hitoshura25/cvefixes huggingface dataset:
CVE-2022-23633 (Ruby, published 2022-02-11T21:15Z)
Description: value: Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-212 \u2014 Improper Removal of Sensitive Information Before Storage or Transfer
The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
Repository: https://github.com/rails/rails
Files changed:
activesupport/lib/active_support/reloader.rb
Commit message: Fix reloader to work with new Executor signature

This is a follow up to [CVE-2022-23633].


Vulnerable code:
    def self.run! # :nodoc:

Fixed code:
    def self.run!(reset: false) # :nodoc:
CVE-2022-3704 (Ruby, published 2022-10-26T20:15Z)
Description: value: A vulnerability classified as problematic has been found in Ruby on Rails. This affects an unknown part of the file actionpack/lib/action_dispatch/middleware/templates/routes/_table.html.erb. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The real existence of this vulnerability is still doubted at the moment. The name of the patch is be177e4566747b73ff63fd5f529fab564e475ed4. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-212319. NOTE: Maintainer declares that there isn’t a valid attack vector. The issue was wrongly reported as a security vulnerability by a non-member of the Rails team.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-707 \u2014 Improper Neutralization
The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
Repository: https://github.com/rails/rails
Files changed:
actionpack/lib/action_dispatch/middleware/templates/routes/_table.html.erb
Commit message: Fix #46244 Remove innerHTML usage to avoid self-XSS


Vulnerable code:
    function checkNoMatch(section, noMatchText) {
        section.innerHTML += noMatchText;
          defaultExactMatch = '<tr><th colspan="4">Paths Matching (' + path +'):</th></tr>',
          defaultFuzzyMatch = '<tr><th colspan="4">Paths Containing (' + path +'):</th></tr>',
          noExactMatch      = '<tr><th colspan="4">No Exact Matches Found</th></tr>',
          noFuzzyMatch      = '<tr><th colspan="4">No Fuzzy Matches Found</th></tr>';
        exactSection.innerHTML = defaultExactMatch;
        fuzzySection.innerHTML = defaultFuzzyMatch;

Fixed code:
    function checkNoMatch(section, trElement) {
        section.appendChild(trElement);
    function buildTr(string) {
      var tr = document.createElement('tr');
      var th = document.createElement('th');
      th.setAttribute('colspan', 4);
      tr.appendChild(th);
      th.innerText = string;
      return tr;
    }

          defaultExactMatch = buildTr('Paths Matching (' + path + '):'),
          defaultFuzzyMatch = buildTr('Paths Containing (' + path +'):'),
          noExactMatch      = buildTr('No Exact Matches Found'),
          noFuzzyMatch      = buildTr('No Fuzzy Matches Found');
        exactSection.replaceChildren(defaultExactMatch);
        fuzzySection.replaceChildren(defaultFuzzyMatch);
CVE-2024-28103 (Ruby, published 2024-06-04T20:15Z)
Description: value: Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in  6.1.7.8, 7.0.8.2, and 7.1.3.3.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/rails/rails
Files changed:
actionpack/lib/action_dispatch/http/permissions_policy.rb
actionpack/test/dispatch/permissions_policy_test.rb
Commit message: include the HTTP Permissions-Policy on non-HTML Content-Types

[CVE-2024-28103]

The application configurable Permissions-Policy is only
served on responses with an HTML related Content-Type.

This change allows all Content-Types to serve the
configured Permissions-Policy as there are many non-HTML
Content-Types that would benefit from this header.
(examples include image/svg+xml and application/xml)


Vulnerable code:
        return response unless html_response?(headers)
        def html_response?(headers)
          if content_type = headers[Rack::CONTENT_TYPE]
            content_type.include?("html")
          end
        end

  test "non-html requests will not set a policy" do
    assert_nil response.headers[ActionDispatch::Constants::FEATURE_POLICY]

