Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2018-10717: Out-of-bounds Write (CWE-787)
value: The DecodeGifImg function in ngiflib.c in MiniUPnP ngiflib 0.4 does not consider the bounds of the pixels data structure, which allows remote attackers to cause a denial of service (WritePixels heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted GIF file, a different vulnerability than CVE-2018-10677.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.8
Published: 2018-05-03T17:29Z
Repository: https://github.com/miniupnp/ngiflib
Language: C
Files changed: ngiflib.c
Commit date: 2018-05-03 17:35:47 +0200
Commit message: fix "pixel overrun"

fixes #3

Diff: diff --git a/ngiflib.c b/ngiflib.c
index ac8dc2a..32596d0 100644
--- a/ngiflib.c
+++ b/ngiflib.c
@@ -526,11 +526,12 @@ static int DecodeGifImg(struct ngiflib_img * i) {
 			context.nbbit = i->imgbits + 1;
 			context.max = clr + clr - 1; /* (1 << context.nbbit) - 1 */
 			act_code = GetGifWord(i, &context);
 			casspecial = (u8)act_code;
 			old_code = act_code;
-			WritePixel(i, &context, casspecial); npix--;
+			if(npix > 0) WritePixel(i, &context, casspecial);
+			npix--;
 		} else {
 			read_byt = act_code;
 			if(act_code >= free) {	/* code pas encore dans alphabet */
 /*				printf("Code pas dans alphabet : %d>=%d push %d\n", act_code, free, casspecial); */
 				*(--stackp) = casspecial; /* dernier debut de chaine ! */
@@ -543,11 +544,15 @@ static int DecodeGifImg(struct ngiflib_img * i) {
 				act_code = ab_prfx[act_code];	/* prefixe */
 			}
 			/* act_code est concret */
 			casspecial = (u8)act_code;	/* dernier debut de chaine ! */
 			*(--stackp) = casspecial;	/* push on stack */
-			WritePixels(i, &context, stackp, stack_top - stackp);	/* unstack all pixels at once */
+			if(npix >= (stack_top - stackp)) {
+				WritePixels(i, &context, stackp, stack_top - stackp);	/* unstack all pixels at once */
+			} else if(npix > 0) {	/* "pixel overflow" */
+				WritePixels(i, &context, stackp, npix);
+			}
 			npix -= (stack_top - stackp);
 			stackp = stack_top;
 /*			putchar('\n'); */
 			if(free < 4096) { /* la taille du dico est 4096 max ! */
 				ab_prfx[free] = old_code;

Vulnerable code: 			WritePixel(i, &context, casspecial); npix--;
			WritePixels(i, &context, stackp, stack_top - stackp);	/* unstack all pixels at once */
Fixed code: 			if(npix > 0) WritePixel(i, &context, casspecial);
			npix--;
			if(npix >= (stack_top - stackp)) {
				WritePixels(i, &context, stackp, stack_top - stackp);	/* unstack all pixels at once */
			} else if(npix > 0) {	/* "pixel overflow" */
				WritePixels(i, &context, stackp, npix);
			}
CVE-2020-27519: Improper Privilege Management (CWE-269)
value: Pritunl Client v1.2.2550.20 contains a local privilege escalation vulnerability in the pritunl-service component. The attack vector is: malicious openvpn config. A local attacker could leverage the log and log-append along with log injection to create or append to privileged script files and execute code as root/SYSTEM.
CWE description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CVSS v3 base score: 7.8
Published: 2021-04-30T14:15Z
Repository: https://github.com/pritunl/pritunl-client-electron
Language: Go
Files changed: service/profile/profile.go
Commit date: 2020-09-04 11:42:55 -0400
Commit message: Update profile write

Diff: diff --git a/service/profile/profile.go b/service/profile/profile.go
index 2ba9ecb3..4a2ebac3 100644
--- a/service/profile/profile.go
+++ b/service/profile/profile.go
@@ -235,10 +235,14 @@ func (p *Profile) write() (pth string, err error) {
 		trimLine = strings.Trim(trimLine, "{")
 		trimLine = strings.Trim(trimLine, "}")
 
 		if strings.Contains(trimLine, "script-security") ||
 			strings.HasPrefix(trimLine, "log ") ||
+			strings.HasPrefix(trimLine, "log-append ") ||
+			strings.HasPrefix(trimLine, "syslog ") ||
+			strings.HasPrefix(trimLine, "management ") ||
+			strings.HasPrefix(trimLine, "plugin ") ||
 			strings.HasPrefix(trimLine, "up ") ||
 			strings.HasPrefix(trimLine, "down ") ||
 			strings.HasPrefix(trimLine, "route-pre-down ") ||
 			strings.HasPrefix(trimLine, "tls-verify ") ||
 			strings.HasPrefix(trimLine, "ipchange ") ||

Fixed code: 			strings.HasPrefix(trimLine, "log-append ") ||
			strings.HasPrefix(trimLine, "syslog ") ||
			strings.HasPrefix(trimLine, "management ") ||
			strings.HasPrefix(trimLine, "plugin ") ||
CVE-2022-25372: Improper Privilege Management (CWE-269)
value: Pritunl Client through 1.2.3019.52 on Windows allows local privilege escalation, related to an ACL entry for CREATOR OWNER in platform_windows.go.
CWE description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CVSS v3 base score: 7.8
Published: 2022-02-20T20:15Z
Repository: https://github.com/pritunl/pritunl-client-electron
Language: Go
Files changed: service/platform/platform_windows.go
Commit date: 2022-02-17 18:47:14 -0500
Commit message: Update acl in service platform windows

Diff: diff --git a/service/platform/platform_windows.go b/service/platform/platform_windows.go
index 2f6c64a9..8483483c 100644
--- a/service/platform/platform_windows.go
+++ b/service/platform/platform_windows.go
@@ -20,11 +20,10 @@ func MkdirSecure(pth string) (err error) {
 
 	err = acl.Apply(
 		pth,
 		true,
 		false,
-		acl.GrantName(windows.GENERIC_ALL, "CREATOR OWNER"),
 		acl.GrantName(windows.GENERIC_ALL, "SYSTEM"),
 		acl.GrantName(windows.GENERIC_ALL, "Administrators"),
 	)
 	if err != nil {
 		err = &errortypes.WriteError{

