hitoshura25/cvefixes huggingface dataset:
CVE-2018-14354 (C, published 2018-07-17T17:29Z)
Description: value: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with a manual subscription or unsubscription.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/neomutt/neomutt
Files changed:
imap/imap.c
Commit message: Quote path in imap_subscribe


Vulnerable code:
    snprintf(mbox, sizeof(mbox), "%smailboxes \"%s\"", subscribe ? "" : "un", path);

Fixed code:
  size_t len = 0;
	len = snprintf(mbox, sizeof(mbox), "%smailboxes ", subscribe ? "" : "un");
	imap_quote_string(mbox + len, sizeof(mbox) - len, path, true);
CVE-2018-14355 (C, published 2018-07-17T17:29Z)
Description: value: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/util.c mishandles ".." directory traversal in a mailbox name.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/neomutt/neomutt
Files changed:
imap/util.c
Commit message: Selectively cache headers

Co-authored-by: JerikoOne <jeriko.one@gmx.us>


Vulnerable code:

Fixed code:
  if (strstr(mbox, "/../") || (strcmp(mbox, "..") == 0) || (strncmp(mbox, "../", 3) == 0))
    return NULL;
  size_t len = strlen(mbox);
  if ((len > 3) && (strcmp(mbox + len - 3, "/..") == 0))
    return NULL;
CVE-2018-14356 (C, published 2018-07-17T17:29Z)
Description: value: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. pop.c mishandles a zero-length UID.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-824 \u2014 Access of Uninitialized Pointer
The product accesses or uses a pointer that has not been initialized.
Repository: https://github.com/neomutt/neomutt
Files changed:
pop.c
Commit message: Ensure UID in fetch_uidl


Vulnerable code:

Fixed code:
  /* uid must be at least be 1 byte */
  if (strlen(line) == 0)
    return -1;
CVE-2018-14357 (C, published 2018-07-17T17:29Z)
Description: value: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with an automatic subscription.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/neomutt/neomutt
Files changed:
imap/auth_login.c
imap/command.c
imap/imap.c
imap/imap_private.h
imap/util.c
Commit message: quote imap strings more carefully

Co-authored-by: JerikoOne <jeriko.one@gmx.us>


Vulnerable code:
  imap_quote_string(q_user, sizeof(q_user), idata->conn->account.user);
  imap_quote_string(q_pass, sizeof(q_pass), idata->conn->account.pass);
  imap_quote_string(errstr, sizeof(errstr), list.name);
        imap_quote_string(term, sizeof(term), pat->p.str);
        imap_quote_string(term, sizeof(term), delim);
        imap_quote_string(term, sizeof(term), pat->p.str);
        imap_quote_string(term, sizeof(term), pat->p.str);
        imap_quote_string(term, sizeof(term), pat->p.str);
void imap_quote_string(char *dest, size_t dlen, const char *src);
void imap_quote_string(char *dest, size_t dlen, const char *src)
  static const char quote[] = "\"\\";
  imap_quote_string(dest, dlen, buf);

Fixed code:
  imap_quote_string(q_user, sizeof(q_user), idata->conn->account.user, false);
  imap_quote_string(q_pass, sizeof(q_pass), idata->conn->account.pass, false);
  imap_quote_string(errstr, sizeof(errstr), list.name, true);
        imap_quote_string(term, sizeof(term), pat->p.str, false);
        imap_quote_string(term, sizeof(term), delim, false);
        imap_quote_string(term, sizeof(term), pat->p.str, false);
        imap_quote_string(term, sizeof(term), pat->p.str, false);
        imap_quote_string(term, sizeof(term), pat->p.str, false);
void imap_quote_string(char *dest, size_t dlen, const char *src, bool quote_backtick);
void imap_quote_string(char *dest, size_t dlen, const char *src, bool quote_backtick)
  const char *quote = "`\"\\";
  if (!quote_backtick)
    quote++;

  imap_quote_string(dest, dlen, buf, false);
CVE-2018-14358 (C, published 2018-07-17T17:29Z)
Description: value: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/message.c has a stack-based buffer overflow for a FETCH response with a long RFC822.SIZE field.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/neomutt/neomutt
Files changed:
imap/message.c
Commit message: Don't overflow stack buffer in msg_parse_fetch


Vulnerable code:
      while (*s && *s != '\"')
      while (isdigit((unsigned char) *s))

Fixed code:
      while (*s && (*s != '\"') && (ptmp != (tmp + sizeof(tmp) - 1)))
      while (isdigit((unsigned char) *s) && (ptmp != (tmp + sizeof(tmp) - 1)))
CVE-2018-14359 (C, published 2018-07-17T17:29Z)
Description: value: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They have a buffer overflow via base64 data.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/neomutt/neomutt
Files changed:
imap/auth_cram.c
imap/auth_gss.c
mutt/base64.c
mutt/base64.h
mutt/rfc2047.c
test/base64.c
Commit message: Check outbuf length in mutt_to_base64()

The obuf can be overflowed in auth_cram.c, and possibly auth_gss.c.

