Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2020-24753: Out-of-bounds Write (CWE-787)
value: A memory corruption vulnerability in Objective Open CBOR Run-time (oocborrt) in versions before 2020-08-12 could allow an attacker to execute code via crafted Concise Binary Object Representation (CBOR) input to the cbor2json decoder. An uncaught error while decoding CBOR Major Type 3 text strings leads to the use of an attacker-controllable uninitialized stack value. This can be used to modify memory, causing a crash or potentially exploitable heap corruption.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2020-09-17T18:15Z
Repository: https://github.com/objsys/oocborrt
Language: C
Files changed: util/cbor2json.c
Commit date: 2020-08-12 15:26:00 -0400
Commit message: fixed missing return status test error

Diff: diff --git a/util/cbor2json.c b/util/cbor2json.c
index 5b44edf..55a58c3 100644
--- a/util/cbor2json.c
+++ b/util/cbor2json.c
@@ -110,10 +110,11 @@ static int cbor2json (OSCTXT* pCborCtxt, OSCTXT* pJsonCtxt)
       break;
    }
    case OSRTCBOR_UTF8STR: {
       OSUTF8CHAR* utf8str;
       ret = rtCborDecDynUTF8Str (pCborCtxt, ub, (char**)&utf8str);
+      if (0 != ret) return LOG_RTERR (pCborCtxt, ret);
 
       ret = rtJsonEncStringValue (pJsonCtxt, utf8str);
       rtxMemFreePtr (pCborCtxt, utf8str);
       if (0 != ret) return LOG_RTERR (pJsonCtxt, ret);
 

Fixed code:       if (0 != ret) return LOG_RTERR (pCborCtxt, ret);
CVE-2020-24753: Use of Uninitialized Resource (CWE-908)
value: A memory corruption vulnerability in Objective Open CBOR Run-time (oocborrt) in versions before 2020-08-12 could allow an attacker to execute code via crafted Concise Binary Object Representation (CBOR) input to the cbor2json decoder. An uncaught error while decoding CBOR Major Type 3 text strings leads to the use of an attacker-controllable uninitialized stack value. This can be used to modify memory, causing a crash or potentially exploitable heap corruption.
CWE description: The product uses or accesses a resource that has not been initialized.
CVSS v3 base score: 9.8
Published: 2020-09-17T18:15Z
Repository: https://github.com/objsys/oocborrt
Language: C
Files changed: util/cbor2json.c
Commit date: 2020-08-12 15:26:00 -0400
Commit message: fixed missing return status test error

Diff: diff --git a/util/cbor2json.c b/util/cbor2json.c
index 5b44edf..55a58c3 100644
--- a/util/cbor2json.c
+++ b/util/cbor2json.c
@@ -110,10 +110,11 @@ static int cbor2json (OSCTXT* pCborCtxt, OSCTXT* pJsonCtxt)
       break;
    }
    case OSRTCBOR_UTF8STR: {
       OSUTF8CHAR* utf8str;
       ret = rtCborDecDynUTF8Str (pCborCtxt, ub, (char**)&utf8str);
+      if (0 != ret) return LOG_RTERR (pCborCtxt, ret);
 
       ret = rtJsonEncStringValue (pJsonCtxt, utf8str);
       rtxMemFreePtr (pCborCtxt, utf8str);
       if (0 != ret) return LOG_RTERR (pJsonCtxt, ret);
 

Fixed code:       if (0 != ret) return LOG_RTERR (pCborCtxt, ret);
CVE-2018-1000815: Improper Input Validation (CWE-20)
value: Brave Software Inc. Brave version version 0.22.810 to 0.24.0 contains a Other/Unknown vulnerability in function ContentSettingsObserver::AllowScript() in content_settings_observer.cc that can result in Websites can run inline JavaScript even if script is blocked, making attackers easier to track users. This attack appear to be exploitable via the victim must visit a specially crafted website. This vulnerability appears to have been fixed in 0.25.2.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 4.3
Published: 2018-12-20T15:29Z
Repository: https://github.com/brave/muon
Language: C++
Files changed: chromium_src/chrome/renderer/content_settings_observer.cc
Commit date: 2018-10-03 11:26:43 -0700
Commit message: Issue: 15232 AllowScript should use atom::ContentSettingsManager like other Allow* methods in the observer

Diff: diff --git a/chromium_src/chrome/renderer/content_settings_observer.cc b/chromium_src/chrome/renderer/content_settings_observer.cc
index b57315220..7c5b289e4 100644
--- a/chromium_src/chrome/renderer/content_settings_observer.cc
+++ b/chromium_src/chrome/renderer/content_settings_observer.cc
@@ -430,15 +430,17 @@ bool ContentSettingsObserver::AllowScript(bool enabled_per_settings) {
 
   // Evaluate the content setting rules before
   // IsWhitelistedForContentSettings(); if there is only the default rule
   // allowing all scripts, it's quicker this way.
   bool allow = true;
-  if (content_setting_rules_) {
-    ContentSetting setting = GetContentSettingFromRules(
-        content_setting_rules_->script_rules, frame,
-        url::Origin(frame->GetDocument().GetSecurityOrigin()).GetURL());
-    allow = setting != CONTENT_SETTING_BLOCK;
+  if (content_settings_manager_->content_settings()) {
+    allow =
+        content_settings_manager_->GetSetting(
+          ContentSettingsManager::GetOriginOrURL(render_frame()->GetWebFrame()),
+          url::Origin(frame->GetDocument().GetSecurityOrigin()).GetURL(),
+          "javascript",
+          allow) != CONTENT_SETTING_BLOCK;
   }
   allow = allow || IsWhitelistedForContentSettings();
 
   cached_script_permissions_[frame] = allow;
   return allow;

