hitoshura25/cvefixes huggingface dataset:
CVE-2017-9205 (C, published 2017-05-23T04:29Z)
Description: value: The iw_get_ui16be function in imagew-util.c:422:24 in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (invalid read and SEGV) via a crafted image, related to imagew-jpeg.c.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/jsummers/imageworsener
Files changed:
src/imagew-jpeg.c
Commit message: Fixed invalid memory access bugs when decoding JPEG Exif data

Fixes issues #22, #23, #24, #25


Vulnerable code:
	field_type = iw_get_ui16_e(&e->d[tag_pos+2],e->endian);
	value_count = iw_get_ui32_e(&e->d[tag_pos+4],e->endian);
		*pv = iw_get_ui16_e(&e->d[tag_pos+8],e->endian);
		*pv = iw_get_ui32_e(&e->d[tag_pos+8],e->endian);
	field_type = iw_get_ui16_e(&e->d[tag_pos+2],e->endian);
	value_count = iw_get_ui32_e(&e->d[tag_pos+4],e->endian);
	value_pos = iw_get_ui32_e(&e->d[tag_pos+8],e->endian);
	numer = iw_get_ui32_e(&e->d[value_pos  ],e->endian);
	denom = iw_get_ui32_e(&e->d[value_pos+4],e->endian);
	if(ifd<8 || ifd>e->d_len-18) return;
	tag_count = iw_get_ui16_e(&e->d[ifd],e->endian);
		tag_id = iw_get_ui16_e(&e->d[tag_pos],e->endian);
	ifd = iw_get_ui32_e(&d[4],e.endian);

Fixed code:
static unsigned int get_exif_ui16(struct iw_exif_state *e, unsigned int pos)
{
	if(e->d_len<2 || pos>e->d_len-2) return 0;
	return iw_get_ui16_e(&e->d[pos], e->endian);
}

static unsigned int get_exif_ui32(struct iw_exif_state *e, unsigned int pos)
{
	if(e->d_len<4 || pos>e->d_len-4) return 0;
	return iw_get_ui32_e(&e->d[pos], e->endian);
}

	field_type = get_exif_ui16(e, tag_pos+2);
	value_count = get_exif_ui32(e, tag_pos+4);
		*pv = get_exif_ui16(e, tag_pos+8);
		*pv = get_exif_ui32(e, tag_pos+8);
	field_type = get_exif_ui16(e, tag_pos+2);
	value_count = get_exif_ui32(e, tag_pos+4);
	value_pos = get_exif_ui32(e, tag_pos+8);
	numer = get_exif_ui32(e, value_pos);
	denom = get_exif_ui32(e, value_pos+4);
	if(ifd<8 || e->d_len<18 || ifd>e->d_len-18) return;
	tag_count = get_exif_ui16(e, ifd);
		tag_id = get_exif_ui16(e, tag_pos);
	ifd = get_exif_ui32(&e, 4);
CVE-2017-9206 (C, published 2017-05-23T04:29Z)
Description: value: The iw_get_ui16le function in imagew-util.c:405:23 in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted image, related to imagew-jpeg.c.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/jsummers/imageworsener
Files changed:
src/imagew-jpeg.c
Commit message: Fixed invalid memory access bugs when decoding JPEG Exif data

Fixes issues #22, #23, #24, #25


Vulnerable code:
	field_type = iw_get_ui16_e(&e->d[tag_pos+2],e->endian);
	value_count = iw_get_ui32_e(&e->d[tag_pos+4],e->endian);
		*pv = iw_get_ui16_e(&e->d[tag_pos+8],e->endian);
		*pv = iw_get_ui32_e(&e->d[tag_pos+8],e->endian);
	field_type = iw_get_ui16_e(&e->d[tag_pos+2],e->endian);
	value_count = iw_get_ui32_e(&e->d[tag_pos+4],e->endian);
	value_pos = iw_get_ui32_e(&e->d[tag_pos+8],e->endian);
	numer = iw_get_ui32_e(&e->d[value_pos  ],e->endian);
	denom = iw_get_ui32_e(&e->d[value_pos+4],e->endian);
	if(ifd<8 || ifd>e->d_len-18) return;
	tag_count = iw_get_ui16_e(&e->d[ifd],e->endian);
		tag_id = iw_get_ui16_e(&e->d[tag_pos],e->endian);
	ifd = iw_get_ui32_e(&d[4],e.endian);