Vulnerable code: 		acl.GrantName(windows.GENERIC_ALL, "CREATOR OWNER"),
CVE-2022-4875: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability has been found in fossology and classified as problematic. This vulnerability affects unknown code. The manipulation of the argument sql/VarValue leads to cross site scripting. The attack can be initiated remotely. The patch is identified as 8e0eba001662c7eb35f045b70dd458a4643b4553. It is recommended to apply a patch to fix this issue. VDB-217426 is the identifier assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-01-04T22:15Z
Repository: https://github.com/fossology/fossology
Language: Unknown
Commit date: 2023-01-02 12:40:26 +0530
Commit message: Merge pull request #2356 from Orange-OpenSource/fix/orange-opensource/security/fix-reflected-xss

fix(security) fix Reflected XSS vulnerability

Reviewed-by: shaheem.azmal@siemens.com
Tested-by: shaheem.azmal@siemens.com
CVE-2017-14638: NULL Pointer Dereference (CWE-476)
value: AP4_AtomFactory::CreateAtomFromStream in Core/Ap4AtomFactory.cpp in Bento4 version 1.5.0-617 has missing NULL checks, leading to a NULL pointer dereference, segmentation fault, and application crash in AP4_Atom::SetType in Core/Ap4Atom.h.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 6.5
Published: 2017-09-21T17:29Z
Repository: https://github.com/axiomatic-systems/Bento4
Language: C++
Files changed: Source/C++/Core/Ap4AtomFactory.cpp
Commit date: 2017-09-09 10:36:28 -0700
Commit message: fix for #182

Diff: diff --git a/Source/C++/Core/Ap4AtomFactory.cpp b/Source/C++/Core/Ap4AtomFactory.cpp
index 687aab55..f5bd0696 100644
--- a/Source/C++/Core/Ap4AtomFactory.cpp
+++ b/Source/C++/Core/Ap4AtomFactory.cpp
@@ -488,17 +488,21 @@ AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream& stream,
             break;
 
           case AP4_ATOM_TYPE_HVCE:
             if (atom_is_large) return AP4_ERROR_INVALID_FORMAT;
             atom = AP4_HvccAtom::Create(size_32, stream);
-            atom->SetType(AP4_ATOM_TYPE_HVCE);
+            if (atom) {
+                atom->SetType(AP4_ATOM_TYPE_HVCE);
+            }
             break;
 
           case AP4_ATOM_TYPE_AVCE:
             if (atom_is_large) return AP4_ERROR_INVALID_FORMAT;
             atom = AP4_AvccAtom::Create(size_32, stream);
-            atom->SetType(AP4_ATOM_TYPE_AVCE);
+            if (atom) {
+                atom->SetType(AP4_ATOM_TYPE_AVCE);
+            }
             break;
 
     #if !defined(AP4_CONFIG_MINI_BUILD)
           case AP4_ATOM_TYPE_UUID: {
               AP4_UI08 uuid[16];

Vulnerable code:             atom->SetType(AP4_ATOM_TYPE_HVCE);
            atom->SetType(AP4_ATOM_TYPE_AVCE);
Fixed code:             if (atom) {
                atom->SetType(AP4_ATOM_TYPE_HVCE);
            }
            if (atom) {
                atom->SetType(AP4_ATOM_TYPE_AVCE);
            }
CVE-2017-14639: Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)
value: AP4_VisualSampleEntry::ReadFields in Core/Ap4SampleEntry.cpp in Bento4 1.5.0-617 uses incorrect character data types, which causes a stack-based buffer underflow and out-of-bounds write, leading to denial of service (application crash) or possibly unspecified other impact.
CWE description: The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
CVSS v3 base score: 8.8
Published: 2017-09-21T17:29Z
Repository: https://github.com/axiomatic-systems/Bento4
Language: C++
Files changed: Source/C++/Core/Ap4SampleEntry.cpp
Commit date: 2017-09-09 16:12:31 -0700
Commit message: fix for #190

Diff: diff --git a/Source/C++/Core/Ap4SampleEntry.cpp b/Source/C++/Core/Ap4SampleEntry.cpp
index d29d08a9..6bdf6f8f 100644
--- a/Source/C++/Core/Ap4SampleEntry.cpp
+++ b/Source/C++/Core/Ap4SampleEntry.cpp
@@ -770,17 +770,17 @@ AP4_VisualSampleEntry::ReadFields(AP4_ByteStream& stream)
     stream.ReadUI32(m_HorizResolution);
     stream.ReadUI32(m_VertResolution);
     stream.ReadUI32(m_Reserved3);
     stream.ReadUI16(m_FrameCount);
 
-    char compressor_name[33];
+    AP4_UI08 compressor_name[33];
     compressor_name[32] = 0;
     stream.Read(compressor_name, 32);
-    int name_length = compressor_name[0];
+    AP4_UI08 name_length = compressor_name[0];
     if (name_length < 32) {
         compressor_name[name_length+1] = 0; // force null termination
-        m_CompressorName = &compressor_name[1];
+        m_CompressorName = (const char*)(&compressor_name[1]);
     }
 
     stream.ReadUI16(m_Depth);
     stream.ReadUI16(m_Predefined3);
 

Vulnerable code:     char compressor_name[33];
    int name_length = compressor_name[0];
        m_CompressorName = &compressor_name[1];
Fixed code:     AP4_UI08 compressor_name[33];
    AP4_UI08 name_length = compressor_name[0];
        m_CompressorName = (const char*)(&compressor_name[1]);
CVE-2017-14640: NULL Pointer Dereference (CWE-476)
value: A NULL pointer dereference was discovered in AP4_AtomSampleTable::GetSample in Core/Ap4AtomSampleTable.cpp in Bento4 version 1.5.0-617. The vulnerability causes a segmentation fault and application crash, which leads to remote denial of service.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 6.5
Published: 2017-09-21T17:29Z
Repository: https://github.com/axiomatic-systems/Bento4
Language: C++
Files changed: Source/C++/Core/Ap4AtomSampleTable.cpp
Commit date: 2017-09-09 10:42:03 -0700
Commit message: fix for #183