Vulnerable code:   if (content_setting_rules_) {
    ContentSetting setting = GetContentSettingFromRules(
        content_setting_rules_->script_rules, frame,
        url::Origin(frame->GetDocument().GetSecurityOrigin()).GetURL());
    allow = setting != CONTENT_SETTING_BLOCK;
Fixed code:   if (content_settings_manager_->content_settings()) {
    allow =
        content_settings_manager_->GetSetting(
          ContentSettingsManager::GetOriginOrURL(render_frame()->GetWebFrame()),
          url::Origin(frame->GetDocument().GetSecurityOrigin()).GetURL(),
          "javascript",
          allow) != CONTENT_SETTING_BLOCK;
CVE-2016-5737: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: The Gerrit configuration in the Openstack Puppet module for Gerrit (aka puppet-gerrit) improperly marks text/html as a safe mimetype, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via a crafted review.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-01-12T23:59Z
Repository: https://github.com/openstack-infra/puppet-gerrit
Language: Ruby
Files changed: templates/gerrit.config.erb
Commit date: 2016-06-21 15:43:34 +0000
Commit message: Remove text/html as a safe mimetype

The non-default safe mimetype in gerrit exists purely to proect installs
against setting this - when set, downloading a text/html file will
result in that file being rendered.

Change-Id: I648ada0b26aaf35ece9ef57f609b46f23f6e422a

Diff: diff --git a/templates/gerrit.config.erb b/templates/gerrit.config.erb
index c707f6c..1c922e0 100644
--- a/templates/gerrit.config.erb
+++ b/templates/gerrit.config.erb
@@ -200,12 +200,10 @@
         safe = true
 [mimetype "text/x-rst"]
         safe = true
 [mimetype "text/plain"]
         safe = true
-[mimetype "text/html"]
-        safe = true
 [mimetype "text/x-puppet"]
         safe = true
 [mimetype "text/x-ini"]
         safe = true
 [mimetype "text/x-properties"]

Vulnerable code: [mimetype "text/html"]
        safe = true
CVE-2017-12850: Weak Password Recovery Mechanism for Forgotten Password (CWE-640)
value: An authenticated standard user could reset the password of other users (including the admin) by altering form data. Affects kanboard before 1.0.46.
CWE description: The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
CVSS v3 base score: 8.8
Published: 2017-08-14T20:29Z
Repository: https://github.com/kanboard/kanboard
Language: PHP
Files changed: app/Controller/UserCredentialController.php, app/Validator/UserValidator.php
Commit date: 2017-08-11 21:24:29 -0700
Commit message: Make sure only admins can change password of other users

Diff: diff --git a/app/Controller/UserCredentialController.php b/app/Controller/UserCredentialController.php
index 23e7edba..ae52a13c 100644
--- a/app/Controller/UserCredentialController.php
+++ b/app/Controller/UserCredentialController.php
@@ -41,10 +41,14 @@ class UserCredentialController extends BaseController
         $user = $this->getUser();
         $values = $this->request->getValues();
 
         list($valid, $errors) = $this->userValidator->validatePasswordModification($values);
 
+        if (! $this->userSession->isAdmin()) {
+            $values['id'] = $this->userSession->getId();
+        }
+
         if ($valid) {
             if ($this->userModel->update($values)) {
                 $this->flash->success(t('Password modified successfully.'));
                 $this->userLockingModel->resetFailedLogin($user['username']);
                 $this->response->redirect($this->helper->url->to('UserViewController', 'show', array('user_id' => $user['id'])), true);
diff --git a/app/Validator/UserValidator.php b/app/Validator/UserValidator.php
index fe402c47..041390a3 100644
--- a/app/Validator/UserValidator.php
+++ b/app/Validator/UserValidator.php
@@ -114,10 +114,14 @@ class UserValidator extends BaseValidator
         );
 
         $v = new Validator($values, array_merge($rules, $this->commonPasswordValidationRules()));
 
         if ($v->execute()) {
+            if (! $this->userSession->isAdmin() && $values['id'] != $this->userSession->getId()) {
+                return array(false, array('current_password' => array('Invalid User ID')));
+            }
+
             if ($this->authenticationManager->passwordAuthentication($this->userSession->getUsername(), $values['current_password'], false)) {
                 return array(true, array());
             } else {
                 return array(false, array('current_password' => array(t('Wrong password'))));
             }

Fixed code:         if (! $this->userSession->isAdmin()) {
            $values['id'] = $this->userSession->getId();
        }

            if (! $this->userSession->isAdmin() && $values['id'] != $this->userSession->getId()) {
                return array(false, array('current_password' => array('Invalid User ID')));
            }
CVE-2017-15205: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: In Kanboard before 1.0.47, by altering form data, an authenticated user can download attachments from a private project of another user.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 4.3
Published: 2017-10-11T01:32Z
Repository: https://github.com/kanboard/kanboard
Language: PHP
Files changed: app/Controller/BaseController.php
Commit date: 2017-09-27 21:58:16 -0700
Commit message: Make sure people do not access to files of other projects

