aswin1906/github-advisory-2021.csv huggingface dataset:
Division by 0 in inplace operations
Published: 2021-08-25T14:42:44Z
Aliases: CVE-2021-37660

### Impact
An attacker can cause a floating point exception by calling inplace operations with crafted arguments that would result in a division by 0:

```python
import tensorflow as tf

tf.raw_ops.InplaceSub(x=[],i=[-99,-1,-1],v=[1,1,1])
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/inplace_ops.cc#L283) has a logic error: it should skip processing if `x` and `v` are empty but the code uses `||` instead of `&&`.

### Patches
We have patched the issue in GitHub commit [e86605c0a336c088b638da02135ea6f9f6753618](https://github.com/tensorflow/tensorflow/commit/e86605c0a336c088b638da02135ea6f9f6753618).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Read on uninitialized buffer in postscript
Published: 2021-08-25T20:52:23Z
Aliases: CVE-2021-26953

Affected versions of this crate passes an uninitialized buffer to a user-provided Read implementation.

Arbitrary Read implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer. Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.

This flaw was fixed in commit `8026286` by zero-initializing the buffer before handing to a user-provided Read.
Potential memory corruption in arrayfire
Published: 2021-08-25T20:43:26Z
Aliases: CVE-2018-20998

The attribute repr() added to enums to be compatible with C-FFI caused memory corruption on MSVC toolchain.

arrayfire crates <= version 3.5.0 do not have this issue when used with Rust versions 1.27 or earlier. The issue only started to appear since Rust version 1.28.

The issue seems to be interlinked with which version of Rust is being used.

The issue was fixed in crate 3.6.0.
Reference counting error in pyo3
Published: 2021-08-25T20:49:52Z
Aliases: CVE-2020-35917

An issue was discovered in the pyo3 crate before 0.12.4 for Rust. There is a reference-counting error and use-after-free in From<Py<T>>.
Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault
Published: 2021-08-02T17:11:41Z
Aliases: CVE-2020-16250

HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1..
Cachet vulnerable to new line injection during configuration edition
Published: 2021-08-30T16:11:24Z
Aliases: CVE-2021-39172

### Impact

Authenticated users, regardless of their privileges (_User_ or _Admin_), can exploit a new line injection in the configuration edition feature (e.g. mail settings) and gain arbitrary code execution on the server.

### Patches

This issue was addressed by improving `UpdateConfigCommandHandler` and preventing the use of new lines characters in new configuration values.

### Workarounds

Only allow trusted source IP addresses to access to the administration dashboard.

### References

- https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection

### For more information

If you have any questions or comments about this advisory, you can contact:
- The original reporters, by sending an email to vulnerability.research [at] sonarsource.com;
- The maintainers, by opening an issue on this repository.
Double free in alpm-rs
Published: 2021-08-25T20:48:59Z
Aliases: CVE-2020-35885

An issue was discovered in the alpm-rs crate through 2020-08-20 for Rust. StrcCtx performs improper memory deallocation.
Uninitialized memory use in generator
Published: 2021-08-25T20:58:25Z
Aliases: CVE-2019-16144

An issue was discovered in the generator crate before 0.6.18 for Rust. Uninitialized memory is used by Scope, done, and yield_ during API calls.
Double free in algorithmica
Published: 2021-08-25T21:01:52Z
Aliases: CVE-2021-31996

An issue was discovered in the algorithmica crate through 2021-03-07 for Rust. In the affected versions of this crate, `merge_sort::merge()` wildly duplicates and drops ownership of `T` without guarding against double-free. Due to such implementation, simply invoking `merge_sort::merge()` on `Vec<T: Drop>` can cause **double free** bugs.
Improper Handling of Length Parameter Inconsistency in Compress
Published: 2021-08-02T16:55:15Z
Aliases: CVE-2021-35516

When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
Data races in max7301
Published: 2021-08-25T20:59:22Z
Aliases: CVE-2020-36472

The `ImmediateIO` and `TransactionalIO` types implement `Sync` for all contained
`Expander<EI>` types regardless of if the `Expander` itself is safe to use
across threads.

As the `IO` types allow retrieving the `Expander`, this can lead to non-thread
safe types being sent across threads as part of the `Expander` leading to data
races.
Command injection in kekbit
Published: 2021-08-25T20:57:10Z
Aliases: CVE-2020-36449

An issue was discovered in the kekbit crate before 0.3.4 for Rust. For ShmWriter<H>, Send is implemented without requiring H: Send.
Data races in slock
Published: 2021-08-25T20:58:00Z
Aliases: CVE-2020-36455

An issue was discovered in the slock crate through 2020-11-17 for Rust. Slock<T> unconditionally implements Send and Sync.
FPE in TFLite division operations
Published: 2021-08-25T14:40:16Z
Aliases: CVE-2021-37683

### Impact
The implementation of division in TFLite is [vulnerable to a division by 0 error](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/lite/kernels/div.cc)

There is no check that the divisor tensor does not contain zero elements.

### Patches
We have patched the issue in GitHub commit [1e206baedf8bef0334cca3eb92bab134ef525a28](https://github.com/tensorflow/tensorflow/commit/1e206baedf8bef0334cca3eb92bab134ef525a28).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Command injection in mail agent settings
Published: 2021-08-30T16:14:09Z
Aliases: CVE-2021-37708

### Impact
Command injection in mail agent settings

### Patches
We recommend updating to the current version 6.4.3.1. You can get the update to 6.4.3.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
Double free in crossbeam
Published: 2021-08-25T20:43:21Z
Aliases: CVE-2018-20996

Even if an element is popped from a queue, crossbeam would run its destructor inside the epoch-based garbage collector. This is a source of double frees.

The flaw was corrected by wrapping elements inside queues in a ManuallyDrop.
Incorrect buffer size calculation in iced-x86
Published: 2021-08-25T20:55:47Z
Aliases: CVE-2021-38188

An issue was discovered in the iced-x86 crate through 1.10.3 for Rust. In Decoder::new(), slice.get_unchecked(slice.length()) is used unsafely.
Data races in hashconsing
Published: 2021-08-25T20:51:52Z
Aliases: CVE-2020-36215

Affected versions of hashconsing implements Send/Sync for its HConsed type without restricting it to Sendable types and Syncable types. This allows non-Sync types such as Cell to be shared across threads leading to undefined behavior and memory corruption in concurrent programs.
Null pointer dereference in `RaggedTensorToTensor`
Published: 2021-08-25T14:44:09Z
Aliases: CVE-2021-37638

### Impact
Sending invalid argument for `row_partition_types` of `tf.raw_ops.RaggedTensorToTensor` API results in a null pointer dereference and undefined behavior:

