Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2012-5162: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Multiple SQL injection vulnerabilities in oc-admin/ajax/ajax.php in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the id parameter in a (1) edit_category_post or (2) enable_category action to index.php.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Published: 2012-09-26T00:55Z
Repository: https://github.com/osclass/OSClass
Language: Unknown
Commit date: 2012-01-16 19:44:06 +0100
Commit message: OSClass 2.3.5
CVE-2012-5163: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in oc-admin/ajax/ajax.php in OSClass before 2.3.5 allows remote attackers to inject arbitrary web script or HTML via the id parameter in an enable_category action to index.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2012-09-26T00:55Z
Repository: https://github.com/osclass/OSClass
Language: Unknown
Commit date: 2012-01-16 19:44:06 +0100
Commit message: OSClass 2.3.5
CVE-2024-26134: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object. Version 5.6.2 contains a patch for this issue.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Published: 2024-02-19T23:15Z
Repository: https://github.com/agronholm/cbor2
Language: Other
Files changed: docs/versionhistory.rst, source/tags.c
Commit date: 2024-02-03 13:03:38 +0200
Commit message: Check PyObject_Hash() return value for errors

Fixes #213.

Diff: diff --git a/docs/versionhistory.rst b/docs/versionhistory.rst
index 70948c5..c91cdd0 100644
--- a/docs/versionhistory.rst
+++ b/docs/versionhistory.rst
@@ -3,10 +3,15 @@ Version history
 
 .. currentmodule:: cbor2
 
 This library adheres to `Semantic Versioning <http://semver.org/>`_.
 
+**UNRELEASED**
+
+- Fixed ``__hash__()`` of the C version of the ``CBORTag`` type crashing when there's a recursive
+  reference cycle
+
 **5.6.1** (2024-02-01)
 
 - Fixed use-after-free in the decoder's C version when prematurely encountering the end of stream
 - Fixed the C version of the decoder improperly raising ``CBORDecodeEOF`` when decoding a text
   string longer than 65536 bytes
diff --git a/source/tags.c b/source/tags.c
index b718f55..ceb0916 100644
--- a/source/tags.c
+++ b/source/tags.c
@@ -180,10 +180,12 @@ CBORTag_hash(CBORTagObject *self)
     tmp = Py_BuildValue("(KO)", self->tag, self->value);
     if (!tmp)
         goto exit;
 
     ret = PyObject_Hash(tmp);
+    if (ret == -1)
+        goto exit;
 
     // Remove id(self) from thread_locals.running_hashes
     if (PySet_Discard(running_hashes, self_id) == -1) {
         ret = -1;
         goto exit;

Fixed code: **UNRELEASED**

- Fixed ``__hash__()`` of the C version of the ``CBORTag`` type crashing when there's a recursive
  reference cycle

    if (ret == -1)
        goto exit;
CVE-2017-5999: Inadequate Encryption Strength (CWE-326)
value: An issue was discovered in sysPass 2.x before 2.1, in which an algorithm was never sufficiently reviewed by cryptographers. The fact that inc/SP/Core/Crypt.class is using the MCRYPT_RIJNDAEL_256() function (the 256-bit block version of Rijndael, not AES) instead of MCRYPT_RIJNDAEL_128 (real AES) could help an attacker to create unknown havoc in the remote system.
CWE description: The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
CVSS v3 base score: 7.5
Published: 2017-03-06T06:59Z
Repository: https://github.com/nuxsmin/sysPass
Language: Unknown
Commit date: 2017-03-01 03:37:47 +0100
Commit message: Merge branch 'crypt'

Conflicts:
	inc/SP/Core/Upgrade/Group.class.php
	inc/SP/Core/Upgrade/Upgrade.class.php
CVE-2021-29439: Incorrect Authorization (CWE-863)
value: The Grav admin plugin prior to version 1.10.11 does not correctly verify caller's privileges. As a consequence, users with the permission `admin.login` can install third-party plugins and their dependencies. By installing the right plugin, an attacker can obtain an arbitrary code execution primitive and elevate their privileges on the instance. The vulnerability has been addressed in version 1.10.11. As a mitigation blocking access to the `/admin` path from untrusted sources will reduce the probability of exploitation. 
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 7.2
Published: 2021-04-13T20:15Z
Repository: https://github.com/getgrav/grav-plugin-admin
Language: Unknown
Commit date: 2021-04-13 12:21:55 -0600
Commit message: Merge branch 'release/1.10.11'
CVE-2021-3799: Improper Restriction of Rendered UI Layers or Frames (CWE-1021)
value: grav-plugin-admin is vulnerable to Improper Restriction of Rendered UI Layers or Frames
CWE description: The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.
CVSS v3 base score: 5.4
Published: 2021-09-27T13:15Z
Repository: https://github.com/getgrav/grav-plugin-admin
Language: PHP
Files changed: CHANGELOG.md, classes/plugin/Router.php
Commit date: 2021-09-01 13:17:21 +0300
Commit message: Fixed `X-Frame-Options` to be `DENY` in all admin pages to prevent a clickjacking attack

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index f9559e5f1..f7eca9c3e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,10 +1,11 @@
 # v1.10.20
 ## 08/31/2021
 
 3. [](#bugfix)
     * Fixed regression `Argument 4 passed to Grav\Plugin\Form\TwigExtension::prepareFormField() must be of the type array` [#2177](https://github.com/getgrav/grav-plugin-admin/issues/2177)
+    * Fixed `X-Frame-Options` to be `DENY` in all admin pages to prevent a clickjacking attack
 
 # v1.10.19
 ## 08/31/2021
 
 1. [](#new)
diff --git a/classes/plugin/Router.php b/classes/plugin/Router.php
index 2c866616b..c9e32177f 100644
--- a/classes/plugin/Router.php
+++ b/classes/plugin/Router.php
@@ -65,8 +65,8 @@ class Router extends ProcessorBase
         $response = $handler->handle($request);
 
         $this->stopTimer();
 