Diff: diff --git a/app/Controller/BaseController.php b/app/Controller/BaseController.php
index 41fcef1c3..43ecfaab5 100644
--- a/app/Controller/BaseController.php
+++ b/app/Controller/BaseController.php
@@ -72,27 +72,34 @@ abstract class BaseController extends Base
      */
     protected function getFile()
     {
         $task_id = $this->request->getIntegerParam('task_id');
         $file_id = $this->request->getIntegerParam('file_id');
+        $project_id = $this->request->getIntegerParam('project_id');
         $model = 'projectFileModel';
 
         if ($task_id > 0) {
             $model = 'taskFileModel';
-            $project_id = $this->taskFinderModel->getProjectId($task_id);
+            $task_project_id = $this->taskFinderModel->getProjectId($task_id);
 
-            if ($project_id !== $this->request->getIntegerParam('project_id')) {
+            if ($project_id != $task_project_id) {
                 throw new AccessForbiddenException();
             }
         }
 
         $file = $this->$model->getById($file_id);
 
         if (empty($file)) {
             throw new PageNotFoundException();
         }
 
+        if (isset($file['task_id']) && $file['task_id'] != $task_id) {
+            throw new AccessForbiddenException();
+        } else if (isset($file['project_id']) && $file['project_id'] != $project_id) {
+            throw new AccessForbiddenException();
+        }
+
         $file['model'] = $model;
         return $file;
     }
 
     /**

Vulnerable code:             $project_id = $this->taskFinderModel->getProjectId($task_id);
            if ($project_id !== $this->request->getIntegerParam('project_id')) {
Fixed code:         $project_id = $this->request->getIntegerParam('project_id');
            $task_project_id = $this->taskFinderModel->getProjectId($task_id);
            if ($project_id != $task_project_id) {
        if (isset($file['task_id']) && $file['task_id'] != $task_id) {
            throw new AccessForbiddenException();
        } else if (isset($file['project_id']) && $file['project_id'] != $project_id) {
            throw new AccessForbiddenException();
        }
CVE-2017-15209: Authorization Bypass Through User-Controlled Key (CWE-639)
value: In Kanboard before 1.0.47, by altering form data, an authenticated user can remove attachments from a private project of another user.
CWE description: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CVSS v3 base score: 4.3
Published: 2017-10-11T01:32Z
Repository: https://github.com/kanboard/kanboard
Language: PHP
Files changed: app/Controller/BaseController.php
Commit date: 2017-09-27 21:58:16 -0700
Commit message: Make sure people do not access to files of other projects

Diff: diff --git a/app/Controller/BaseController.php b/app/Controller/BaseController.php
index 41fcef1c3..43ecfaab5 100644
--- a/app/Controller/BaseController.php
+++ b/app/Controller/BaseController.php
@@ -72,27 +72,34 @@ abstract class BaseController extends Base
      */
     protected function getFile()
     {
         $task_id = $this->request->getIntegerParam('task_id');
         $file_id = $this->request->getIntegerParam('file_id');
+        $project_id = $this->request->getIntegerParam('project_id');
         $model = 'projectFileModel';
 
         if ($task_id > 0) {
             $model = 'taskFileModel';
-            $project_id = $this->taskFinderModel->getProjectId($task_id);
+            $task_project_id = $this->taskFinderModel->getProjectId($task_id);
 
-            if ($project_id !== $this->request->getIntegerParam('project_id')) {
+            if ($project_id != $task_project_id) {
                 throw new AccessForbiddenException();
             }
         }
 
         $file = $this->$model->getById($file_id);
 
         if (empty($file)) {
             throw new PageNotFoundException();
         }
 
+        if (isset($file['task_id']) && $file['task_id'] != $task_id) {
+            throw new AccessForbiddenException();
+        } else if (isset($file['project_id']) && $file['project_id'] != $project_id) {
+            throw new AccessForbiddenException();
+        }
+
         $file['model'] = $model;
         return $file;
     }
 
     /**

Vulnerable code:             $project_id = $this->taskFinderModel->getProjectId($task_id);
            if ($project_id !== $this->request->getIntegerParam('project_id')) {
Fixed code:         $project_id = $this->request->getIntegerParam('project_id');
            $task_project_id = $this->taskFinderModel->getProjectId($task_id);
            if ($project_id != $task_project_id) {
        if (isset($file['task_id']) && $file['task_id'] != $task_id) {
            throw new AccessForbiddenException();
        } else if (isset($file['project_id']) && $file['project_id'] != $project_id) {
            throw new AccessForbiddenException();
        }
CVE-2017-15210: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: In Kanboard before 1.0.47, by altering form data, an authenticated user can see thumbnails of pictures from a private project of another user.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 4.3
Published: 2017-10-11T01:32Z
Repository: https://github.com/kanboard/kanboard
Language: PHP
Files changed: app/Controller/BaseController.php
Commit date: 2017-09-27 21:58:16 -0700
Commit message: Make sure people do not access to files of other projects

Diff: diff --git a/app/Controller/BaseController.php b/app/Controller/BaseController.php
index 41fcef1c3..43ecfaab5 100644
--- a/app/Controller/BaseController.php
+++ b/app/Controller/BaseController.php
@@ -72,27 +72,34 @@ abstract class BaseController extends Base
      */
     protected function getFile()
     {
         $task_id = $this->request->getIntegerParam('task_id');
         $file_id = $this->request->getIntegerParam('file_id');
+        $project_id = $this->request->getIntegerParam('project_id');
         $model = 'projectFileModel';
 
         if ($task_id > 0) {
             $model = 'taskFileModel';
-            $project_id = $this->taskFinderModel->getProjectId($task_id);
+            $task_project_id = $this->taskFinderModel->getProjectId($task_id);
 