Diff: diff --git a/Source/C++/Core/Ap4AtomSampleTable.cpp b/Source/C++/Core/Ap4AtomSampleTable.cpp
index 77d11191..ec3b0806 100644
--- a/Source/C++/Core/Ap4AtomSampleTable.cpp
+++ b/Source/C++/Core/Ap4AtomSampleTable.cpp
@@ -138,12 +138,14 @@ AP4_AtomSampleTable::GetSample(AP4_Ordinal index,
 
     // set the dts and cts
     AP4_UI32 cts_offset = 0;
     AP4_UI64 dts        = 0;
     AP4_UI32 duration   = 0;
-    result = m_SttsAtom->GetDts(index, dts, &duration);
-    if (AP4_FAILED(result)) return result;
+    if (m_SttsAtom) {
+        result = m_SttsAtom->GetDts(index, dts, &duration);
+        if (AP4_FAILED(result)) return result;
+    }
     sample.SetDuration(duration);
     sample.SetDts(dts);
     if (m_CttsAtom == NULL) {
         sample.SetCts(dts);
     } else {

Vulnerable code:     result = m_SttsAtom->GetDts(index, dts, &duration);
    if (AP4_FAILED(result)) return result;
Fixed code:     if (m_SttsAtom) {
        result = m_SttsAtom->GetDts(index, dts, &duration);
        if (AP4_FAILED(result)) return result;
    }
CVE-2017-14641: NULL Pointer Dereference (CWE-476)
value: A NULL pointer dereference was discovered in the AP4_DataAtom class in MetaData/Ap4MetaData.cpp in Bento4 version 1.5.0-617. The vulnerability causes a segmentation fault and application crash, which leads to remote denial of service.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 6.5
Published: 2017-09-21T17:29Z
Repository: https://github.com/axiomatic-systems/Bento4
Language: C++
Files changed: Source/C++/MetaData/Ap4MetaData.cpp
Commit date: 2017-09-09 10:47:31 -0700
Commit message: fix for #184

Diff: diff --git a/Source/C++/MetaData/Ap4MetaData.cpp b/Source/C++/MetaData/Ap4MetaData.cpp
index 040bcacc..d2a9fbdb 100644
--- a/Source/C++/MetaData/Ap4MetaData.cpp
+++ b/Source/C++/MetaData/Ap4MetaData.cpp
@@ -1256,11 +1256,12 @@ AP4_AtomMetaDataValue::ToInteger() const
 /*----------------------------------------------------------------------
 |   AP4_DataAtom::AP4_DataAtom
 +---------------------------------------------------------------------*/
 AP4_DataAtom::AP4_DataAtom(const AP4_MetaData::Value& value) :
     AP4_Atom(AP4_ATOM_TYPE_DATA, AP4_ATOM_HEADER_SIZE),
-    m_DataType(DATA_TYPE_BINARY)
+    m_DataType(DATA_TYPE_BINARY),
+    m_Source(NULL)
 {
     AP4_MemoryByteStream* memory = new AP4_MemoryByteStream();
     AP4_Size payload_size = 8;
     m_Source = memory;
     
@@ -1332,11 +1333,12 @@ AP4_DataAtom::AP4_DataAtom(const AP4_MetaData::Value& value) :
 
 /*----------------------------------------------------------------------
 |   AP4_DataAtom::AP4_DataAtom
 +---------------------------------------------------------------------*/
 AP4_DataAtom::AP4_DataAtom(AP4_UI32 size, AP4_ByteStream& stream) :
-    AP4_Atom(AP4_ATOM_TYPE_DATA, size)
+    AP4_Atom(AP4_ATOM_TYPE_DATA, size),
+    m_Source(NULL)
 {
     if (size < AP4_ATOM_HEADER_SIZE+8) return;
 
     AP4_UI32 i;
     stream.ReadUI32(i); m_DataType = (DataType)i;

Vulnerable code:     m_DataType(DATA_TYPE_BINARY)
    AP4_Atom(AP4_ATOM_TYPE_DATA, size)
Fixed code:     m_DataType(DATA_TYPE_BINARY),
    m_Source(NULL)
    AP4_Atom(AP4_ATOM_TYPE_DATA, size),
    m_Source(NULL)
CVE-2017-14642: NULL Pointer Dereference (CWE-476)
value: A NULL pointer dereference was discovered in the AP4_HdlrAtom class in Bento4 version 1.5.0-617. The vulnerability causes a segmentation fault and application crash in AP4_StdcFileByteStream::ReadPartial in System/StdC/Ap4StdCFileByteStream.cpp, which leads to remote denial of service.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 6.5
Published: 2017-09-21T17:29Z
Repository: https://github.com/axiomatic-systems/Bento4
Language: C++
Files changed: Source/C++/Core/Ap4HdlrAtom.cpp
Commit date: 2017-09-09 10:56:33 -0700
Commit message: fix for #185

Diff: diff --git a/Source/C++/Core/Ap4HdlrAtom.cpp b/Source/C++/Core/Ap4HdlrAtom.cpp
index 34aefca9..42c117c5 100644
--- a/Source/C++/Core/Ap4HdlrAtom.cpp
+++ b/Source/C++/Core/Ap4HdlrAtom.cpp
@@ -78,13 +78,14 @@ AP4_HdlrAtom::AP4_HdlrAtom(AP4_UI32        size,
     stream.ReadUI32(m_Reserved[0]);
     stream.ReadUI32(m_Reserved[1]);
     stream.ReadUI32(m_Reserved[2]);
     
     // read the name unless it is empty
-    int name_size = size-(AP4_FULL_ATOM_HEADER_SIZE+20);
-    if (name_size == 0) return;
+    if (size < AP4_FULL_ATOM_HEADER_SIZE+20) return;
+    AP4_UI32 name_size = size-(AP4_FULL_ATOM_HEADER_SIZE+20);
     char* name = new char[name_size+1];
+    if (name == NULL) return;
     stream.Read(name, name_size);
     name[name_size] = '\0'; // force a null termination
     // handle a special case: the Quicktime files have a pascal
     // string here, but ISO MP4 files have a C string.
     // we try to detect a pascal encoding and correct it.