         // Never allow admin pages to be rendered in <frame>, <iframe>, <embed> or <object> for improved security.
-        return $response->withHeader('X-Frame-Options', 'NONE');
+        return $response->withHeader('X-Frame-Options', 'DENY');
     }
 }

Vulnerable code:         return $response->withHeader('X-Frame-Options', 'NONE');
Fixed code:     * Fixed `X-Frame-Options` to be `DENY` in all admin pages to prevent a clickjacking attack
        return $response->withHeader('X-Frame-Options', 'DENY');
CVE-2023-23631: Uncontrolled Resource Consumption (CWE-400)
value: github.com/ipfs/go-unixfsnode is an ADL IPLD prime node that wraps go-codec-dagpb's implementation of protobuf to enable pathing. In versions priot to 1.5.2 trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks.
If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by bogus fanout parameter in the HAMT directory nodes. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 7.5
Published: 2023-02-09T21:15Z
Repository: https://github.com/ipfs/go-unixfsnode
Language: Other
Files changed: go.mod
Commit date: 2023-02-09 20:42:32 +0100
Commit message: Merge pull request from GHSA-4gj3-6r43-3wfc

Add size check on the bitfield before allocation
Diff: diff --cc go.mod
index c58d36f,a196152..9a82b12
--- a/go.mod
+++ b/go.mod
@@@ -1,36 -1,37 +1,37 @@@
  module github.com/ipfs/go-unixfsnode
  
 -go 1.18
 +go 1.19
  
  require (
- 	github.com/ipfs/go-bitfield v1.0.0
- 	github.com/ipfs/go-cid v0.2.0
+ 	github.com/ipfs/go-bitfield v1.1.0
+ 	github.com/ipfs/go-cid v0.3.2
  	github.com/ipfs/go-ipfs-chunker v0.0.1
  	github.com/ipfs/go-ipfs-util v0.0.2
  	github.com/ipfs/go-ipld-format v0.2.0
  	github.com/ipfs/go-merkledag v0.5.1
- 	github.com/ipfs/go-unixfs v0.3.1
+ 	github.com/ipfs/go-unixfs v0.4.3
  	github.com/ipld/go-car/v2 v2.1.1
  	github.com/ipld/go-codec-dagpb v1.4.1
  	github.com/ipld/go-ipld-prime v0.16.0
- 	github.com/multiformats/go-multicodec v0.4.1
- 	github.com/multiformats/go-multihash v0.1.0
+ 	github.com/multiformats/go-multicodec v0.7.0
+ 	github.com/multiformats/go-multihash v0.2.1
  	github.com/spaolacci/murmur3 v1.1.0
- 	github.com/stretchr/testify v1.7.0
- 	google.golang.org/protobuf v1.28.0
+ 	github.com/stretchr/testify v1.8.1
+ 	google.golang.org/protobuf v1.28.1
  )
  
  require (
+ 	github.com/benbjohnson/clock v1.3.0 // indirect
  	github.com/davecgh/go-spew v1.1.1 // indirect
  	github.com/gogo/protobuf v1.3.2 // indirect
- 	github.com/google/uuid v1.2.0 // indirect
+ 	github.com/google/uuid v1.3.0 // indirect
  	github.com/hashicorp/golang-lru v0.5.4 // indirect
  	github.com/ipfs/bbloom v0.0.4 // indirect
  	github.com/ipfs/go-block-format v0.0.3 // indirect
  	github.com/ipfs/go-blockservice v0.2.1 // indirect
- 	github.com/ipfs/go-datastore v0.5.0 // indirect
+ 	github.com/ipfs/go-datastore v0.6.0 // indirect
  	github.com/ipfs/go-ipfs-blockstore v1.1.2 // indirect
  	github.com/ipfs/go-ipfs-ds-help v1.1.0 // indirect
  	github.com/ipfs/go-ipfs-exchange-interface v0.1.0 // indirect
  	github.com/ipfs/go-ipfs-exchange-offline v0.1.1 // indirect
  	github.com/ipfs/go-ipld-cbor v0.0.5 // indirect

Vulnerable code:  	github.com/ipfs/go-bitfield v1.0.0
 	github.com/ipfs/go-cid v0.2.0
Fixed code:  	github.com/ipfs/go-bitfield v1.1.0
 	github.com/ipfs/go-cid v0.3.2
CVE-2018-0500: Out-of-bounds Write (CWE-787)
value: Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that might be exploitable by an attacker who can control the data that curl transmits over SMTP with certain settings (i.e., use of a nonstandard --limit-rate argument or CURLOPT_BUFFERSIZE value).
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2018-07-11T13:29Z
Repository: https://github.com/curl/curl
Language: C
Files changed: lib/smtp.c
Commit date: 2018-07-09 08:15:48 +0200
Commit message: smtp: use the upload buffer size for scratch buffer malloc

... not the read buffer size, as that can be set smaller and thus cause
a buffer overflow! CVE-2018-0500

Reported-by: Peter Wu
Bug: https://curl.haxx.se/docs/adv_2018-70a2.html

Diff: diff --git a/lib/smtp.c b/lib/smtp.c
index e6872badb8..ecf10a41ac 100644
--- a/lib/smtp.c
+++ b/lib/smtp.c
@@ -1561,17 +1561,18 @@ CURLcode Curl_smtp_escape_eob(struct connectdata *conn, const ssize_t nread)
 
   /* Do we need to allocate a scratch buffer? */
   if(!scratch || data->set.crlf) {
     oldscratch = scratch;
 
-    scratch = newscratch = malloc(2 * data->set.buffer_size);
+    scratch = newscratch = malloc(2 * UPLOAD_BUFSIZE);
     if(!newscratch) {
       failf(data, "Failed to alloc scratch buffer!");
 
       return CURLE_OUT_OF_MEMORY;
     }
   }
+  DEBUGASSERT(UPLOAD_BUFSIZE >= nread);
 
   /* Have we already sent part of the EOB? */
   eob_sent = smtp->eob;
 