-            if ($project_id !== $this->request->getIntegerParam('project_id')) {
+            if ($project_id != $task_project_id) {
                 throw new AccessForbiddenException();
             }
         }
 
         $file = $this->$model->getById($file_id);
 
         if (empty($file)) {
             throw new PageNotFoundException();
         }
 
+        if (isset($file['task_id']) && $file['task_id'] != $task_id) {
+            throw new AccessForbiddenException();
+        } else if (isset($file['project_id']) && $file['project_id'] != $project_id) {
+            throw new AccessForbiddenException();
+        }
+
         $file['model'] = $model;
         return $file;
     }
 
     /**

Vulnerable code:             $project_id = $this->taskFinderModel->getProjectId($task_id);
            if ($project_id !== $this->request->getIntegerParam('project_id')) {
Fixed code:         $project_id = $this->request->getIntegerParam('project_id');
            $task_project_id = $this->taskFinderModel->getProjectId($task_id);
            if ($project_id != $task_project_id) {
        if (isset($file['task_id']) && $file['task_id'] != $task_id) {
            throw new AccessForbiddenException();
        } else if (isset($file['project_id']) && $file['project_id'] != $project_id) {
            throw new AccessForbiddenException();
        }
CVE-2019-7324: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: app/Core/Paginator.php in Kanboard before 1.2.8 has XSS in pagination sorting.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-02-04T19:29Z
Repository: https://github.com/kanboard/kanboard
Language: PHP
Files changed: app/Core/Paginator.php
Commit date: 2019-01-30 22:05:43 -0800
Commit message: Avoid XSS in pagination ordering

Diff: diff --git a/app/Core/Paginator.php b/app/Core/Paginator.php
index 9776a03dd..d805567e6 100644
--- a/app/Core/Paginator.php
+++ b/app/Core/Paginator.php
@@ -167,14 +167,20 @@ class Paginator
      * @return array
      */
     public function executeQuery()
     {
         if ($this->query !== null) {
+
             $this->query
                 ->offset($this->offset)
-                ->limit($this->limit)
-                ->orderBy($this->order, $this->direction);
+                ->limit($this->limit);
+
+            if (preg_match('/^[a-zA-Z0-9._]+$/', $this->order)) {
+                $this->query->orderBy($this->order, $this->direction);
+            } else {
+                $this->order = '';
+            }
 
             if ($this->formatter !== null) {
                 return $this->formatter->withQuery($this->query)->format();
             } else {
                 return $this->query->findAll();

Vulnerable code:                 ->limit($this->limit)
                ->orderBy($this->order, $this->direction);
Fixed code: 
                ->limit($this->limit);

            if (preg_match('/^[a-zA-Z0-9._]+$/', $this->order)) {
                $this->query->orderBy($this->order, $this->direction);
            } else {
                $this->order = '';
            }
CVE-2023-36813: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Kanboard is project management software that focuses on the Kanban methodology. In versions prior to 1.2.31authenticated user is able to perform a SQL Injection, leading to a privilege escalation or loss of confidentiality. It appears that in some insert and update operations, the code improperly uses the PicoDB library to update/insert new information. Version 1.2.31 contains a fix for this issue.

CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 8.8
Published: 2023-07-05T22:15Z
Repository: https://github.com/kanboard/kanboard
Language: PHP
Files changed: libs/picodb/lib/PicoDb/Database.php
Commit date: 2023-07-03 15:40:34 -0700
Commit message: Avoid potential SQL injections without breaking compatibility with plugins

Diff: diff --git a/libs/picodb/lib/PicoDb/Database.php b/libs/picodb/lib/PicoDb/Database.php
index 22c9d2fb61..df017ed82b 100644
--- a/libs/picodb/lib/PicoDb/Database.php
+++ b/libs/picodb/lib/PicoDb/Database.php
@@ -3,10 +3,11 @@
 namespace PicoDb;
 
 use Closure;
 use PDOException;
 use LogicException;
+use PicoDb\SQLException;
 use PicoDb\Driver\Mssql;
 use PicoDb\Driver\Sqlite;
 use PicoDb\Driver\Mysql;
 use PicoDb\Driver\Postgres;
 
@@ -213,10 +214,15 @@ class Database
         // Do not escape custom query
         if (strpos($value, '.') !== false || strpos($value, ' ') !== false) {
             return $value;
         }
 
+        // Avoid potential SQL injection
+        if (preg_match('/^[a-z0-9_]+$/', $value) === 0) {
+            throw new SQLException('Invalid identifier: '.$value);
+        }
+
         if (! empty($table)) {
             return $this->driver->escape($table).'.'.$this->driver->escape($value);
         }
 
         return $this->driver->escape($value);

Fixed code: use PicoDb\SQLException;
        // Avoid potential SQL injection
        if (preg_match('/^[a-z0-9_]+$/', $value) === 0) {
            throw new SQLException('Invalid identifier: '.$value);
        }
CVE-2017-8288: Improper Input Validation (CWE-20)
value: gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. With these extensions, a bystander could launch applications (but not interact with them), see information from the extensions (e.g., what applications you have opened or what music you were playing), or even execute arbitrary commands. It all depends on what extensions a user has enabled. The problem is caused by lack of exception handling in js/ui/extensionSystem.js.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 8.1
Published: 2017-04-27T00:59Z
Repository: https://github.com/GNOME/gnome-shell
Language: JavaScript
Files changed: js/ui/extensionSystem.js
Commit date: 2017-04-25 17:47:08 +0200
Commit message: extensionSystem: handle reloading broken extensions