Vulnerable code:     int name_size = size-(AP4_FULL_ATOM_HEADER_SIZE+20);
    if (name_size == 0) return;
Fixed code:     if (size < AP4_FULL_ATOM_HEADER_SIZE+20) return;
    AP4_UI32 name_size = size-(AP4_FULL_ATOM_HEADER_SIZE+20);
    if (name == NULL) return;
CVE-2017-14643: Out-of-bounds Read (CWE-125)
value: The AP4_HdlrAtom class in Core/Ap4HdlrAtom.cpp in Bento4 version 1.5.0-617 uses an incorrect character data type, leading to a heap-based buffer over-read and application crash in AP4_BytesToUInt32BE in Core/Ap4Utils.h.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2017-09-21T17:29Z
Repository: https://github.com/axiomatic-systems/Bento4
Language: C++
Files changed: Source/C++/Core/Ap4HdlrAtom.cpp, Source/C++/Core/Ap4StszAtom.cpp
Commit date: 2017-09-09 15:43:50 -0700
Commit message: fix for #187

Diff: diff --git a/Source/C++/Core/Ap4HdlrAtom.cpp b/Source/C++/Core/Ap4HdlrAtom.cpp
index 42c117c5..e784ce66 100644
--- a/Source/C++/Core/Ap4HdlrAtom.cpp
+++ b/Source/C++/Core/Ap4HdlrAtom.cpp
@@ -87,11 +87,11 @@ AP4_HdlrAtom::AP4_HdlrAtom(AP4_UI32        size,
     stream.Read(name, name_size);
     name[name_size] = '\0'; // force a null termination
     // handle a special case: the Quicktime files have a pascal
     // string here, but ISO MP4 files have a C string.
     // we try to detect a pascal encoding and correct it.
-    if (name[0] == name_size-1) {
+    if ((AP4_UI08)name[0] == (AP4_UI08)(name_size-1)) {
         m_HandlerName = name+1;
     } else {
         m_HandlerName = name;
     }
     delete[] name;
diff --git a/Source/C++/Core/Ap4StszAtom.cpp b/Source/C++/Core/Ap4StszAtom.cpp
index 2af9fecf..cc4577a1 100644
--- a/Source/C++/Core/Ap4StszAtom.cpp
+++ b/Source/C++/Core/Ap4StszAtom.cpp
@@ -71,10 +71,17 @@ AP4_StszAtom::AP4_StszAtom(AP4_UI32        size,
     AP4_Atom(AP4_ATOM_TYPE_STSZ, size, version, flags)
 {
     stream.ReadUI32(m_SampleSize);
     stream.ReadUI32(m_SampleCount);
     if (m_SampleSize == 0) { // means that the samples have different sizes
+        // check for overflow
+        if (m_SampleCount > (size-8)/4) {
+            m_SampleCount = 0;
+            return;
+        }
+        
+        // read the entries
         AP4_Cardinal sample_count = m_SampleCount;
         m_Entries.SetItemCount(sample_count);
         unsigned char* buffer = new unsigned char[sample_count*4];
         AP4_Result result = stream.Read(buffer, sample_count*4);
         if (AP4_FAILED(result)) {

Vulnerable code:     if (name[0] == name_size-1) {
Fixed code:     if ((AP4_UI08)name[0] == (AP4_UI08)(name_size-1)) {
        // check for overflow
        if (m_SampleCount > (size-8)/4) {
            m_SampleCount = 0;
            return;
        }
        
        // read the entries
CVE-2016-9243: Improper Input Validation (CWE-20)
value: HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 7.5
Published: 2017-03-27T17:59Z
Repository: https://github.com/pyca/cryptography
Language: Python
Files changed: src/cryptography/hazmat/primitives/kdf/hkdf.py, tests/hazmat/primitives/test_hkdf.py
Commit date: 2016-11-06 10:08:21 +0800
Commit message: Fixes #3211 -- fixed hkdf's output with short length (#3215)


Diff: diff --git a/src/cryptography/hazmat/primitives/kdf/hkdf.py b/src/cryptography/hazmat/primitives/kdf/hkdf.py
index f738bbdc..82ed9b1c 100644
--- a/src/cryptography/hazmat/primitives/kdf/hkdf.py
+++ b/src/cryptography/hazmat/primitives/kdf/hkdf.py
@@ -89,11 +89,11 @@ class HKDFExpand(object):
 
     def _expand(self, key_material):
         output = [b""]
         counter = 1
 
-        while (self._algorithm.digest_size // 8) * len(output) < self._length:
+        while self._algorithm.digest_size * (len(output) - 1) < self._length:
             h = hmac.HMAC(key_material, self._algorithm, backend=self._backend)
             h.update(output[-1])
             h.update(self._info)
             h.update(six.int2byte(counter))
             output.append(h.finalize())
diff --git a/tests/hazmat/primitives/test_hkdf.py b/tests/hazmat/primitives/test_hkdf.py
index e33529c9..a05fd752 100644
--- a/tests/hazmat/primitives/test_hkdf.py
+++ b/tests/hazmat/primitives/test_hkdf.py
@@ -140,10 +140,21 @@ class TestHKDF(object):
                 backend=backend
             )
 
             hkdf.verify(b"foo", u"bar")
 
+    def test_derive_short_output(self, backend):
+        hkdf = HKDF(
+            hashes.SHA256(),
+            4,
+            salt=None,
+            info=None,
+            backend=backend
+        )
+
+        assert hkdf.derive(b"\x01" * 16) == b"gJ\xfb{"
+
 
 @pytest.mark.requires_backend_interface(interface=HMACBackend)
 class TestHKDFExpand(object):
     def test_derive(self, backend):
         prk = binascii.unhexlify(