   /* This loop can be improved by some kind of Boyer-Moore style of

Vulnerable code:     scratch = newscratch = malloc(2 * data->set.buffer_size);
Fixed code:     scratch = newscratch = malloc(2 * UPLOAD_BUFSIZE);
  DEBUGASSERT(UPLOAD_BUFSIZE >= nread);
CVE-2018-16839: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 9.8
Published: 2018-10-31T18:29Z
Repository: https://github.com/curl/curl
Language: C
Files changed: lib/vauth/cleartext.c
Commit date: 2018-10-29 08:05:23 +0100
Commit message: Curl_auth_create_plain_message: fix too-large-input-check

CVE-2018-16839
Reported-by: Harry Sintonen
Bug: https://curl.haxx.se/docs/CVE-2018-16839.html

Diff: diff --git a/lib/vauth/cleartext.c b/lib/vauth/cleartext.c
index a10edbdc74..be6d6111e2 100644
--- a/lib/vauth/cleartext.c
+++ b/lib/vauth/cleartext.c
@@ -72,11 +72,11 @@ CURLcode Curl_auth_create_plain_message(struct Curl_easy *data,
   *outptr = NULL;
   ulen = strlen(userp);
   plen = strlen(passwdp);
 
   /* Compute binary message length. Check for overflows. */
-  if((ulen > SIZE_T_MAX/2) || (plen > (SIZE_T_MAX/2 - 2)))
+  if((ulen > SIZE_T_MAX/4) || (plen > (SIZE_T_MAX/2 - 2)))
     return CURLE_OUT_OF_MEMORY;
   plainlen = 2 * ulen + plen + 2;
 
   plainauth = malloc(plainlen);
   if(!plainauth)

Vulnerable code:   if((ulen > SIZE_T_MAX/2) || (plen > (SIZE_T_MAX/2 - 2)))
Fixed code:   if((ulen > SIZE_T_MAX/4) || (plen > (SIZE_T_MAX/2 - 2)))
CVE-2018-16840: Use After Free (CWE-416)
value: A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 9.8
Published: 2018-10-31T18:29Z
Repository: https://github.com/curl/curl
Language: C
Files changed: lib/url.c
Commit date: 2018-10-29 08:05:23 +0100
Commit message: Curl_close: clear data->multi_easy on free to avoid use-after-free

Regression from b46cfbc068 (7.59.0)
CVE-2018-16840
Reported-by: Brian Carpenter (Geeknik Labs)

Bug: https://curl.haxx.se/docs/CVE-2018-16840.html

Diff: diff --git a/lib/url.c b/lib/url.c
index 723b898065..0d5a13f996 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -329,14 +329,16 @@ CURLcode Curl_close(struct Curl_easy *data)
   if(m)
     /* This handle is still part of a multi handle, take care of this first
        and detach this handle from there. */
     curl_multi_remove_handle(data->multi, data);
 
-  if(data->multi_easy)
+  if(data->multi_easy) {
     /* when curl_easy_perform() is used, it creates its own multi handle to
        use and this is the one */
     curl_multi_cleanup(data->multi_easy);
+    data->multi_easy = NULL;
+  }
 
   /* Destroy the timeout list that is held in the easy handle. It is
      /normally/ done by curl_multi_remove_handle() but this is "just in
      case" */
   Curl_llist_destroy(&data->state.timeoutlist, NULL);

Vulnerable code:   if(data->multi_easy)
Fixed code:   if(data->multi_easy) {
    data->multi_easy = NULL;
  }
CVE-2018-16842: Out-of-bounds Read (CWE-125)
value: Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.1
Published: 2018-10-31T19:29Z
Repository: https://github.com/curl/curl
Language: C
Files changed: src/tool_msgs.c
Commit date: 2018-10-30 07:47:25 +0100
Commit message: voutf: fix bad arethmetic when outputting warnings to stderr

CVE-2018-16842
Reported-by: Brian Carpenter
Bug: https://curl.haxx.se/docs/CVE-2018-16842.html

Diff: diff --git a/src/tool_msgs.c b/src/tool_msgs.c
index 832ed8147b..f5e1df25fb 100644
--- a/src/tool_msgs.c
+++ b/src/tool_msgs.c
@@ -65,11 +65,11 @@ static void voutf(struct GlobalConfig *config,
           cut = width-1;
 
         (void)fwrite(ptr, cut + 1, 1, config->errors);
         fputs("\n", config->errors);
         ptr += cut + 1; /* skip the space too */
-        len -= cut;
+        len -= cut + 1;
       }
       else {
         fputs(ptr, config->errors);
         len = 0;
       }

Vulnerable code:         len -= cut;
Fixed code:         len -= cut + 1;
CVE-2021-22898: Missing Initialization of Resource (CWE-909)
value: curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.
CWE description: The product does not initialize a critical resource.
CVSS v3 base score: 3.1
Published: 2021-06-11T16:15Z
Repository: https://github.com/curl/curl
Language: C
Files changed: lib/telnet.c
Commit date: 2021-05-24 07:56:05 +0200
Commit message: telnet: check sscanf() for correct number of matches

CVE-2021-22898

Bug: https://curl.se/docs/CVE-2021-22898.html

Diff: diff --git a/lib/telnet.c b/lib/telnet.c
index 26e0658ba9..fdd137fb0c 100644
--- a/lib/telnet.c
+++ b/lib/telnet.c
@@ -920,11 +920,11 @@ static void suboption(struct Curl_easy *data)
 
       for(v = tn->telnet_vars; v; v = v->next) {
         size_t tmplen = (strlen(v->data) + 1);
         /* Add the variable only if it fits */
         if(len + tmplen < (int)sizeof(temp)-6) {
-          if(sscanf(v->data, "%127[^,],%127s", varname, varval)) {
+          if(sscanf(v->data, "%127[^,],%127s", varname, varval) == 2) {
             msnprintf((char *)&temp[len], sizeof(temp) - len,
                       "%c%s%c%s", CURL_NEW_ENV_VAR, varname,
                       CURL_NEW_ENV_VALUE, varval);
             len += tmplen;
           }

Vulnerable code:           if(sscanf(v->data, "%127[^,],%127s", varname, varval)) {
Fixed code:           if(sscanf(v->data, "%127[^,],%127s", varname, varval) == 2) {
CVE-2023-37378: Insufficient Information (NVD-CWE-noinfo)
value: Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.3
Published: 2023-07-03T20:15Z
Repository: https://github.com/kichik/nsis
Language: C
Files changed: Source/exehead/util.c
Commit date: 2023-06-21 23:38:48 +0000
Commit message: Don't allow everyone to delete the uninstaller directory


git-svn-id: https://svn.code.sf.net/p/nsis/code/NSIS/trunk@7396 212acab6-be3b-0410-9dea-997c60f758d6

Diff: diff --git a/Source/exehead/util.c b/Source/exehead/util.c
index ba682f6f7..634d4a69f 100644
--- a/Source/exehead/util.c
+++ b/Source/exehead/util.c
@@ -60,11 +60,11 @@ const UINT32 g_restrictedacl[] = {
   0x00340002, 0x00000002, // ACL (ACL_REVISION2, 2 ACEs)
   0x00180300, // ACCESS_ALLOWED_ACE:ACE_HEADER (ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE|OBJECT_INHERIT_ACE)
   0x10000000, // ACCESS_ALLOWED_ACE:ACCESS_MASK: GENERIC_ALL
   0x00000201, 0x05000000, 0x00000020, 0x00000220, // ACCESS_ALLOWED_ACE:SID (BUILTIN\Administrators) NOTE: GetAdminGrpSid() relies on this being the first SID in the ACL
   0x00140300, // ACCESS_ALLOWED_ACE:ACE_HEADER (ACCESS_ALLOWED_ACE_TYPE, CONTAINER_INHERIT_ACE|OBJECT_INHERIT_ACE)
-  0x00130041, // ACCESS_ALLOWED_ACE:ACCESS_MASK: DELETE|READ_CONTROL|SYNCHRONIZE|FILE_DELETE_CHILD|FILE_LIST_DIRECTORY
+  0x001200c1, // ACCESS_ALLOWED_ACE:ACCESS_MASK: SYNCHRONIZE|READ_CONTROL|FILE_LIST_DIRECTORY|FILE_DELETE_CHILD|FILE_READ_ATTRIBUTES
   0x00000101, 0x01000000, 0x00000000 // ACCESS_ALLOWED_ACE:SID (WORLD\Everyone)
 };
 
 DWORD NSISCALL CreateRestrictedDirectory(LPCTSTR path)
 {

Vulnerable code:   0x00130041, // ACCESS_ALLOWED_ACE:ACCESS_MASK: DELETE|READ_CONTROL|SYNCHRONIZE|FILE_DELETE_CHILD|FILE_LIST_DIRECTORY
Fixed code:   0x001200c1, // ACCESS_ALLOWED_ACE:ACCESS_MASK: SYNCHRONIZE|READ_CONTROL|FILE_LIST_DIRECTORY|FILE_DELETE_CHILD|FILE_READ_ATTRIBUTES
CVE-2023-37378: Insufficient Information (NVD-CWE-noinfo)
value: Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.3
Published: 2023-07-03T20:15Z
Repository: https://github.com/kichik/nsis
Language: C
Files changed: Source/exehead/Main.c
Commit date: 2023-06-03 15:10:54 +0000
Commit message: Don't delete old uninstaller if it points somewhere else


git-svn-id: https://svn.code.sf.net/p/nsis/code/NSIS/trunk@7394 212acab6-be3b-0410-9dea-997c60f758d6

Diff: diff --git a/Source/exehead/Main.c b/Source/exehead/Main.c
index 78ff558c6..e39c63167 100644
--- a/Source/exehead/Main.c
+++ b/Source/exehead/Main.c
@@ -374,14 +374,14 @@ retry_un_dir:
           ec = CreateNormalDirectory(state_temp_dir);
         }
 
         if (ec)
         {
-          // Delete previous uninstaller
-          if (DeleteFile(unexe))
+          // Delete previous uninstaller (if it is safe to do so)
+          if (!(GetFileAttributes(unexe) & FILE_ATTRIBUTE_REPARSE_POINT) && DeleteFile(unexe))
           {
-            myDelete(state_temp_dir, DEL_DIR|DEL_RECURSE);
+            myDelete(state_temp_dir, DEL_DIR);
             if (!retry++) goto retry_un_dir;
           }
         }
         else
         {

Vulnerable code:           // Delete previous uninstaller
          if (DeleteFile(unexe))
            myDelete(state_temp_dir, DEL_DIR|DEL_RECURSE);
Fixed code:           // Delete previous uninstaller (if it is safe to do so)
          if (!(GetFileAttributes(unexe) & FILE_ATTRIBUTE_REPARSE_POINT) && DeleteFile(unexe))
            myDelete(state_temp_dir, DEL_DIR);
CVE-2018-1000052: Use of Externally-Controlled Format String (CWE-134)
value: fmtlib version prior to version 4.1.0 (before commit 0555cea5fc0bf890afe0071a558e44625a34ba85) contains a Memory corruption (SIGSEGV), CWE-134 vulnerability in fmt::print() library function that can result in Denial of Service. This attack appear to be exploitable via Specifying an invalid format specifier in the fmt::print() function results in a SIGSEGV (memory corruption, invalid write). This vulnerability appears to have been fixed in after commit 8cf30aa2be256eba07bb1cefb998c52326e846e7.
CWE description: The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
CVSS v3 base score: 7.5
Published: 2018-02-09T23:29Z
Repository: https://github.com/fmtlib/fmt
Language: C++
Files changed: fmt/format.h, test/format-test.cc
Commit date: 2018-02-01 21:49:03 -0800
Commit message: Fix segfault on complex pointer formatting (#642)