Some extensions out there may fail to reload. When that happens,
we need to catch any exceptions so that we don't leave things in
a broken state that could lead to leaving extensions enabled in
the screen shield.

https://bugzilla.gnome.org/show_bug.cgi?id=781728

Diff: diff --git a/js/ui/extensionSystem.js b/js/ui/extensionSystem.js
index a4dc29ee..fc352b89 100644
--- a/js/ui/extensionSystem.js
+++ b/js/ui/extensionSystem.js
@@ -280,16 +280,24 @@ function _onVersionValidationChanged() {
     // we want to reload all extensions, but only enable
     // extensions when allowed by the sessionMode, so
     // temporarily disable them all
     enabledExtensions = [];
     for (let uuid in ExtensionUtils.extensions)
-        reloadExtension(ExtensionUtils.extensions[uuid]);
+        try {
+            reloadExtension(ExtensionUtils.extensions[uuid]);
+        } catch(e) {
+            logExtensionError(uuid, e);
+        }
     enabledExtensions = getEnabledExtensions();
 
     if (Main.sessionMode.allowExtensions) {
         enabledExtensions.forEach(function(uuid) {
-            enableExtension(uuid);
+            try {
+                enableExtension(uuid);
+            } catch(e) {
+                logExtensionError(uuid, e);
+            }
         });
     }
 }
 
 function _loadExtensions() {

Vulnerable code:         reloadExtension(ExtensionUtils.extensions[uuid]);
            enableExtension(uuid);
Fixed code:         try {
            reloadExtension(ExtensionUtils.extensions[uuid]);
        } catch(e) {
            logExtensionError(uuid, e);
        }
            try {
                enableExtension(uuid);
            } catch(e) {
                logExtensionError(uuid, e);
            }
CVE-2021-29511: Out-of-bounds Write (CWE-787)
value: evm is a pure Rust implementation of Ethereum Virtual Machine. Prior to the patch, when executing specific EVM opcodes related to memory operations that use `evm_core::Memory::copy_large`, the `evm` crate can over-allocate memory when it is not needed, making it possible for an attacker to perform denial-of-service attack. The flaw was corrected in commit `19ade85`. Users should upgrade to `==0.21.1, ==0.23.1, ==0.24.1, ==0.25.1, >=0.26.1`. There are no workarounds. Please upgrade your `evm` crate version.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2021-05-12T18:15Z
Repository: https://github.com/rust-blockchain/evm
Language: Rust
Files changed: core/src/memory.rs
Commit date: 2021-05-11 17:33:30 +0200
Commit message: Skip setting memory value if the value vec is empty
Diff: diff --git a/core/src/memory.rs b/core/src/memory.rs
index 3d209be..a2266cf 100644
--- a/core/src/memory.rs
+++ b/core/src/memory.rs
@@ -103,10 +103,14 @@ impl Memory {
 		&mut self,
 		offset: usize,
 		value: &[u8],
 		target_size: Option<usize>
 	) -> Result<(), ExitFatal> {
+		if value.is_empty() {
+			return Ok(())
+		}
+		
 		let target_size = target_size.unwrap_or(value.len());
 
 		if offset.checked_add(target_size)
 			.map(|pos| pos > self.limit).unwrap_or(true)
 		{

Fixed code: 		if value.is_empty() {
			return Ok(())
		}
CVE-2022-26691: Incorrect Comparison (CWE-697)
value: A logic issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. An application may be able to gain elevated privileges.
CWE description: The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
CVSS v3 base score: 6.7
Published: 2022-05-26T18:15Z
Repository: https://github.com/OpenPrinting/cups
Language: C
Files changed: CHANGES.md, scheduler/cert.c
Commit date: 2022-05-26 06:27:04 +0200
Commit message: scheduler/cert.c: Fix string comparison (fixes CVE-2022-26691)

The previous algorithm didn't expect the strings can have a different
length, so one string can be a substring of the other and such substring
was reported as equal to the longer string.

Diff: diff --git a/CHANGES.md b/CHANGES.md
index b254bc57..1fc8ab0c 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -2,10 +2,11 @@ CHANGES - OpenPrinting CUPS 2.4.1 - 2022-01-27
 ==============================================
 
 Changes in CUPS v2.4.2 (TBA)
 ----------------------------
 
+- Fixed certificate strings comparison for Local authorization (CVE-2022-26691)
 - The `cupsFileOpen` function no longer opens files for append in read-write
   mode (Issue #291)
 - The cupsd daemon removed processing temporary queue (Issue #364)
 - Fixed delay in IPP backend if GNUTLS is used and endpoint doesn't confirm
   closing the connection (Issue #365)
diff --git a/scheduler/cert.c b/scheduler/cert.c
index b268bf1b..9b65b96c 100644
--- a/scheduler/cert.c
+++ b/scheduler/cert.c
@@ -442,7 +442,14 @@ ctcompare(const char *a,		/* I - First string */
     result |= *a ^ *b;
     a ++;
     b ++;
   }
 
-  return (result);
+ /*
+  * The while loop finishes when *a == '\0' or *b == '\0'
+  * so after the while loop either both *a and *b == '\0',
+  * or one points inside a string, so when we apply logical OR on *a,
+  * *b and result, we get a non-zero return value if the compared strings don't match.
+  */
+
+  return (result | *a | *b);
 }

Vulnerable code:   return (result);
Fixed code: - Fixed certificate strings comparison for Local authorization (CVE-2022-26691)
 /*
  * The while loop finishes when *a == '\0' or *b == '\0'
  * so after the while loop either both *a and *b == '\0',
  * or one points inside a string, so when we apply logical OR on *a,
  * *b and result, we get a non-zero return value if the compared strings don't match.
  */

  return (result | *a | *b);
CVE-2023-34241: Use After Free (CWE-416)
value: OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Starting in version 2.0.0 and prior to version 2.4.6, CUPS logs data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data right before. This is a use-after-free bug that impacts the entire cupsd process.