```python
import tensorflow as tf

tf.raw_ops.RaggedTensorToTensor(
  shape=1,
  values=10,
  default_value=21,
  row_partition_tensors=tf.constant([0,0,0,0]),
  row_partition_types=[])
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/47a06f40411a69c99f381495f490536972152ac0/tensorflow/core/kernels/ragged_tensor_to_tensor_op.cc#L328) accesses the first element of a user supplied list of values without validating that the provided list is not empty.

### Patches
We have patched the issue in GitHub commit [301ae88b331d37a2a16159b65b255f4f9eb39314](https://github.com/tensorflow/tensorflow/commit/301ae88b331d37a2a16159b65b255f4f9eb39314).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Arbitrary file overwrite in tar-rs
Published: 2021-08-25T20:43:54Z
Aliases: CVE-2018-20990

When unpacking a tarball with the unpack_in-family of functions it's intended that only files within the specified directory are able to be written. Tarballs with hard links or symlinks, however, can be used to overwrite any file on the filesystem. Tarballs can contain multiple entries for the same file. A tarball which first contains an entry for a hard link or symlink pointing to any file on the filesystem will have the link created, and then afterwards if the same file is listed in the tarball the hard link will be rewritten and any file can be rewritten on the filesystem.
Fake objects feature vulnerability allowing to execute JavaScript code using malformed HTML.
Published: 2021-08-23T19:42:15Z
Aliases: CVE-2021-37695

### Affected packages
The vulnerability has been discovered in [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) plugin. All plugins with [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) plugin dependency are affected:

* [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects)
* [Link](https://ckeditor.com/cke4/addon/link)
* [Flash](https://ckeditor.com/cke4/addon/flash)
* [Iframe](https://ckeditor.com/cke4/addon/iframe)
* [Forms](https://ckeditor.com/cke4/addon/forms)
* [Page Break](https://ckeditor.com/cke4/addon/pagebreak)

### Impact
A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version < 4.16.2.

### Patches
The problem has been recognized and patched. The fix will be available in version 4.16.2.

### For more information
Email us at security@cksource.com if you have any questions or comments about this advisory.

### Acknowledgements
The CKEditor 4 team would like to thank Mika Kulmala ([kulmik](https://github.com/kulmik)) for recognizing and reporting this vulnerability.
Double free in containers
Published: 2021-08-25T20:53:05Z
Aliases: CVE-2021-25907

Upon panic in a user-provided function f, fn mutate() & fn mutate2 drops twice a same object.

