aswin1906/github-advisory-2021.csv huggingface dataset:
Out of bounds write in traitobject
Published: 2021-08-25T20:48:02Z
Aliases: CVE-2020-35881

An issue was discovered in the traitobject crate through 2020-06-01 for Rust. It has false expectations about fat pointers, possibly causing memory corruption in, for example, Rust 2.x.
Insecure direct object reference of log files of the Import/Export feature
Published: 2021-08-30T16:14:19Z
Aliases: CVE-2021-37709

### Impact
Insecure direct object reference of log files of the Import/Export feature

### Patches
We recommend updating to the current version 6.4.3.1. You can get the update to 6.4.3.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
Use-after-free in chttp
Published: 2021-08-25T20:44:40Z
Aliases: CVE-2019-16140

The From implementation for Vec was not properly implemented, returning a vector backed by freed memory. This could lead to memory corruption or be exploited to cause undefined behavior.

A fix was published in version 0.1.3.
Open Redirect in Flask-User
Published: 2021-08-09T20:44:32Z
Aliases: CVE-2021-23401

This affects all versions of package Flask-User. When using the `make_safe_url` function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple backslashes such as `/////evil.com/path` or `\\\evil.com/path`. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using `autocorrect_location_header=False`.
Permissions bypass in pleaser
Published: 2021-08-25T21:01:47Z
Aliases: CVE-2021-31155

Failure to normalize the umask in pleaser before 0.4.0 allows a local attacker to gain full root privileges if they are allowed to execute at least one command.
Data race in disrustor
Published: 2021-08-25T20:56:59Z
Aliases: CVE-2020-36470

An issue was discovered in the disrustor crate through 2020-12-17 for Rust. RingBuffer doe not properly limit the number of mutable references.
Double free in through
Published: 2021-08-25T20:54:12Z
Aliases: CVE-2021-29940

An issue was discovered in the through crate through 2021-02-18 for Rust. There is a double free (in through and through_and) upon a panic of the map function.
Use after free in heapless
Published: 2021-08-25T20:56:09Z
Aliases: CVE-2020-36464

An issue was discovered in the heapless crate before 0.6.1 for Rust. The IntoIter Clone implementation clones an entire underlying Vec without considering whether it has already been partially consumed.
Improper Handling of Length Parameter Inconsistency in Apache Ant
Published: 2021-08-02T16:56:17Z
Aliases: CVE-2021-36373

When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
Out of bounds read in simd-json
Published: 2021-08-25T20:43:56Z
Aliases: CVE-2019-15550

The affected version of this crate did not guard against accessing memory beyond the range of its input data. A pointer cast to read the data into a 256-bit register could lead to a segmentation fault when the end plus the 32 bytes (256 bit) read would overlap into the next page during string parsing. This allows an attacker to eventually crash a service. The flaw was corrected by using a padding buffer for the last read from the input. So that we are we never read over the boundary of the input data.
Druid ingestion system Authenticated users can read data from other sources than intended
Published: 2021-08-13T15:21:50Z
Aliases: CVE-2021-26920

In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the HTTP InputSource.
Cross-site Scripting in curly-bracket-parser
Published: 2021-08-10T16:08:16Z
Aliases: CVE-2021-23416

This affects all versions of package curly-bracket-parser.
 When used as a template library, it does not properly sanitize the user input.
Out of bounds read in simple-slab
Published: 2021-08-25T20:48:38Z
Aliases: CVE-2020-35892

An issue was discovered in the simple-slab crate before 0.3.3 for Rust. index() allows an out-of-bounds read.
Singleton lacks bounds on Send and Sync.
Published: 2021-08-25T21:00:11Z

`Singleton<T>` is meant to be a static object that can be initialized lazily. In
order to satisfy the requirement that `static` items must implement `Sync`,
`Singleton` implemented both `Sync` and `Send` unconditionally.

This allows for a bug where non-`Sync` types such as `Cell` can be used in
singletons and cause data races in concurrent programs.

The flaw was corrected in commit `b0d2bd20e` by adding trait bounds, requiring
the contaiend type to implement `Sync`.
Unauthorized property update in CheckboxGroup component in Vaadin 12-14 and 15-20
Published: 2021-08-30T16:16:46Z

Improper check in `CheckboxGroup` in `com.vaadin:vaadin-checkbox-flow` versions 1.2.0 prior to 2.0.0 (Vaadin 12.0.0 prior to 14.0.0), 2.0.0 prior to 3.0.0 (Vaadin 14.0.0 prior to 14.5.0), 3.0.0 through 4.0.1 (Vaadin 15.0.0 through 17.0.11), 14.5.0 through 14.6.7 (Vaadin 14.5.0 through 14.6.7), and 18.0.0 through 20.0.5 (Vaadin 18.0.0 through 20.0.5) allows attackers to modify the value of a disabled `Checkbox` inside enabled `CheckboxGroup` component via unspecified vectors.