Fixed code:
  test "non-html requests will set a policy" do
    assert_equal "gyroscope 'self'", response.headers[ActionDispatch::Constants::FEATURE_POLICY]
CVE-2024-32464 (Ruby, published 2024-06-04T20:15Z)
Description: value: Action Text brings rich text content and editing to Rails. Instances of ActionText::Attachable::ContentAttachment included within a rich_text_area tag could potentially contain unsanitized HTML. This vulnerability is fixed in 7.1.3.4 and 7.2.0.beta2.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/rails/rails
Files changed:
actiontext/app/helpers/action_text/content_helper.rb
actiontext/lib/action_text/content.rb
actiontext/test/unit/attachment_test.rb
Commit message: Sanitize ActionText HTML ContentAttachment in Trix edit view

[CVE-2024-32464]
Instances of ActionText::Attachable::ContentAttachment included
within a rich_text_area tag could potentially contain unsanitized
HTML. This could lead to a potential cross site scripting issue
within the Trix editor.

This change enforces existing sanitization routines on
ActionText::Attachable::ContentAttachment attachments.


Vulnerable code:
    include Rendering, Serialization

Fixed code:
    def sanitize_content_attachment(content_attachment)
      sanitizer.sanitize(
        content_attachment,
        tags: sanitizer_allowed_tags,
        attributes: sanitizer_allowed_attributes,
        scrubber: scrubber,
      )
    end

    include Rendering, Serialization, ContentHelper
        node["content"] = sanitize_content_attachment(node["content"])
  test "sanitizes HTML content attachment" do
    attachment = attachment_from_html('<action-text-attachment content-type="text/html" content="<img src=\&quot;.\&quot; onerror=alert>"></action-text-attachment>')
    attachable = attachment.attachable

    ActionText::Content.with_renderer MessagesController.renderer do
      assert_equal "<img src=\"\\%22.\\%22\">", attachable.to_html.strip
    end
  end
CVE-2012-2675 (C, published 2012-07-25T19:55Z)
Description: value: Multiple integer overflows in the (1) CallMalloc (malloc) and (2) nedpcalloc (calloc) functions in nedmalloc (nedmalloc.c) before 1.10 beta2 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-189 \u2014 Numeric Errors
Weaknesses in this category are related to improper calculation or conversion of numbers.
Repository: https://github.com/ned14/nedmalloc
Files changed:
nedmalloc.c
Commit message: Avoid overflowing allocation size in CallMalloc()

The wraparound could happen if USE_MAGIC_HEADERS is enabled.


Vulnerable code:
	size+=alignment+3*sizeof(size_t);

Fixed code:
	size_t bytes=size+alignment+3*sizeof(size_t);
	/* Avoid addition overflow. */
	if(bytes<size)
		return 0;
	size=bytes;
CVE-2012-2675 (C, published 2012-07-25T19:55Z)
Description: value: Multiple integer overflows in the (1) CallMalloc (malloc) and (2) nedpcalloc (calloc) functions in nedmalloc (nedmalloc.c) before 1.10 beta2 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-189 \u2014 Numeric Errors
Weaknesses in this category are related to improper calculation or conversion of numbers.
Repository: https://github.com/ned14/nedmalloc
Files changed:
nedmalloc.c
Commit message: Avoid overflowing allocation size in calloc()


Vulnerable code:
	unsigned flags=NEDMALLOC_FORCERESERVE(p, 0, no*size);
	return nedpmalloc2(p, size*no, 0, M2_ZERO_MEMORY|flags);

Fixed code:
	size_t bytes=no*size;
	/* Avoid multiplication overflow. */
	if(size && no!=bytes/size)
		return 0;
	unsigned flags=NEDMALLOC_FORCERESERVE(p, 0, bytes);
	return nedpmalloc2(p, bytes, 0, M2_ZERO_MEMORY|flags);
CVE-2011-3598 (PHP, published 2011-10-08T02:52Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in phpPgAdmin before 5.0.3 allow remote attackers to inject arbitrary web script or HTML via (1) a web page title, related to classes/Misc.php; or the (2) return_url or (3) return_desc parameter to display.php.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phppgadmin/phppgadmin
Files changed:
HISTORY
classes/Misc.php
display.php
Commit message: Fix two security fix about XSS, reported by Mateusz Goik, fixed by ioguix.


