Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2022-26563: Incorrect Authorization (CWE-863)
value: An issue was discovered in Tildeslash Monit before 5.31.0, allows remote attackers to gain escilated privlidges due to improper PAM-authorization.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 8.8
Published: 2023-07-18T14:15Z
Repository: https://bitbucket.org/tildeslash/monit
Language: Other
Files changed: CHANGES, src/util.c
Commit date: 2022-03-03 20:30:09 +0100
Commit message: Fixed: PAM authentication: Users with a valid password for disabled account can login to Monit. Thanks to Youssef Rebahi-Gilbert.

Diff: diff --git a/CHANGES b/CHANGES
index 6dcbe85e..1ab9aa75 100644
--- a/CHANGES
+++ b/CHANGES
@@ -10,10 +10,13 @@ The same problem occurred if a new "onreboot nostart" service was added, even if
 existed.
 
 Fixed: Issue #1029: The generic protocol test truncated the received data in the case that it
 contained zeros.
 
+Fixed: PAM authentication: Users with a valid password for disabled account can login to Monit.
+Thanks to Youssef Rebahi-Gilbert.
+
 
 Version 5.31.0
 
 New: Issue #1021: Add support for Linux OpenZFS 2.x I/O statistics
 
diff --git a/src/util.c b/src/util.c
index 9afeaff9..a318ccac 100644
--- a/src/util.c
+++ b/src/util.c
@@ -388,14 +388,14 @@ static bool PAMcheckPasswd(const char *login, const char *passwd) {
         if ((rv = pam_start("monit", login, &conv, &pamh) != PAM_SUCCESS)) {
                 DEBUG("PAM authentication start failed -- %d\n", rv);
                 return false;
         }
 
-        rv = pam_authenticate(pamh, PAM_SILENT);
+        if ((rv = pam_authenticate(pamh, PAM_SILENT)) == PAM_SUCCESS)
+                rv = pam_acct_mgmt(pamh, PAM_SILENT);
 
-        if (pam_end(pamh, rv) != PAM_SUCCESS)
-                pamh = NULL;
+        pam_end(pamh, rv);
 
         return rv == PAM_SUCCESS ? true : false;
 }
 
 

Vulnerable code:         rv = pam_authenticate(pamh, PAM_SILENT);
        if (pam_end(pamh, rv) != PAM_SUCCESS)
                pamh = NULL;
Fixed code: Fixed: PAM authentication: Users with a valid password for disabled account can login to Monit.
Thanks to Youssef Rebahi-Gilbert.

        if ((rv = pam_authenticate(pamh, PAM_SILENT)) == PAM_SUCCESS)
                rv = pam_acct_mgmt(pamh, PAM_SILENT);
        pam_end(pamh, rv);
CVE-2021-21433: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: Discord Recon Server is a bot that allows you to do your reconnaissance process from your Discord. Remote code execution in version 0.0.1 would allow remote users to execute commands on the server resulting in serious issues. This flaw is patched in 0.0.2.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 8.8
Published: 2021-04-09T18:15Z
Repository: https://github.com/DEMON1A/Discord-Recon
Language: Python
Files changed: app.py
Commit date: 2021-02-25 12:32:33 +0200
Commit message: Fixing Command Injection Issues.
Diff: diff --git a/app.py b/app.py
index d754337..43b1517 100644
--- a/app.py
+++ b/app.py
@@ -93,10 +93,14 @@ async def ip(ctx , *, argument):
     Message = getIp.getIp(Domain=argument)
     await ctx.send(Message)
 
 @Client.command()
 async def dirsearch(ctx , *, argument):
+    if not CommandInjection.commandInjection(argument=argument , RCE=RCE):
+        await ctx.send("**Your Command Contains Unallowed Chars. Don't Try To Use It Again.**")
+        return
+    
     Path = TOOLS['dirsearch']; MainPath = getcwd(); chdir(Path)
     await ctx.send(f"**Running Your Dirsearch Scan, We Will Send The Results When It's Done**")
     Process = subprocess.Popen(f'python3 dirsearch.py -u {argument} -e * -b' , shell=True,stdout=subprocess.PIPE,stderr=subprocess.STDOUT)
     Output = Process.communicate()[0].decode('UTF-8')
     Output = removeColors.Remove(Output); chdir(MainPath)
@@ -113,10 +117,14 @@ async def dirsearch(ctx , *, argument):
         await ctx.send(f'```{Output}```')
         await ctx.send(f"\n**- {ctx.message.author}**")
 
 @Client.command()
 async def arjun(ctx , *, argument):
+    if not CommandInjection.commandInjection(argument=argument , RCE=RCE):
+        await ctx.send("**Your Command Contains Unallowed Chars. Don't Try To Use It Again.**")
+        return
+    
     Path = TOOLS['arjun']; MainPath = getcwd(); chdir(Path)
     await ctx.send(f"**Running Your Arjun Scan, We Will Send The Results When It's Done**")
     await ctx.send(f"**Note: The Bot Won't Respond Until The Scan is Done. All Of Your Commands Now Will Be Executed After This Process is Done.")
     Process = subprocess.Popen(f'python3 arjun.py -u {argument}' , shell=True,stdout=subprocess.PIPE,stderr=subprocess.STDOUT)
     Output = Process.communicate()[0].decode('UTF-8')

Fixed code:     if not CommandInjection.commandInjection(argument=argument , RCE=RCE):
        await ctx.send("**Your Command Contains Unallowed Chars. Don't Try To Use It Again.**")
        return
    
    if not CommandInjection.commandInjection(argument=argument , RCE=RCE):
        await ctx.send("**Your Command Contains Unallowed Chars. Don't Try To Use It Again.**")
        return
CVE-2024-21663: Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
value: Discord-Recon is a Discord bot created to automate bug bounty recon, automated scans and information gathering via a discord server. Discord-Recon is vulnerable to remote code execution. An attacker is able to execute shell commands in the server without having an admin role. This vulnerability has been fixed in version 0.0.8.

CWE description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CVSS v3 base score: 8.8
Published: 2024-01-09T00:15Z
Repository: https://github.com/DEMON1A/Discord-Recon
Language: Python
Files changed: app.py
Commit date: 2024-01-08 23:10:14 +0000
Commit message: Use CommandInjection protection on prips command

Diff: diff --git a/app.py b/app.py
index d183fe5..b215f06 100644
--- a/app.py
+++ b/app.py
@@ -155,26 +155,27 @@ async def statuscode(ctx, *, argument):
     await ctx.send(message)
     await ctx.send(f"\nRequested by **{ctx.message.author}**")
 
 @Client.command()
 async def prips(ctx, *, argument):
+    argument = CommandInjection.sanitizeInput(argument)
     Output = subprocess.Popen(f"prips {argument}", stdout=subprocess.PIPE, stderr=subprocess.STDOUT, shell=True)
     Output = Output.communicate()[0].decode('UTF-8')
 
     if len(Output) > 2000:
         RandomStr = utilities.generate_random_string()
 
         with open(f'messages/{RandomStr}' , 'w') as Message:
             Message.write(Output)
             Message.close()
 
-            await ctx.send("Prips Results: ", file=discord.File(f"messages/{RandomStr}"))
-            await ctx.send(f"\n**- {ctx.message.author}**")
+            await ctx.send(f"Prips output for **{argument}**: ", file=discord.File(f"messages/{RandomStr}"))
+            await ctx.send(f"\nRequested by **{ctx.message.author}**")
     else:
-        await ctx.send("**Prips Results:**")
+        await ctx.send(f"Prips output for **{argument}:**")
         await ctx.send(f"```{Output}```")
-        await ctx.send(f"\n**- {ctx.message.author}**")
+        await ctx.send(f"\nRequested by **{ctx.message.author}**")
 
 # Tools commands
 @Client.command()
 async def dirsearch(ctx , *, argument):
     argument = CommandInjection.sanitizeInput(argument)

Vulnerable code:             await ctx.send("Prips Results: ", file=discord.File(f"messages/{RandomStr}"))
            await ctx.send(f"\n**- {ctx.message.author}**")
        await ctx.send("**Prips Results:**")
        await ctx.send(f"\n**- {ctx.message.author}**")
Fixed code:     argument = CommandInjection.sanitizeInput(argument)
            await ctx.send(f"Prips output for **{argument}**: ", file=discord.File(f"messages/{RandomStr}"))
            await ctx.send(f"\nRequested by **{ctx.message.author}**")
        await ctx.send(f"Prips output for **{argument}:**")
        await ctx.send(f"\nRequested by **{ctx.message.author}**")
CVE-2024-38514: Insufficient Information (NVD-CWE-noinfo)
value: NextChat is a cross-platform ChatGPT/Gemini UI. There is a Server-Side Request Forgery (SSRF) vulnerability due to a lack of validation of the `endpoint` GET parameter on the WebDav API endpoint. This SSRF can be used to perform arbitrary HTTPS request from the vulnerable instance (MKCOL, PUT and GET methods supported), or to target NextChat users and make them execute arbitrary JavaScript code in their browser. This vulnerability has been patched in version 2.12.4.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-06-28T19:15Z
Repository: https://github.com/ChatGPTNextWeb/ChatGPT-Next-Web
Language: Unknown
Commit date: 2024-06-24 14:33:31 +0800
Commit message: Merge pull request from GHSA-gph5-rx77-3pjg

fix: validate the url to avoid SSRF
CVE-2021-23368: Insufficient Information (NVD-CWE-noinfo)
value: The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.3
Published: 2021-04-12T14:15Z
Repository: https://github.com/postcss/postcss
Language: JavaScript
Files changed: lib/previous-map.js
Commit date: 2021-04-08 02:57:25 -0400
Commit message: Fix unsafe regexp

Diff: diff --git a/lib/previous-map.js b/lib/previous-map.js
index 1a5bd1c..ff474a2 100644
--- a/lib/previous-map.js
+++ b/lib/previous-map.js
@@ -52,11 +52,11 @@ class PreviousMap {
       .match(/\/\*\s*# sourceMappingURL=(.*)\s*\*\//)[1]
       .trim()
   }
 
   loadAnnotation(css) {
-    let annotations = css.match(/\/\*\s*# sourceMappingURL=.*\s*\*\//gm)
+    let annotations = css.match(/\/\*\s*# sourceMappingURL=.*\*\//gm)
 
     if (annotations && annotations.length > 0) {
       // Locate the last sourceMappingURL to avoid picking up
       // sourceMappingURLs from comments, strings, etc.
       let lastAnnotation = annotations[annotations.length - 1]

Vulnerable code:     let annotations = css.match(/\/\*\s*# sourceMappingURL=.*\s*\*\//gm)
Fixed code:     let annotations = css.match(/\/\*\s*# sourceMappingURL=.*\*\//gm)
CVE-2021-23368: Insufficient Information (NVD-CWE-noinfo)
value: The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.3
Published: 2021-04-12T14:15Z
Repository: https://github.com/postcss/postcss
Language: JavaScript
Files changed: lib/previous-map.js
Commit date: 2021-04-11 09:03:18 -0400
Commit message: Fix unsafe regexp in getAnnotationURL() too

Diff: diff --git a/lib/previous-map.js b/lib/previous-map.js
index ff474a2b..d9308ff2 100644
--- a/lib/previous-map.js
+++ b/lib/previous-map.js
@@ -46,13 +46,11 @@ class PreviousMap {
     if (!string) return false
     return string.substr(0, start.length) === start
   }
 
   getAnnotationURL(sourceMapString) {
-    return sourceMapString
-      .match(/\/\*\s*# sourceMappingURL=(.*)\s*\*\//)[1]
-      .trim()
+    return sourceMapString.match(/\/\*\s*# sourceMappingURL=(.*)\*\//)[1].trim()
   }
 
   loadAnnotation(css) {
     let annotations = css.match(/\/\*\s*# sourceMappingURL=.*\*\//gm)
 

Vulnerable code:     return sourceMapString
      .match(/\/\*\s*# sourceMappingURL=(.*)\s*\*\//)[1]
      .trim()
Fixed code:     return sourceMapString.match(/\/\*\s*# sourceMappingURL=(.*)\*\//)[1].trim()
CVE-2021-23382: Inefficient Regular Expression Complexity (CWE-1333)
value: The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \/\*\s* sourceMappingURL=(.*).
CWE description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CVSS v3 base score: 7.5
Published: 2021-04-26T16:15Z
Repository: https://github.com/postcss/postcss
Language: Unknown
Commit date: 2021-04-26 08:08:17 -0400
Commit message: Merge pull request #1567 from yetingli/main