Affected versions of this crate did not guard against double drop while temporarily duplicating an object's ownership with ptr::read().

Dropping a same object can result in memory corruption.

The flaw was corrected in version "0.9.11" by fixing the code to abort upon panic.
Cross Site Scripting in LavaLite CMS
Published: 2021-08-09T20:38:54Z
Aliases: CVE-2020-23234

Cross Site Scripting (XSS) vulnerabiity exists in LavaLite CMS 5.8.0 via the Menu Blocks feature, which can be bypassed by using HTML event handlers, such as "ontoggle,".
Data races in gfwx
Published: 2021-08-25T20:50:39Z
Aliases: CVE-2020-36211

In the affected versions of this crate, ImageChunkMut<'_, T> unconditionally implements Send and Sync, allowing to create data races.

This can result in a memory corruption or undefined behavior when non thread-safe types are moved and referenced across thread boundaries.

The flaw was corrected in commit e7fb2f5 by adding T: Send bound to the Send impl and adding T: Sync bound to the Sync impl.
Use after free in generic-array
Published: 2021-08-25T20:56:12Z
Aliases: CVE-2020-36465

An issue was discovered in the generic-array crate before 0.13.3 for Rust. It violates soundness by using the arr! macro to extend lifetimes.
Reference binding to nullptr in `RaggedTensorToVariant`
Published: 2021-08-25T14:42:13Z
Aliases: CVE-2021-37666

### Impact
An attacker can cause undefined behavior via binding a reference to null pointer in `tf.raw_ops.RaggedTensorToVariant`:

```python
import tensorflow as tf

tf.raw_ops.RaggedTensorToVariant(
  rt_nested_splits=[],
  rt_dense_values=[1,2,3],
  batched_input=True)
```
  
The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/ragged_tensor_to_variant_op.cc#L129) has an incomplete validation of the splits values, missing the case when the argument would be empty.

### Patches
We have patched the issue in GitHub commit [be7a4de6adfbd303ce08be4332554dff70362612](https://github.com/tensorflow/tensorflow/commit/be7a4de6adfbd303ce08be4332554dff70362612).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
  
### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Cross site scripting via HTML attributes in the back end
Published: 2021-08-25T14:45:01Z
Aliases: CVE-2021-35955

### Impact

It is possible for untrusted users to inject malicious code into HTML attributes in the back end, which will be executed both in the element preview (back end) and on the website (front end).

Installations are only affected if there are untrusted back end users who have the rights to modify HTML fields (e.g. TinyMCE).

### Patches

Update to Contao 4.4.56, 4.9.18 or 4.11.7

### Workarounds

Disable all fields that allow HTML for untrusted back end users or disable the login for these users.

### References

https://contao.org/en/security-advisories/cross-site-scripting-via-html-attributes-in-the-back-end

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).

### Credits

Thanks to Mikhail Khramenkov and Moritz Vondano for reporting this security issue.
Incomplete validation in `QuantizeV2`
Published: 2021-08-25T14:42:23Z
Aliases: CVE-2021-37663