Thanks to Jeriko One for the bug report.


Vulnerable code:
  len = mutt_b64_decode(obuf, idata->buf + 2);
    request_buf.length = mutt_b64_decode(buf2, idata->buf + 2);
  request_buf.length = mutt_b64_decode(buf2, idata->buf + 2);
 * @param out Output buffer for the raw bytes
 * @param in  Input  buffer for the null-terminated base64-encoded string
int mutt_b64_decode(char *out, const char *in)
int    mutt_b64_decode(char *out, const char *in);
    char *out = mutt_mem_malloc(3 * len / 4 + 1);
    int dlen = mutt_b64_decode(out, it);
  int len = mutt_b64_decode(buffer, encoded);
  declen = mutt_b64_decode(out2, out1);
    declen = mutt_b64_decode(out2, out1);

Fixed code:
  len = mutt_b64_decode(obuf, idata->buf + 2, sizeof(obuf));
    request_buf.length = mutt_b64_decode(buf2, idata->buf + 2, sizeof(buf2));
  request_buf.length = mutt_b64_decode(buf2, idata->buf + 2, sizeof(buf2));
 * @param out  Output buffer for the raw bytes
 * @param in   Input  buffer for the null-terminated base64-encoded string
 * @param olen Length of the output buffer
int mutt_b64_decode(char *out, const char *in, size_t olen)
    if (len == olen)
      return len;
      if (len == olen)
        return len;
        if (len == olen)
          return len;
int    mutt_b64_decode(char *out, const char *in, size_t olen);
    const int olen = 3 * len / 4 + 1;
    char *out = mutt_mem_malloc(olen);
    int dlen = mutt_b64_decode(out, it, olen);
  int len = mutt_b64_decode(buffer, encoded, sizeof(buffer));
  declen = mutt_b64_decode(out2, out1, sizeof(out2));
    declen = mutt_b64_decode(out2, out1, sizeof(out2));
CVE-2018-14360 (C, published 2018-07-17T17:29Z)
Description: value: An issue was discovered in NeoMutt before 2018-07-16. nntp_add_group in newsrc.c has a stack-based buffer overflow because of incorrect sscanf usage.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/neomutt/neomutt
Files changed:
newsrc.c
Commit message: Set length modifiers for group and desc

nntp_add_group parses a line controlled by the connected nntp server.
Restrict the maximum lengths read into the stack buffers group, and
desc.


Vulnerable code:
  char group[LONG_STRING];
  if (sscanf(line, "%s " ANUM " " ANUM " %c %[^\n]", group, &last, &first, &mod, desc) < 4)

Fixed code:
  char group[LONG_STRING] = "";
  /* These sscanf limits must match the sizes of the group and desc arrays */
  if (sscanf(line, "%1023s " ANUM " " ANUM " %c %8191[^\n]", group, &last, &first, &mod, desc) < 4)
  {
    mutt_debug(4, "Cannot parse server line: %s\n", line);
  }
CVE-2018-14361 (C, published 2018-07-17T17:29Z)
Description: value: An issue was discovered in NeoMutt before 2018-07-16. nntp.c proceeds even if memory allocation fails for messages data.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/neomutt/neomutt
Files changed:
nntp.c
Commit message: Add alloc fail check in nntp_fetch_headers


Vulnerable code:

Fixed code:
  if (fc.messages == NULL)
	  return -1;
CVE-2018-14362 (C, published 2018-07-17T17:29Z)
Description: value: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. pop.c does not forbid characters that may have unsafe interaction with message-cache pathnames, as demonstrated by a '/' character.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/neomutt/neomutt
Files changed:
newsrc.c
pop.c
Commit message: sanitise cache paths

Co-authored-by: JerikoOne <jeriko.one@gmx.us>


Vulnerable code:
  return snprintf(dest, destlen, "%s.hcache", path);
  return mutt_bcache_del(bcache, id);
          (mutt_bcache_exists(pop_data->bcache, ctx->hdrs[i]->data) == 0);
  msg->fp = mutt_bcache_get(pop_data->bcache, h->data);
    msg->fp = mutt_bcache_put(pop_data->bcache, h->data);
    mutt_bcache_commit(pop_data->bcache, h->data);
          mutt_bcache_del(pop_data->bcache, ctx->hdrs[i]->data);

