hitoshura25/cvefixes huggingface dataset:
CVE-2019-14980 (C, published 2019-08-12T23:15Z)
Description: value: In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in the UnmapBlob function that allows an attacker to cause a denial of service by sending a crafted file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/ImageMagick/ImageMagick6
Files changed:
magick/blob.c
Commit message: https://github.com/ImageMagick/ImageMagick6/issues/43


Vulnerable code:

Fixed code:
      blob_info->data=NULL;
CVE-2019-14981 (C, published 2019-08-12T23:15Z)
Description: value: In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in the MeanShiftImage function. It allows an attacker to cause a denial of service by sending a crafted file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-369 \u2014 Divide By Zero
The product divides a value by zero.
Repository: https://github.com/ImageMagick/ImageMagick6
Files changed:
magick/feature.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1552


Vulnerable code:
        gamma=1.0/count;

Fixed code:
        gamma=PerceptibleReciprocal(count);
CVE-2019-15141 (C, published 2019-08-18T19:15Z)
Description: value: WriteTIFFImage in coders/tiff.c in ImageMagick 7.0.8-43 Q16 allows attackers to cause a denial-of-service (application crash resulting from a heap-based buffer over-read) via a crafted TIFF image file, related to TIFFRewriteDirectory, TIFFWriteDirectory, TIFFWriteDirectorySec, and TIFFWriteDirectoryTagColormap in tif_dirwrite.c of LibTIFF. NOTE: this occurs because of an incomplete fix for CVE-2019-11597.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick6
Files changed:
coders/tiff.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1560


Vulnerable code:
    if (image->exception.severity > ErrorException)
      break;
    (void) TIFFWriteDirectory(tiff);
  return(image->exception.severity > ErrorException ? MagickFalse : MagickTrue);

Fixed code:
    if (TIFFWriteDirectory(tiff) == 0)
      {
        status=MagickFalse;
        break;
      }
  return(status);
CVE-2020-27764 (C, published 2020-12-03T17:15Z)
Description: value: In /MagickCore/statistic.c, there are several areas in ApplyEvaluateOperator() where a size_t cast should have been a ssize_t cast, which causes out-of-range values under some circumstances when a crafted input file is processed by ImageMagick. Red Hat Product Security marked this as Low severity because although it could potentially lead to an impact to application availability, no specific impact was shown in this case. This flaw affects ImageMagick versions prior to 6.9.10-69.
Severity: MEDIUM (CVSS v3 base score: 3.3)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/ImageMagick/ImageMagick6
Files changed:
magick/statistic.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1735


Vulnerable code:
      result=(MagickRealType) ((size_t) pixel & (size_t) (value+0.5));
      result=(MagickRealType) ((size_t) pixel << (size_t) (value+0.5));
      result=(MagickRealType) ((size_t) pixel | (size_t) (value+0.5));
      result=(MagickRealType) ((size_t) pixel >> (size_t) (value+0.5));
      result=(MagickRealType) ((size_t) pixel ^ (size_t) (value+0.5));

Fixed code:
      result=(MagickRealType) ((ssize_t) pixel & (ssize_t) (value+0.5));
      result=(MagickRealType) ((ssize_t) pixel << (ssize_t) (value+0.5));
      result=(MagickRealType) ((ssize_t) pixel | (ssize_t) (value+0.5));
      result=(MagickRealType) ((ssize_t) pixel >> (ssize_t) (value+0.5));
      result=(MagickRealType) ((ssize_t) pixel ^ (ssize_t) (value+0.5));
CVE-2021-3574 (C, published 2022-08-26T16:15Z)
Description: value: A vulnerability was found in ImageMagick-7.0.11-5, where executing a crafted file with the convert command, ASAN detects memory leaks.
Severity: nan (CVSS v3 base score: 3.3)
Weakness: CWE-401 \u2014 Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
Repository: https://github.com/ImageMagick/ImageMagick6
Files changed:
coders/tiff.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/3540


Vulnerable code:
    if (samples_per_pixel > MaxPixelChannels)
      {
        TIFFClose(tiff);
        ThrowReaderException(CorruptImageError,"MaximumChannelsExceeded");
      }