The exact cause of this issue is the function `httpClose(con->http)` being called in `scheduler/client.c`. The problem is that httpClose always, provided its argument is not null, frees the pointer at the end of the call, only for cupsdLogClient to pass the pointer to httpGetHostname. This issue happens in function `cupsdAcceptClient` if LogLevel is warn or higher and in two scenarios: there is a double-lookup for the IP Address (HostNameLookups Double is set in `cupsd.conf`) which fails to resolve, or if CUPS is compiled with TCP wrappers and the connection is refused by rules from `/etc/hosts.allow` and `/etc/hosts.deny`.

Version 2.4.6 has a patch for this issue.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 7.1
Published: 2023-06-22T23:15Z
Repository: https://github.com/OpenPrinting/cups
Language: Unknown
Commit date: 2023-06-22 12:00:56 +0200
Commit message: Merge pull request from GHSA-qjgh-5hcq-5f25

Log result of httpGetHostname BEFORE closing the connection
CVE-2024-35235: Insufficient Information (NVD-CWE-noinfo)
value: OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when starting the cupsd server with a Listen configuration item pointing to a symbolic link, the cupsd process can be caused to perform an arbitrary chmod of the provided argument, providing world-writable access to the target. Given that cupsd is often running as root, this can result in the change of permission of any user or system files to be world writable. Given the aforementioned Ubuntu AppArmor context, on such systems this vulnerability is limited to those files modifiable by the cupsd process. In that specific case it was found to be possible to turn the configuration of the Listen argument into full control over the cupsd.conf and cups-files.conf configuration files. By later setting the User and Group arguments in cups-files.conf, and printing with a printer configured by PPD with a `FoomaticRIPCommandLine` argument, arbitrary user and group (not root) command execution could be achieved, which can further be used on Ubuntu systems to achieve full root command execution. Commit ff1f8a623e090dee8a8aadf12a6a4b25efac143d contains a patch for the issue.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-06-11T15:16Z
Repository: https://github.com/OpenPrinting/cups
Language: Unknown
Commit date: 2024-06-11 16:04:10 +0200
Commit message: Merge pull request from GHSA-vvwp-mv6j-hw6f

Fix domain socket handling
CVE-2019-25072: Uncontrolled Resource Consumption (CWE-400)
value: Due to support of Gzip compression in request bodies, as well as a lack of limiting response body sizes, a malicious server can cause a client to consume a significant amount of system resources, which may be used as a denial of service vector.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 7.5
Published: 2022-12-27T22:15Z
Repository: https://github.com/tendermint/tendermint
Language: Go
Files changed: rpc/lib/client/http_client.go
Commit date: 2019-03-19 20:18:18 -0400
Commit message: rpc: client disable compression (#3430)


Diff: diff --git a/rpc/lib/client/http_client.go b/rpc/lib/client/http_client.go
index 97b8dfe7..cfa26e89 100644
--- a/rpc/lib/client/http_client.go
+++ b/rpc/lib/client/http_client.go
@@ -72,11 +72,13 @@ func makeHTTPDialer(remoteAddr string) (string, string, func(string, string) (ne
 // remoteAddr should be fully featured (eg. with tcp:// or unix://)
 func makeHTTPClient(remoteAddr string) (string, *http.Client) {
 	protocol, address, dialer := makeHTTPDialer(remoteAddr)
 	return protocol + "://" + address, &http.Client{
 		Transport: &http.Transport{
-			Dial: dialer,
+			// Set to true to prevent GZIP-bomb DoS attacks
+			DisableCompression: true,
+			Dial:               dialer,
 		},
 	}
 }
 
 //------------------------------------------------------------------------------------

Vulnerable code: 			Dial: dialer,
Fixed code: 			// Set to true to prevent GZIP-bomb DoS attacks
			DisableCompression: true,
			Dial:               dialer,
CVE-2021-27185: Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
value: The samba-client package before 4.0.0 for Node.js allows command injection because of the use of process.exec.
CWE description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2021-02-10T22:15Z
Repository: https://github.com/eflexsystems/node-samba-client
Language: Unknown
Commit date: 2021-02-09 17:12:15 -0500
Commit message: Merge pull request #36 from eflexsystems/v4
CVE-2019-20786: Improper Authentication (CWE-287)
value: handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 9.8
Published: 2020-04-19T20:15Z
Repository: https://github.com/pion/dtls
Language: Go
Files changed: conn.go
Commit date: 2019-10-11 02:19:56 -0700
Commit message: Assert that ApplicationData has epoch != 0

Otherwise we may accept unencrypted/unauthenticated ApplicationData
from a remote