### Impact                                                                                                                                                                                                                                                                                
Due to incomplete validation in `tf.raw_ops.QuantizeV2`, an attacker can trigger undefined behavior via binding a reference to a null pointer or can access data outside the bounds of heap allocated arrays:

```python
import tensorflow as tf

tf.raw_ops.QuantizeV2(
  input=[1,2,3],
  min_range=[1,2],
  max_range=[],
  T=tf.qint32,
  mode='SCALED',
  round_mode='HALF_AWAY_FROM_ZERO',
  narrow_range=False,
  axis=1,
  ensure_minimum_range=3)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/quantize_op.cc#L59) has some validation but does not check that `min_range` and `max_range` both have the same non-zero number of elements. If `axis` is provided (i.e., not `-1`), then validation should check that it is a value in range for the rank of `input` tensor and then the lengths of `min_range` and `max_range` inputs match the `axis` dimension of the `input` tensor.
  
### Patches
We have patched the issue in GitHub commit [6da6620efad397c85493b8f8667b821403516708](https://github.com/tensorflow/tensorflow/commit/6da6620efad397c85493b8f8667b821403516708).
  
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
crossbeam-deque Data Race before v0.7.4 and v0.8.1
Published: 2021-08-25T21:01:15Z
Aliases: CVE-2021-32810

### Impact

In the affected version of this crate, the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of other tasks that are forgotten and never popped. If tasks are allocated on the heap, this can cause double free and a memory leak. If not, this still can cause a logical bug.

Crates using `Stealer::steal`, `Stealer::steal_batch`, or `Stealer::steal_batch_and_pop` are affected by this issue.

### Patches

This has been fixed in crossbeam-deque 0.8.1 and 0.7.4.

### Credits

This issue was reported and fixed by Maor Kleinberger.

### License

This advisory is in the public domain.
Incorrect buffer size in crossbeam-channel
Published: 2021-08-25T20:49:43Z
Aliases: CVE-2020-35904

The affected version of this crate's the bounded channel incorrectly assumes that Vec::from_iter has allocated capacity that same as the number of iterator elements. Vec::from_iter does not actually guarantee that and may allocate extra memory. The destructor of the bounded channel reconstructs Vec from the raw pointer based on the incorrect assumes described above. This is unsound and causing deallocation with the incorrect capacity when Vec::from_iter has allocated different sizes with the number of iterator elements.
Uncontrolled recursion in rust-yaml
Published: 2021-08-25T20:43:13Z
Aliases: CVE-2018-20993

Affected versions of this crate did not prevent deep recursion while deserializing data structures. This allows an attacker to make a YAML file with deeply nested structures that causes an abort while deserializing it. The flaw was corrected by checking the recursion depth.
@npmcli/arborist vulnerable to UNIX Symbolic Link (Symlink) Following
Published: 2021-08-31T16:04:03Z
Aliases: CVE-2021-39134

### Impact

Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution

`@npmcli/arborist`, the library that calculates dependency trees and manages the `node_modules` folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder.

This is, in part, accomplished by resolving dependency specifiers defined in `package.json` manifests for dependencies with a specific name, and nesting folders to resolve conflicting dependencies.

When multiple dependencies differ only in the case of their name, Arborist's internal data structure saw them as separate items that could coexist within the same level in the `node_modules` hierarchy.  However, on case-insensitive file systems (such as macOS and Windows), this is not the case.  Combined with a symlink dependency such as `file:/some/path`, this allowed an attacker to create a situation in which arbitrary contents could be written to any location on the filesystem.

For example, a package `pwn-a` could define a dependency in their `package.json` file such as `"foo": "file:/some/path"`.  Another package, `pwn-b` could define a dependency such as `FOO: "file:foo.tgz"`.  On case-insensitive file systems, if `pwn-a` was installed, and then `pwn-b` was installed afterwards, the contents of `foo.tgz` would be written to `/some/path`, and any existing contents of `/some/path` would be removed.

Anyone using npm v7.20.6 or earlier on a case-insensitive filesystem is potentially affected.

### Patches

2.8.2 (included in npm v7.20.7 and above)

### Fix and Caveats

There are two parts to the fix:

1. Immediately prior to extraction, if the target folder is not a directory, it is moved aside.  (If the installation fails, filesystem entries moved aside in this manner are moved back as part of the rollback process.)
2. The `children` map that represents child nodes in the tree is replaced with a case-insensitive map object, such that `node.children.get('foo')` and `node.children.get('FOO')` will return the same object, enabling Arborist to detect and handle this class of tree collision.

This second item imposes a caveat on case _sensitive_ filesystems where two packages with names which differ only in case may already exist at the same level in the tree, causing unpredictable behavior in this rare edge case.  Note that in such cases, the `package-lock.json` already creates a situation which is hazardous to use on case-sensitive filesystems, and will likely lead to other problems.

If affected by this caveat, please run `npm update` to rebuild your tree and generate a new `package-lock.json` file.
Improper Handling of Length Parameter Inconsistency in Compress
Published: 2021-08-02T16:55:53Z
Aliases: CVE-2021-36090

When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.
Remote code execution in ChakraCore
Published: 2021-08-02T17:28:53Z
Aliases: CVE-2020-1057

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-1172, CVE-2020-1180.
Data races in ticketed_lock
Published: 2021-08-25T21:00:34Z

Affected versions of this crate unconditionally implemented `Send` for `ReadTicket<T>` & `WriteTicket<T>`.
This allows to send non-Send `T` to other threads.

This can allows creating data races by cloning types with internal mutability and sending them to other threads (as `T` of `ReadTicket<T>`/`WriteTicket<T>`). Such data races can cause memory corruption or other undefined behavior.

The flaw was corrected in commit `a986a93` by adding `T: Send` bounds to `Send` impls of `ReadTicket<T>`/`WriteTicket<T>`.