Vulnerable code:
* One security fix about code injection
				if ($title != '') echo " - {$title}";
			echo "\t<li><a href=\"{$_REQUEST['return_url']}\">{$_REQUEST['return_desc']}</a></li>\n";

Fixed code:
* Three security fix about code injection
				if ($title != '') echo htmlspecialchars(" - {$title}");
			echo "\t<li><a href=\"". htmlspecialchars($_REQUEST['return_url']) ."\">". htmlspecialchars($_REQUEST['return_desc']) ."</a></li>\n";
CVE-2012-1600 (PHP, published 2014-05-14T00:55Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in functions.php in phpPgAdmin before 5.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) type of a function.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phppgadmin/phppgadmin
Files changed:
functions.php
Commit message: Fix XSS in function.php, reported by Mateusz Goik.

I'm not sure why the name and the type the functions were not escaped
*on purpose* here. There's no more reason here than in any other place
with other PostgreSQL objects to not escape the name or the type...


Vulnerable code:
				'type'  => 'verbatim',
				'type'  => 'verbatim',

Fixed code:
CVE-2017-7962 (C, published 2017-04-19T15:59Z)
Description: value: The iwgif_read_image function in imagew-gif.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-369 \u2014 Divide By Zero
The product divides a value by zero.
Repository: https://github.com/jsummers/imageworsener
Files changed:
src/imagew-gif.c
Commit message: Fixed a GIF decoding bug (divide by zero)

Fixes issue #15


Vulnerable code:

Fixed code:
	if(rctx->image_width<1 || rctx->image_height<1) {
		iw_set_error(rctx->ctx, "Invalid image dimensions");
		goto done;
	}
CVE-2017-8325 (C, published 2017-04-29T20:59Z)
Description: value: The iw_process_cols_to_intermediate function in imagew-main.c in libimageworsener.a in ImageWorsener before 1.3.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted image.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/jsummers/imageworsener
Files changed:
src/imagew-internals.h
Commit message: Reduced the max memory use and image size in 64-bit builds

This is a stopgap measure that should prevent some problems with excessive
resource use, and possibly integer overflow.
Related: issue #14


Vulnerable code:
#define IW_DEFAULT_MAX_DIMENSION 1000000
#define IW_DEFAULT_MAX_MALLOC 2000000000000

Fixed code:
#define IW_DEFAULT_MAX_DIMENSION 40000
#define IW_DEFAULT_MAX_MALLOC 2000000000
CVE-2017-8326 (C, published 2017-04-29T20:59Z)
Description: value: libimageworsener.a in ImageWorsener before 1.3.1 has "left shift cannot be represented in type int" undefined behavior issues, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image, related to imagew-bmp.c and imagew-util.c.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-682 \u2014 Incorrect Calculation
The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.
Repository: https://github.com/jsummers/imageworsener
Files changed:
src/imagew-bmp.c
src/imagew-util.c
Commit message: Trying to fix some invalid left shift operations

Fixes issue #16


Vulnerable code:
		if(x&(1<<i)) return i;
		if(x&(1<<i)) return i;
	return b[0] | (b[1]<<8);
	return b[0] | (b[1]<<8) | (b[2]<<16) | (b[3]<<24);
	return (iw_int32)(iw_uint32)(b[0] | (b[1]<<8) | (b[2]<<16) | (b[3]<<24));
	return (b[0]<<8) | b[1];
	return (b[0]<<24) | (b[1]<<16) | (b[2]<<8) | b[3];

Fixed code:
		if(x&(1U<<(unsigned int)i)) return i;
		if(x&(1U<<(unsigned int)i)) return i;
	return (unsigned int)b[0] | ((unsigned int)b[1]<<8);
	return (unsigned int)b[0] | ((unsigned int)b[1]<<8) |
		((unsigned int)b[2]<<16) | ((unsigned int)b[3]<<24);
	return (iw_int32)(iw_uint32)((unsigned int)b[0] | ((unsigned int)b[1]<<8) |
		((unsigned int)b[2]<<16) | ((unsigned int)b[3]<<24));
	return ((unsigned int)b[0]<<8) | (unsigned int)b[1];
	return ((unsigned int)b[0]<<24) | ((unsigned int)b[1]<<16) |
		((unsigned int)b[2]<<8) | (unsigned int)b[3];
CVE-2017-8327 (C, published 2017-04-29T20:59Z)
Description: value: The bmpr_read_uncompressed function in imagew-bmp.c in libimageworsener.a in ImageWorsener before 1.3.1 allows remote attackers to cause a denial of service (memory consumption) via a crafted image.
Severity: HIGH (CVSS v3 base score: 6.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/jsummers/imageworsener
Files changed:
src/imagew-internals.h
Commit message: Reduced the max memory use and image size in 64-bit builds

This is a stopgap measure that should prevent some problems with excessive
resource use, and possibly integer overflow.
Related: issue #14


Vulnerable code:
#define IW_DEFAULT_MAX_DIMENSION 1000000
#define IW_DEFAULT_MAX_MALLOC 2000000000000

Fixed code:
#define IW_DEFAULT_MAX_DIMENSION 40000
#define IW_DEFAULT_MAX_MALLOC 2000000000
CVE-2017-9201 (C, published 2017-05-23T04:29Z)
Description: value: imagew-cmd.c:850:46 in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted image, related to imagew-api.c.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-369 \u2014 Divide By Zero
The product divides a value by zero.
Repository: https://github.com/jsummers/imageworsener
Files changed:
src/imagew-api.c
Commit message: Double-check that the input image's density is valid

Fixes a bug that could result in division by zero, at least for a JPEG
source image.
Fixes issues #19, #20


Vulnerable code:
	*pcode = ctx->img1.density_code;
	if(ctx->img1.density_code!=IW_DENSITY_UNKNOWN) {
		*px = ctx->img1.density_x;
		*py = ctx->img1.density_y;
		return 1;
	return 0;

Fixed code:
	*pcode = IW_DENSITY_UNKNOWN;

	if(ctx->img1.density_code==IW_DENSITY_UNKNOWN) {
		return 0;
	if(!iw_is_valid_density(ctx->img1.density_x, ctx->img1.density_y,
		ctx->img1.density_code))
	{
		return 0;
	}
	*px = ctx->img1.density_x;
	*py = ctx->img1.density_y;
	*pcode = ctx->img1.density_code;
	return 1;
CVE-2017-9202 (C, published 2017-05-23T04:29Z)
Description: value: imagew-cmd.c:854:45 in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted image, related to imagew-api.c.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-369 \u2014 Divide By Zero
The product divides a value by zero.
Repository: https://github.com/jsummers/imageworsener
Files changed:
src/imagew-api.c
Commit message: Double-check that the input image's density is valid

Fixes a bug that could result in division by zero, at least for a JPEG
source image.
Fixes issues #19, #20


Vulnerable code:
	*pcode = ctx->img1.density_code;
	if(ctx->img1.density_code!=IW_DENSITY_UNKNOWN) {
		*px = ctx->img1.density_x;
		*py = ctx->img1.density_y;
		return 1;
	return 0;

Fixed code:
	*pcode = IW_DENSITY_UNKNOWN;

	if(ctx->img1.density_code==IW_DENSITY_UNKNOWN) {
		return 0;
	if(!iw_is_valid_density(ctx->img1.density_x, ctx->img1.density_y,
		ctx->img1.density_code))
	{
		return 0;
	}
	*px = ctx->img1.density_x;
	*py = ctx->img1.density_y;
	*pcode = ctx->img1.density_code;
	return 1;
CVE-2017-9203 (C, published 2017-05-23T04:29Z)
Description: value: imagew-main.c:960:12 in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (buffer underflow) via a crafted image, related to imagew-bmp.c.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/jsummers/imageworsener
Files changed:
src/imagew-bmp.c
src/imagew-main.c
Commit message: Fixed a bug that could cause invalid memory to be accessed