Vulnerable code:         while (self._algorithm.digest_size // 8) * len(output) < self._length:
Fixed code:         while self._algorithm.digest_size * (len(output) - 1) < self._length:
    def test_derive_short_output(self, backend):
        hkdf = HKDF(
            hashes.SHA256(),
            4,
            salt=None,
            info=None,
            backend=backend
        )

        assert hkdf.derive(b"\x01" * 16) == b"gJ\xfb{"
CVE-2018-17292: Out-of-bounds Read (CWE-125)
value: An issue was discovered in WAVM before 2018-09-16. The loadModule function in Include/Inline/CLI.h lacks checking of the file length before a file magic comparison, allowing attackers to cause a Denial of Service (application crash caused by out-of-bounds read) by crafting a file that has fewer than 4 bytes.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2018-09-21T07:29Z
Repository: https://github.com/WAVM/WAVM
Language: C
Files changed: Include/Inline/CLI.h
Commit date: 2018-09-16 08:20:54 -0400
Commit message: Fix out-of-bounds array access when passing a <4 byte input file to wavm or wavm-compile

Diff: diff --git a/Include/Inline/CLI.h b/Include/Inline/CLI.h
index 2cd490c..05d0c61 100644
--- a/Include/Inline/CLI.h
+++ b/Include/Inline/CLI.h
@@ -142,11 +142,11 @@ inline bool loadModule(const char* filename, IR::Module& outModule)
 	// Read the specified file into an array.
 	std::vector<U8> fileBytes;
 	if(!loadFile(filename, fileBytes)) { return false; }
 
 	// If the file starts with the WASM binary magic number, load it as a binary irModule.
-	if(*(U32*)fileBytes.data() == 0x6d736100)
+	if(fileBytes.size() >= 4 && *(U32*)fileBytes.data() == 0x6d736100)
 	{ return loadBinaryModule(fileBytes.data(), fileBytes.size(), outModule); }
 	else
 	{
 		// Make sure the WAST file is null terminated.
 		fileBytes.push_back(0);

Vulnerable code: 	if(*(U32*)fileBytes.data() == 0x6d736100)
Fixed code: 	if(fileBytes.size() >= 4 && *(U32*)fileBytes.data() == 0x6d736100)
CVE-2018-17293: NULL Pointer Dereference (CWE-476)
value: An issue was discovered in WAVM before 2018-09-16. The run function in Programs/wavm/wavm.cpp does not check whether there is Emscripten memory to store the command-line arguments passed by the input WebAssembly file's main function, which allows attackers to cause a denial of service (application crash by NULL pointer dereference) or possibly have unspecified other impact by crafting certain WebAssembly files.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 8.8
Published: 2018-09-21T07:29Z
Repository: https://github.com/WAVM/WAVM
Language: C++
Files changed: Programs/wavm/wavm.cpp
Commit date: 2018-09-16 09:55:34 -0400
Commit message: Fix dereferencing null pointer when running wavm with WebAssembly main function that takes command-line arguments but no Emscripten memory to write them to

Diff: diff --git a/Programs/wavm/wavm.cpp b/Programs/wavm/wavm.cpp
index a8d46968..b21e4103 100644
--- a/Programs/wavm/wavm.cpp
+++ b/Programs/wavm/wavm.cpp
@@ -248,25 +248,27 @@ static int run(const CommandLineOptions& options)
 	std::vector<Value> invokeArgs;
 	if(!options.functionName)
 	{
 		if(functionType.params().size() == 2)
 		{
-			MemoryInstance* defaultMemory = Runtime::getDefaultMemory(moduleInstance);
-			if(!defaultMemory)
+			if(!emscriptenInstance)
 			{
 				Log::printf(
 					Log::error,
 					"Module does not declare a default memory object to put arguments in.\n");
 				return EXIT_FAILURE;
 			}
+			else
+			{
+				std::vector<const char*> argStrings;
+				argStrings.push_back(options.filename);
+				char** args = options.args;
+				while(*args) { argStrings.push_back(*args++); };
 
-			std::vector<const char*> argStrings;
-			argStrings.push_back(options.filename);
-			char** args = options.args;
-			while(*args) { argStrings.push_back(*args++); };
-
-			Emscripten::injectCommandArgs(emscriptenInstance, argStrings, invokeArgs);
+				wavmAssert(emscriptenInstance);
+				Emscripten::injectCommandArgs(emscriptenInstance, argStrings, invokeArgs);
+			}
 		}
 		else if(functionType.params().size() > 0)
 		{
 			Log::printf(Log::error,
 						"WebAssembly function requires %" PRIu64

Vulnerable code: 			MemoryInstance* defaultMemory = Runtime::getDefaultMemory(moduleInstance);
			if(!defaultMemory)
			std::vector<const char*> argStrings;
			argStrings.push_back(options.filename);
			char** args = options.args;
			while(*args) { argStrings.push_back(*args++); };

			Emscripten::injectCommandArgs(emscriptenInstance, argStrings, invokeArgs);
Fixed code: 			if(!emscriptenInstance)
			else
			{
				std::vector<const char*> argStrings;
				argStrings.push_back(options.filename);
				char** args = options.args;
				while(*args) { argStrings.push_back(*args++); };
				wavmAssert(emscriptenInstance);
				Emscripten::injectCommandArgs(emscriptenInstance, argStrings, invokeArgs);
			}
CVE-2024-39326: Insufficient Information (NVD-CWE-noinfo)
value: SkillTree is a micro-learning gamification platform. Prior to version 2.12.6, the endpoint 
`/admin/projects/{projectname}/skills/{skillname}/video` (and probably others) is open to a cross-site request forgery (CSRF) vulnerability. Due to the endpoint being CSRFable e.g POST request, supports a content type that can be exploited (multipart file upload), makes a state change and has no CSRF mitigations in place (samesite flag, CSRF token). It is possible to perform a CSRF attack against a logged in admin account, allowing an attacker that can target a logged in admin of Skills Service to modify the videos, captions, and text of the skill. Version 2.12.6 contains a patch for this issue.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-07-02T21:15Z
Repository: https://github.com/NationalSecurityAgency/skills-service
Language: Unknown
Commit date: 2024-06-21 13:09:23 -0400
Commit message: Merge pull request #2600 from NationalSecurityAgency/csrf_fix