- https://vaadin.com/security/cve-2021-33605
Null pointer dereference in `MatrixDiagPartOp`
Published: 2021-08-25T14:43:42Z
Aliases: CVE-2021-37643

### Impact
If a user does not provide a valid padding value to `tf.raw_ops.MatrixDiagPartOp`, then the code triggers a null pointer dereference (if input is empty) or produces invalid behavior, ignoring all values after the first:

```python
import tensorflow as tf

tf.raw_ops.MatrixDiagPartV2(
  input=tf.ones(2,dtype=tf.int32),
  k=tf.ones(2,dtype=tf.int32),
  padding_value=[])
```

Although this example is given for `MatrixDiagPartV2`, all versions of the operation are affected.

The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/linalg/matrix_diag_op.cc#L89) reads the first value from a tensor buffer without first checking that the tensor has values to read from.

### Patches
We have patched the issue in GitHub commit [482da92095c4d48f8784b1f00dda4f81c28d2988](https://github.com/tensorflow/tensorflow/commit/482da92095c4d48f8784b1f00dda4f81c28d2988).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Data race in conqueue
Published: 2021-08-25T20:58:50Z
Aliases: CVE-2020-36437

Affected versions of this crate unconditionally implemented `Send`/`Sync` for `QueueSender<T>`, allowing to send non-Send `T` to other threads by invoking `(&QueueSender<T>).send()`.

This fails to prevent users from creating data races by sending types like `Rc<T>` or `Arc<Cell<T>>` to other threads, which can lead to memory corruption. The flaw was corrected in commit `1e462c3` by imposing `T: Send` to both `Send`/`Sync` impls for `QueueSender<T>`/`QueueReceiver<T>`.
Buffer Overflow in Apache Mina SSHD
Published: 2021-08-02T16:54:09Z
Aliases: CVE-2021-30129

A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error. This issue affects the SFTP and port forwarding features of Apache Mina SSHD version 2.0.0 and later versions. It was addressed in Apache Mina SSHD 2.7.0
Dolibarr Cross-site Scripting vulnerability
Published: 2021-08-30T16:22:46Z
Aliases: CVE-2021-25955

In `Dolibarr ERP CRM`, WYSIWYG Editor module, v2.8.1 to v13.0.2 are affected by a stored XSS vulnerability that allows low privileged application users to store malicious scripts in the `Private Note` field at `/adherents/note.php?id=1` endpoint. These scripts are executed in a victim’s browser when they open the page containing the vulnerable field. In the worst case, the victim who inadvertently triggers the attack is a highly privileged administrator. The injected scripts can extract the Session ID, which can lead to full Account takeover of the admin and due to other vulnerability (Improper Access Control on Private notes) a low privileged user can update the private notes which could lead to privilege escalation.
Segmentation fault in time
Published: 2021-08-25T20:56:46Z
Aliases: CVE-2020-26235

### Impact

Unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library.

The affected functions from time 0.2.7 through 0.2.22 are:

- `time::UtcOffset::local_offset_at`
- `time::UtcOffset::try_local_offset_at`
- `time::UtcOffset::current_local_offset`
- `time::UtcOffset::try_current_local_offset`
- `time::OffsetDateTime::now_local`
- `time::OffsetDateTime::try_now_local`

The affected functions in time 0.1 (all versions) are:

- `at`
- `at_utc`
- `now`

Non-Unix targets (including Windows and wasm) are unaffected.

### Patches

In some versions of `time`, the internal method that determines the local offset has been modified to always return `None` on the affected operating systems. This has the effect of returning an `Err` on the `try_*` methods and `UTC` on the non-`try_*` methods. In later versions, `time` will attempt to determine the number of threads running in the process. If the process is single-threaded, the call will proceed as its safety invariant is upheld.

Users and library authors with time in their dependency tree must perform `cargo update`, which will pull in the updated, unaffected code.

Users of time 0.1 do not have a patch and must upgrade to an unaffected version: time 0.2.23 or greater or the 0.3 series.

### Workarounds

Library authors must ensure that the program only has one running thread at the time of calling any affected method. Binary authors may do the same and/or ensure that no other thread is actively mutating the environment.

### References

[time-rs/time#293](https://github.com/time-rs/time/issues/293).
XStream is vulnerable to an Arbitrary Code Execution attack
Published: 2021-08-25T14:47:38Z
Aliases: CVE-2021-39148

### Impact
The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-39148](https://x-stream.github.io/CVE-2021-39148.html).

### Credits
wh1t3p1g from TSRC (Tencent Security Response Center) found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Out of bounds read in dync
Published: 2021-08-25T20:49:47Z
Aliases: CVE-2020-35903

VecCopy::data is created as a Vec of u8 but can be used to store and retrieve elements of different types leading to misaligned access.

