hitoshura25/cvefixes huggingface dataset:
CVE-2021-20257 (C, published 2022-03-16T15:15Z)
Description: value: An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
Severity: LOW (CVSS v3 base score: 6.5)
Weakness: CWE-835 \u2014 Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Repository: https://github.com/qemu/qemu
Files changed:
hw/net/e1000.c
Commit message: e1000: fail early for evil descriptor

During procss_tx_desc(), driver can try to chain data descriptor with
legacy descriptor, when will lead underflow for the following
calculation in process_tx_desc() for bytes:

            if (tp->size + bytes > msh)
                bytes = msh - tp->size;

This will lead a infinite loop. So check and fail early if tp->size if
greater or equal to msh.

Reported-by: Alexander Bulekov <alxndr@bu.edu>
Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr>
Reported-by: Ruhr-University Bochum <bugs-syssec@rub.de>
Cc: Prasad J Pandit <ppandit@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Jason Wang <jasowang@redhat.com>


Vulnerable code:

Fixed code:
            if (tp->size >= msh) {
                goto eop;
            }
eop:
CVE-2021-3748 (C, published 2022-03-23T20:15Z)
Description: value: A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non direct access region, due to num_buffers being set after the virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting in a denial of service condition, or potentially execute code on the host with the privileges of the QEMU process.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/qemu/qemu
Files changed:
hw/net/virtio-net.c
Commit message: virtio-net: fix use after unmap/free for sg

When mergeable buffer is enabled, we try to set the num_buffers after
the virtqueue elem has been unmapped. This will lead several issues,
E.g a use after free when the descriptor has an address which belongs
to the non direct access region. In this case we use bounce buffer
that is allocated during address_space_map() and freed during
address_space_unmap().

Fixing this by storing the elems temporarily in an array and delay the
unmap after we set the the num_buffers.

This addresses CVE-2021-3748.

Reported-by: Alexander Bulekov <alxndr@bu.edu>
Fixes: fbe78f4f55c6 ("virtio-net support")
Cc: qemu-stable@nongnu.org
Signed-off-by: Jason Wang <jasowang@redhat.com>


Vulnerable code:
    size_t offset, i, guest_offset;
            return -1;
            return -1;
            return size;
        /* signal other side */
        virtqueue_fill(q->rx_vq, elem, total, i++);
        g_free(elem);

Fixed code:
    VirtQueueElement *elems[VIRTQUEUE_MAX_SIZE];
    size_t lens[VIRTQUEUE_MAX_SIZE];
    size_t offset, i, guest_offset, j;
    ssize_t err;
        if (i == VIRTQUEUE_MAX_SIZE) {
            virtio_error(vdev, "virtio-net unexpected long buffer chain");
            err = size;
            goto err;
        }

            err = -1;
            goto err;
            err = -1;
            goto err;
            err = size;
            goto err;
        elems[i] = elem;
        lens[i] = total;
        i++;
    for (j = 0; j < i; j++) {
        /* signal other side */
        virtqueue_fill(q->rx_vq, elems[j], lens[j], j);
        g_free(elems[j]);
    }


err:
    for (j = 0; j < i; j++) {
        g_free(elems[j]);
    }

    return err;
CVE-2022-35414 (C, published 2022-07-11T02:15Z)
Description: value: softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_readx or io_writex crash. NOTE: a third party states that the Non-virtualization Use Case in the qemu.org reference applies here, i.e., "Bugs affecting the non-virtualization use case are not considered security bugs at this time.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-908 \u2014 Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
Repository: https://github.com/qemu/qemu
Files changed:
softmmu/physmem.c
Commit message: softmmu: Always initialize xlat in address_space_translate_for_iotlb

The bug is an uninitialized memory read, along the translate_fail
path, which results in garbage being read from iotlb_to_section,
which can lead to a crash in io_readx/io_writex.

The bug may be fixed by writing any value with zero
in ~TARGET_PAGE_MASK, so that the call to iotlb_to_section using
the xlat'ed address returns io_mem_unassigned, as desired by the
translate_fail path.