Fixed code:
static unsigned int get_exif_ui16(struct iw_exif_state *e, unsigned int pos)
{
	if(e->d_len<2 || pos>e->d_len-2) return 0;
	return iw_get_ui16_e(&e->d[pos], e->endian);
}

static unsigned int get_exif_ui32(struct iw_exif_state *e, unsigned int pos)
{
	if(e->d_len<4 || pos>e->d_len-4) return 0;
	return iw_get_ui32_e(&e->d[pos], e->endian);
}

	field_type = get_exif_ui16(e, tag_pos+2);
	value_count = get_exif_ui32(e, tag_pos+4);
		*pv = get_exif_ui16(e, tag_pos+8);
		*pv = get_exif_ui32(e, tag_pos+8);
	field_type = get_exif_ui16(e, tag_pos+2);
	value_count = get_exif_ui32(e, tag_pos+4);
	value_pos = get_exif_ui32(e, tag_pos+8);
	numer = get_exif_ui32(e, value_pos);
	denom = get_exif_ui32(e, value_pos+4);
	if(ifd<8 || e->d_len<18 || ifd>e->d_len-18) return;
	tag_count = get_exif_ui16(e, ifd);
		tag_id = get_exif_ui16(e, tag_pos);
	ifd = get_exif_ui32(&e, 4);
CVE-2017-9207 (C, published 2017-05-23T04:29Z)
Description: value: The iw_get_ui16be function in imagew-util.c:422:24 in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted image, related to imagew-jpeg.c.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/jsummers/imageworsener
Files changed:
src/imagew-jpeg.c
Commit message: Fixed invalid memory access bugs when decoding JPEG Exif data

Fixes issues #22, #23, #24, #25


Vulnerable code:
	field_type = iw_get_ui16_e(&e->d[tag_pos+2],e->endian);
	value_count = iw_get_ui32_e(&e->d[tag_pos+4],e->endian);
		*pv = iw_get_ui16_e(&e->d[tag_pos+8],e->endian);
		*pv = iw_get_ui32_e(&e->d[tag_pos+8],e->endian);
	field_type = iw_get_ui16_e(&e->d[tag_pos+2],e->endian);
	value_count = iw_get_ui32_e(&e->d[tag_pos+4],e->endian);
	value_pos = iw_get_ui32_e(&e->d[tag_pos+8],e->endian);
	numer = iw_get_ui32_e(&e->d[value_pos  ],e->endian);
	denom = iw_get_ui32_e(&e->d[value_pos+4],e->endian);
	if(ifd<8 || ifd>e->d_len-18) return;
	tag_count = iw_get_ui16_e(&e->d[ifd],e->endian);
		tag_id = iw_get_ui16_e(&e->d[tag_pos],e->endian);
	ifd = iw_get_ui32_e(&d[4],e.endian);