Fixed code:
  int count = snprintf(dest, destlen, "%s.hcache", path);

  /* Strip out any directories in the path */
  char *first = strchr(dest, '/');
  char *last = strrchr(dest, '/');
  if (first && last && (last > first))
  {
    memmove(first, last, strlen(last) + 1);
    count -= (last - first);
  }

  return count;
/**
 * cache_id - Make a message-cache-compatible id
 * @param id POP message id
 * @retval ptr Sanitised string
 *
 * The POP message id may contain '/' and other awkward characters.
 *
 * @note This function returns a pointer to a static buffer.
 */
static const char *cache_id(const char *id)
{
  static char clean[SHORT_STRING];
  mutt_str_strfcpy(clean, id, sizeof(clean));
  mutt_file_sanitize_filename(clean, true);
  return clean;
}

  return mutt_bcache_del(bcache, cache_id(id));
          (mutt_bcache_exists(pop_data->bcache, cache_id(ctx->hdrs[i]->data)) == 0);
  msg->fp = mutt_bcache_get(pop_data->bcache, cache_id(h->data));
    msg->fp = mutt_bcache_put(pop_data->bcache, cache_id(h->data));
    mutt_bcache_commit(pop_data->bcache, cache_id(h->data));
          mutt_bcache_del(pop_data->bcache, cache_id(ctx->hdrs[i]->data));
CVE-2018-14363 (C, published 2018-07-17T17:29Z)
Description: value: An issue was discovered in NeoMutt before 2018-07-16. newsrc.c does not properly restrict '/' characters that may have unsafe interaction with cache pathnames.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/neomutt/neomutt
Files changed:
newsrc.c
pop.c
Commit message: sanitise cache paths

Co-authored-by: JerikoOne <jeriko.one@gmx.us>


Vulnerable code:
  return snprintf(dest, destlen, "%s.hcache", path);
  return mutt_bcache_del(bcache, id);
          (mutt_bcache_exists(pop_data->bcache, ctx->hdrs[i]->data) == 0);
  msg->fp = mutt_bcache_get(pop_data->bcache, h->data);
    msg->fp = mutt_bcache_put(pop_data->bcache, h->data);
    mutt_bcache_commit(pop_data->bcache, h->data);
          mutt_bcache_del(pop_data->bcache, ctx->hdrs[i]->data);

Fixed code:
  int count = snprintf(dest, destlen, "%s.hcache", path);

  /* Strip out any directories in the path */
  char *first = strchr(dest, '/');
  char *last = strrchr(dest, '/');
  if (first && last && (last > first))
  {
    memmove(first, last, strlen(last) + 1);
    count -= (last - first);
  }

  return count;
/**
 * cache_id - Make a message-cache-compatible id
 * @param id POP message id
 * @retval ptr Sanitised string
 *
 * The POP message id may contain '/' and other awkward characters.
 *
 * @note This function returns a pointer to a static buffer.
 */
static const char *cache_id(const char *id)
{
  static char clean[SHORT_STRING];
  mutt_str_strfcpy(clean, id, sizeof(clean));
  mutt_file_sanitize_filename(clean, true);
  return clean;
}

  return mutt_bcache_del(bcache, cache_id(id));
          (mutt_bcache_exists(pop_data->bcache, cache_id(ctx->hdrs[i]->data)) == 0);
  msg->fp = mutt_bcache_get(pop_data->bcache, cache_id(h->data));
    msg->fp = mutt_bcache_put(pop_data->bcache, cache_id(h->data));
    mutt_bcache_commit(pop_data->bcache, cache_id(h->data));
          mutt_bcache_del(pop_data->bcache, cache_id(ctx->hdrs[i]->data));
CVE-2020-14954 (C, published 2020-06-21T17:15Z)
Description: value: Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data (e.g., from a man-in-the-middle attacker) and evaluates it in a TLS context, aka "response injection."
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/neomutt/neomutt
Files changed:
conn/socket.c
conn/socket.h
imap/command.c
imap/imap.c
imap/private.h
nntp/nntp.c
pop/pop_lib.c
smtp.c
Commit message: tls: clear data after a starttls acknowledgement

After a starttls acknowledgement message, clear the buffers of any
incoming data / commands.  This will ensure that all future data is
handled securely.