It is most useful to record the original physical page address,
which will eventually be logged by memory_region_access_valid
when the access is rejected by unassigned_mem_accepts.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1065
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20220621153829.366423-1-richard.henderson@linaro.org>


Vulnerable code:
address_space_translate_for_iotlb(CPUState *cpu, int asidx, hwaddr addr,

Fixed code:
address_space_translate_for_iotlb(CPUState *cpu, int asidx, hwaddr orig_addr,
    hwaddr addr = orig_addr;
    /*
     * We should be given a page-aligned address -- certainly
     * tlb_set_page_with_attrs() does so.  The page offset of xlat
     * is used to index sections[], and PHYS_SECTION_UNASSIGNED = 0.
     * The page portion of xlat will be logged by memory_region_access_valid()
     * when this memory access is rejected, so use the original untranslated
     * physical address.
     */
    assert((orig_addr & ~TARGET_PAGE_MASK) == 0);
    *xlat = orig_addr;
CVE-2022-35414 (C, published 2022-07-11T02:15Z)
Description: value: softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_readx or io_writex crash. NOTE: a third party states that the Non-virtualization Use Case in the qemu.org reference applies here, i.e., "Bugs affecting the non-virtualization use case are not considered security bugs at this time.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-908 \u2014 Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
Repository: https://github.com/qemu/qemu
Files changed:
target/loongarch/cpu.c
Commit message: target/loongarch: Clean up tlb when cpu reset

We should make sure that tlb is clean when cpu reset.

Signed-off-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20220705070950.2364243-1-gaosong@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>


Vulnerable code:

Fixed code:
    memset(env->tlb, 0, sizeof(env->tlb));
CVE-2024-24474 (C, published 2024-02-20T18:15Z)
Description: value: QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/qemu/qemu
Files changed:
hw/scsi/esp.c
Commit message: esp: restrict non-DMA transfer length to that of available data

In the case where a SCSI layer transfer is incorrectly terminated, it is
possible for a TI command to cause a SCSI buffer overflow due to the
expected transfer data length being less than the available data in the
FIFO. When this occurs the unsigned async_len variable underflows and
becomes a large offset which writes past the end of the allocated SCSI
buffer.

Restrict the non-DMA transfer length to be the smallest of the expected
transfer length and the available FIFO data to ensure that it is no longer
possible for the SCSI buffer overflow to occur.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1810
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20230913204410.65650-3-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


Vulnerable code:
        len = MIN(fifo8_num_used(&s->fifo), ESP_FIFO_SZ);

Fixed code:
        len = MIN(s->async_len, ESP_FIFO_SZ);
        len = MIN(len, fifo8_num_used(&s->fifo));
CVE-2023-26113 (JavaScript, published 2023-03-18T05:15Z)
Description: value: Versions of the package collection.js before 6.8.1 are vulnerable to Prototype Pollution via the extend function in Collection.js/dist/node/iterators/extend.js. 
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/kobezzza/Collection
Files changed:
src/iterators/extend.js
Commit message: fix: fixed prototype pollution issue


Vulnerable code:

Fixed code:
			if (key === '__proto__') {
				return;
			}
CVE-2018-14857 (Unknown, published 2018-08-06T21:29Z)
Description: value: Unrestricted file upload (with remote code execution) in require/mail/NotificationMail.php in Webconsole in OCS Inventory NG OCS Inventory Server through 2.5 allows a privileged user to gain access to the server via a template file containing PHP code, because file extensions other than .html are permitted.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/OCSInventory-NG/OCSInventory-ocsreports
Files changed:
Commit message: Merge pull request #525 from OCSInventory-NG/notification-improvement

Notification improvement

Vulnerable code:

Fixed code:
CVE-2020-14947 (PHP, published 2020-06-30T21:15Z)
Description: value: OCS Inventory NG 2.7 allows Remote Command Execution via shell metacharacters to require/commandLine/CommandLine.php because mib_file in plugins/main_sections/ms_config/ms_snmp_config.php is mishandled in get_mib_oid.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/OCSInventory-NG/OCSInventory-ocsreports
Files changed:
require/commandLine/CommandLine.php
Commit message: Fix CVE-2020-14947


Vulnerable code:
        $result_cmd = shell_exec($cmd);

Fixed code:
        $result_cmd = shell_exec(escapeshellcmd($cmd));
CVE-2024-31996 (Java, published 2024-04-10T21:15Z)
Description: value: XWiki Platform is a generic wiki platform. Starting in version 3.0.1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, the HTML escaping of escaping tool that is used in XWiki doesn't escape `{`, which, when used in certain places, allows XWiki syntax injection and thereby remote code execution. The vulnerability has been fixed in XWiki 14.10.19, 15.5.5, and 15.9 RC1. Apart from upgrading, there is no generic workaround. However, replacing `$escapetool.html` by `$escapetool.xml` in XWiki documents fixes the vulnerability. In a standard XWiki installation, the maintainers are only aware of the document `Panels.PanelLayoutUpdate` that exposes this vulnerability, patching this document is thus a workaround. Any extension could expose this vulnerability and might thus require patching, too.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/xwiki/xwiki-commons
Files changed:
xwiki-commons-core/xwiki-commons-velocity/src/main/java/org/xwiki/velocity/tools/EscapeTool.java
xwiki-commons-core/xwiki-commons-velocity/src/test/java/org/xwiki/velocity/tools/EscapeToolTest.java
Commit message: XCOMMONS-2828: Support curly braces in `EscapeTool.html()`