Csrf fix
CVE-2022-41920: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Lancet is a general utility library for the go programming language. Affected versions are subject to a ZipSlip issue when using the fileutil package to unzip files. This issue has been addressed and a fix will be included in versions 2.1.10 and 1.3.4. Users are advised to upgrade. There are no known workarounds for this issue.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 8.8
Published: 2022-11-17T18:15Z
Repository: https://github.com/duke-git/lancet
Language: Go
Files changed: fileutil/file.go
Commit date: 2022-11-16 16:04:38 +0800
Commit message: fix: issue#62: fix ZipSlip bug

Diff: diff --git a/fileutil/file.go b/fileutil/file.go
index 743bbae..ef77c62 100644
--- a/fileutil/file.go
+++ b/fileutil/file.go
@@ -212,11 +212,10 @@ func Zip(fpath string, destPath string) error {
 	return nil
 }
 
 // UnZip unzip the file and save it to destPath
 func UnZip(zipFile string, destPath string) error {
-	destPath = filepath.Clean(destPath) + string(os.PathSeparator)
 
 	zipReader, err := zip.OpenReader(zipFile)
 	if err != nil {
 		return err
 	}
@@ -224,12 +223,13 @@ func UnZip(zipFile string, destPath string) error {
 
 	for _, f := range zipReader.File {
 		path := filepath.Join(destPath, f.Name)
 
 		//issue#62: fix ZipSlip bug
-		if !strings.HasPrefix(path, destPath) {
-			return fmt.Errorf("%s: illegal file path", path)
+		path, err := safeFilepathJoin(destPath, f.Name)
+		if err != nil {
+			return err
 		}
 
 		if f.FileInfo().IsDir() {
 			os.MkdirAll(path, os.ModePerm)
 		} else {
@@ -256,10 +256,21 @@ func UnZip(zipFile string, destPath string) error {
 		}
 	}
 	return nil
 }
 
+func safeFilepathJoin(path1, path2 string) (string, error) {
+	relPath, err := filepath.Rel(".", path2)
+	if err != nil || strings.HasPrefix(relPath, "..") {
+		return "", fmt.Errorf("(zipslip) filepath is unsafe %q: %v", path2, err)
+	}
+	if path1 == "" {
+		path1 = "."
+	}
+	return filepath.Join(path1, filepath.Join("/", relPath)), nil
+}
+
 // IsLink checks if a file is symbol link or not
 func IsLink(path string) bool {
 	fi, err := os.Lstat(path)
 	if err != nil {
 		return false

Vulnerable code: 	destPath = filepath.Clean(destPath) + string(os.PathSeparator)
		if !strings.HasPrefix(path, destPath) {
			return fmt.Errorf("%s: illegal file path", path)
Fixed code: 		path, err := safeFilepathJoin(destPath, f.Name)
		if err != nil {
			return err
func safeFilepathJoin(path1, path2 string) (string, error) {
	relPath, err := filepath.Rel(".", path2)
	if err != nil || strings.HasPrefix(relPath, "..") {
		return "", fmt.Errorf("(zipslip) filepath is unsafe %q: %v", path2, err)
	}
	if path1 == "" {
		path1 = "."
	}
	return filepath.Join(path1, filepath.Join("/", relPath)), nil
}
CVE-2014-8990: Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
value: default-rsyncssh.lua in Lsyncd 2.1.5 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a filename.
CWE description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Published: 2014-12-05T16:59Z
Repository: https://github.com/axkibe/lsyncd
Language: Lua
Files changed: default-rsyncssh.lua
Commit date: 2014-11-26 09:01:25 +0100
Commit message: Properly sanitize mv parameters (CVE-2014-8990)

When using -rsyncssh option, some filenames
could -in addition of not syncing correctly-
crash the service and execute arbitrary commands
under the credentials of the remote user.

These issues have been assigned CVE-2014-8990

This commit fixes the incomplete and lua5.2-incompatible
sanitization performed by 18f02ad0

Signed-off-by: Sven Schwedas <sven.schwedas@tao.at>

Diff: diff --git a/default-rsyncssh.lua b/default-rsyncssh.lua
index 589837d..3f3261d 100644
--- a/default-rsyncssh.lua
+++ b/default-rsyncssh.lua
@@ -75,12 +75,14 @@ rsyncssh.action = function( inlet )
 	local config = inlet.getConfig( )
 
 	-- makes move local on target host
 	-- if the move fails, it deletes the source
 	if event.etype == 'Move' then
-		local path1 = event.path:gsub ('"', '\\"'):gsub ('`', '\\`'):gsub ('%$','\\%$')
-		local path2 = event2.path:gsub ('"', '\\"'):gsub ('`', '\\`'):gsub ('%$','\\%$')
+		local path1 = config.targetdir .. event.path
+		local path2 = config.targetdir .. event2.path
+		path1 = "'" .. path1:gsub ('\'', '\'"\'"\'') .. "'"
+		path2 = "'" .. path2:gsub ('\'', '\'"\'"\'') .. "'"
 
 		log(
 			'Normal',
 			'Moving ',
 			event.path,
@@ -92,14 +94,14 @@ rsyncssh.action = function( inlet )
 			event,
 			config.ssh.binary,
 			config.ssh._computed,
 			config.host,
 			'mv',
-			'\"' .. config.targetdir .. path1 .. '\"',
-			'\"' .. config.targetdir .. path2 .. '\"',
+			path1,
+			path2,
 			'||', 'rm', '-rf',
-			'\"' .. config.targetdir .. path1 .. '\"'
+			path1
 		)
 
 		return
 	end
 

Vulnerable code: 		local path1 = event.path:gsub ('"', '\\"'):gsub ('`', '\\`'):gsub ('%$','\\%$')
		local path2 = event2.path:gsub ('"', '\\"'):gsub ('`', '\\`'):gsub ('%$','\\%$')
			'\"' .. config.targetdir .. path1 .. '\"',
			'\"' .. config.targetdir .. path2 .. '\"',
			'\"' .. config.targetdir .. path1 .. '\"'
Fixed code: 		local path1 = config.targetdir .. event.path
		local path2 = config.targetdir .. event2.path
		path1 = "'" .. path1:gsub ('\'', '\'"\'"\'') .. "'"
		path2 = "'" .. path2:gsub ('\'', '\'"\'"\'') .. "'"
			path1,
			path2,
			path1
CVE-2014-8990: Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
value: default-rsyncssh.lua in Lsyncd 2.1.5 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a filename.
CWE description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Published: 2014-12-05T16:59Z
Repository: https://github.com/axkibe/lsyncd
Language: Lua
Files changed: default-rsyncssh.lua
Commit date: 2014-10-29 13:32:20 +0100
Commit message: Sanitize mv arguments:

1. Fixes crashes on file names containing `, $ or "
2. Also prevents shell execution of ``, $() … in file names, which can be
   used to gain remote shell access as lsyncd's (target) user.