The bug could happen when transparency is removed from an image.
Also fixed a semi-related BMP error handling logic bug.
Fixes issue #21


Vulnerable code:
// 'handle_alpha_flag' must be set if an alpha channel exists and this is not
// the alpha channel.
	out_ci = &ctx->img2_ci[output_channel];

Fixed code:
		goto done;
		goto done;
	struct iw_channelinfo_out default_ci_out;
	if(output_channel>=0) {
		out_ci = &ctx->img2_ci[output_channel];
	}
	else {
		// If there is no output channelinfo struct, create a temporary one to
		// use.
		// TODO: This is admittedly ugly, but we use these settings for a few
		// things even when there is no corresponding output channel, and I
		// don't remember exactly why.
		iw_zeromem(&default_ci_out, sizeof(struct iw_channelinfo_out));
		default_ci_out.channeltype = IW_CHANNELTYPE_NONALPHA;
		out_ci = &default_ci_out;
	}
CVE-2017-9204 (C, published 2017-05-23T04:29Z)
Description: value: The iw_get_ui16le function in imagew-util.c:405:23 in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (invalid read and SEGV) via a crafted image, related to imagew-jpeg.c.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/jsummers/imageworsener
Files changed:
src/imagew-jpeg.c
Commit message: Fixed invalid memory access bugs when decoding JPEG Exif data

Fixes issues #22, #23, #24, #25


Vulnerable code:
	field_type = iw_get_ui16_e(&e->d[tag_pos+2],e->endian);
	value_count = iw_get_ui32_e(&e->d[tag_pos+4],e->endian);
		*pv = iw_get_ui16_e(&e->d[tag_pos+8],e->endian);
		*pv = iw_get_ui32_e(&e->d[tag_pos+8],e->endian);
	field_type = iw_get_ui16_e(&e->d[tag_pos+2],e->endian);
	value_count = iw_get_ui32_e(&e->d[tag_pos+4],e->endian);
	value_pos = iw_get_ui32_e(&e->d[tag_pos+8],e->endian);
	numer = iw_get_ui32_e(&e->d[value_pos  ],e->endian);
	denom = iw_get_ui32_e(&e->d[value_pos+4],e->endian);
	if(ifd<8 || ifd>e->d_len-18) return;
	tag_count = iw_get_ui16_e(&e->d[ifd],e->endian);
		tag_id = iw_get_ui16_e(&e->d[tag_pos],e->endian);
	ifd = iw_get_ui32_e(&d[4],e.endian);

Fixed code:
static unsigned int get_exif_ui16(struct iw_exif_state *e, unsigned int pos)
{
	if(e->d_len<2 || pos>e->d_len-2) return 0;
	return iw_get_ui16_e(&e->d[pos], e->endian);
}

static unsigned int get_exif_ui32(struct iw_exif_state *e, unsigned int pos)
{
	if(e->d_len<4 || pos>e->d_len-4) return 0;
	return iw_get_ui32_e(&e->d[pos], e->endian);
}

	field_type = get_exif_ui16(e, tag_pos+2);
	value_count = get_exif_ui32(e, tag_pos+4);
		*pv = get_exif_ui16(e, tag_pos+8);
		*pv = get_exif_ui32(e, tag_pos+8);
	field_type = get_exif_ui16(e, tag_pos+2);
	value_count = get_exif_ui32(e, tag_pos+4);
	value_pos = get_exif_ui32(e, tag_pos+8);
	numer = get_exif_ui32(e, value_pos);
	denom = get_exif_ui32(e, value_pos+4);
	if(ifd<8 || e->d_len<18 || ifd>e->d_len-18) return;
	tag_count = get_exif_ui16(e, ifd);
		tag_id = get_exif_ui16(e, tag_pos);
	ifd = get_exif_ui32(&e, 4);