Fixed code:
    if (samples_per_pixel > MaxPixelChannels)
      {
        TIFFClose(tiff);
        ThrowReaderException(CorruptImageError,"MaximumChannelsExceeded");
      }
CVE-2022-1115 (C, published 2022-08-29T15:15Z)
Description: value: A heap-buffer-overflow flaw was found in ImageMagick’s PushShortPixel() function of quantum-private.h file. This vulnerability is triggered when an attacker passes a specially crafted TIFF image file to ImageMagick for conversion, potentially leading to a denial of service.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick6
Files changed:
coders/tiff.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/4974


Vulnerable code:
        extent=MagickMax(rows*TIFFTileRowSize(tiff),TIFFTileSize(tiff));

Fixed code:
        extent=4*MagickMax(rows*TIFFTileRowSize(tiff),TIFFTileSize(tiff));
CVE-2022-28463 (C, published 2022-05-08T23:15Z)
Description: value: ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/ImageMagick/ImageMagick6
Files changed:
coders/cin.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/4988


Vulnerable code:

Fixed code:
  if (cin.file.image_offset < 712)
    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
CVE-2022-3213 (C, published 2022-09-19T18:15Z)
Description: value: A heap buffer overflow issue was found in ImageMagick. When an application processes a malformed TIFF file, it could lead to undefined behavior or a crash causing a denial of service.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick6
Files changed:
coders/tiff.c
Commit message: squash heap-buffer-overflow, PoC TIFF from Hardik


Vulnerable code:
        extent=4*(samples_per_pixel+1)*TIFFStripSize(tiff);

Fixed code:
        extent=4*((image->depth+7)/8)*(samples_per_pixel+1)*TIFFStripSize(tiff);
CVE-2022-32545 (C, published 2022-06-16T18:15Z)
Description: value: A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned char' at coders/psd.c, when crafted or untrusted input is processed. This leads to a negative impact to application availability or other problems related to undefined behavior.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/ImageMagick/ImageMagick6
Files changed:
coders/emf.c
coders/psd.c
magick/widget.c
wand/animate.c
wand/display.c
Commit message: Pull request: https://github.com/ImageMagick/ImageMagick/pull/4963


Vulnerable code:
  if (((PAPMHEADER) pBits)->dwKey != 0x9ac6cdd7l)
          SetPSDPixel(image,channels,type,packet_size,(((unsigned char) pixel)
            & (0x01 << (7-bit))) != 0 ? 0 : QuantumRange,q++,indexes,x++);
              return(MagickFalse);
              return(MagickFalse);

Fixed code:
  if (((PAPMHEADER) pBits)->dwKey != 0x9ac6cdd7l ||
      (((PAPMHEADER) pBits)->wInch == 0))
          SetPSDPixel(image,channels,type,packet_size,
            (((unsigned char) ((ssize_t) pixel)) & (0x01 << (7-bit))) != 0 ? 0 :
            QuantumRange,q++,indexes,x++);
        if (selection_info.height == 0)
          break;
        if (selection_info.height == 0)
          break;
        if (selection_info.height == 0)
          break;
              {
                DestroyAnimate();
                return(MagickFalse);
              }
              {
                DestroyDisplay();
                return(MagickFalse);
              }
CVE-2022-32546 (C, published 2022-06-16T18:15Z)
Description: value: A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned long' at coders/pcl.c, when crafted or untrusted input is processed. This leads to a negative impact to application availability or other problems related to undefined behavior.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/ImageMagick/ImageMagick6
Files changed:
coders/pcl.c
Commit message: https://github.com/ImageMagick/ImageMagick/pull/4986


Vulnerable code:
    width=(size_t) floor(bounds.x2-bounds.x1+0.5);
    height=(size_t) floor(bounds.y2-bounds.y1+0.5);

Fixed code:
    width=(size_t) CastDoubleToLong(floor(bounds.x2-bounds.x1+0.5));
    height=(size_t) CastDoubleToLong(floor(bounds.y2-bounds.y1+0.5));
CVE-2022-32547 (C, published 2022-06-16T18:15Z)
Description: value: In ImageMagick, there is load of misaligned address for type 'double', which requires 8 byte alignment and for type 'float', which requires 4 byte alignment at MagickCore/property.c. Whenever crafted or untrusted input is processed by ImageMagick, this causes a negative impact to application availability or other problems related to undefined behavior.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-704 \u2014 Incorrect Type Conversion or Cast
The product does not correctly convert an object, resource, or structure from one type to a different type.
Repository: https://github.com/ImageMagick/ImageMagick6
Files changed:
magick/property.c
Commit message: https://github.com/ImageMagick/ImageMagick/pull/5034