Diff: diff --git a/fmt/format.h b/fmt/format.h
index 2327659..6a8fa66 100644
--- a/fmt/format.h
+++ b/fmt/format.h
@@ -2998,17 +2998,17 @@ typename BasicWriter<Char>::CharPtr
     unsigned fill_size = width - number_size;
     if (align != ALIGN_LEFT) {
       CharPtr p = grow_buffer(fill_size);
       std::uninitialized_fill(p, p + fill_size, fill);
     }
-    CharPtr result = prepare_int_buffer(
-        num_digits, subspec, prefix, prefix_size);
+    std::ptrdiff_t offset = get(prepare_int_buffer(
+        num_digits, subspec, prefix, prefix_size)) - &buffer_[0];
     if (align == ALIGN_LEFT) {
       CharPtr p = grow_buffer(fill_size);
       std::uninitialized_fill(p, p + fill_size, fill);
     }
-    return result;
+    return internal::make_ptr(&buffer_[0], buffer_.size()) + offset;
   }
   unsigned size = prefix_size + num_digits;
   if (width <= size) {
     CharPtr p = grow_buffer(size);
     std::uninitialized_copy(prefix, prefix + prefix_size, p);
diff --git a/test/format-test.cc b/test/format-test.cc
index c836541..ec232e8 100644
--- a/test/format-test.cc
+++ b/test/format-test.cc
@@ -1759,5 +1759,9 @@ void convert(int);
 
 // Check if there is no collision with convert function in the global namespace.
 TEST(FormatTest, ConvertCollision) {
   fmt::format("{}", 42);
 }
+
+TEST(FormatTest, Regression) {
+  fmt::format("...........{:<77777.7p}", "foo");
+}

Vulnerable code:     CharPtr result = prepare_int_buffer(
        num_digits, subspec, prefix, prefix_size);
    return result;
Fixed code:     std::ptrdiff_t offset = get(prepare_int_buffer(
        num_digits, subspec, prefix, prefix_size)) - &buffer_[0];
    return internal::make_ptr(&buffer_[0], buffer_.size()) + offset;

TEST(FormatTest, Regression) {
  fmt::format("...........{:<77777.7p}", "foo");
}
CVE-2022-4817: Exposure of Resource to Wrong Sphere (CWE-668)
value: A vulnerability was found in centic9 jgit-cookbook. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to insecure temporary file. The attack can be initiated remotely. The name of the patch is b8cb29b43dc704708d598c60ac1881db7cf8e9c3. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216988.
CWE description: The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
CVSS v3 base score: 7.8
Published: 2022-12-28T19:15Z
Repository: https://github.com/centic9/jgit-cookbook
Language: Unknown
Commit date: 2022-08-09 08:17:52 +0200
Commit message: Merge pull request #86 from BulkSecurityGeneratorProjectV2/fix/JLL/temporary_directory_hijacking_or_temporary_directory_information_disclosure

[SECURITY] Fix Temporary Directory Hijacking or Information Disclosure Vulnerability
CVE-2018-7466: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: install/installNewDB.php in TestLink through 1.9.16 allows remote attackers to conduct injection attacks by leveraging control over DB LOGIN NAMES data during installation to provide a long, crafted value.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 7.5
Published: 2018-02-25T07:29Z
Repository: https://github.com/TestLinkOpenSourceTRMS/testlink-code
Language: PHP
Files changed: install/installNewDB.php
Commit date: 2018-02-24 17:21:33 +0100
Commit message: Limit DB LOGIN NAMES length to avoid some kind of injection

Diff: diff --git a/install/installNewDB.php b/install/installNewDB.php
index e6428ed0d..dbfc37650 100644
--- a/install/installNewDB.php
+++ b/install/installNewDB.php
@@ -61,26 +61,29 @@ $db_table_prefix = trim($_SESSION['tableprefix']);
 $db_table_prefix = preg_replace($san,'',$db_table_prefix);
 
 $db_server = trim($_SESSION['databasehost']);
 $db_server = preg_replace($san,'',$db_server);
 
-$db_admin_name = trim($_SESSION['databaseloginname']);
-$db_admin_name = preg_replace($san,'',$db_admin_name);
-
 $db_admin_pass = trim($_SESSION['databaseloginpassword']);
 $db_admin_pass = preg_replace($san,'',$db_admin_pass);
 
 $db_type = trim($_SESSION['databasetype']);
 $db_type = preg_replace($san,'',$db_type);
 
-$tl_db_login = trim($_SESSION['tl_loginname']);
-$tl_db_login = preg_replace($san,'',$tl_db_login);
-
 $tl_db_passwd = trim($_SESSION['tl_loginpassword']);
 $tl_db_passwd = preg_replace($san,'',$tl_db_passwd);
 
 
+// will limit length to avoi some kind of injection
+// Choice: 32 
+$tl_db_login = trim($_SESSION['tl_loginname']);
+$tl_db_login = substr(preg_replace($san,'',$tl_db_login),0,32);
+
+$db_admin_name = trim($_SESSION['databaseloginname']);
+$db_admin_name = substr(preg_replace($san,'',$db_admin_name),0,32);
+
+
 
 $sql_create_schema = array();
 $sql_create_schema[] = "sql/{$db_type}/testlink_create_tables.sql";
 $a_sql_schema = array();
 $a_sql_schema[] = $sql_create_schema;

Vulnerable code: $db_admin_name = trim($_SESSION['databaseloginname']);
$db_admin_name = preg_replace($san,'',$db_admin_name);

$tl_db_login = trim($_SESSION['tl_loginname']);
$tl_db_login = preg_replace($san,'',$tl_db_login);

Fixed code: // will limit length to avoi some kind of injection
// Choice: 32 
$tl_db_login = trim($_SESSION['tl_loginname']);
$tl_db_login = substr(preg_replace($san,'',$tl_db_login),0,32);