Co-authored-by: Pietro Cerutti <gahr@gahr.ch>


Vulnerable code:
        enum ImapExecResult rc = imap_exec(adata, "STARTTLS", IMAP_CMD_NO_FLAGS);

Fixed code:

/**
 * mutt_socket_empty - Clear out any queued data
 *
 * The internal buffer is emptied and any data that has already arrived at this
 * machine (in kernel buffers) is read and dropped.
 */
void mutt_socket_empty(struct Connection *conn)
{
  if (!conn)
    return;

  char buf[1024];
  int bytes;

  while ((bytes = mutt_socket_poll(conn, 0)) > 0)
  {
    mutt_socket_read(conn, buf, MIN(bytes, sizeof(buf)));
  }
}
void               mutt_socket_empty   (struct Connection *conn);
  if (flags & IMAP_CMD_SINGLE)
  {
    // Process any existing commands
    if (adata->nextcmd != adata->lastcmd)
      imap_exec(adata, NULL, IMAP_CMD_POLL);
  }

    // The queue is empty, so the single command has been processed
    if ((flags & IMAP_CMD_SINGLE) && (adata->nextcmd == adata->lastcmd))
      break;
        enum ImapExecResult rc = imap_exec(adata, "STARTTLS", IMAP_CMD_SINGLE);
        // Clear any data after the STARTTLS acknowledgement
        mutt_socket_empty(adata->conn);

#define IMAP_CMD_SINGLE      (1 << 3)  ///< Run a single command
      // Clear any data after the STARTTLS acknowledgement
      mutt_socket_empty(conn);
      // Clear any data after the STLS acknowledgement
      mutt_socket_empty(adata->conn);
    // Clear any data after the STARTTLS acknowledgement
    mutt_socket_empty(conn);
CVE-2020-28896 (C, published 2020-11-23T19:15Z)
Description: value: Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $ssl_force_tls was processed if an IMAP server's initial server response was invalid. The connection was not properly closed, and the code could continue attempting to authenticate. This could result in authentication credentials being exposed on an unencrypted connection, or to a machine-in-the-middle.
Severity: LOW (CVSS v3 base score: 5.3)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/neomutt/neomutt
Files changed:
imap/imap.c
Commit message: imap: close connection on all failures

Thanks to Gabriel Salles-Loustau for spotting the problem.

Co-authored-by: Kevin McCarthy <kevin@8t8.us>


Vulnerable code:
        goto err_close_conn;
            goto err_close_conn;
      goto err_close_conn;
      goto err_close_conn;
#ifdef USE_SSL
err_close_conn:
  imap_close_connection(adata);
#endif

Fixed code:
        goto bail;
            goto bail;
      goto bail;
      goto bail;
  imap_close_connection(adata);
CVE-2020-28896 (C, published 2020-11-23T19:15Z)
Description: value: Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $ssl_force_tls was processed if an IMAP server's initial server response was invalid. The connection was not properly closed, and the code could continue attempting to authenticate. This could result in authentication credentials being exposed on an unencrypted connection, or to a machine-in-the-middle.
Severity: LOW (CVSS v3 base score: 5.3)
Weakness: CWE-755 \u2014 Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
Repository: https://github.com/neomutt/neomutt
Files changed:
imap/imap.c
Commit message: imap: close connection on all failures

Thanks to Gabriel Salles-Loustau for spotting the problem.

Co-authored-by: Kevin McCarthy <kevin@8t8.us>


Vulnerable code:
        goto err_close_conn;
            goto err_close_conn;
      goto err_close_conn;
      goto err_close_conn;
#ifdef USE_SSL
err_close_conn:
  imap_close_connection(adata);
#endif

Fixed code:
        goto bail;
            goto bail;
      goto bail;
      goto bail;
  imap_close_connection(adata);
CVE-2021-32055 (C, published 2021-05-05T16:15Z)
Description: value: Mutt 1.11.0 through 2.0.x before 2.0.7 (and NeoMutt 2019-10-25 through 2021-05-04) has a $imap_qresync issue in which imap/util.c has an out-of-bounds read in situations where an IMAP sequence set ends with a comma. NOTE: the $imap_qresync setting for QRESYNC is not enabled by default.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/neomutt/neomutt
Files changed:
imap/util.c
Commit message: Fix seqset iterator when it ends in a comma

If the seqset ended with a comma, the substr_end marker would be just
before the trailing nul.  In the next call, the loop to skip the
marker would iterate right past the end of string too.

The fix is simple: place the substr_end marker and skip past it
immediately.


Vulnerable code:
    while (!*(iter->substr_cur))
      iter->substr_cur++;
      *(iter->substr_end) = '\0';

Fixed code:
      *(iter->substr_end++) = '\0';
CVE-2015-7777 (Unknown, published 2015-11-21T11:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in index.php in JosephErnest Void before 2015-10-02 allows remote attackers to inject arbitrary web script or HTML via a crafted URI.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/josephernest/void
Files changed:
Commit message: Merge pull request #18 from g-sato/fix_security_bug

Security fix

Vulnerable code:

Fixed code: