hitoshura25/cvefixes huggingface dataset:
CVE-2022-32545 (C, published 2022-06-16T18:15Z)
Description: value: A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned char' at coders/psd.c, when crafted or untrusted input is processed. This leads to a negative impact to application availability or other problems related to undefined behavior.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/psd.c
Commit message: fix issue: outside the range of representable values of type 'unsigned int' at coders/psd.c:1025 (#4963)

* fix Division by zero in XMenuWidget() of MagickCore/widget.c

* Fix memory leak in AnimateImageCommand() of MagickWand/animate.c and DisplayImageCommand() of MagickWand/display.c

* fix Division by zero in ReadEnhMetaFile() of coders/emf.c

* Resolve conflicts

* fix issue: outside the range of representable values of type 'unsigned char' at coders/psd.c:1025

Co-authored-by: zhailiangliang <zhailiangliang@loongson.cn>

Vulnerable code:
          SetPSDPixel(image,channel,packet_size,(((unsigned char) pixel)

Fixed code:
          SetPSDPixel(image,channel,packet_size,(((unsigned char)((ssize_t)pixel))
CVE-2022-32546 (C, published 2022-06-16T18:15Z)
Description: value: A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned long' at coders/pcl.c, when crafted or untrusted input is processed. This leads to a negative impact to application availability or other problems related to undefined behavior.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/pcl.c
Commit message: Fixes #4985: 4e+26 is outside the range of representable values of type 'unsigned long' at coders/pcl.c:299 (#4986)

* fix Division by zero in XMenuWidget() of MagickCore/widget.c

* Fix memory leak in AnimateImageCommand() of MagickWand/animate.c and DisplayImageCommand() of MagickWand/display.c

* fix Division by zero in ReadEnhMetaFile() of coders/emf.c

* Resolve conflicts

* fix issue: outside the range of representable values of type 'unsigned char' at coders/psd.c:1025

* fix error: 4e+26 is outside the range of representable values of type 'unsigned long' at coders/pcl.c:299

Co-authored-by: zhailiangliang <zhailiangliang@loongson.cn>

Vulnerable code:
    width=(size_t) floor(bounds.x2-bounds.x1+0.5);
    height=(size_t) floor(bounds.y2-bounds.y1+0.5);

Fixed code:
    width=(size_t)CastDoubleToLong(floor(bounds.x2-bounds.x1+0.5));
    height=(size_t)CastDoubleToLong(floor(bounds.y2-bounds.y1+0.5));
CVE-2022-32547 (C, published 2022-06-16T18:15Z)
Description: value: In ImageMagick, there is load of misaligned address for type 'double', which requires 8 byte alignment and for type 'float', which requires 4 byte alignment at MagickCore/property.c. Whenever crafted or untrusted input is processed by ImageMagick, this causes a negative impact to application availability or other problems related to undefined behavior.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-704 \u2014 Incorrect Type Conversion or Cast
The product does not correctly convert an object, resource, or structure from one type to a different type.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
MagickCore/property.c
Commit message: fix #5033: runtime error: load of misaligned address (#5034)

* fix Division by zero in XMenuWidget() of MagickCore/widget.c

* Fix memory leak in AnimateImageCommand() of MagickWand/animate.c and DisplayImageCommand() of MagickWand/display.c

* fix Division by zero in ReadEnhMetaFile() of coders/emf.c

* Resolve conflicts

* fix issue: outside the range of representable values of type 'unsigned char' at coders/psd.c:1025

* fix error: 4e+26 is outside the range of representable values of type 'unsigned long' at coders/pcl.c:299

* fix #5033:runtime error: load of misaligned address

Co-authored-by: zhailiangliang <zhailiangliang@loongson.cn>

Vulnerable code:
              EXIFMultipleValues(4,"%f",(double) *(float *) p1);
              EXIFMultipleValues(8,"%f",*(double *) p1);

Fixed code:
              EXIFMultipleValues(4,"%f",(double)ReadPropertySignedLong(endian,p1));
              EXIFMultipleValues(8,"%f",(double)ReadPropertySignedLong(endian,p1));
CVE-2023-1289 (C, published 2023-03-23T20:15Z)
Description: value: A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote attacker to pass a specially crafted SVG file that leads to a segmentation fault, generating many trash files in "/tmp," resulting in a denial of service. When ImageMagick crashes, it generates a lot of trash files. These trash files can be large if the SVG file contains many render actions. In a denial of service attack, if a remote attacker uploads an SVG file of size t, ImageMagick generates files of size 103*t. If an attacker uploads a 100M SVG, the server will generate about 10G.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
MagickCore/draw.c
Commit message: erecursion detection


Vulnerable code:
      clone_info=CloneImageInfo(draw_info->image_info);

Fixed code:
      clone_info=AcquireImageInfo();
      clone_info->recursion_depth=draw_info->image_info->recursion_depth;
CVE-2023-1906 (C, published 2023-04-12T22:15Z)
Description: value: A heap-based buffer overflow issue was discovered in ImageMagick's ImportMultiSpectralQuantum() function in MagickCore/quantum-import.c. An attacker could pass specially crafted file to convert, triggering an out-of-bounds read error, allowing an application to crash, resulting in a denial of service.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/tiff.c
Commit message: possible heap buffer overflow (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-35q2-86c7-9247)


Vulnerable code:
        extent=4*MagickMax(image->columns*(samples_per_pixel+extra_samples)*
          (image->depth+7)/8,(size_t) TIFFStripSize(tiff));

Fixed code:
        extent=MagickMax(sizeof(uint32),(samples_per_pixel+extra_samples)*
          (image->depth+7)/8)*image->columns*rows_per_strip;
CVE-2023-3195 (Other, published 2023-06-16T20:15Z)
Description: value: A stack-based buffer overflow issue was found in ImageMagick's coders/tiff.c. This flaw allows an attacker to trick the user into opening a specially crafted malicious tiff file, causing an application to crash, resulting in a denial of service.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
ChangeLog
coders/tiff.c
Commit message: fix stack overflow when parsing malicious tiff image


Vulnerable code:

Fixed code:
  * fix stack overflow when parsing malicious tiff image file (report from
    Muhammad Aldo Firmansyah).
#if defined(TIFF_VERSION_BIG)
        extent+=image->columns*sizeof(uint64);
#else
        extent+=image->columns*sizeof(uint32);
#endif
CVE-2023-34474 (C, published 2023-06-16T20:15Z)
Description: value: A heap-based buffer overflow issue was discovered in ImageMagick's ReadTIM2ImageData() function in coders/tim2.c. A local attacker could trick the user in opening specially crafted file, triggering an out-of-bounds read error, allowing an application to crash, resulting in a denial of service.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
MagickCore/profile.c
coders/tim2.c
Commit message: carefully crafted image files (TIM2, JPEG) no longer overflow buffer nor use heap after free (thanks to Juzhi Lu, Zhen Zhou, Likang Luo of NSFOCUS Security Team)


Vulnerable code:
  memmove(datum+start+value_length,datum+end,length-end);
  memcpy(datum+start,value,value_length);
    clut_data=(unsigned char *) AcquireQuantumMemory(1,header->clut_size);

Fixed code:
  (void) memmove(datum+start+value_length,datum+end,length-end);
  (void) memcpy(datum+start,value,value_length);
      datum=(char *) GetStringInfoDatum(profile);
    clut_data=(unsigned char *) AcquireQuantumMemory(2,
      MagickMax(header->clut_size,image->colors));
    (void) memset(clut_data,0,2*MagickMax(header->clut_size,image->colors));
CVE-2023-34475 (C, published 2023-06-16T20:15Z)
Description: value: A heap use after free issue was discovered in ImageMagick's ReplaceXmpValue() function in MagickCore/profile.c. An attacker could trick user to open a specially crafted file to convert, triggering an heap-use-after-free write error, allowing an application to crash, resulting in a denial of service.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
MagickCore/profile.c
coders/tim2.c
Commit message: carefully crafted image files (TIM2, JPEG) no longer overflow buffer nor use heap after free (thanks to Juzhi Lu, Zhen Zhou, Likang Luo of NSFOCUS Security Team)


Vulnerable code:
  memmove(datum+start+value_length,datum+end,length-end);
  memcpy(datum+start,value,value_length);
    clut_data=(unsigned char *) AcquireQuantumMemory(1,header->clut_size);

Fixed code:
  (void) memmove(datum+start+value_length,datum+end,length-end);
  (void) memcpy(datum+start,value,value_length);
      datum=(char *) GetStringInfoDatum(profile);
    clut_data=(unsigned char *) AcquireQuantumMemory(2,
      MagickMax(header->clut_size,image->colors));
    (void) memset(clut_data,0,2*MagickMax(header->clut_size,image->colors));
CVE-2023-3745 (Other, published 2023-07-24T16:15Z)
Description: value: A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel() function in quantum-private.h. This issue may allow a local attacker to trick the user into opening a specially crafted file, triggering an out-of-bounds read error and allowing an application to crash, resulting in a denial of service.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
ChangeLog
coders/tiff.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1857


Vulnerable code:

Fixed code:
  * Prevent heap overflow (reference
     https://github.com/ImageMagick/ImageMagick/issues/1857).
        if (photometric == PHOTOMETRIC_YCBCR)
          extent<<=1;
CVE-2023-3745 (C, published 2023-07-24T16:15Z)
Description: value: A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel() function in quantum-private.h. This issue may allow a local attacker to trick the user into opening a specially crafted file, triggering an out-of-bounds read error and allowing an application to crash, resulting in a denial of service.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/tiff.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1857


Vulnerable code:
    if (photometric == PHOTOMETRIC_LOGLUV)
        if (photometric == PHOTOMETRIC_YCBCR)
          extent<<=1;

Fixed code:
    if ((photometric == PHOTOMETRIC_LOGLUV) ||
        (photometric == PHOTOMETRIC_YCBCR))
CVE-2023-5341 (C, published 2023-11-19T10:15Z)
Description: value: A heap use-after-free flaw was found in coders/bmp.c in ImageMagick.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/bmp.c
Commit message: check for BMP file size, poc provided by Hardik Shah of Vehere (Dawn Treaders team)


Vulnerable code:

Fixed code:
    if ((bmp_info.file_size != 0) &&
        ((MagickSizeType) bmp_info.file_size > GetBlobSize(image)))
      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
CVE-2020-15150 (Unknown, published 2020-09-01T17:15Z)
Description: value: There is a vulnerability in Paginator (Elixir/Hex package) which makes it susceptible to Remote Code Execution (RCE) attacks via input parameters to the paginate() function. This will potentially affect all current users of Paginator prior to version 1.0.0. The vulnerability has been patched in version 1.0.0 and all users should upgrade to this version immediately. Note that this patched version uses a dependency that requires an Elixir version >=1.5.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/duffelhq/paginator
Files changed:
Commit message: Merge pull request from GHSA-w98m-2xqg-9cvj

Fix unsafe binary to term

Vulnerable code:

Fixed code:
CVE-2021-23440 (JSON, published 2021-09-12T13:15Z)
Description: value: This affects the package set-value before <2.0.1, >=3.0.0 <4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-843 \u2014 Access of Resource Using Incompatible Type ('Type Confusion')
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
Repository: https://github.com/jonschlinkert/set-value
Files changed:
package.json
Commit message: 4.0.1

Fixes https://github.com/jonschlinkert/set-value/pull/33 thanks to @ready-research.


Vulnerable code:
  "version": "4.0.0",
}

Fixed code:
  "version": "4.0.1",
}
CVE-2018-14938 (C++, published 2018-08-05T03:29Z)
Description: value: An issue was discovered in wifipcap/wifipcap.cpp in TCPFLOW through 1.5.0-alpha. There is an integer overflow in the function handle_prism during caplen processing. If the caplen is less than 144, one can cause an integer overflow in the function handle_80211, which will result in an out-of-bounds read and may allow access to sensitive memory (or a denial of service).
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/simsong/tcpflow
Files changed:
src/wifipcap/wifipcap.cpp
Commit message: fixed buffer overflow


Vulnerable code:
    hdr.host_time 	= EXTRACT_LE_32BITS(pc+32);
    hdr.mac_time 	= EXTRACT_LE_32BITS(pc+44);
    hdr.channel 	= EXTRACT_LE_32BITS(pc+56);
    hdr.rssi 		= EXTRACT_LE_32BITS(pc+68);
    hdr.sq 		= EXTRACT_LE_32BITS(pc+80);
    hdr.signal  	= EXTRACT_LE_32BITS(pc+92);
    hdr.noise   	= EXTRACT_LE_32BITS(pc+104);
    hdr.rate		= EXTRACT_LE_32BITS(pc+116)/2;
    hdr.istx		= EXTRACT_LE_32BITS(pc+128);
    cbs->HandlePrism( *this, &hdr, pc + 144, len - 144);
    handle_80211(pc+144,len-144);

Fixed code:
    if (len>=144){
        hdr.host_time 	= EXTRACT_LE_32BITS(pc+32);
        hdr.mac_time 	= EXTRACT_LE_32BITS(pc+44);
        hdr.channel 	= EXTRACT_LE_32BITS(pc+56);
        hdr.rssi 		= EXTRACT_LE_32BITS(pc+68);
        hdr.sq 		= EXTRACT_LE_32BITS(pc+80);
        hdr.signal  	= EXTRACT_LE_32BITS(pc+92);
        hdr.noise   	= EXTRACT_LE_32BITS(pc+104);
        hdr.rate		= EXTRACT_LE_32BITS(pc+116)/2;
        hdr.istx		= EXTRACT_LE_32BITS(pc+128);
        cbs->HandlePrism( *this, &hdr, pc + 144, len - 144);
        handle_80211(pc+144,len-144);
    }
/// 2018-08-02: slg - I'm not sure why this is commented out.
        /// 2018-08-02: slg - I'm also not sure why this is commented out.
CVE-2018-14938 (C++, published 2018-08-05T03:29Z)
Description: value: An issue was discovered in wifipcap/wifipcap.cpp in TCPFLOW through 1.5.0-alpha. There is an integer overflow in the function handle_prism during caplen processing. If the caplen is less than 144, one can cause an integer overflow in the function handle_80211, which will result in an out-of-bounds read and may allow access to sensitive memory (or a denial of service).
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/simsong/tcpflow
Files changed:
src/wifipcap/wifipcap.cpp
Commit message: fixed buffer overflow


Vulnerable code:
    hdr.host_time 	= EXTRACT_LE_32BITS(pc+32);
    hdr.mac_time 	= EXTRACT_LE_32BITS(pc+44);
    hdr.channel 	= EXTRACT_LE_32BITS(pc+56);
    hdr.rssi 		= EXTRACT_LE_32BITS(pc+68);
    hdr.sq 		= EXTRACT_LE_32BITS(pc+80);
    hdr.signal  	= EXTRACT_LE_32BITS(pc+92);
    hdr.noise   	= EXTRACT_LE_32BITS(pc+104);
    hdr.rate		= EXTRACT_LE_32BITS(pc+116)/2;
    hdr.istx		= EXTRACT_LE_32BITS(pc+128);
    cbs->HandlePrism( *this, &hdr, pc + 144, len - 144);
    handle_80211(pc+144,len-144);

Fixed code:
    if (len>=144){
        hdr.host_time 	= EXTRACT_LE_32BITS(pc+32);
        hdr.mac_time 	= EXTRACT_LE_32BITS(pc+44);
        hdr.channel 	= EXTRACT_LE_32BITS(pc+56);
        hdr.rssi 		= EXTRACT_LE_32BITS(pc+68);
        hdr.sq 		= EXTRACT_LE_32BITS(pc+80);
        hdr.signal  	= EXTRACT_LE_32BITS(pc+92);
        hdr.noise   	= EXTRACT_LE_32BITS(pc+104);
        hdr.rate		= EXTRACT_LE_32BITS(pc+116)/2;
        hdr.istx		= EXTRACT_LE_32BITS(pc+128);
        cbs->HandlePrism( *this, &hdr, pc + 144, len - 144);
        handle_80211(pc+144,len-144);
    }
/// 2018-08-02: slg - I'm not sure why this is commented out.
        /// 2018-08-02: slg - I'm also not sure why this is commented out.
CVE-2020-36402 (Other, published 2021-07-01T03:15Z)
Description: value: Solidity 0.7.5 has a stack-use-after-return issue in smtutil::CHCSmtLib2Interface::querySolver. NOTE: c39a5e2b7a3fabbf687f53a2823fc087be6c1a7e is cited in the OSV "fixed" field but does not have a code change.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ethereum/solidity
Files changed:
docs/ir/ir-breaking-changes.rst
Commit message: Fix accidental repetition in ir breaking changes docs.


Vulnerable code:
     1. State variables are assigned value their initial values, if present at declaration.

Fixed code:
     1. State variables are assigned their initial values, if present at declaration.
CVE-2019-25066 (Python, published 2022-06-09T17:15Z)
Description: value: A vulnerability has been found in ajenti 2.1.31 and classified as critical. This vulnerability affects unknown code of the component API. The manipulation leads to privilege escalation. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.1.32 is able to address this issue. The name of the patch is 7aa146b724e0e20cfee2c71ca78fafbf53a8767c. It is recommended to upgrade the affected component.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/ajenti/ajenti
Files changed:
ajenti-core/aj/auth.py
Commit message: fixed shell injection in os auth provider


Vulnerable code:
            child = pexpect.spawn('/bin/sh', ['-c', '/bin/su -c "/bin/echo SUCCESS" - %s' % username], timeout=5)

Fixed code:
from six import PY3

        if PY3:
            from shlex import quote
        else:
            from pipes import quote

            child = pexpect.spawn('/bin/sh', ['-c', '/bin/su -c "/bin/echo SUCCESS" - %s' % quote(username)], timeout=5)
CVE-2022-28044 (C, published 2022-04-15T14:15Z)
Description: value: Irzip v0.640 was discovered to contain a heap memory corruption via the component lrzip.c:initialise_control.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ckolivas/lrzip
Files changed:
lrzip.c
main.c
Commit message: Fix control->suffix being deallocated as heap memory as reported by Pietro Borrello.


Vulnerable code:
	control->suffix = ".lrz";
			control->suffix = "";
			control->suffix = optarg;

Fixed code:
	control->suffix = strdup(".lrz");
			dealloc(control->suffix);
			control->suffix = strdup("");
			dealloc(control->suffix);
			control->suffix = strdup(optarg);