Fix ReDoS in previous-map
CVE-2023-44270: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.
CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 5.3
Published: 2023-09-29T22:15Z
Repository: https://github.com/postcss/postcss
Language: JavaScript
Files changed: lib/tokenize.js, test/parse.test.ts
Commit date: 2023-09-29 00:07:58 +0200
Commit message: Fix carrier return parsing

Diff: diff --git a/lib/tokenize.js b/lib/tokenize.js
index 5a9ed176..39a20a37 100644
--- a/lib/tokenize.js
+++ b/lib/tokenize.js
@@ -20,11 +20,11 @@ const ASTERISK = '*'.charCodeAt(0)
 const COLON = ':'.charCodeAt(0)
 const AT = '@'.charCodeAt(0)
 
 const RE_AT_END = /[\t\n\f\r "#'()/;[\\\]{}]/g
 const RE_WORD_END = /[\t\n\f\r !"#'():;@[\\\]{}]|\/(?=\*)/g
-const RE_BAD_BRACKET = /.[\n"'(/\\]/
+const RE_BAD_BRACKET = /.[\r\n"'(/\\]/
 const RE_HEX_ESCAPE = /[\da-f]/i
 
 module.exports = function tokenizer(input, options = {}) {
   let css = input.css.valueOf()
   let ignore = options.ignoreErrors
diff --git a/test/parse.test.ts b/test/parse.test.ts
index 4ab6c2f2..13de8985 100755
--- a/test/parse.test.ts
+++ b/test/parse.test.ts
@@ -32,10 +32,16 @@ test('should has true at hasBOM property', () => {
 test('should has false at hasBOM property', () => {
   let css = parse('@host { a {\f} }')
   is(css.first?.source?.input.hasBOM, false)
 })
 
+test('parses carrier return', () => {
+  throws(() => {
+    parse('@font-face{ font:(\r/*);} body { a: "a*/)} a{}"}')
+  }, /:1:46: Unclosed string/)
+})
+
 test('saves source file', () => {
   let css = parse('a {}', { from: 'a.css' })
   is(css.first?.source?.input.css, 'a {}')
   is(css.first?.source?.input.file, resolve('a.css'))
   is(css.first?.source?.input.from, resolve('a.css'))

Vulnerable code: const RE_BAD_BRACKET = /.[\n"'(/\\]/
Fixed code: const RE_BAD_BRACKET = /.[\r\n"'(/\\]/
test('parses carrier return', () => {
  throws(() => {
    parse('@font-face{ font:(\r/*);} body { a: "a*/)} a{}"}')
  }, /:1:46: Unclosed string/)
})
CVE-2013-7416: Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
value: canto_curses/guibase.py in Canto Curses before 0.9.0 allows remote feed servers to execute arbitrary commands via shell metacharacters in a URL in a feed.
CWE description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Published: 2014-12-03T21:59Z
Repository: https://github.com/themoken/canto-curses
Language: Python
Files changed: canto_curses/guibase.py
Commit date: 2014-10-17 11:33:09 -0500
Commit message: Proper URL quoting to avoid shell injection

Diff: diff --git a/canto_curses/guibase.py b/canto_curses/guibase.py
index c23a2ec..a67fc7d 100644
--- a/canto_curses/guibase.py
+++ b/canto_curses/guibase.py
@@ -154,10 +154,15 @@ class GuiBase(CommandHandler):
             response.close()
             tmp.close()
 
             href = tmpnam
 
+        # Make sure that we quote href such that malicious URLs like
+        # "http://example.com & rm -rf ~/" won't be interpreted by the shell.
+
+        href = shlex.quote(href)
+
         # A lot of programs don't appreciate
         # having their fds closed, so instead
         # we dup them to /dev/null.
 
         fd = os.open("/dev/null", os.O_RDWR)

Fixed code:         # Make sure that we quote href such that malicious URLs like
        # "http://example.com & rm -rf ~/" won't be interpreted by the shell.

        href = shlex.quote(href)
CVE-2022-4594: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: A vulnerability was found in drogatkin TJWS2. It has been declared as critical. Affected by this vulnerability is the function deployWar of the file 1.x/src/rogatkin/web/WarRoller.java. The manipulation leads to path traversal. The attack can be launched remotely. The name of the patch is 1bac15c496ec54efe21ad7fab4e17633778582fc. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216187.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 9.8
Published: 2022-12-18T08:15Z
Repository: https://github.com/drogatkin/TJWS2
Language: Java
Files changed: 1.x/src/rogatkin/web/WarRoller.java
Commit date: 2022-05-24 18:04:48 -0700
Commit message: the a Path Traversal vulnerability reported by Google
Diff: diff --git a/1.x/src/rogatkin/web/WarRoller.java b/1.x/src/rogatkin/web/WarRoller.java
old mode 100644
new mode 100755
index 9e9da9b..59206a1
--- a/1.x/src/rogatkin/web/WarRoller.java
+++ b/1.x/src/rogatkin/web/WarRoller.java
@@ -129,10 +129,12 @@ public class WarRoller implements WarDeployer {
 		while (entries.hasMoreElements()) {
 		    ZipEntry ze = entries.nextElement();
 		    String en = ze.getName();
 		    if (File.separatorChar == '/')
 			en = en.replace('\\', File.separatorChar);
+		    if (en.contains("../") || en.contains("/..")) 
+		    	throw new IOException("The file name " + en + " contains .. which can lead to a Path Traversal vulnerability");
 		    File outFile = new File(deployDir, en);
 		    if (ze.isDirectory()) {
 			outFile.mkdirs();
 		    } else {
 			OutputStream os = null;

Fixed code: 		    if (en.contains("../") || en.contains("/..")) 
		    	throw new IOException("The file name " + en + " contains .. which can lead to a Path Traversal vulnerability");
CVE-2023-1362: Improper Restriction of Rendered UI Layers or Frames (CWE-1021)
value: Improper Restriction of Rendered UI Layers or Frames in GitHub repository unilogies/bumsys prior to v2.0.2.
CWE description: The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.
CVSS v3 base score: 6.1
Published: 2023-03-13T05:15Z
Repository: https://github.com/unilogies/bumsys
Language: PHP
Files changed: core/loader.php
Commit date: 2023-03-04 16:36:41 +0600
Commit message: Set X-Frame-Option