Diff: diff --git a/default-rsyncssh.lua b/default-rsyncssh.lua
index 58b2af0..589837d 100644
--- a/default-rsyncssh.lua
+++ b/default-rsyncssh.lua
@@ -75,10 +75,12 @@ rsyncssh.action = function( inlet )
 	local config = inlet.getConfig( )
 
 	-- makes move local on target host
 	-- if the move fails, it deletes the source
 	if event.etype == 'Move' then
+		local path1 = event.path:gsub ('"', '\\"'):gsub ('`', '\\`'):gsub ('%$','\\%$')
+		local path2 = event2.path:gsub ('"', '\\"'):gsub ('`', '\\`'):gsub ('%$','\\%$')
 
 		log(
 			'Normal',
 			'Moving ',
 			event.path,
@@ -90,14 +92,14 @@ rsyncssh.action = function( inlet )
 			event,
 			config.ssh.binary,
 			config.ssh._computed,
 			config.host,
 			'mv',
-			'\"' .. config.targetdir .. event.path .. '\"',
-			'\"' .. config.targetdir .. event2.path .. '\"',
+			'\"' .. config.targetdir .. path1 .. '\"',
+			'\"' .. config.targetdir .. path2 .. '\"',
 			'||', 'rm', '-rf',
-			'\"' .. config.targetdir .. event.path .. '\"'
+			'\"' .. config.targetdir .. path1 .. '\"'
 		)
 
 		return
 	end
 

Vulnerable code: 			'\"' .. config.targetdir .. event.path .. '\"',
			'\"' .. config.targetdir .. event2.path .. '\"',
			'\"' .. config.targetdir .. event.path .. '\"'
Fixed code: 		local path1 = event.path:gsub ('"', '\\"'):gsub ('`', '\\`'):gsub ('%$','\\%$')
		local path2 = event2.path:gsub ('"', '\\"'):gsub ('`', '\\`'):gsub ('%$','\\%$')
			'\"' .. config.targetdir .. path1 .. '\"',
			'\"' .. config.targetdir .. path2 .. '\"',
			'\"' .. config.targetdir .. path1 .. '\"'
CVE-2015-10015: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability, which was classified as critical, has been found in glidernet ogn-live. This issue affects some unknown processing. The manipulation leads to sql injection. The patch is named bc0f19965f760587645583b7624d66a260946e01. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217487.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-05T15:15Z
Repository: https://github.com/glidernet/ogn-live
Language: Unknown
Commit date: 2015-02-07 14:35:43 +0100
Commit message: Merge pull request #11 from dbursem/master

Fixed SQL injection vulnerabilities by using PDO statements
CVE-2021-41274: Cross-Site Request Forgery (CSRF) (CWE-352)
value: solidus_auth_devise provides authentication services for the Solidus webstore framework, using the Devise gem. In affected versions solidus_auth_devise is subject to a CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of `solidus_auth_devise` are affected if `protect_from_forgery` method is both: Executed whether as: A `before_action` callback (the default) or A `prepend_before_action` (option `prepend: true` given) before the `:load_object` hook in `Spree::UserController` (most likely order to find). Configured to use `:null_session` or `:reset_session` strategies (`:null_session` is the default in case the no strategy is given, but `rails --new` generated skeleton use `:exception`). Users should promptly update to `solidus_auth_devise` version `2.5.4`. Users unable to update should if possible, change their strategy to `:exception`. Please see the linked GHSA for more workaround details.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2021-11-17T20:15Z
Repository: https://github.com/solidusio/solidus_auth_devise
Language: Ruby
Files changed: lib/controllers/frontend/spree/users_controller.rb
Commit date: 2021-11-17 11:06:11 +0100
Commit message: Merge pull request from GHSA-xm34-v85h-9pg2

Fix account takeover through CSRF attack
Diff: diff --cc lib/controllers/frontend/spree/users_controller.rb
index 91c86d0,793d6e0..b6f31b4
--- a/lib/controllers/frontend/spree/users_controller.rb
+++ b/lib/controllers/frontend/spree/users_controller.rb
@@@ -1,13 -1,15 +1,13 @@@
  # frozen_string_literal: true
  
  class Spree::UsersController < Spree::StoreController
    skip_before_action :set_current_order, only: :show, raise: false
-   prepend_before_action :load_object, only: [:show, :edit, :update]
    prepend_before_action :authorize_actions, only: :new
  
 -  include Spree::Core::ControllerHelpers
 -
    def show
+     load_object
      @orders = @user.orders.complete.order('completed_at desc')
    end
  
    def create
      @user = Spree::User.new(user_params)

Vulnerable code:    prepend_before_action :load_object, only: [:show, :edit, :update]
Fixed code:      load_object
CVE-2023-52079: Uncontrolled Recursion (CWE-674)
value: msgpackr is a fast MessagePack NodeJS/JavaScript implementation. Prior to 1.10.1, when decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop. The fix is available in v1.10.1.  
Exploits seem to require structured cloning, replacing the 0x70 extension with your own (that throws an error or does something other than recursive referencing) should mitigate the issue.
CWE description: The product does not properly control the amount of recursion that takes place,  consuming excessive resources, such as allocated memory or the program stack.
CVSS v3 base score: 6.5
Published: 2023-12-28T16:16Z
Repository: https://github.com/kriszyp/msgpackr
Language: JavaScript
Files changed: unpack.js
Commit date: 2023-12-25 19:59:59 -0700
Commit message: Ensure that string conversion doesn't recursively join or execute code

