wireshark.org/questions/3183/acknowledgment-number-broken-tcp-the-acknowledge-field-is-nonzero-while-the-ack-flag-is-not-set */
     if (!(p->tcph->th_flags & TH_ACK) && TCP_GET_ACK(p) != 0) {
         StreamTcpSetEvent(p, STREAM_PKT_BROKEN_ACK);
+        goto error;
     }
 
     /* If we are on IPS mode, and got a drop action triggered from
      * the IP only module, or from a reassembled msg and/or from an
      * applayer detection, then drop the rest of the packets of the
@@ -6927,11 +6928,11 @@ static int StreamTcpTest10 (void)
     StreamTcpUTInit(&stt.ra_ctx);
     stream_config.async_oneside = TRUE;
 
     tcph.th_win = htons(5480);
     tcph.th_seq = htonl(10);
-    tcph.th_ack = htonl(11);
+    tcph.th_ack = 0;
     tcph.th_flags = TH_SYN;
     p->tcph = &tcph;
 
     FAIL_IF(StreamTcpPacket(&tv, p, &stt, &pq) == -1);
 

Vulnerable code:     tcph.th_ack = htonl(11);
Fixed code:         goto error;
    tcph.th_ack = 0;
CVE-2018-1000883: Improper Input Validation (CWE-20)
value: Elixir Plug Plug version All contains a Header Injection vulnerability in Connection that can result in Given a cookie value, Headers can be added. This attack appear to be exploitable via Crafting a value to be sent as a cookie. This vulnerability appears to have been fixed in >= 1.3.5 or ~> 1.2.5 or ~> 1.1.9 or ~> 1.0.6.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 6.5
Published: 2018-12-20T21:29Z
Repository: https://github.com/elixir-plug/plug
Language: Other
Files changed: lib/plug/conn.ex, test/plug/conn_test.exs
Commit date: 2017-04-17 12:20:10 +0200
Commit message: Validate cookie headers

Diff: diff --git a/lib/plug/conn.ex b/lib/plug/conn.ex
index b8d35cc..67da8a9 100644
--- a/lib/plug/conn.ex
+++ b/lib/plug/conn.ex
@@ -988,10 +988,11 @@ defmodule Plug.Conn do
   defp verify_cookie!(cookie, key) when byte_size(cookie) > 4096 do
     raise Plug.Conn.CookieOverflowError,
           "cookie named #{inspect key} exceeds maximum size of 4096 bytes"
   end
   defp verify_cookie!(cookie, _key) do
+    validate_header_value!(cookie)
     cookie
   end
 
   defp update_cookies(%Conn{state: :sent}, _fun),
     do: raise AlreadySentError
diff --git a/test/plug/conn_test.exs b/test/plug/conn_test.exs
index d5b037c..4a4931e 100644
--- a/test/plug/conn_test.exs
+++ b/test/plug/conn_test.exs
@@ -603,10 +603,18 @@ defmodule Plug.ConnTest do
       |> put_resp_cookie("foo", String.duplicate("a", 4095))
       |> send_resp(200, "OK")
     end
   end
 
+  test "put_resp_cookie/4 raises on new line" do
+    assert_raise Plug.Conn.InvalidHeaderError, fn ->
+      conn(:get, "/")
+      |> put_resp_cookie("foo", "bar\nbaz")
+      |> send_resp(200, "OK")
+    end
+  end
+
   test "put_resp_cookie/4 is secure on https" do
     conn = conn(:get, "https://example.com/")
            |> put_resp_cookie("foo", "baz", path: "/baz")
            |> send_resp(200, "ok")
     assert conn.resp_cookies["foo"] ==

Fixed code:     validate_header_value!(cookie)
  test "put_resp_cookie/4 raises on new line" do
    assert_raise Plug.Conn.InvalidHeaderError, fn ->
      conn(:get, "/")
      |> put_resp_cookie("foo", "bar\nbaz")
      |> send_resp(200, "OK")
    end
  end
CVE-2021-42917: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: Buffer overflow vulnerability in Kodi xbmc up to 19.0, allows attackers to cause a denial of service due to improper length of values passed to istream.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 5.5
Published: 2021-11-01T19:15Z
Repository: https://github.com/xbmc/xbmc
Language: Unknown
Commit date: 2021-10-20 12:54:32 +1000
Commit message: Merge pull request #20306 from fuzzard/fix_20305