Fixed code:
static unsigned int get_exif_ui16(struct iw_exif_state *e, unsigned int pos)
{
	if(e->d_len<2 || pos>e->d_len-2) return 0;
	return iw_get_ui16_e(&e->d[pos], e->endian);
}

static unsigned int get_exif_ui32(struct iw_exif_state *e, unsigned int pos)
{
	if(e->d_len<4 || pos>e->d_len-4) return 0;
	return iw_get_ui32_e(&e->d[pos], e->endian);
}

	field_type = get_exif_ui16(e, tag_pos+2);
	value_count = get_exif_ui32(e, tag_pos+4);
		*pv = get_exif_ui16(e, tag_pos+8);
		*pv = get_exif_ui32(e, tag_pos+8);
	field_type = get_exif_ui16(e, tag_pos+2);
	value_count = get_exif_ui32(e, tag_pos+4);
	value_pos = get_exif_ui32(e, tag_pos+8);
	numer = get_exif_ui32(e, value_pos);
	denom = get_exif_ui32(e, value_pos+4);
	if(ifd<8 || e->d_len<18 || ifd>e->d_len-18) return;
	tag_count = get_exif_ui16(e, ifd);
		tag_id = get_exif_ui16(e, tag_pos);
	ifd = get_exif_ui32(&e, 4);
CVE-2024-21669 (Unknown, published 2024-01-11T06:15Z)
Description: value: Hyperledger Aries Cloud Agent Python (ACA-Py) is a foundation for building decentralized identity applications and services running in non-mobile environments. When verifying W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDP-VCs), the result of verifying the presentation `document.proof` was not factored into the final `verified` value (`true`/`false`) on the presentation record. The flaw enables holders of W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDPs) to present incorrectly constructed proofs, and allows malicious verifiers to save and replay a presentation from such holders as their own. This vulnerability has been present since version 0.7.0 and fixed in version 0.10.5.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-347 \u2014 Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Repository: https://github.com/hyperledger/aries-cloudagent-python
Files changed:
Commit message: Merge pull request #2615 from dbluhm/fix/presentation-result-verification

fix: report presentation result

Vulnerable code:

Fixed code:
CVE-2021-24892 (PHP, published 2021-11-23T20:15Z)
Description: value: Insecure Direct Object Reference in edit function of Advanced Forms (Free & Pro) before 1.6.9 allows authenticated remote attacker to change arbitrary user's email address and request for reset password, which could lead to take over of WordPress's administrator account. To exploit this vulnerability, an attacker must register to obtain a valid WordPress's user and use such user to authenticate with WordPress in order to exploit the vulnerable edit function.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-639 \u2014 Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Repository: https://github.com/advancedforms/advanced-forms
Files changed:
core/forms/forms-rendering.php
core/forms/forms-submissions.php
Commit message: Added form nonce with arguments

This fixes a security issue where arguments could be edited client-side.


Vulnerable code:
      $nonce = wp_create_nonce( 'acf_nonce' );
      echo sprintf( '<input type="hidden" name="_acfnonce" value="%s">', $nonce );
      echo sprintf( '<input type="hidden" name="nonce" value="%s">', $nonce );
      echo sprintf( '<input type="hidden" name="af_form_args" value="%s">', base64_encode( json_encode( $args ) ) );
      echo sprintf( '<input type="hidden" name="_acf_form" value="%s">', base64_encode( json_encode( $args ) ) );
    $args = json_decode( base64_decode( $_POST['af_form_args'] ), true );

Fixed code:
      $acf_nonce = wp_create_nonce( 'acf_nonce' );
      echo sprintf( '<input type="hidden" name="_acfnonce" value="%s">', $acf_nonce );
      echo sprintf( '<input type="hidden" name="nonce" value="%s">', $acf_nonce );

      $encoded_args = base64_encode( json_encode( $args ) );
      echo sprintf( '<input type="hidden" name="af_form_args" value="%s">', $encoded_args );
      echo sprintf( '<input type="hidden" name="_acf_form" value="%s">', $encoded_args );

      // Add nonce to ensure arguments can't be altered.
      $hashed_args = hash( 'sha256', $encoded_args );
      $nonce = wp_create_nonce( sprintf( 'af_submission_%s_%s', $form['key'], $hashed_args ) );
      echo sprintf( '<input type="hidden" name="af_form_nonce" value="%s">', $nonce );
    $encoded_args = $_POST['af_form_args'];
    $args = json_decode( base64_decode( $encoded_args ), true );