Diff: diff --git a/core/loader.php b/core/loader.php
index 7b9fc0be..501ea74f 100644
--- a/core/loader.php
+++ b/core/loader.php
@@ -5,10 +5,13 @@
  */
  
 // Set the php coockie id only visible over http
 ini_set('session.cookie_httponly', true);
 
+// Prevent Loading iframe to other website
+header("X-Frame-Options: DENY");
+
 // Check if the PHP version is at leat 7.0
 if( version_compare(PHP_VERSION, '7.0.0') <= 0 ) {
     header('HTTP/1.0 403 Forbidden');
     die("BumSys require at least PHP 7.0.0. You are running PHP " . PHP_VERSION);
 }

Fixed code: // Prevent Loading iframe to other website
header("X-Frame-Options: DENY");
CVE-2019-16235: Origin Validation Error (CWE-346)
value: Dino before 2019-09-10 does not properly check the source of a carbons message in module/xep/0280_message_carbons.vala.
CWE description: The product does not properly verify that the source of data or communication is valid.
CVSS v3 base score: 7.5
Published: 2019-09-11T19:15Z
Repository: https://github.com/dino/dino
Language: Other
Files changed: xmpp-vala/src/module/xep/0280_message_carbons.vala
Commit date: 2019-09-10 21:11:49 +0200
Commit message: Fix check of source of a carbons message

Diff: diff --git a/xmpp-vala/src/module/xep/0280_message_carbons.vala b/xmpp-vala/src/module/xep/0280_message_carbons.vala
index fca3560..508d332 100644
--- a/xmpp-vala/src/module/xep/0280_message_carbons.vala
+++ b/xmpp-vala/src/module/xep/0280_message_carbons.vala
@@ -50,13 +50,13 @@ public class ReceivedPipelineListener : StanzaListener<MessageStanza> {
         StanzaNode? carbons_node = received_node != null ? received_node : sent_node;
         if (carbons_node != null) {
             StanzaNode? forwarded_node = carbons_node.get_subnode("forwarded", "urn:xmpp:forward:0");
             if (forwarded_node != null) {
                 StanzaNode? message_node = forwarded_node.get_subnode("message", Xmpp.NS_URI);
-                string? from_attribute = message_node.get_attribute("from", Xmpp.NS_URI);
                 // Any forwarded copies received by a Carbons-enabled client MUST be from that user's bare JID; any copies that do not meet this requirement MUST be ignored.
-                if (from_attribute != null && from_attribute == stream.get_flag(Bind.Flag.IDENTITY).my_jid.bare_jid.to_string()) {
+                if (!message.from.equals(stream.get_flag(Bind.Flag.IDENTITY).my_jid.bare_jid)) {
+                    warning("Received alleged carbon message from %s, ignoring", message.from.to_string());
                     return true;
                 }
                 if (received_node != null) {
                     message.add_flag(new MessageFlag(MessageFlag.TYPE_RECEIVED));
                 } else if (sent_node != null) {

Vulnerable code:                 string? from_attribute = message_node.get_attribute("from", Xmpp.NS_URI);
                if (from_attribute != null && from_attribute == stream.get_flag(Bind.Flag.IDENTITY).my_jid.bare_jid.to_string()) {
Fixed code:                 if (!message.from.equals(stream.get_flag(Bind.Flag.IDENTITY).my_jid.bare_jid)) {
                    warning("Received alleged carbon message from %s, ignoring", message.from.to_string());
CVE-2019-16236: Missing Authorization (CWE-862)
value: Dino before 2019-09-10 does not check roster push authorization in module/roster/module.vala.
CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 7.5
Published: 2019-09-11T19:15Z
Repository: https://github.com/dino/dino
Language: Other
Files changed: xmpp-vala/src/module/roster/module.vala
Commit date: 2019-09-10 23:02:42 +0200
Commit message: Check roster push authorization

Diff: diff --git a/xmpp-vala/src/module/roster/module.vala b/xmpp-vala/src/module/roster/module.vala
index 7a69abe9..0fa7911c 100644
--- a/xmpp-vala/src/module/roster/module.vala
+++ b/xmpp-vala/src/module/roster/module.vala
@@ -45,10 +45,14 @@ public class Module : XmppStreamModule, Iq.Handler {
     }
 
     public void on_iq_set(XmppStream stream, Iq.Stanza iq) {
         StanzaNode? query_node = iq.stanza.get_subnode("query", NS_URI);
         if (query_node == null) return;
+        if (!iq.from.equals(stream.get_flag(Bind.Flag.IDENTITY).my_jid.bare_jid)) {
+            warning("Received alledged roster push from %s, ignoring", iq.from.to_string());
+            return;
+        }
 
         Flag flag = stream.get_flag(Flag.IDENTITY);
         Item item = new Item.from_stanza_node(query_node.get_subnode("item", NS_URI));
         switch (item.subscription) {
             case Item.SUBSCRIPTION_REMOVE:

Fixed code:         if (!iq.from.equals(stream.get_flag(Bind.Flag.IDENTITY).my_jid.bare_jid)) {
            warning("Received alledged roster push from %s, ignoring", iq.from.to_string());
            return;
        }
CVE-2019-16237: Origin Validation Error (CWE-346)
value: Dino before 2019-09-10 does not properly check the source of an MAM message in module/xep/0313_message_archive_management.vala.
CWE description: The product does not properly verify that the source of data or communication is valid.
CVSS v3 base score: 7.5
Published: 2019-09-11T19:15Z
Repository: https://github.com/dino/dino
Language: Other
Files changed: xmpp-vala/src/module/xep/0313_message_archive_management.vala
Commit date: 2019-09-10 22:03:24 +0200
Commit message: Fix check of source of MAM message

Diff: diff --git a/xmpp-vala/src/module/xep/0313_message_archive_management.vala b/xmpp-vala/src/module/xep/0313_message_archive_management.vala
index 674224c9..e99193a7 100644
--- a/xmpp-vala/src/module/xep/0313_message_archive_management.vala
+++ b/xmpp-vala/src/module/xep/0313_message_archive_management.vala
@@ -92,15 +92,20 @@ public class ReceivedPipelineListener : StanzaListener<MessageStanza> {
 
     public override string action_group { get { return "EXTRACT_MESSAGE_1"; } }
     public override string[] after_actions { get { return after_actions_const; } }
 
     public override async bool run(XmppStream stream, MessageStanza message) {
-        //        if (message.from != stream.remote_name) return;
         if (stream.get_flag(Flag.IDENTITY) == null) return false;
 