Diff: diff --git a/conn.go b/conn.go
index 441db86..bf5a88e 100644
--- a/conn.go
+++ b/conn.go
@@ -557,10 +557,14 @@ func (c *Conn) handleIncomingPacket(buf []byte) (*alert, error) {
 		return nil, fmt.Errorf("alert: %v", content)
 	case *changeCipherSpec:
 		c.log.Trace("<- ChangeCipherSpec")
 		c.setRemoteEpoch(c.getRemoteEpoch() + 1)
 	case *applicationData:
+		if h.epoch == 0 {
+			return &alert{alertLevelFatal, alertUnexpectedMessage}, fmt.Errorf("ApplicationData with epoch of 0")
+		}
+
 		c.decrypted <- content.data
 	default:
 		return &alert{alertLevelFatal, alertUnexpectedMessage}, fmt.Errorf("unhandled contentType %d", content.contentType())
 	}
 	return nil, nil

Fixed code: 		if h.epoch == 0 {
			return &alert{alertLevelFatal, alertUnexpectedMessage}, fmt.Errorf("ApplicationData with epoch of 0")
		}
CVE-2018-15853: Uncontrolled Resource Consumption (CWE-400)
value: Endless recursion exists in xkbcomp/expr.c in xkbcommon and libxkbcommon before 0.8.1, which could be used by local attackers to crash xkbcommon users by supplying a crafted keymap file that triggers boolean negation.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 5.5
Published: 2018-08-25T21:29Z
Repository: https://github.com/xkbcommon/libxkbcommon
Language: C
Files changed: src/xkbcomp/expr.c
Commit date: 2018-07-30 10:35:10 +0300
Commit message: xkbcomp: fix stack overflow when evaluating boolean negation

The expression evaluator would go into an infinite recursion when
evaluating something like this as a boolean: `!True`. Instead of
recursing to just `True` and negating, it recursed to `!True` itself
again.

Bug inherited from xkbcomp.

Caught with the afl fuzzer.

Signed-off-by: Ran Benita <ran234@gmail.com>

Diff: diff --git a/src/xkbcomp/expr.c b/src/xkbcomp/expr.c
index 3ff3c18..5d43cba 100644
--- a/src/xkbcomp/expr.c
+++ b/src/xkbcomp/expr.c
@@ -163,11 +163,11 @@ ExprResolveBoolean(struct xkb_context *ctx, const ExprDef *expr,
                 xkb_atom_text(ctx, expr->field_ref.field));
         return false;
 
     case EXPR_INVERT:
     case EXPR_NOT:
-        ok = ExprResolveBoolean(ctx, expr, set_rtrn);
+        ok = ExprResolveBoolean(ctx, expr->unary.child, set_rtrn);
         if (ok)
             *set_rtrn = !*set_rtrn;
         return ok;
     case EXPR_ADD:
     case EXPR_SUBTRACT:

Vulnerable code:         ok = ExprResolveBoolean(ctx, expr, set_rtrn);
Fixed code:         ok = ExprResolveBoolean(ctx, expr->unary.child, set_rtrn);
CVE-2018-15856: Loop with Unreachable Exit Condition ('Infinite Loop') (CWE-835)
value: An infinite loop when reaching EOL unexpectedly in compose/parser.c (aka the keymap parser) in xkbcommon before 0.8.1 could be used by local attackers to cause a denial of service during parsing of crafted keymap files.
CWE description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CVSS v3 base score: 5.5
Published: 2018-08-25T21:29Z
Repository: https://github.com/xkbcommon/libxkbcommon
Language: C
Files changed: src/compose/parser.c
Commit date: 2018-07-30 10:35:10 +0300
Commit message: compose: fix infinite loop in parser on some inputs

The parser would enter an infinite loop if an unterminated keysym
literal occurs at EOF.

Found with the afl fuzzer.

Signed-off-by: Ran Benita <ran234@gmail.com>

Diff: diff --git a/src/compose/parser.c b/src/compose/parser.c
index 40c9470e..439d404f 100644
--- a/src/compose/parser.c
+++ b/src/compose/parser.c
@@ -142,11 +142,11 @@ skip_more_whitespace_and_comments:
     s->token_column = s->column;
     s->buf_pos = 0;
 
     /* LHS Keysym. */
     if (chr(s, '<')) {
-        while (peek(s) != '>' && !eol(s))
+        while (peek(s) != '>' && !eol(s) && !eof(s))
             buf_append(s, next(s));
         if (!chr(s, '>')) {
             scanner_err(s, "unterminated keysym literal");
             return TOK_ERROR;
         }

Vulnerable code:         while (peek(s) != '>' && !eol(s))
Fixed code:         while (peek(s) != '>' && !eol(s) && !eof(s))
CVE-2018-15857: Use After Free (CWE-416)
value: An invalid free in ExprAppendMultiKeysymList in xkbcomp/ast-build.c in xkbcommon before 0.8.1 could be used by local attackers to crash xkbcommon keymap parsers or possibly have unspecified other impact by supplying a crafted keymap file.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 7.8
Published: 2018-08-25T21:29Z
Repository: https://github.com/xkbcommon/libxkbcommon
Language: C
Files changed: src/xkbcomp/ast-build.c
Commit date: 2018-08-01 13:50:38 +1000
Commit message: xkbcomp: fix pointer value for FreeStmt