    // Verify nonce
    $nonce = $_POST['af_form_nonce'];
    $hashed_args = hash( 'sha256', $encoded_args );
    $nonce_value = sprintf( 'af_submission_%s_%s', $form['key'], $hashed_args );
    if ( ! wp_verify_nonce( $nonce, $nonce_value ) ) {
      wp_die( 'Invalid form nonce' );
      exit;
    }
CVE-2023-32696 (Unknown, published 2023-05-30T19:15Z)
Description: value: CKAN is an open-source data management system for powering data hubs and data portals. Prior to versions 2.9.9 and 2.10.1, the `ckan` user (equivalent to www-data) owned code and configuration files in the docker container and the `ckan` user had the permissions to use sudo. These issues allowed for code execution or privilege escalation if an arbitrary file write bug was available. Versions 2.9.9, 2.9.9-dev, 2.10.1, and 2.10.1-dev contain a patch.




Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-269 \u2014 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Repository: https://github.com/ckan/ckan-docker-base
Files changed:
Commit message: Merge pull request from GHSA-c74x-xfvr-x5wg

2.10 and 2.9 changes

Vulnerable code:

Fixed code:
CVE-2023-46448 (PHP, published 2023-11-01T22:15Z)
Description: value: Reflected Cross-Site Scripting (XSS) vulnerability in dmpop Mejiro Commit Versions Prior To 3096393 allows attackers to run arbitrary code via crafted string in metadata of uploaded images.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/dmpop/mejiro
Files changed:
index.php
Commit message: Fix reflected XSS vulnerability


Vulnerable code:
						'lat' => $lat,
						'lon' => $lon
			$aperture = (is_null($exif['COMPUTED']['ApertureFNumber']) ? null : $exif['COMPUTED']['ApertureFNumber']);
			$exposure = (is_null($exif['EXIF']['ExposureTime']) ? null : $exif['EXIF']['ExposureTime']);
					$exposure = ' &bull; 1/' . round($parts[1] / $parts[0], 0);
						$exposure = ' &bull; ' . $parts[0];
						$exposure = ' &bull; ' . $parts[0] . '/' . $parts[1];
			$iso = (is_null($exif['EXIF']['ISOSpeedRatings']) ? null : " &bull; " . $exif['EXIF']['ISOSpeedRatings']);
			$datetime = $exif['EXIF']['DateTimeOriginal'] ?? null;
			$comment = $exif['COMMENT']['0'] ?? null;

Fixed code:
						'lat' => htmlentities($lat),
						'lon' => htmlentities($lon)
			$aperture = htmlentities((is_null($exif['COMPUTED']['ApertureFNumber']) ? null : $exif['COMPUTED']['ApertureFNumber']));
			$exposure = htmlentities((is_null($exif['EXIF']['ExposureTime']) ? null : $exif['EXIF']['ExposureTime']));
					$exposure = htmlentities(' &bull; 1/' . round($parts[1] / $parts[0], 0));
						$exposure = htmlentities(' &bull; ' . $parts[0]);
						$exposure = htmlentities(' &bull; ' . $parts[0] . '/' . $parts[1]);
			$iso = htmlentities((is_null($exif['EXIF']['ISOSpeedRatings']) ? null : " &bull; " . $exif['EXIF']['ISOSpeedRatings']));
			$datetime = htmlentities($exif['EXIF']['DateTimeOriginal']) ?? null;
			$comment = htmlentities($exif['COMMENT']['0']) ?? null;
CVE-2015-10076 (Java, published 2023-02-09T23:15Z)
Description: value: A vulnerability was found in dimtion Shaarlier up to 1.2.2. It has been declared as critical. Affected by this vulnerability is the function createTag of the file app/src/main/java/com/dimtion/shaarlier/TagsSource.java of the component Tag Handler. The manipulation leads to sql injection. Upgrading to version 1.2.3 is able to address this issue. The identifier of the patch is 3d1d9b239d9b3cd87e8bed45a0f02da583ad371e. It is recommended to upgrade the affected component. The identifier VDB-220453 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/dimtion/Shaarlier
Files changed:
app/src/main/java/com/dimtion/shaarlier/TagsSource.java
Commit message: Solve bug with tags (possible sql injection)


Vulnerable code:
                MySQLiteHelper.TAGS_COLUMN_ID_ACCOUNT + " = " + tag.getMasterAccountId() + " AND " +
                        MySQLiteHelper.TAGS_COLUMN_TAG + " = '" + tag.getValue() + "'",
                null, null, null, null);

Fixed code:
        String[] getTagArgs = {String.valueOf(tag.getMasterAccountId()), tag.getValue()};

                MySQLiteHelper.TAGS_COLUMN_ID_ACCOUNT + " = ? AND " +
                        MySQLiteHelper.TAGS_COLUMN_TAG + " = ?",
                getTagArgs, null, null, null);
CVE-2016-5104 (C, published 2016-06-13T14:59Z)
Description: value: The socket_create function in common/socket.c in libimobiledevice and libusbmuxd allows remote attackers to bypass intended access restrictions and communicate with services on iOS devices by connecting to an IPv4 TCP socket.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/libimobiledevice/libusbmuxd
Files changed:
common/socket.c
Commit message: common: [security fix] Make sure sockets only listen locally


Vulnerable code:
	saddr.sin_addr.s_addr = htonl(INADDR_ANY);
	addr.sin_addr.s_addr = htonl(INADDR_ANY);

Fixed code:
	saddr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
	addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
CVE-2019-3465 (PHP, published 2019-11-07T20:15Z)
Description: value: Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-347 \u2014 Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Repository: https://github.com/robrichards/xmlseclibs
Files changed:
CHANGELOG.txt
LICENSE
src/XMLSecurityDSig.php
xmlseclibs.php
Commit message: Release 3.0.4. Security release for CVE-2019-3465


Vulnerable code:
??, ??? 2018, 3.0.4-dev
Copyright (c) 2007-2018, Robert Richards <rrichards@cdatazone.org>.
                            $arXpath['namespaces'] = array();
        $query = "./secdsig:SignedInfo/secdsig:Reference";
        $query = "./secdsig:SignedInfo/secdsig:Reference";
 * @version   3.0.4-dev

Fixed code:
06, Nov 2019, 3.0.4
Security Improvements:
- Insure only a single SignedInfo element exists within a signature during 
  verification. Refs CVE-2019-3465.
Bug Fixes:
- Fix variable casing.
Copyright (c) 2007-2019, Robert Richards <rrichards@cdatazone.org>.
            $query = "./secdsig:SignedInfo";
            $nodeset = $xpath->query($query, $this->sigNode);
            if ($nodeset->length > 1) {
                throw new Exception("Invalid structure - Too many SignedInfo elements found");
            }
            if ($nodeset->length > 1) {
                throw new Exception("Invalid structure - Too many SignedInfo elements found");
            }
                            $arXPath['namespaces'] = array();
        $query = "./secdsig:SignedInfo[1]/secdsig:Reference";
        $query = "./secdsig:SignedInfo[1]/secdsig:Reference";
 * @version   3.0.4
CVE-2018-11652 (Other, published 2018-06-01T15:29Z)
Description: value: CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject arbitrary OS commands via the Server field in an HTTP response header, which is directly injected into a CSV report.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-1236 \u2014 Improper Neutralization of Formula Elements in a CSV File
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
Repository: https://github.com/sullo/nikto
Files changed:
program/plugins/nikto_outdated.plugin
program/plugins/nikto_report_csv.plugin
Commit message: Fix CSV injection issue if server responds with a malicious Server string & CSV output is opened in Excel or other spreadsheet app. Potentially malicious cell start characters are now prefaced with a ' mark. Thanks to Adam (@bytesoverbombs) for letting me know!

Also fixed a crash in the outdated plugin if the $sepr field ends up being something that triggers a panic in split().


Vulnerable code:
            my @T = split(/$sepr/, $mark->{'banner'});
    print $handle "\"$hostname\","
      . "\"$mark->{'ip'}\","
      . "\"$mark->{'port'}\"," . "\"\"," . "\"\"," . "\"\","
      . "\"$mark->{'banner'}\"\n";
        $line .= "\"$hostname\",";
        $line .= "\"$item->{'mark'}->{'ip'}\",";
        $line .= "\"$item->{'mark'}->{'port'}\",";
        if ($item->{'method'} ne '') { $line .= $item->{'method'}; }
			{ $line .= $mark->{'root'} . $uri; }
		else { $line .= $uri; }
		my $msg = $item->{'message'};
		$uri=quotemeta($uri);
		my $root = quotemeta($mark->{'root'});
		$msg =~ s/^$uri:\s//;
		$msg =~ s/^$root$uri:\s//;
        $line .= "\"$msg\"";

Fixed code:
            my @T = split(/\\$sepr/, $mark->{'banner'});
    print $handle "\"" . csv_safecell($hostname) . "\","
      . "\"" . csv_safecell($mark->{'ip'}) . "\","
      . "\"" . csv_safecell($mark->{'port'}) . "\"," . "\"\"," . "\"\"," . "\"\","
      #. "\"" . $mark->{'banner'} . "\"\n";
      . "\"" . csv_safecell($mark->{'banner'}) . "\"\n";
        $line .= "\"" . csv_safecell($hostname) . "\",";
        $line .= "\"" . csv_safecell($item->{'mark'}->{'ip'}) . \",";
        $line .= "\"" . csv_safecell($item->{'mark'}->{'port'}) . "\",";
        if ($item->{'method'} ne '') { $line .= csv_safecell($item->{'method'}); }
			{ $line .= csv_safecell($mark->{'root'}) . $uri; }
		else { $line .= csv_safecell($uri); }
	my $msg = $item->{'message'};
	$uri=quotemeta($uri);
	my $root = quotemeta($mark->{'root'});
	$msg =~ s/^$uri:\s//;
	$msg =~ s/^$root$uri:\s//;
        $line .= "\"" . csv_safecell($msg) ."\"";
###############################################################################
# prevent CSV injection attacks
sub csv_safecell {
    my $celldata = $_[0] || return;
    if ($celldata =~ /^[=+@-]/) { $celldata = "'" . $celldata; }
    return $celldata;
}
CVE-2024-27319 (C++, published 2024-02-23T18:15Z)
Description: value: Versions of the package onnx before and including 1.15.0 are vulnerable to Out-of-bounds Read as the ONNX_ASSERT and ONNX_ASSERTM functions have an off by one string copy.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/onnx/onnx
Files changed:
onnx/common/assertions.cc
Commit message: Fix Out of bounds read due to lack of string termination in assert (#5918)

Signed-off-by: liqunfu <liqun.fu@microsoft.com>
Co-authored-by: G. Ramalingam <grama@microsoft.com>

Vulnerable code:
  char msg[2048];
  // Although vsnprintf might have vulnerability issue while using format string with overflowed length,
  // it should be safe here to use fixed length for buffer "msg". No further checking is needed.
  vsnprintf(msg, 2048, fmt, args);
  return std::string(msg);

Fixed code:
#include <array>
  constexpr size_t buffer_size = 2048;
  std::array<char, buffer_size> msg{};

  // use fixed length for buffer "msg" to avoid buffer overflow
  vsnprintf(static_cast<char*>(msg.data()), msg.size() - 1, fmt, args);

  // ensure null-terminated string to avoid out of bounds read
  msg.back() = '\0';
  return std::string(msg.data());