Vulnerable code:
              EXIFMultipleValues(4,"%f",(double) *(float *) p1);
              EXIFMultipleValues(8,"%f",*(double *) p1);

Fixed code:
              EXIFMultipleValues(4,"%.20g",(double)
                ReadPropertySignedLong(endian,p1));
              EXIFMultipleValues(8,"%.20g",(double)
                ReadPropertySignedLong(endian,p1));
CVE-2023-1906 (C, published 2023-04-12T22:15Z)
Description: value: A heap-based buffer overflow issue was discovered in ImageMagick's ImportMultiSpectralQuantum() function in MagickCore/quantum-import.c. An attacker could pass specially crafted file to convert, triggering an out-of-bounds read error, allowing an application to crash, resulting in a denial of service.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick6
Files changed:
coders/tiff.c
Commit message: possible heap buffer overflow (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-35q2-86c7-9247)


Vulnerable code:
        extent=4*MagickMax(image->columns*(samples_per_pixel+extra_samples)*
          (image->depth+7)/8,TIFFStripSize(tiff));

Fixed code:
        extent=MagickMax(sizeof(uint32),(samples_per_pixel+extra_samples)*
          (image->depth+7)/8)*image->columns*rows_per_strip;
CVE-2023-3195 (Other, published 2023-06-16T20:15Z)
Description: value: A stack-based buffer overflow issue was found in ImageMagick's coders/tiff.c. This flaw allows an attacker to trick the user into opening a specially crafted malicious tiff file, causing an application to crash, resulting in a denial of service.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick6
Files changed:
ChangeLog
coders/tiff.c
Commit message: fix stack overflow when parsing malicious tiff image


Vulnerable code:

Fixed code:
  * fix stack overflow when parsing malicious tiff image file (report from
    Muhammad Aldo Firmansyah).
#if defined(TIFF_VERSION_BIG)
        extent+=image->columns*sizeof(uint64);
#else
        extent+=image->columns*sizeof(uint32);
#endif
CVE-2023-3745 (Other, published 2023-07-24T16:15Z)
Description: value: A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel() function in quantum-private.h. This issue may allow a local attacker to trick the user into opening a specially crafted file, triggering an out-of-bounds read error and allowing an application to crash, resulting in a denial of service.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick6
Files changed:
ChangeLog
coders/tiff.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1857


Vulnerable code:

Fixed code:
  * Prevent heap overflow (reference
    https://github.com/ImageMagick/ImageMagick/issues/1857).
        if (photometric == PHOTOMETRIC_YCBCR)
          extent<<=1;
CVE-2023-3745 (C, published 2023-07-24T16:15Z)
Description: value: A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel() function in quantum-private.h. This issue may allow a local attacker to trick the user into opening a specially crafted file, triggering an out-of-bounds read error and allowing an application to crash, resulting in a denial of service.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick6
Files changed:
coders/tiff.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1857


Vulnerable code:
    if (photometric == PHOTOMETRIC_LOGLUV)
        if (photometric == PHOTOMETRIC_YCBCR)
          extent<<=1;

Fixed code:
    if ((photometric == PHOTOMETRIC_LOGLUV) ||
        (photometric == PHOTOMETRIC_YCBCR))
CVE-2023-39978 (C, published 2023-08-08T06:15Z)
Description: value: ImageMagick before 6.9.12-91 allows attackers to cause a denial of service (memory consumption) in Magick::Draw.
Severity: nan (CVSS v3 base score: 3.3)
Weakness: CWE-401 \u2014 Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
Repository: https://github.com/ImageMagick/ImageMagick6
Files changed:
magick/draw.c
Commit message: Fixed memory leak.


