CVE-2015-10025: Improper Resource Shutdown or Release (CWE-404)
value: A vulnerability has been found in luelista miniConf up to 1.7.6 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file miniConf/MessageView.cs of the component URL Scanning. The manipulation leads to denial of service. Upgrading to version 1.7.7 and 1.8.0 is able to address this issue. The patch is named c06c2e5116c306e4e1bc79779f0eda2d1182f655. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217615.
CWE description: The product does not release or incorrectly releases a resource before it is made available for re-use.
CVSS v3 base score: 7.5
Published: 2023-01-07T13:15Z
Repository: https://github.com/luelista/miniConf
Language: C#
Files changed: Setups/codesign-and-make-setup.bat, miniConf/Form1.cs, miniConf/MessageView.cs, miniConf/Properties/AssemblyInfo.cs
Commit date: 2015-08-13 13:26:16 +0200
Commit message: Version 1.7.7
behebt Denial of Service Bug durch Fehler in URL-scanning Regex

Diff: diff --git a/Setups/codesign-and-make-setup.bat b/Setups/codesign-and-make-setup.bat
index 9f16d80..d2a0e26 100644
--- a/Setups/codesign-and-make-setup.bat
+++ b/Setups/codesign-and-make-setup.bat
@@ -42,11 +42,11 @@ echo Step 4 - Code Sign Installer...
 CALL codesign-dragdrop.bat %INSTALLER%
 
 
 echo.
 echo Step 4 - Uploading as minefield...
-"C:\Program Files (x86)\Git\bin\scp.exe" %INSTALLER% maxweller@cherry.luelistan.net:/srv/hosts/max-weller.de/downloads.max-weller.de/miniconf/miniconf-minefield-setup.exe
+"C:\Program Files (x86)\Git\bin\scp.exe" %INSTALLER% maxweller@oak.teamwiki.net:/var/www/hosts/downloads.max-weller.de/miniconf/miniconf-minefield-setup.exe
 
 
 
 echo.
 echo Done.
diff --git a/Setups/miniconf-1.7.7.exe b/Setups/miniconf-1.7.7.exe
new file mode 100644
index 0000000..9558707
Binary files /dev/null and b/Setups/miniconf-1.7.7.exe differ
diff --git a/miniConf/Form1.cs b/miniConf/Form1.cs
index b24c3dd..4a092c7 100755
--- a/miniConf/Form1.cs
+++ b/miniConf/Form1.cs
@@ -410,15 +410,17 @@ namespace miniConf {
                                 WindowHelper.ShowWindow(popupWindow.Handle, WindowHelper.SW_SHOWNOACTIVATE); //popupWindow.Show();
                                 popupWindow.updateRooms(rooms);
                             }
                             if (enableNotificationsToolStripMenuItem.Checked && !String.IsNullOrEmpty(messageBody)) {
                                 if (ApplicationPreferences.WineTricks) {
+                                    Console.WriteLine("Displaying notification via notify-send ...");
                                     ProcessStartInfo psi = new ProcessStartInfo();
                                     psi.FileName = "/usr/bin/notify-send";
                                     psi.Arguments = "\"Nachricht von " + msg.From.ToString() + "\" \"" + messageBody + "\"";
                                     Process.Start(psi);
                                 } else {
+                                    Console.WriteLine("Showing balloon tip: " + msg.From.Resource + " in " + msg.From.User);
                                     balloonRoom = msg.From.Bare;
                                     notifyIcon1.ShowBalloonTip(30000, msg.From.Resource + " in " + msg.From.User + ":", messageBody, ToolTipIcon.Info);
                                 }
                             }
 