         StanzaNode? message_node = message.stanza.get_deep_subnode(NS_VER(stream) + ":result", "urn:xmpp:forward:0:forwarded", Xmpp.NS_URI + ":message");
         if (message_node != null) {
+            // MAM messages must come from our server // TODO or a MUC server
+            if (!message.from.equals(stream.get_flag(Bind.Flag.IDENTITY).my_jid.bare_jid)) {
+                warning("Received alledged MAM message from %s, ignoring", message.from.to_string());
+                return true;
+            }
+
             StanzaNode? forward_node = message.stanza.get_deep_subnode(NS_VER(stream) + ":result", "urn:xmpp:forward:0:forwarded", DelayedDelivery.NS_URI + ":delay");
             DateTime? datetime = DelayedDelivery.Module.get_time_for_node(forward_node);
             message.add_flag(new MessageFlag(datetime));
 
             message.stanza = message_node;

Vulnerable code:         //        if (message.from != stream.remote_name) return;
Fixed code:             // MAM messages must come from our server // TODO or a MUC server
            if (!message.from.equals(stream.get_flag(Bind.Flag.IDENTITY).my_jid.bare_jid)) {
                warning("Received alledged MAM message from %s, ignoring", message.from.to_string());
                return true;
            }
CVE-2023-37905: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: ckeditor-wordcount-plugin is an open source WordCount Plugin for CKEditor. It has been discovered that the `ckeditor-wordcount-plugin` plugin for CKEditor4 is susceptible to cross-site scripting when switching to the source code mode. This issue has been addressed in version 1.17.12 of the `ckeditor-wordcount-plugin` plugin and users are advised to upgrade. There are no known workarounds for this vulnerability.


CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-07-21T20:15Z
Repository: https://github.com/w8tcha/CKEditor-WordCount-Plugin
Language: JavaScript
Files changed: wordcount/plugin.js
Commit date: 2023-07-08 09:21:37 +0200
Commit message: [FIXED] xss issue

Diff: diff --git a/wordcount/plugin.js b/wordcount/plugin.js
index 16ab9d5..f60581a 100644
--- a/wordcount/plugin.js
+++ b/wordcount/plugin.js
@@ -4,11 +4,11 @@
  */
 
 CKEDITOR.plugins.add("wordcount",
     {
         lang: "ar,bg,ca,cs,da,de,el,en,es,eu,fa,fi,fr,he,hr,hu,it,ka,ko,ja,nl,no,pl,pt,pt-br,ru,sk,sv,tr,uk,zh-cn,zh,ro", // %REMOVE_LINE_CORE%
-        version: "1.17.10",
+        version: "1.17.11",
         requires: "htmlwriter,notification,undo",
         bbcodePluginLoaded: false,
         onLoad: function() {
             CKEDITOR.document.appendStyleSheet(this.path + "css/wordcount.css");
         },
@@ -180,15 +180,17 @@ CKEDITOR.plugins.add("wordcount",
                 // Add filter before strip
                 html = filter(html);
 
                 tmp.innerHTML = html;
 
-                if (tmp.textContent == "" && typeof tmp.innerText == "undefined") {
+                // Parse filtered HTML, without applying it to any element in DOM
+                var tmp = new DOMParser().parseFromString(html, 'text/html');
+                if (!tmp.body || !tmp.body.textContent) {
                     return "";
                 }
 
-                return tmp.textContent || tmp.innerText;
+                return tmp.body.textContent || tmp.body.innerText;
             }
 
             /**
              * Implement filter to add or remove before counting
              * @param html

Vulnerable code:         version: "1.17.10",
                if (tmp.textContent == "" && typeof tmp.innerText == "undefined") {
                return tmp.textContent || tmp.innerText;
Fixed code:         version: "1.17.11",
                // Parse filtered HTML, without applying it to any element in DOM
                var tmp = new DOMParser().parseFromString(html, 'text/html');
                if (!tmp.body || !tmp.body.textContent) {
                return tmp.body.textContent || tmp.body.innerText;
CVE-2023-37905: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: ckeditor-wordcount-plugin is an open source WordCount Plugin for CKEditor. It has been discovered that the `ckeditor-wordcount-plugin` plugin for CKEditor4 is susceptible to cross-site scripting when switching to the source code mode. This issue has been addressed in version 1.17.12 of the `ckeditor-wordcount-plugin` plugin and users are advised to upgrade. There are no known workarounds for this vulnerability.


CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-07-21T20:15Z
Repository: https://github.com/w8tcha/CKEditor-WordCount-Plugin
Language: JSON
Files changed: package.json, wordcount/plugin.js
Commit date: 2023-07-11 06:38:26 +0200
Commit message: [FIXED] xss issue

Diff: diff --git a/package.json b/package.json
index d0d0134..4ef108d 100644
--- a/package.json
+++ b/package.json
@@ -1,8 +1,8 @@
 {
   "name": "ckeditor-wordcount-plugin",
-  "version": "1.17.11",
+  "version": "1.17.12",
   "author": "w8tcha",
   "description": "WordCount Plugin for CKEditor Editor",
   "repository": {
     "type": "git",
     "url": "https://github.com/w8tcha/CKEditor-WordCount-Plugin.git"
diff --git a/wordcount/plugin.js b/wordcount/plugin.js
index f60581a..e2e608b 100644
--- a/wordcount/plugin.js
+++ b/wordcount/plugin.js
@@ -4,11 +4,11 @@
  */
 
 CKEDITOR.plugins.add("wordcount",
     {
         lang: "ar,bg,ca,cs,da,de,el,en,es,eu,fa,fi,fr,he,hr,hu,it,ka,ko,ja,nl,no,pl,pt,pt-br,ru,sk,sv,tr,uk,zh-cn,zh,ro", // %REMOVE_LINE_CORE%
-        version: "1.17.11",
+        version: "1.17.12",
         requires: "htmlwriter,notification,undo",
         bbcodePluginLoaded: false,
         onLoad: function() {
             CKEDITOR.document.appendStyleSheet(this.path + "css/wordcount.css");
         },
@@ -173,17 +173,13 @@ CKEDITOR.plugins.add("wordcount",
                 if (bbcodePluginLoaded) {
                     // stripping out BBCode tags [...][/...]
                     return html.replace(/\[.*?\]/gi, "");
                 }
 
-                var tmp = document.createElement("div");
-
                 // Add filter before strip
                 html = filter(html);
 
-                tmp.innerHTML = html;
-
                 // Parse filtered HTML, without applying it to any element in DOM
                 var tmp = new DOMParser().parseFromString(html, 'text/html');
                 if (!tmp.body || !tmp.body.textContent) {
                     return "";
                 }

Vulnerable code:   "version": "1.17.11",
        version: "1.17.11",
                var tmp = document.createElement("div");

                tmp.innerHTML = html;

Fixed code:   "version": "1.17.12",
        version: "1.17.12",
CVE-2017-10929: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: The grub_memmove function in shlr/grub/kern/misc.c in radare2 1.5.0 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, possibly related to a read overflow in the grub_disk_read_small_real function in kern/disk.c in GNU GRUB 2.02.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.8
Published: 2017-07-05T12:29Z
Repository: https://github.com/radare/radare2
Language: C
Files changed: shlr/grub/kern/disk.c
Commit date: 2017-07-04 19:38:33 +0200
Commit message: Fix r2_hbo_grub_memmove ext2 crash

Diff: diff --git a/shlr/grub/kern/disk.c b/shlr/grub/kern/disk.c
index a4d3f867c..f93116854 100644
--- a/shlr/grub/kern/disk.c
+++ b/shlr/grub/kern/disk.c
@@ -447,12 +447,18 @@ grub_disk_read (grub_disk_t disk, grub_disk_addr_t sector,
       /* Fetch the cache.  */
       data = grub_disk_cache_fetch (disk->dev->id, disk->id, start_sector);
       if (data)
 	{
 	  /* Just copy it!  */
-	  if (buf)
+	  if (buf) {
+	    if (pos + real_offset + len >= size) {
+              // prevent read overflow
+              grub_errno = GRUB_ERR_BAD_FS;
+              return grub_errno;
+	    }
 	    grub_memcpy (buf, data + pos + real_offset, len);
+          }
 	  grub_disk_cache_unlock (disk->dev->id, disk->id, start_sector);
 	}
       else
 	{
 	  /* Otherwise read data from the disk actually.  */

Vulnerable code: 	  if (buf)
Fixed code: 	  if (buf) {
	    if (pos + real_offset + len >= size) {
              // prevent read overflow
              grub_errno = GRUB_ERR_BAD_FS;
              return grub_errno;
	    }
          }
CVE-2017-15385: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: The store_versioninfo_gnu_verdef function in libr/bin/format/elf/elf.c in radare2 2.0.0 allows remote attackers to cause a denial of service (r_read_le16 invalid write and application crash) or possibly have unspecified other impact via a crafted ELF file.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.8
Published: 2017-10-16T22:29Z
Repository: https://github.com/radare/radare2
Language: C
Files changed: libr/bin/format/elf/elf.c
Commit date: 2017-10-14 21:45:16 +0200
Commit message: Fix #8685 - Crash in ELF version parsing

Diff: diff --git a/libr/bin/format/elf/elf.c b/libr/bin/format/elf/elf.c
index 0235e0c5e4..90f6acd301 100644
--- a/libr/bin/format/elf/elf.c
+++ b/libr/bin/format/elf/elf.c
@@ -729,11 +729,11 @@ static Sdb *store_versioninfo_gnu_verdef(ELFOBJ *bin, Elf_(Shdr) *shdr, int sz)
 	sdb_num_set (sdb, "addr", shdr->sh_addr, 0);
 	sdb_num_set (sdb, "offset", shdr->sh_offset, 0);
 	sdb_num_set (sdb, "link", shdr->sh_link, 0);
 	sdb_set (sdb, "link_section_name", link_section_name, 0);
 
-	for (cnt = 0, i = 0; cnt < shdr->sh_info && ((char *)defs + i < end); ++cnt) {
+	for (cnt = 0, i = 0; i >= 0 && cnt < shdr->sh_info && ((char *)defs + i < end); ++cnt) {
 		Sdb *sdb_verdef = sdb_new0 ();
 		char *vstart = ((char*)defs) + i;
 		char key[32] = {0};
 		Elf_(Verdef) *verdef = (Elf_(Verdef)*)vstart;
 		Elf_(Verdaux) aux = {0};
@@ -800,10 +800,14 @@ static Sdb *store_versioninfo_gnu_verdef(ELFOBJ *bin, Elf_(Shdr) *shdr, int sz)
 		sdb_ns_set (sdb, key, sdb_verdef);
 		if (!verdef->vd_next) {
 			sdb_free (sdb_verdef);
 			goto out_error;
 		}
+		if ((st32)verdef->vd_next < 1) {
+			eprintf ("Warning: Invalid vd_next in the ELF version\n");
+			break;
+		}
 		i += verdef->vd_next;
 	}
 	free (defs);
 	return sdb;
 out_error:

Vulnerable code: 	for (cnt = 0, i = 0; cnt < shdr->sh_info && ((char *)defs + i < end); ++cnt) {
Fixed code: 	for (cnt = 0, i = 0; i >= 0 && cnt < shdr->sh_info && ((char *)defs + i < end); ++cnt) {
		if ((st32)verdef->vd_next < 1) {
			eprintf ("Warning: Invalid vd_next in the ELF version\n");
			break;
		}
CVE-2017-15931: Out-of-bounds Read (CWE-125)
value: In radare2 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo_gnu_verneed() in libr/bin/format/elf/elf.c via crafted ELF files on 32bit systems.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2017-10-27T18:29Z
Repository: https://github.com/radare/radare2
Language: C
Files changed: libr/bin/format/elf/elf.c
Commit date: 2017-10-25 18:00:11 +0200
Commit message: Fix #8731 - Crash in ELF parser with negative 32bit number