Diff: diff --git a/unpack.js b/unpack.js
index b019a02..a9af6f0 100644
--- a/unpack.js
+++ b/unpack.js
@@ -912,11 +912,11 @@ function readKey() {
 			return srcString.slice(position - srcStringStart, (position += length) - srcStringStart)
 		else if (!(srcStringEnd == 0 && srcEnd < 180))
 			return readFixedString(length)
 	} else { // not cacheable, go back and do a standard read
 		position--
-		return read().toString()
+		return asSafeString(read())
 	}
 	let key = ((length << 5) ^ (length > 1 ? dataView.getUint16(position) : length > 0 ? src[position] : 0)) & 0xfff
 	let entry = keyCache[key]
 	let checkPosition = position
 	let end = position + length - 3
@@ -964,13 +964,19 @@ function readKey() {
 	if (string != null)
 		return entry.string = string
 	return entry.string = readFixedString(length)
 }
 
+function asSafeString(property) {
+	if (typeof property === 'string') return property;
+	if (typeof property === 'number') return property.toString();
+	throw new Error('Invalid property type for record', typeof property);
+}
 // the registration of the record definition extension (as "r")
 const recordDefinition = (id, highByte) => {
-	let structure = read().map(property => property.toString()) // ensure that all keys are strings and that the array is mutable
+	let structure = read().map(asSafeString) // ensure that all keys are strings and
+	// that the array is mutable
 	let firstByte = id
 	if (highByte !== undefined) {
 		id = id < 32 ? -((highByte << 5) + id) : ((highByte << 5) + id)
 		structure.highByte = highByte
 	}

Vulnerable code: 		return read().toString()
	let structure = read().map(property => property.toString()) // ensure that all keys are strings and that the array is mutable
Fixed code: 		return asSafeString(read())
function asSafeString(property) {
	if (typeof property === 'string') return property;
	if (typeof property === 'number') return property.toString();
	throw new Error('Invalid property type for record', typeof property);
}
	let structure = read().map(asSafeString) // ensure that all keys are strings and
	// that the array is mutable
CVE-2021-32782: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content-Security-Policy. It is recommended that the Nextcloud Circles application is upgraded to 0.21.3, 0.20.10 or 0.19.14 to resolve this issue. As a workaround users may use a browser that has support for Content-Security-Policy. A notable exemption is Internet Explorer which does not support CSP properly.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2021-09-07T20:15Z
Repository: https://github.com/nextcloud/circles
Language: JavaScript
Files changed: js/files/circles.files.list.js
Commit date: 2021-07-01 10:49:43 -0100
Commit message: escapeHTML when browsing shared files

Signed-off-by: Maxence Lange <maxence@artificial-owl.com>
Diff: diff --git a/js/files/circles.files.list.js b/js/files/circles.files.list.js
index 2da4417c..78fac568 100644
--- a/js/files/circles.files.list.js
+++ b/js/files/circles.files.list.js
@@ -20,10 +20,21 @@
  *
  * You should have received a copy of the GNU Affero General Public License
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  *
  */
+
+
+function escapeHTML(text) {
+	return text.toString()
+		.split('&').join('&amp;')
+		.split('<').join('&lt;')
+		.split('>').join('&gt;')
+		.split('"').join('&quot;')
+		.split('\'').join('&#039;')
+}
+
 (function() {
 	/**
 	 * @class OCA.Circles.FileList
 	 * @augments OCA.Files.FileList
 	 *
@@ -122,16 +133,15 @@
 						callback([]);
 					}
 				},
 
 				formatResult: function (circle) {
-					return circle.name;
+					return escapeHTML(circle.name);
 				},
 
 				formatSelection: function (circle) {
-					return circle.name;
-					//return OC.SystemTags.getDescriptiveTag(tag)[0].outerHTML;
+					return escapeHTML(circle.name);
 				},
 
 				sortResults: function(results) {
 					results.sort(function(a, b) {
 						var aLastUsed = self._lastUsedTags.indexOf(a.id);

Vulnerable code: 					return circle.name;
					return circle.name;
					//return OC.SystemTags.getDescriptiveTag(tag)[0].outerHTML;
Fixed code: 

function escapeHTML(text) {
	return text.toString()
		.split('&').join('&amp;')
		.split('<').join('&lt;')
		.split('>').join('&gt;')
		.split('"').join('&quot;')
		.split('\'').join('&#039;')
}

					return escapeHTML(circle.name);
					return escapeHTML(circle.name);
CVE-2012-6084: Other (NVD-CWE-Other)
value: modules/m_capab.c in (1) ircd-ratbox before 3.0.8 and (2) Charybdis before 3.4.2 does not properly support capability negotiation during server handshakes, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a malformed request.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Published: 2013-01-01T15:55Z
Repository: https://github.com/atheme/charybdis
Language: C
Files changed: modules/m_capab.c
Commit date: 2012-12-31 13:13:05 -0600
Commit message: m_capab: fix a possible remote crash triggered by the CAPAB parsing code.

Diff: diff --git a/modules/m_capab.c b/modules/m_capab.c
index 54e9a53..b03fb3f 100644
--- a/modules/m_capab.c
+++ b/modules/m_capab.c
@@ -36,11 +36,11 @@
 static int mr_capab(struct Client *, struct Client *, int, const char **);
 static int me_gcap(struct Client *, struct Client *, int, const char **);
 
 struct Message capab_msgtab = {
 	"CAPAB", 0, 0, 0, MFLG_SLOW | MFLG_UNREG,
-	{{mr_capab, 0}, mg_ignore, mg_ignore, mg_ignore, mg_ignore, mg_ignore}
+	{{mr_capab, 2}, mg_ignore, mg_ignore, mg_ignore, mg_ignore, mg_ignore}
 };
 struct Message gcap_msgtab = {
 	"GCAP", 0, 0, 0, MFLG_SLOW,
 	{mg_ignore, mg_ignore, mg_ignore, mg_ignore, {me_gcap, 2}, mg_ignore}
 };

Vulnerable code: 	{{mr_capab, 0}, mg_ignore, mg_ignore, mg_ignore, mg_ignore, mg_ignore}
Fixed code: 	{{mr_capab, 2}, mg_ignore, mg_ignore, mg_ignore, mg_ignore, mg_ignore}