diff --git a/miniConf/MessageView.cs b/miniConf/MessageView.cs
index 60fbc2b..5d7ec39 100644
--- a/miniConf/MessageView.cs
+++ b/miniConf/MessageView.cs
@@ -168,11 +168,11 @@ namespace miniConf {
             text = text.Replace("&", "&amp;");
             text = text.Replace("<", "&lt;");
             if (!String.IsNullOrEmpty(highlightString)) text = Regex.Replace(text, highlightString, "<em>$0</em>");
             text = text.Replace("\n", "\n<br>");
             var imageLink = Regex.Match(text, "https?://[\\w.-]+/[\\w_.,/+?&%$!=)(\\[\\]{}-]*\\.(png|jpg|gif|webp)");
-            text = Regex.Replace(text, "(?i)\\b((?:[a-z][\\w-]+:(?:/{1,3}|[a-z0-9%])|www\\d{0,3}[.]|[a-z0-9.\\-]+[.][a-z]{2,4}/)(?:[^\\s()<>]+|\\(([^\\s()<>]+|(\\([^\\s()<>]+\\)))*\\))+(?:\\(([^\\s()<>]+|(\\([^\\s()<>]+\\)))*\\)|[^\\s`!()\\[\\]{};:'\".,<>?«»“”‘’]))",
+            text = Regex.Replace(text, "(?i)\\b((?:[a-z][\\w-]+:(?:/{1,3})|www\\d{0,3}[.]|[a-z0-9.\\-]+[.][a-z]{2,4}/)(?:[^\\s()<>]+|\\(([^\\s()<>]+|(\\([^\\s()<>]+\\)))*\\))+(?:\\(([^\\s()<>]+|(\\([^\\s()<>]+\\)))*\\)|[^\\s`!()\\[\\]{};:'\".,<>?«»“”‘’]))",
                          (match) => ("<a href=\"" + match.Value.Replace("\"", "&quot;") + "\">" + match.Value + "</a>"));
             if (imagePreview && imageLink.Success) {
                 string link = imageLink.Value; 
                 //HACK HACK HACK
                 if (link.EndsWith(".webp")) link = link.Replace(".webp", ".png");
diff --git a/miniConf/Properties/AssemblyInfo.cs b/miniConf/Properties/AssemblyInfo.cs
index e645bb5..589b35a 100755
--- a/miniConf/Properties/AssemblyInfo.cs
+++ b/miniConf/Properties/AssemblyInfo.cs
@@ -30,7 +30,7 @@ using System.Runtime.InteropServices;
 //      Revision
 //
 // Sie können alle Werte angeben oder die standardmäßigen Build- und Revisionsnummern 
 // übernehmen, indem Sie "*" eingeben:
 // [assembly: AssemblyVersion("1.0.*")]
-[assembly: AssemblyVersion("1.7.6.4")]
-[assembly: AssemblyFileVersion("1.7.6.4")]
+[assembly: AssemblyVersion("1.7.7.0")]
+[assembly: AssemblyFileVersion("1.7.7.0")]

Vulnerable code: "C:\Program Files (x86)\Git\bin\scp.exe" %INSTALLER% maxweller@cherry.luelistan.net:/srv/hosts/max-weller.de/downloads.max-weller.de/miniconf/miniconf-minefield-setup.exe
            text = Regex.Replace(text, "(?i)\\b((?:[a-z][\\w-]+:(?:/{1,3}|[a-z0-9%])|www\\d{0,3}[.]|[a-z0-9.\\-]+[.][a-z]{2,4}/)(?:[^\\s()<>]+|\\(([^\\s()<>]+|(\\([^\\s()<>]+\\)))*\\))+(?:\\(([^\\s()<>]+|(\\([^\\s()<>]+\\)))*\\)|[^\\s`!()\\[\\]{};:'\".,<>?«»“”‘’]))",
[assembly: AssemblyVersion("1.7.6.4")]
[assembly: AssemblyFileVersion("1.7.6.4")]
Fixed code: "C:\Program Files (x86)\Git\bin\scp.exe" %INSTALLER% maxweller@oak.teamwiki.net:/var/www/hosts/downloads.max-weller.de/miniconf/miniconf-minefield-setup.exe
                                    Console.WriteLine("Displaying notification via notify-send ...");
                                    Console.WriteLine("Showing balloon tip: " + msg.From.Resource + " in " + msg.From.User);
            text = Regex.Replace(text, "(?i)\\b((?:[a-z][\\w-]+:(?:/{1,3})|www\\d{0,3}[.]|[a-z0-9.\\-]+[.][a-z]{2,4}/)(?:[^\\s()<>]+|\\(([^\\s()<>]+|(\\([^\\s()<>]+\\)))*\\))+(?:\\(([^\\s()<>]+|(\\([^\\s()<>]+\\)))*\\)|[^\\s`!()\\[\\]{};:'\".,<>?«»“”‘’]))",
[assembly: AssemblyVersion("1.7.7.0")]
[assembly: AssemblyFileVersion("1.7.7.0")]