$db_admin_name = trim($_SESSION['databaseloginname']);
$db_admin_name = substr(preg_replace($san,'',$db_admin_name),0,32);
CVE-2019-20107: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Multiple SQL injection vulnerabilities in TestLink through 1.9.19 allows remote authenticated users to execute arbitrary SQL commands via the (1) tproject_id parameter to keywordsView.php; the (2) req_spec_id parameter to reqSpecCompareRevisions.php; the (3) requirement_id parameter to reqCompareVersions.php; the (4) build_id parameter to planUpdateTC.php; the (5) tplan_id parameter to newest_tcversions.php; the (6) tplan_id parameter to tcCreatedPerUserGUI.php; the (7) tcase_id parameter to tcAssign2Tplan.php; or the (8) testcase_id parameter to tcCompareVersions.php. Authentication is often easy to achieve: a guest account, that can execute this attack, can be created by anyone in the default configuration.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 8.8
Published: 2020-03-05T13:15Z
Repository: https://github.com/TestLinkOpenSourceTRMS/testlink-code
Language: PHP
Files changed: lib/testcases/tcAssign2Tplan.php
Commit date: 2019-12-30 09:58:07 +0100
Commit message: fix: security #8829

Diff: diff --git a/lib/testcases/tcAssign2Tplan.php b/lib/testcases/tcAssign2Tplan.php
index d3b0df1e9..acfd3e664 100644
--- a/lib/testcases/tcAssign2Tplan.php
+++ b/lib/testcases/tcAssign2Tplan.php
@@ -174,12 +174,21 @@ function init_args()
 
   // if any piece of context is missing => we will display nothing instead of crashing WORK TO BE DONE
   $args = new stdClass();
   $args->tplan_id = isset($_REQUEST['tplan_id']) ? $_REQUEST['tplan_id'] : $_SESSION['testplanID'];
   $args->tproject_id = isset($_REQUEST['tproject_id']) ? $_REQUEST['tproject_id'] : $_SESSION['testprojectID'];
+  
+  $args->tproject_id = intval($args->tproject_id);
+  $args->tplan_id = intval($args->tplan_id);
+
+
   $args->tcase_id = isset($_REQUEST['tcase_id']) ? $_REQUEST['tcase_id'] : 0;
+  $args->tcase_id = intval($args->tcase_id);
+
   $args->tcversion_id = isset($_REQUEST['tcversion_id']) ? $_REQUEST['tcversion_id'] : 0;
+  $args->tcversion_id = intval($args->tcversion_id);
+
   return $args; 
 }
 
 
 /**

Fixed code:   
  $args->tproject_id = intval($args->tproject_id);
  $args->tplan_id = intval($args->tplan_id);


  $args->tcase_id = intval($args->tcase_id);

  $args->tcversion_id = intval($args->tcversion_id);
CVE-2019-20107: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Multiple SQL injection vulnerabilities in TestLink through 1.9.19 allows remote authenticated users to execute arbitrary SQL commands via the (1) tproject_id parameter to keywordsView.php; the (2) req_spec_id parameter to reqSpecCompareRevisions.php; the (3) requirement_id parameter to reqCompareVersions.php; the (4) build_id parameter to planUpdateTC.php; the (5) tplan_id parameter to newest_tcversions.php; the (6) tplan_id parameter to tcCreatedPerUserGUI.php; the (7) tcase_id parameter to tcAssign2Tplan.php; or the (8) testcase_id parameter to tcCompareVersions.php. Authentication is often easy to achieve: a guest account, that can execute this attack, can be created by anyone in the default configuration.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 8.8
Published: 2020-03-05T13:15Z
Repository: https://github.com/TestLinkOpenSourceTRMS/testlink-code
Language: PHP
Files changed: lib/requirements/reqCompareVersions.php
Commit date: 2019-12-30 09:51:24 +0100
Commit message: fix: security #8829

Diff: diff --git a/lib/requirements/reqCompareVersions.php b/lib/requirements/reqCompareVersions.php
index dd04e4bdb..88ec0d8be 100644
--- a/lib/requirements/reqCompareVersions.php
+++ b/lib/requirements/reqCompareVersions.php
@@ -245,15 +245,16 @@ function getCFDiff($cfields,&$reqMgr)
  *
  */
 function init_args() {
   $args = new stdClass();
 
-  $args->req_id = isset($_REQUEST['requirement_id']) ? $_REQUEST['requirement_id'] : 0;
+  $args->req_id = isset($_REQUEST['requirement_id']) ? intval($_REQUEST['requirement_id']) : 0;
+
   $args->compare_selected_versions = isset($_REQUEST['compare_selected_versions']);
   $args->left_item_id = isset($_REQUEST['left_item_id']) ? intval($_REQUEST['left_item_id']) : -1;
   $args->right_item_id = isset($_REQUEST['right_item_id']) ? intval($_REQUEST['right_item_id']) :  -1;
-    $args->tproject_id = isset($_SESSION['testprojectID']) ? $_SESSION['testprojectID'] : 0;
+    $args->tproject_id = isset($_SESSION['testprojectID']) ? intval($_SESSION['testprojectID']) : 0;
 
   $args->use_daisydiff = isset($_REQUEST['use_html_comp']);
 
   $diffEngineCfg = config_get("diffEngine");
   $args->context = null;

Vulnerable code:   $args->req_id = isset($_REQUEST['requirement_id']) ? $_REQUEST['requirement_id'] : 0;
    $args->tproject_id = isset($_SESSION['testprojectID']) ? $_SESSION['testprojectID'] : 0;
Fixed code:   $args->req_id = isset($_REQUEST['requirement_id']) ? intval($_REQUEST['requirement_id']) : 0;

    $args->tproject_id = isset($_SESSION['testprojectID']) ? intval($_SESSION['testprojectID']) : 0;
CVE-2019-20107: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Multiple SQL injection vulnerabilities in TestLink through 1.9.19 allows remote authenticated users to execute arbitrary SQL commands via the (1) tproject_id parameter to keywordsView.php; the (2) req_spec_id parameter to reqSpecCompareRevisions.php; the (3) requirement_id parameter to reqCompareVersions.php; the (4) build_id parameter to planUpdateTC.php; the (5) tplan_id parameter to newest_tcversions.php; the (6) tplan_id parameter to tcCreatedPerUserGUI.php; the (7) tcase_id parameter to tcAssign2Tplan.php; or the (8) testcase_id parameter to tcCompareVersions.php. Authentication is often easy to achieve: a guest account, that can execute this attack, can be created by anyone in the default configuration.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 8.8
Published: 2020-03-05T13:15Z
Repository: https://github.com/TestLinkOpenSourceTRMS/testlink-code
Language: PHP
Files changed: lib/testcases/tcCompareVersions.php
Commit date: 2019-12-30 09:59:16 +0100
Commit message: fix: security #8829