The issue was resolved in v0.5.0 by replacing data being stored by Vec<u8> with a custom managed pointer. Elements are now stored and retrieved using types with proper alignment corresponding to original types.
Use after free in boosted trees creation
Published: 2021-08-25T14:43:07Z
Aliases: CVE-2021-37652

### Impact
The implementation for `tf.raw_ops.BoostedTreesCreateEnsemble` can result in a use after free error if an attacker supplies specially crafted arguments:

```python
import tensorflow as tf

v= tf.Variable([0.0])
tf.raw_ops.BoostedTreesCreateEnsemble(
  tree_ensemble_handle=v.handle,
  stamp_token=[0],
  tree_ensemble_serialized=['0']) 
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/f24faa153ad31a4b51578f8181d3aaab77a1ddeb/tensorflow/core/kernels/boosted_trees/resource_ops.cc#L55) uses a reference counted resource and decrements the refcount if the initialization fails, as it should. However, when the code was written, the  resource was represented as a naked pointer but later refactoring has changed it to be a smart pointer. Thus, when the pointer leaves the scope, a subsequent `free`-ing of the resource occurs, but this fails to take into account that the refcount has already reached 0, thus the resource has been already freed. During this double-free process, members of the resource object are accessed for cleanup but they are invalid as the entire resource has been freed.

### Patches
We have patched the issue in GitHub commit [5ecec9c6fbdbc6be03295685190a45e7eee726ab](https://github.com/tensorflow/tensorflow/commit/5ecec9c6fbdbc6be03295685190a45e7eee726ab).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Multiple security issues including data race, buffer overflow, and uninitialized memory drop in arr
Published: 2021-08-25T20:48:36Z
Aliases: CVE-2020-35888

arr crate contains multiple security issues. Specifically,

1.  It incorrectly implements Sync/Send bounds, which allows to smuggle non-Sync/Send types across the thread boundary.
2. Index and IndexMut implementation does not check the array bound.
3. Array::new_from_template() drops uninitialized memory.
Multiple soundness issues in cgc
Published: 2021-08-25T20:56:16Z
Aliases: CVE-2020-36467

Affected versions of this crate have the following issues:

1. `Ptr` implements `Send` and `Sync` for all types, this can lead to data
   races by sending non-thread safe types across threads.

2. `Ptr::get` violates mutable alias rules by returning multiple mutable
   references to the same object.

3. `Ptr::write` uses non-atomic writes to the underlying pointer. This means
   that when used across threads it can lead to data races.
Arbitrary Command Injection due to Improper Command Sanitization
Published: 2021-08-05T17:07:39Z

### Summary
There exists a command injection vulnerability in `npmcli/git` versions <2.0.8 which may result in arbitrary shell command execution due to improper argument sanitization when `npmcli/git` is used to execute Git commands based on user controlled input. 

The impact of this issue is possible Arbitrary Command Injection when `npmcli/git` is run with untrusted (user controlled) Git command arguments. 

### Impact

Arbitrary Command Injection

### Details

`npmcli/git` prior to release `2.0.8` passed user controlled input as arguments to a shell command without properly sanitizing this input. Passing unsanitized input to a shell can lead to arbitrary command injection. For example passing `git+https://github.com/npm/git; echo hello world` would trigger the shell execution of `echo hello world`.  

This issue was remediated by no longer running `npmcli/git` git commands through an intermediate shell.

### Patches

This issue has been patched in release `2.0.8`

### Acknowledgements

This report was reported to us by @tyage (Ierae Security) through the [GitHub Bug Bounty Program](https://bounty.github.com).
Cross-site Scripting in OWASP AntiSamy
Published: 2021-08-02T16:58:43Z
Aliases: CVE-2021-35043

OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with &#00058 as the replacement for the : character.
Integer division by 0 in sparse reshaping
Published: 2021-08-25T14:44:02Z
Aliases: CVE-2021-37640

### Impact
The implementation of `tf.raw_ops.SparseReshape` can be made to trigger an integral division by 0 exception:

```python
import tensorflow as tf

tf.raw_ops.SparseReshape(
  input_indices = np.ones((1,3)),
  input_shape = np.array([1,1,0]),
  new_shape = np.array([1,0]))
```
  
The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/reshape_util.cc#L176-L181) calls the reshaping functor whenever there is at least an index in the input but does not check that shape of the input or the target shape have both a non-zero number of elements.

The [reshape functor](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/reshape_util.cc#L40-L78) blindly divides by the dimensions of the target shape. Hence, if this is not checked, code will result in a division by 0.
  
### Patches
We have patched the issue in GitHub commit [4923de56ec94fff7770df259ab7f2288a74feb41](https://github.com/tensorflow/tensorflow/commit/4923de56ec94fff7770df259ab7f2288a74feb41).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1 as this is the other affected version.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
  
### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Data races in beef
Published: 2021-08-25T20:59:08Z
Aliases: CVE-2020-36442

An issue was discovered in the beef crate before 0.5.0 for Rust. 
Affected versions of this crate did not have a `T: Sync` bound in the `Send` impl for `Cow<'_, T, U>`. This allows users to create data races by making `Cow` contain types that are (Send && !Sync) like `Cell<_>` or `RefCell<_>`.

Such data races can lead to memory corruption.

The flaw was corrected in commit d1c7658 by adding trait bounds `T: Sync` and `T::Owned: Send` to the `Send` impl for `Cow<'_, T, U>`.
Heap OOB and CHECK fail in `ResourceGather`
Published: 2021-08-25T14:43:01Z
Aliases: CVE-2021-37654

### Impact
An attacker can trigger a crash via a `CHECK`-fail in debug builds of TensorFlow using `tf.raw_ops.ResourceGather` or a read from outside the bounds of heap allocated data in the same API in a release build:

```python
import tensorflow as tf

tensor = tf.constant(value=[[1,2],[3,4],[5,6]],shape=(3,2),dtype=tf.uint32)
v = tf.Variable(tensor)
tf.raw_ops.ResourceGather(
  resource=v.handle,
  indices=[0],
  dtype=tf.uint32,
  batch_dims=10,
  validate_indices=False)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/f24faa153ad31a4b51578f8181d3aaab77a1ddeb/tensorflow/core/kernels/resource_variable_ops.cc#L660-L668) does not check that the `batch_dims` value that the user supplies is less than the rank of the input tensor.

Since the implementation uses several for loops over the dimensions of `tensor`, this results in reading data from outside the bounds of heap allocated buffer backing the tensor:

```cc
    // batch_dims_ = > params.dims() (10 > 2)
    for (int i = 0; i < batch_dims_; ++i) {
      result_shape.AddDim(params.dim_size(i));
    }
    for (int i = batch_dims_; i < indices.dims(); ++i) {
      result_shape.AddDim(indices.dim_size(i));
    }
    for (int i = batch_dims_ + 1; i < params.dims(); ++i) {
      result_shape.AddDim(params.dim_size(i));
    }
```

In debug mode, `.dim_size(i)` validates that the argument is less than `.dims()` using a `DCHECK`. But the `DCHECK` is a no-op in release builds.

### Patches
We have patched the issue in GitHub commit [bc9c546ce7015c57c2f15c168b3d9201de679a1d](https://github.com/tensorflow/tensorflow/commit/bc9c546ce7015c57c2f15c168b3d9201de679a1d).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Double free in slice-deque
Published: 2021-08-25T20:54:16Z
Aliases: CVE-2021-29938

An issue was discovered in the slice-deque crate through 2021-02-19 for Rust. A double drop can occur in SliceDeque::drain_filter upon a panic in a predicate function.
Path traversal in mozwire
Published: 2021-08-25T20:49:02Z
Aliases: CVE-2020-35883

An issue was discovered in the mozwire crate through 2020-08-18 for Rust. A ../ directory-traversal situation allows overwriting local files that have .conf at the end of the filename.
Data races in parc
Published: 2021-08-25T20:57:24Z
Aliases: CVE-2020-36454

In the affected versions of this crate, LockWeak<T> unconditionally implemented Send with no trait bounds on T. LockWeak<T> doesn't own T and only provides &T. This allows concurrent access to a non-Sync T, which can cause undefined behavior like data races.
Data races in magnetic
Published: 2021-08-25T20:50:05Z
Aliases: CVE-2020-35925

Affected versions of this crate unconditionally implemented Sync and Send traits for MPMCConsumer and MPMCProducer types. This allows users to send types that do not implement Send trait across thread boundaries, which can cause a data race. The flaw was corrected in the 2.0.1 release by adding T: Send bound to affected Sync/Send trait implementations.
Cross-site scripting in feehicms
Published: 2021-08-30T16:22:25Z
Aliases: CVE-2020-19709

Insufficient filtering of the tag parameters in feehicms 0.1.3 allows attackers to execute arbitrary web or HTML via a crafted payload.
Null pointer deference in fltk
Published: 2021-08-25T20:53:56Z
Aliases: CVE-2021-28306

An issue was discovered in the fltk crate before 0.15.3 for Rust. There is a NULL pointer dereference during attempted use of a multi label type if the image is nonexistent.
Code injection in topthink/think
Published: 2021-08-09T20:39:52Z
Aliases: CVE-2020-17952

A remote code execution (RCE) vulnerability in /library/think/App.php of Twothink v2.0 allows attackers to execute arbitrary PHP code.