Vulnerable code:
  clone_info->image_info=CloneImageInfo(draw_info->image_info);

Fixed code:
CVE-2023-46404 (Markdown, published 2023-11-03T16:15Z)
Description: value: PCRS <= 3.11 (d0de1e) “Questions” page and “Code editor” page are vulnerable to remote code execution (RCE) by escaping Python sandboxing.
Severity: nan (CVSS v3 base score: 9.9)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://bitbucket.org/utmandrew/pcrs
Files changed:
CHANGELOG.md
Commit message: Citing CVE


Vulnerable code:

Fixed code:
- A CVE (https://github.com/windecks/CVE-2023-46404/) was reported and has been partially mitigated. Changes in 3.11 use RestrictedPython, which has reduced functionality somewhat. A more complete fix requires sandboxing of the installation, which is recommended; a guide for doing so is in preparation.
CVE-2014-9273 (C, published 2014-12-08T16:59Z)
Description: value: lib/handle.c in Hivex before 1.3.11 allows local users to execute arbitrary code and gain privileges via a small hive files, which triggers an out-of-bounds read or write.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/libguestfs/hivex
Files changed:
lib/handle.c
Commit message: handle: Check that pages do not extend beyond the end of the file.

Thanks: Mahmoud Al-Qudsi


Vulnerable code:

Fixed code:
    if (off + page_size > h->size) {
      SET_ERRNO (ENOTSUP,
                 "%s: page size %zu at 0x%zx extends beyond end of file, bad registry",
                 filename, page_size, off);
      goto error;
    }
CVE-2014-9273 (C, published 2014-12-08T16:59Z)
Description: value: lib/handle.c in Hivex before 1.3.11 allows local users to execute arbitrary code and gain privileges via a small hive files, which triggers an out-of-bounds read or write.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/libguestfs/hivex
Files changed:
lib/handle.c
Commit message: handle: Refuse to open files < 8192 bytes in size.

These cannot be valid hives, since they don't contain a full header
page and at least a single page of data (in other words they couldn't
contain a root node).

Thanks: Mahmoud Al-Qudsi


Vulnerable code:

Fixed code:
  if (h->size < 0x2000) {
    SET_ERRNO (EINVAL,
               "%s: file is too small to be a Windows NT Registry hive file",
               filename);
    goto error;
  }
CVE-2021-3622 (C, published 2021-12-23T21:15Z)
Description: value: A flaw was found in the hivex library. This flaw allows an attacker to input a specially crafted Windows Registry (hive) file, which would cause hivex to recursively call the _get_children() function, leading to a stack overflow. The highest threat from this vulnerability is to system availability.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/libguestfs/hivex
Files changed:
lib/node.c
Commit message: lib/node.c: Limit recursion in ri-records (CVE-2021-3622)

Windows Registry hive "ri"-records are arbitrarily nested B-tree-like
structures:

  +-------------+
  | ri          |
  |-------------|
  | nr_offsets  |
  |   offset[0] ------>  points to another lf/lh/li/ri block
  |   offset[1] ------>
  |   offset[2] ------>
  +-------------+

It is possible to construct a hive with a very deeply nested tree of
ri-records, causing the internal _get_children function to recurse to
any depth which can cause programs linked to hivex to crash with a
stack overflow.

Since it is not thought that deeply nested ri-records occur in real
hives, limit recursion depth.  If you hit this limit you will see the
following error and the operation will return an error instead of
crashing:

  \> ls
  hivex: _get_children: returning EINVAL because: ri-record nested to depth >= 32
  ls: Invalid argument

Thanks to Jeremy Galindo for finding and reporting this bug.

Reported-by: Jeremy Galindo, Sr Security Engineer, Datto.com
Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
Fixes: CVE-2021-3622
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1975489
(cherry picked from commit 781a12c4a49dd81365c9c567c5aa5e19e894ba0e)


Vulnerable code:
                          int flags);
  if (_get_children (h, subkey_lf, &children, &blocks, flags) == -1)
               int flags)
      if (_get_children (h, offset, children, blocks, flags) == -1)

Fixed code:
                          int flags, unsigned depth);
  if (_get_children (h, subkey_lf, &children, &blocks, flags, 0) == -1)
               int flags, unsigned depth)
      /* Although in theory hive ri records might be nested to any
       * depth, in practice this is unlikely.  Recursing here caused
       * CVE-2021-3622.  Thus limit the depth we will recurse to
       * something small.
       */
      if (depth >= 32) {
        SET_ERRNO (EINVAL, "ri-record nested to depth >= %u", depth);
        return -1;
      }

      if (_get_children (h, offset, children, blocks, flags, depth+1) == -1)