Diff: diff --git a/lib/testcases/tcCompareVersions.php b/lib/testcases/tcCompareVersions.php
index 327cf1073..0cf2a3ebc 100644
--- a/lib/testcases/tcCompareVersions.php
+++ b/lib/testcases/tcCompareVersions.php
@@ -83,11 +83,12 @@ function init_args()
 	$args = new stdClass();
   $args->use_daisydiff = isset($_REQUEST['use_html_comp']);
 	
 
   $args->tcase_id = isset($_REQUEST['testcase_id']) ? $_REQUEST['testcase_id'] : 0;
-
+  $args->tcase_id = intval($args->tcase_id);
+ 
   $key2set = array('compare_selected_versions' => 0,'version_left' => '','version_right' => '');
   foreach($key2set as $tk => $value)
   {
     $args->$tk = isset($_REQUEST[$tk]) ? $_REQUEST[$tk] : $value;
   } 

Fixed code:   $args->tcase_id = intval($args->tcase_id);
CVE-2019-20381: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: TestLink before 1.9.20 allows XSS via non-lowercase javascript: in the index.php reqURI parameter. NOTE: this issue exists because of an incomplete fix for CVE-2019-19491.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2020-01-20T06:15Z
Repository: https://github.com/TestLinkOpenSourceTRMS/testlink-code
Language: PHP
Files changed: index.php
Commit date: 2019-12-31 15:07:14 +0100
Commit message: fix: 0008808: TestLink v1.9.19.1 - Bypass security fix for XSS at index.php

Diff: diff --git a/index.php b/index.php
index fc8e7aed92..76494b8392 100644
--- a/index.php
+++ b/index.php
@@ -90,11 +90,11 @@ function initEnv() {
   if ($pParams["reqURI"] != '') {
     $args->reqURI = $pParams["reqURI"];
 
     // some sanity checks
     // strpos ( string $haystack , mixed $needle
-    if (strpos($args->reqURI,'javascript') !== false) {
+    if (stripos($args->reqURI,'javascript') !== false) {
       $args->reqURI = null; 
     }
   }
   if (null == $args->reqURI) {
     $args->reqURI = 'lib/general/mainPage.php';

Vulnerable code:     if (strpos($args->reqURI,'javascript') !== false) {
Fixed code:     if (stripos($args->reqURI,'javascript') !== false) {
CVE-2022-23598: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: laminas-form is a package for validating and displaying simple and complex forms. When rendering validation error messages via the `formElementErrors()` view helper shipped with laminas-form, many messages will contain the submitted value. However, in laminas-form prior to version 3.1.1, the value was not being escaped for HTML contexts, which could potentially lead to a reflected cross-site scripting attack. Versions 3.1.1 and above contain a patch to mitigate the vulnerability. A workaround is available. One may manually place code at the top of a view script where one calls the `formElementErrors()` view helper. More information about this workaround is available on the GitHub Security Advisory.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-01-28T22:15Z
Repository: https://github.com/laminas/laminas-form
Language: Unknown
Commit date: 2022-01-28 09:58:45 -0600
Commit message: Merge pull request from GHSA-jq4p-mq33-w375

Html escape validation error messages
CVE-2019-19905: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: NetHack 3.6.x before 3.6.4 is prone to a buffer overflow vulnerability when reading very long lines from configuration files. This affects systems that have NetHack installed suid/sgid, and shared systems that allow users to upload their own configuration files.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 9.8
Published: 2019-12-19T18:15Z
Repository: https://github.com/NetHack/NetHack
Language: C
Files changed: src/files.c
Commit date: 2019-12-17 15:41:58 -0800
Commit message: parse_conf_file fix fix

Diff: diff --git a/src/files.c b/src/files.c
index 5e500ae3..a25a038e 100644
--- a/src/files.c
+++ b/src/files.c
@@ -1,6 +1,6 @@
-/* NetHack 3.6	files.c	$NHDT-Date: 1574116097 2019/11/18 22:28:17 $  $NHDT-Branch: NetHack-3.6 $:$NHDT-Revision: 1.272 $ */
+/* NetHack 3.6	files.c	$NHDT-Date: 1576626110 2019/12/17 23:41:50 $  $NHDT-Branch: NetHack-3.6 $:$NHDT-Revision: 1.276 $ */
 /* Copyright (c) Stichting Mathematisch Centrum, Amsterdam, 1985. */
 /*-Copyright (c) Derek S. Ray, 2015. */
 /* NetHack may be freely redistributed.  See license for details. */
 
 #define NEED_VARARGS
@@ -3158,11 +3158,12 @@ boolean FDECL((*proc), (char *));
                     if (buf) {
                         Strcat(strcpy(tmpbuf, buf), " ");
                         free(buf);
                     }
                     buf = strcat(tmpbuf, ep);
-                    buf[sizeof inbuf - 1] = '\0';
+                    if (strlen(buf) >= sizeof inbuf)
+                        buf[sizeof inbuf - 1] = '\0';
                 }
 
                 if (morelines || (ignoreline && !oldline))
                     continue;
 