Diff: diff --git a/libr/bin/format/elf/elf.c b/libr/bin/format/elf/elf.c
index 90f6acd301..e3c852fd33 100644
--- a/libr/bin/format/elf/elf.c
+++ b/libr/bin/format/elf/elf.c
@@ -898,11 +898,15 @@ static Sdb *store_versioninfo_gnu_verneed(ELFOBJ *bin, Elf_(Shdr) *shdr, int sz)
 			char *s = r_str_ndup (&bin->dynstr[entry->vn_file], 16);
 			sdb_set (sdb_version, "file_name", s, 0);
 			free (s);
 		}
 		sdb_num_set (sdb_version, "cnt", entry->vn_cnt, 0);
-		vstart += entry->vn_aux;
+		st32 vnaux = entry->vn_aux;
+		if (vnaux < 1) {
+			goto beach;
+		}
+		vstart += vnaux;
 		for (j = 0, isum = i + entry->vn_aux; j < entry->vn_cnt && vstart + sizeof (Elf_(Vernaux)) <= end; ++j) {
 			int k;
 			Elf_(Vernaux) * aux = NULL;
 			Elf_(Vernaux) vaux = {0};
 			sdb_vernaux = sdb_new0 ();

Vulnerable code: 		vstart += entry->vn_aux;
Fixed code: 		st32 vnaux = entry->vn_aux;
		if (vnaux < 1) {
			goto beach;
		}
		vstart += vnaux;
CVE-2017-15932: Out-of-bounds Read (CWE-125)
value: In radare2 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo_gnu_verdef() in libr/bin/format/elf/elf.c via crafted ELF files when parsing the ELF version on 32bit systems.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2017-10-27T18:29Z
Repository: https://github.com/radare/radare2
Language: C
Files changed: libr/bin/format/elf/elf.c
Commit date: 2017-10-25 18:09:24 +0200
Commit message: Fix #8743 - Crash in ELF version parser on 32bit systems

Diff: diff --git a/libr/bin/format/elf/elf.c b/libr/bin/format/elf/elf.c
index e3c852fd33..2248731b38 100644
--- a/libr/bin/format/elf/elf.c
+++ b/libr/bin/format/elf/elf.c
@@ -746,11 +746,16 @@ static Sdb *store_versioninfo_gnu_verdef(ELFOBJ *bin, Elf_(Shdr) *shdr, int sz)
 		verdef->vd_ndx = READ16 (dfs, j)
 		verdef->vd_cnt = READ16 (dfs, j)
 		verdef->vd_hash = READ32 (dfs, j)
 		verdef->vd_aux = READ32 (dfs, j)
 		verdef->vd_next = READ32 (dfs, j)
-		vstart += verdef->vd_aux;
+		int vdaux = verdef->vd_aux;
+		if (vdaux < 1) {
+			sdb_free (sdb_verdef);
+			goto out_error;
+		}
+		vstart += vdaux;
 		if (vstart > end || vstart + sizeof (Elf_(Verdaux)) > end) {
 			sdb_free (sdb_verdef);
 			goto out_error;
 		}
 

Vulnerable code: 		vstart += verdef->vd_aux;
Fixed code: 		int vdaux = verdef->vd_aux;
		if (vdaux < 1) {
			sdb_free (sdb_verdef);
			goto out_error;
		}
		vstart += vdaux;
CVE-2017-16357: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: In radare 2.0.1, a memory corruption vulnerability exists in store_versioninfo_gnu_verdef() and store_versioninfo_gnu_verneed() in libr/bin/format/elf/elf.c, as demonstrated by an invalid free. This error is due to improper sh_size validation when allocating memory.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.8
Published: 2017-11-01T17:29Z
Repository: https://github.com/radare/radare2
Language: C
Files changed: libr/bin/format/elf/elf.c
Commit date: 2017-10-28 11:56:30 +0800
Commit message: Fixed crash in elf.c with 32bit r2 when shdr->sh_size > max size_t

Diff: diff --git a/libr/bin/format/elf/elf.c b/libr/bin/format/elf/elf.c
index 2248731b38..b466c312cb 100644
--- a/libr/bin/format/elf/elf.c
+++ b/libr/bin/format/elf/elf.c
@@ -703,11 +703,11 @@ static Sdb *store_versioninfo_gnu_verdef(ELFOBJ *bin, Elf_(Shdr) *shdr, int sz)
 	int cnt, i;
 	if (shdr->sh_link > bin->ehdr.e_shnum) {
 		return false;
 	}
 	link_shdr = &bin->shdr[shdr->sh_link];
-	if (shdr->sh_size < 1) {
+	if (shdr->sh_size < 1 || shdr->sh_size > SIZE_MAX) {
 		return false;
 	}
 	Elf_(Verdef) *defs = calloc (shdr->sh_size, sizeof (char));
 	if (!defs) {
 		return false;
@@ -835,11 +835,11 @@ static Sdb *store_versioninfo_gnu_verneed(ELFOBJ *bin, Elf_(Shdr) *shdr, int sz)
 		return NULL;
 	}
 	if (shdr->sh_link > bin->ehdr.e_shnum) {
 		return NULL;
 	}
-	if (shdr->sh_size < 1) {
+	if (shdr->sh_size < 1 || shdr->sh_size > SIZE_MAX) {
 		return NULL;
 	}
 	sdb = sdb_new0 ();
 	if (!sdb) {
 		return NULL;

Vulnerable code: 	if (shdr->sh_size < 1) {
	if (shdr->sh_size < 1) {
Fixed code: 	if (shdr->sh_size < 1 || shdr->sh_size > SIZE_MAX) {
	if (shdr->sh_size < 1 || shdr->sh_size > SIZE_MAX) {
CVE-2017-16358: Out-of-bounds Read (CWE-125)
value: In radare 2.0.1, an out-of-bounds read vulnerability exists in string_scan_range() in libr/bin/bin.c when doing a string search.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2017-11-01T17:29Z
Repository: https://github.com/radare/radare2
Language: C
Files changed: libr/bin/bin.c
Commit date: 2017-10-31 13:08:52 +0100
Commit message: Fix #8748 - Fix oobread on string search