Vulnerable code:

Fixed code:
import org.apache.commons.text.translate.CharSequenceTranslator;
import org.apache.commons.text.translate.LookupTranslator;
    private static final CharSequenceTranslator XWIKI_ESCAPE_HTML4 = StringEscapeUtils.ESCAPE_HTML4.with(
        new LookupTranslator(Map.ofEntries(
            Map.entry("{", "&lcub;"),
            Map.entry("}", "&rcub;")
        ))
    );

    /**
     * Escapes the HTML special characters in a <code>String</code> using HTML entities. This overrides the base
     * implementation from Velocity in order to also escape characters potentially harmful in the context of XWiki,
     * such as curly brackets.
     *
     * @param content the string to escape, may be {@code null}
     * @return a new escaped {@code String}, {@code null} if {@code null} input
     */
    @Override
    public String html(Object content)
    {
        if (content == null)
        {
            return null;
        }
        return XWIKI_ESCAPE_HTML4.translate(String.valueOf(content));
    }


    @Test
    void html()
    {
        assertEquals("&lt;script&gt;alert(&quot;Hello, &amp;lt;World&amp;gt;!&quot;);&lt;/script&gt;&lcub;&lcub;"
                + "/html&rcub;&rcub;",
            this.tool.html("<script>alert(\"Hello, &lt;World&gt;!\");</script>{{/html}}"));
    }
CVE-2022-48345 (TypeScript, published 2023-02-24T06:15Z)
Description: value: sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via HTML entities.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/braintree/sanitize-url
Files changed:
CHANGELOG.md
src/__tests__/test.ts
src/index.ts
Commit message: Fix html entity tab (#45)

* fix: correct urls that did not sanitize html encoded colons

* fix: replace html encoded tabs

* update CHANGELOG.md

Co-authored-by: Blade Barringer <blade.barringer@paypal.com>

Vulnerable code:
const urlSchemeRegex = /^([^:]+):/gm;

Fixed code:
## unreleased

- Fix issue where urls in the form `javascript&colon;alert('xss');` were not properly sanitized
- Fix issue where urls in the form `javasc&Tab;ript:alert('XSS');` were not properly sanitized

      "javasc&Tab;ript: alert('XSS');",
      it(`disallows ${protocol} urls that use &colon; for the colon portion of the url`, () => {
        expect(sanitizeUrl(`${protocol}&colon;alert(document.domain)`)).toBe(
          "about:blank"
        );
        expect(sanitizeUrl(`${protocol}&COLON;alert(document.domain)`)).toBe(
          "about:blank"
        );
      });

const htmlTabEntityRegex = /&tab;/gi;
const urlSchemeRegex = /^.+(:|&colon;)/gim;
  str = str.replace(htmlTabEntityRegex, "&#9;");
CVE-2023-32325 (TypeScript, published 2023-05-27T00:15Z)
Description: value: PostHog-js is a library to interface with the PostHog analytics tool. Versions prior to 1.57.2 have the potential for cross-site scripting. Problem has been patched in 1.57.2. Users are advised to upgrade. Users unable to upgrade should ensure that their Content Security Policy is in place.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/PostHog/posthog-js
Files changed:
package.json
src/__tests__/extensions/toolbar.js
src/extensions/toolbar.ts
src/types.ts
Commit message: fix: Remove API and JS urls (#630)

* remove api url

* 1.57.1-alpha.0

* 1.57.2-alpha.0

---------

Co-authored-by: Michael Matloka <dev@twixes.com>

Vulnerable code:
    "version": "1.57.1",
            apiURL: given.config.api_host,
            expect(given.toolbar.loadToolbar).toHaveBeenCalledWith({ ...given.toolbarParams, source: 'url' })
            expect(given.toolbar.loadToolbar).toHaveBeenCalledWith({ ...given.toolbarParams, source: 'url' })
            apiURL: 'http://localhost:8000',
            jsURL: 'http://localhost:8000',
            expect(JSON.parse(window.localStorage.getItem('_postHogToolbarParams'))).toEqual(given.toolbarParams)
            expect(window.ph_load_toolbar).toHaveBeenCalledWith(given.toolbarParams, given.lib)
                    jsURL: 'http://api.example.com',
                apiURL: this.instance.get_config('api_host'),
            if (!toolbarParams.apiURL) {
                toolbarParams.apiURL = this.instance.get_config('api_host')
            }