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>

Diff: diff --git a/src/xkbcomp/ast-build.c b/src/xkbcomp/ast-build.c
index 9c6ccd44..2de9e61d 100644
--- a/src/xkbcomp/ast-build.c
+++ b/src/xkbcomp/ast-build.c
@@ -238,11 +238,11 @@ ExprAppendMultiKeysymList(ExprDef *expr, ExprDef *append)
 
     darray_append(expr->keysym_list.symsMapIndex, nSyms);
     darray_append(expr->keysym_list.symsNumEntries, numEntries);
     darray_concat(expr->keysym_list.syms, append->keysym_list.syms);
 
-    FreeStmt((ParseCommon *) &append);
+    FreeStmt((ParseCommon *) append);
 
     return expr;
 }
 
 KeycodeDef *

Vulnerable code:     FreeStmt((ParseCommon *) &append);
Fixed code:     FreeStmt((ParseCommon *) append);
CVE-2018-15858: NULL Pointer Dereference (CWE-476)
value: Unchecked NULL pointer usage when handling invalid aliases in CopyKeyAliasesToKeymap in xkbcomp/keycodes.c in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2018-08-25T21:29Z
Repository: https://github.com/xkbcommon/libxkbcommon
Language: C
Files changed: src/xkbcomp/keycodes.c
Commit date: 2018-08-01 13:50:38 +1000
Commit message: keycodes: don't try to copy zero key aliases

Move the aliases copy to within the (num_key_aliases > 0) block.

Passing info->aliases into this fuction with invalid aliases will
cause log messages but num_key_aliases stays on 0. The key_aliases array
is never allocated and remains NULL. We then loop through the aliases, causing
a null-pointer dereference.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>

Diff: diff --git a/src/xkbcomp/keycodes.c b/src/xkbcomp/keycodes.c
index 7f5955ef..491da510 100644
--- a/src/xkbcomp/keycodes.c
+++ b/src/xkbcomp/keycodes.c
@@ -594,18 +594,18 @@ CopyKeyAliasesToKeymap(struct xkb_keymap *keymap, KeyNamesInfo *info)
     key_aliases = NULL;
     if (num_key_aliases > 0) {
         key_aliases = calloc(num_key_aliases, sizeof(*key_aliases));
         if (!key_aliases)
             return false;
-    }
 
-    i = 0;
-    darray_foreach(alias, info->aliases) {
-        if (alias->real != XKB_ATOM_NONE) {
-            key_aliases[i].alias = alias->alias;
-            key_aliases[i].real = alias->real;
-            i++;
+        i = 0;
+        darray_foreach(alias, info->aliases) {
+            if (alias->real != XKB_ATOM_NONE) {
+                key_aliases[i].alias = alias->alias;
+                key_aliases[i].real = alias->real;
+                i++;
+            }
         }
     }
 
     keymap->num_key_aliases = num_key_aliases;
     keymap->key_aliases = key_aliases;

Vulnerable code:     }
    i = 0;
    darray_foreach(alias, info->aliases) {
        if (alias->real != XKB_ATOM_NONE) {
            key_aliases[i].alias = alias->alias;
            key_aliases[i].real = alias->real;
            i++;
Fixed code:         i = 0;
        darray_foreach(alias, info->aliases) {
            if (alias->real != XKB_ATOM_NONE) {
                key_aliases[i].alias = alias->alias;
                key_aliases[i].real = alias->real;
                i++;
            }
CVE-2018-15859: NULL Pointer Dereference (CWE-476)
value: Unchecked NULL pointer usage when parsing invalid atoms in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because lookup failures are mishandled.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2018-08-25T21:29Z
Repository: https://github.com/xkbcommon/libxkbcommon
Language: C
Files changed: src/xkbcomp/expr.c
Commit date: 2018-08-03 16:24:50 +0100
Commit message: Fail expression lookup on invalid atoms

If we fail atom lookup, then we should not claim that we successfully
looked up the expression.

Signed-off-by: Daniel Stone <daniels@collabora.com>

Diff: diff --git a/src/xkbcomp/expr.c b/src/xkbcomp/expr.c
index b5ab71708..b2567de3e 100644
--- a/src/xkbcomp/expr.c
+++ b/src/xkbcomp/expr.c
@@ -45,15 +45,19 @@ ExprResolveLhs(struct xkb_context *ctx, const ExprDef *expr,
         return (*field_rtrn != NULL);
     case EXPR_FIELD_REF:
         *elem_rtrn = xkb_atom_text(ctx, expr->field_ref.element);
         *field_rtrn = xkb_atom_text(ctx, expr->field_ref.field);
         *index_rtrn = NULL;
-        return true;
+        return (*elem_rtrn != NULL && *field_rtrn != NULL);
     case EXPR_ARRAY_REF:
         *elem_rtrn = xkb_atom_text(ctx, expr->array_ref.element);
         *field_rtrn = xkb_atom_text(ctx, expr->array_ref.field);
         *index_rtrn = expr->array_ref.entry;
+	if (expr->array_ref.element != XKB_ATOM_NONE && *elem_rtrn == NULL)
+		return false;
+	if (*field_rtrn == NULL)
+		return false;
         return true;
     default:
         break;
     }
     log_wsgo(ctx, "Unexpected operator %d in ResolveLhs\n", expr->expr.op);

Vulnerable code:         return true;
Fixed code:         return (*elem_rtrn != NULL && *field_rtrn != NULL);
	if (expr->array_ref.element != XKB_ATOM_NONE && *elem_rtrn == NULL)
		return false;
	if (*field_rtrn == NULL)
		return false;