Diff: diff --git a/libr/bin/bin.c b/libr/bin/bin.c
index fbb8a8025b..b5fffe88bc 100644
--- a/libr/bin/bin.c
+++ b/libr/bin/bin.c
@@ -350,20 +350,20 @@ static int string_scan_range(RList *list, const ut8 *buf, int min,
 				new->size = needle - str_start;
 				new->ordinal = count++;
 				// TODO: move into adjust_offset
 				switch (str_type) {
 				case R_STRING_TYPE_WIDE:
-					{
-						const ut8 *p = buf  + str_start - 2;
+					if (str_start > 1) {
+						const ut8 *p = buf + str_start - 2;
 						if (p[0] == 0xff && p[1] == 0xfe) {
 							str_start -= 2; // \xff\xfe
 						}
 					}
 					break;
 				case R_STRING_TYPE_WIDE32:
-					{
-						const ut8 *p = buf  + str_start - 4;
+					if (str_start > 3) {
+						const ut8 *p = buf + str_start - 4;
 						if (p[0] == 0xff && p[1] == 0xfe) {
 							str_start -= 4; // \xff\xfe\x00\x00
 						}
 					}
 					break;

Vulnerable code: 					{
						const ut8 *p = buf  + str_start - 2;
					{
						const ut8 *p = buf  + str_start - 4;
Fixed code: 					if (str_start > 1) {
						const ut8 *p = buf + str_start - 2;
					if (str_start > 3) {
						const ut8 *p = buf + str_start - 4;
CVE-2017-16359: NULL Pointer Dereference (CWE-476)
value: In radare 2.0.1, a pointer wraparound vulnerability exists in store_versioninfo_gnu_verdef() in libr/bin/format/elf/elf.c.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2017-11-01T17:29Z
Repository: https://github.com/radare/radare2
Language: C
Files changed: libr/bin/format/elf/elf.c
Commit date: 2017-11-01 20:44:46 +0800
Commit message: Fix #8764 a 3rd time since 2nd time is UB and can be optimized away

Diff: diff --git a/libr/bin/format/elf/elf.c b/libr/bin/format/elf/elf.c
index 7ee0fd65978..0c47f22e674 100644
--- a/libr/bin/format/elf/elf.c
+++ b/libr/bin/format/elf/elf.c
@@ -732,10 +732,11 @@ static Sdb *store_versioninfo_gnu_verdef(ELFOBJ *bin, Elf_(Shdr) *shdr, int sz)
 	sdb_set (sdb, "link_section_name", link_section_name, 0);
 
 	for (cnt = 0, i = 0; i >= 0 && cnt < shdr->sh_info && ((char *)defs + i < end); ++cnt) {
 		Sdb *sdb_verdef = sdb_new0 ();
 		char *vstart = ((char*)defs) + i;
+		size_t vstart_off = i;
 		char key[32] = {0};
 		Elf_(Verdef) *verdef = (Elf_(Verdef)*)vstart;
 		Elf_(Verdaux) aux = {0};
 		int j = 0;
 		int isum = 0;
@@ -747,15 +748,16 @@ static Sdb *store_versioninfo_gnu_verdef(ELFOBJ *bin, Elf_(Shdr) *shdr, int sz)
 		verdef->vd_cnt = READ16 (dfs, j)
 		verdef->vd_hash = READ32 (dfs, j)
 		verdef->vd_aux = READ32 (dfs, j)
 		verdef->vd_next = READ32 (dfs, j)
 		int vdaux = verdef->vd_aux;
-		if (vdaux < 1 || vstart + vdaux < vstart) {
+		if (vdaux < 1 || shdr->sh_size - vstart_off < vdaux) {
 			sdb_free (sdb_verdef);
 			goto out_error;
 		}
 		vstart += vdaux;
+		vstart_off += vdaux;
 		if (vstart > end || vstart + sizeof (Elf_(Verdaux)) > end) {
 			sdb_free (sdb_verdef);
 			goto out_error;
 		}
 
@@ -779,10 +781,11 @@ static Sdb *store_versioninfo_gnu_verdef(ELFOBJ *bin, Elf_(Shdr) *shdr, int sz)
 		for (j = 1; j < verdef->vd_cnt; ++j) {
 			int k;
 			Sdb *sdb_parent = sdb_new0 ();
 			isum += aux.vda_next;
 			vstart += aux.vda_next;
+			vstart_off += aux.vda_next;
 			if (vstart > end || vstart + sizeof (Elf_(Verdaux)) > end) {
 				sdb_free (sdb_verdef);
 				sdb_free (sdb_parent);
 				goto out_error;
 			}

Vulnerable code: 		if (vdaux < 1 || vstart + vdaux < vstart) {
Fixed code: 		size_t vstart_off = i;
		if (vdaux < 1 || shdr->sh_size - vstart_off < vdaux) {
		vstart_off += vdaux;
			vstart_off += aux.vda_next;
CVE-2017-16359: NULL Pointer Dereference (CWE-476)
value: In radare 2.0.1, a pointer wraparound vulnerability exists in store_versioninfo_gnu_verdef() in libr/bin/format/elf/elf.c.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2017-11-01T17:29Z
Repository: https://github.com/radare/radare2
Language: C
Files changed: libr/bin/format/elf/elf.c
Commit date: 2017-11-01 01:52:54 +0800
Commit message: Fix #8764 differently since ptr diff might not fit in ptrdiff_t

Diff: diff --git a/libr/bin/format/elf/elf.c b/libr/bin/format/elf/elf.c
index ba3d1d5404f..eb0ebe0ed23 100644
--- a/libr/bin/format/elf/elf.c
+++ b/libr/bin/format/elf/elf.c
@@ -747,11 +747,11 @@ static Sdb *store_versioninfo_gnu_verdef(ELFOBJ *bin, Elf_(Shdr) *shdr, int sz)
 		verdef->vd_cnt = READ16 (dfs, j)
 		verdef->vd_hash = READ32 (dfs, j)
 		verdef->vd_aux = READ32 (dfs, j)
 		verdef->vd_next = READ32 (dfs, j)
 		int vdaux = verdef->vd_aux;
-		if (vdaux < 1 || (char *)UINTPTR_MAX - vstart < vdaux) {
+		if (vdaux < 1 || vstart + vdaux < vstart) {
 			sdb_free (sdb_verdef);
 			goto out_error;
 		}
 		vstart += vdaux;
 		if (vstart > end || end - vstart < sizeof (Elf_(Verdaux))) {

Vulnerable code: 		if (vdaux < 1 || (char *)UINTPTR_MAX - vstart < vdaux) {
Fixed code: 		if (vdaux < 1 || vstart + vdaux < vstart) {