        // the toolbar does not use the `jsURL` as that route is cached for 24 hours.
        const host = params?.['apiURL'] || this.instance.get_config('api_host')
            apiURL: host, // defaults to api_host from the instance config if nothing else set
            jsURL: host, // defaults to api_host from the instance config if nothing else set
    apiURL?: string
    jsURL?: string

Fixed code:
    "version": "1.57.2-alpha.0",
            expect(given.toolbar.loadToolbar).toHaveBeenCalledWith({
                ...given.toolbarParams,
                source: 'url',
            })
            expect(given.toolbar.loadToolbar).toHaveBeenCalledWith({
                ...given.toolbarParams,
                source: 'url',
            })
            expect(JSON.parse(window.localStorage.getItem('_postHogToolbarParams'))).toEqual({
                ...given.toolbarParams,
                apiURL: 'http://api.example.com',
            })
            expect(window.ph_load_toolbar).toHaveBeenCalledWith(
                { ...given.toolbarParams, apiURL: 'http://api.example.com' },
                given.lib
            )
        const host = this.instance.get_config('api_host')
            apiURL: host, // defaults to api_host from the instance config if nothing else set
CVE-2023-4649 (PHP, published 2023-08-31T01:15Z)
Description: value: Session Fixation in GitHub repository instantsoft/icms2 prior to 2.16.1.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-384 \u2014 Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
Repository: https://github.com/instantsoft/icms2
Files changed:
system/core/config.php
system/core/user.php
Commit message: Add session regenerate after login & logout. Secure cookie if HTTPS.
close #1473

Vulnerable code:
        $this->set('document_root', rtrim(PATH, $this->root));
                'secure'   => false,

Fixed code:
        $this->set('document_root', preg_replace('#(.*)('.preg_quote($this->root).')$#u', '$1', PATH . DIRECTORY_SEPARATOR));
        self::sessionRegenerate();

        self::sessionRegenerate();

        self::sessionRegenerate();

    public static function sessionRegenerate() {

        session_regenerate_id(false);

        $id = session_id();

        session_write_close();

        session_id($id);

        session_start();
    }

                'secure'   => cmsConfig::isSecureProtocol(),
CVE-2023-4650 (PHP, published 2023-08-31T01:15Z)
Description: value: Improper Access Control in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
Severity: nan (CVSS v3 base score: 4.7)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/instantsoft/icms2
Files changed:
install/templates/step_php.php
system/controllers/users/actions/profile_edit_password.php
system/controllers/users/actions/profile_edit_sessions.php
system/controllers/users/frontend.php
Commit message: Administrators cannot change other administrators' passwords
& #1472

Vulnerable code:
<h2><?php echo LANG_PHP_VERSION; ?></h1>
        // проверяем наличие доступа
            cmsCore::error404();
                        
        $menu[] = [
            'title' => LANG_SECURITY,
            'url'   => href_to_profile($profile, ['edit', 'password'])
        ];
        $menu[] = [
            'title' => LANG_USERS_SESSIONS,
            'url'   => href_to_profile($profile, ['edit', 'sessions'])
        ];

Fixed code:
<h2><?php echo LANG_PHP_VERSION; ?></h2>
        // Владельцы и админы могут редактировать
            return cmsCore::error404();
        }

        // Администраторы тут могут редактировать только свои профили
        if ($this->cms_user->is_admin && !$this->is_own_profile && $profile['is_admin']) {
            return cmsCore::error404();

        if ($this->cms_user->is_admin && !$this->is_own_profile && $profile['is_admin']) {
            return cmsCore::error404();
        }

        if ($this->is_own_profile || (!$profile['is_admin'] && $this->cms_user->is_admin)) {
            $menu[] = [
                'title' => LANG_SECURITY,
                'url'   => href_to_profile($profile, ['edit', 'password'])
            ];

            $menu[] = [
                'title' => LANG_USERS_SESSIONS,
                'url'   => href_to_profile($profile, ['edit', 'sessions'])
            ];
        }