Vulnerable code: /* NetHack 3.6	files.c	$NHDT-Date: 1574116097 2019/11/18 22:28:17 $  $NHDT-Branch: NetHack-3.6 $:$NHDT-Revision: 1.272 $ */
                    buf[sizeof inbuf - 1] = '\0';
Fixed code: /* NetHack 3.6	files.c	$NHDT-Date: 1576626110 2019/12/17 23:41:50 $  $NHDT-Branch: NetHack-3.6 $:$NHDT-Revision: 1.276 $ */
                    if (strlen(buf) >= sizeof inbuf)
                        buf[sizeof inbuf - 1] = '\0';
CVE-2017-18185: Out-of-bounds Read (CWE-125)
value: An issue was discovered in QPDF before 7.0.0. There is a large heap-based out-of-bounds read in the Pl_Buffer::write function in Pl_Buffer.cc. It is caused by an integer overflow in the PNG filter.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2018-02-13T19:29Z
Repository: https://github.com/qpdf/qpdf
Language: Other
Files changed: qpdf/qtest/qpdf.test, qpdf/qtest/qpdf/issue-150.out, qpdf/qtest/qpdf/issue-150.pdf
Commit date: 2017-08-29 12:33:01 -0400
Commit message: Add test case for overflow in PNG filter (fixes #150)

Diff: diff --git a/qpdf/qtest/qpdf.test b/qpdf/qtest/qpdf.test
index 5a28a91b..2fc7f63a 100644
--- a/qpdf/qtest/qpdf.test
+++ b/qpdf/qtest/qpdf.test
@@ -223,10 +223,11 @@ my @bug_tests = (
     ["143", "self-referential ostream", 3],
     ["146", "very deeply nested array", 2],
     ["147", "previously caused memory error", 2],
     ["148", "free memory on bad flate", 2],
     ["149", "xref prev pointer loop", 3],
+    ["150", "integer overflow", 2],
     );
 $n_tests += scalar(@bug_tests);
 foreach my $d (@bug_tests)
 {
     my ($n, $description, $exit_status) = @$d;
diff --git a/qpdf/qtest/qpdf/issue-150.out b/qpdf/qtest/qpdf/issue-150.out
new file mode 100644
index 00000000..862b4d1e
--- /dev/null
+++ b/qpdf/qtest/qpdf/issue-150.out
@@ -0,0 +1,2 @@
+WARNING: issue-150.pdf: can't find PDF header
+overflow/underflow converting 9900000000000000000 to 64-bit integer
diff --git a/qpdf/qtest/qpdf/issue-150.pdf b/qpdf/qtest/qpdf/issue-150.pdf
new file mode 100644
index 00000000..c9ce992d
--- /dev/null
+++ b/qpdf/qtest/qpdf/issue-150.pdf
@@ -0,0 +1,4 @@
+00008 0 obj<</Type/XRef/Filter/Fl/DecodeParms<</Columns 9900000000000000000/Predictor 12>>/W[0 2 0]/Size 0>>stream
+xc0endobj
+startxref
+4
\ No newline at end of file

Fixed code:     ["150", "integer overflow", 2],
WARNING: issue-150.pdf: can't find PDF header
overflow/underflow converting 9900000000000000000 to 64-bit integer
00008 0 obj<</Type/XRef/Filter/Fl/DecodeParms<</Columns 9900000000000000000/Predictor 12>>/W[0 2 0]/Size 0>>stream
xc0endobj
startxref
4
CVE-2018-10677: Out-of-bounds Write (CWE-787)
value: The DecodeGifImg function in ngiflib.c in MiniUPnP ngiflib 0.4 lacks certain checks against width and height, which allows remote attackers to cause a denial of service (WritePixels heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted GIF file.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.8
Published: 2018-05-02T19:29Z
Repository: https://github.com/miniupnp/ngiflib
Language: C
Files changed: ngiflib.c
Commit date: 2018-05-02 09:15:48 +0200
Commit message: check GIF image position and dimensions

fixes #1

Diff: diff --git a/ngiflib.c b/ngiflib.c
index b4785b8..ac8dc2a 100644
--- a/ngiflib.c
+++ b/ngiflib.c
@@ -406,10 +406,28 @@ static int DecodeGifImg(struct ngiflib_img * i) {
 	i->posX = GetWord(i->parent);	/* offsetX */
 	i->posY = GetWord(i->parent);	/* offsetY */
 	i->width = GetWord(i->parent);	/* SizeX   */
 	i->height = GetWord(i->parent);	/* SizeY   */
 
+	if((i->width > i->parent->width) || (i->height > i->parent->height)) {
+#if !defined(NGIFLIB_NO_FILE)
+		if(i->parent->log) fprintf(i->parent->log, "*** ERROR *** Image bigger than global GIF canvas !\n");
+#endif
+		return -1;
+	}
+	if((i->posX + i->width) > i->parent->width) {
+#if !defined(NGIFLIB_NO_FILE)
+		if(i->parent->log) fprintf(i->parent->log, "*** WARNING *** Adjusting X position\n");
+#endif
+		i->posX = i->parent->width - i->width;
+	}
+	if((i->posY + i->height) > i->parent->height) {
+#if !defined(NGIFLIB_NO_FILE)
+		if(i->parent->log) fprintf(i->parent->log, "*** WARNING *** Adjusting Y position\n");
+#endif
+		i->posY = i->parent->height - i->height;
+	}
 	context.Xtogo = i->width;
 	context.curY = i->posY;
 #ifdef NGIFLIB_INDEXED_ONLY
 	#ifdef NGIFLIB_ENABLE_CALLBACKS
 	context.line_p.p8 = i->parent->frbuff.p8 + (u32)i->posY*i->parent->width;

Fixed code: 	if((i->width > i->parent->width) || (i->height > i->parent->height)) {
#if !defined(NGIFLIB_NO_FILE)
		if(i->parent->log) fprintf(i->parent->log, "*** ERROR *** Image bigger than global GIF canvas !\n");
#endif
		return -1;
	}
	if((i->posX + i->width) > i->parent->width) {
#if !defined(NGIFLIB_NO_FILE)
		if(i->parent->log) fprintf(i->parent->log, "*** WARNING *** Adjusting X position\n");
#endif
		i->posX = i->parent->width - i->width;
	}
	if((i->posY + i->height) > i->parent->height) {
#if !defined(NGIFLIB_NO_FILE)
		if(i->parent->log) fprintf(i->parent->log, "*** WARNING *** Adjusting Y position\n");
#endif
		i->posY = i->parent->height - i->height;
	}