[Playlist] dont use istream directly to a tinyxml structure
CVE-2023-23082: Out-of-bounds Write (CWE-787)
value: A heap buffer overflow vulnerability in Kodi Home Theater Software up to 19.5 allows attackers to cause a denial of service due to an improper length of the value passed to the offset argument.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 4.6
Published: 2023-02-03T22:15Z
Repository: https://github.com/xbmc/xbmc
Language: Unknown
Commit date: 2023-01-08 17:47:35 +0100
Commit message: Merge pull request #22380 from fritsch/at25

ExifParser: Fix several out of bounds accesses while parsing exif information
CVE-2023-30207: Divide By Zero (CWE-369)
value: A divide by zero issue discovered in Kodi Home Theater Software 19.5 and earlier allows attackers to cause a denial of service via use of crafted mp3 file.
CWE description: The product divides a value by zero.
CVSS v3 base score: 5.5
Published: 2023-07-05T21:15Z
Repository: https://github.com/xbmc/xbmc
Language: C++
Files changed: xbmc/cores/paplayer/VideoPlayerCodec.cpp
Commit date: 2023-01-04 10:53:36 +0100
Commit message: VideoPlayerCodec: Stop dividing by zero

When parsing a file failed so that needed fields, in our case frameSize
are not available a guess work like with m_channels or m_samplerate does
not help. Therefore fail early.

Diff: diff --git a/xbmc/cores/paplayer/VideoPlayerCodec.cpp b/xbmc/cores/paplayer/VideoPlayerCodec.cpp
index eee35a0a5df..668c8206b72 100644
--- a/xbmc/cores/paplayer/VideoPlayerCodec.cpp
+++ b/xbmc/cores/paplayer/VideoPlayerCodec.cpp
@@ -179,11 +179,13 @@ bool VideoPlayerCodec::Init(const CFileItem &file, unsigned int filecache)
   tagLoaderTagLib.Load(file.GetDynPath(), m_tag, strFallbackFileExtension);
 
   // we have to decode initial data in order to get channels/samplerate
   // for sanity - we read no more than 10 packets
   int nErrors = 0;
-  for (int nPacket=0; nPacket < 10 && (m_channels == 0 || m_format.m_sampleRate == 0); nPacket++)
+  for (int nPacket = 0;
+       nPacket < 10 && (m_channels == 0 || m_format.m_sampleRate == 0 || m_format.m_frameSize == 0);
+       nPacket++)
   {
     uint8_t dummy[256];
     size_t nSize = 256;
     if (ReadPCM(dummy, nSize, &nSize) == READ_ERROR)
       ++nErrors;
@@ -237,10 +239,14 @@ bool VideoPlayerCodec::Init(const CFileItem &file, unsigned int filecache)
 
   m_needConvert = false;
   if (NeedConvert(m_srcFormat.m_dataFormat))
   {
     m_needConvert = true;
+    // if we don't know the framesize yet, we will fail when converting
+    if (m_srcFormat.m_frameSize == 0)
+      return false;
+
     m_pResampler = ActiveAE::CAEResampleFactory::Create();
 
     SampleConfig dstConfig, srcConfig;
     dstConfig.channel_layout = CAEUtil::GetAVChannelLayout(m_srcFormat.m_channelLayout);
     dstConfig.channels = m_channels;

Vulnerable code:   for (int nPacket=0; nPacket < 10 && (m_channels == 0 || m_format.m_sampleRate == 0); nPacket++)
Fixed code:   for (int nPacket = 0;
       nPacket < 10 && (m_channels == 0 || m_format.m_sampleRate == 0 || m_format.m_frameSize == 0);
       nPacket++)
    // if we don't know the framesize yet, we will fail when converting
    if (m_srcFormat.m_frameSize == 0)
      return false;