hitoshura25/cvefixes huggingface dataset:
CVE-2023-26485 (Unknown, published 2023-03-31T23:15Z)
Description: value: cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `_` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources.




### Impact

A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service.

### Proof of concept

```
$ ~/cmark-gfm$ python3 -c 'pad = "_" * 100000; print(pad + "." + pad, end="")' | time ./build/src/cmark-gfm --to plaintext
```

Increasing the number 10000 in the above commands causes the running time to increase quadratically.

### Patches

This vulnerability have been patched in 0.29.0.gfm.10.

### Note on cmark and cmark-gfm

XXX: TBD

[cmark-gfm](https://github.com/github/cmark-gfm) is a fork of [cmark](https://github.com/commonmark/cmark) that adds the GitHub Flavored Markdown extensions. The two codebases have diverged over time, but share a common core. These bugs affect both `cmark` and `cmark-gfm`. 

### Credit

We would like to thank @gravypod for reporting this vulnerability.

### References

https://en.wikipedia.org/wiki/Time_complexity

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [github/cmark-gfm](https://github.com/github/cmark-gfm)

Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-407 \u2014 Inefficient Algorithmic Complexity
An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
Repository: https://github.com/github/cmark-gfm
Files changed:
Commit message: Merge pull request from GHSA-r8vr-c48j-fcc5

Fix quadratic behavior in rendering

Vulnerable code:

Fixed code:
CVE-2020-27996 (C#, published 2020-10-29T18:15Z)
Description: value: An issue was discovered in SmartStoreNET before 4.0.1. It does not properly consider the need for a CustomModelPartAttribute decoration in certain ModelBase.CustomProperties situations.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/smartstore/SmartStoreNET
Files changed:
src/Plugins/SmartStore.DevTools/Models/BackendExtensionModel.cs
src/Plugins/SmartStore.GoogleMerchantCenter/Models/FeedGoogleMerchantCenterModel.cs
src/Presentation/SmartStore.Web.Framework/Modelling/ModelBase.cs
src/Presentation/SmartStore.Web.Framework/Modelling/SmartModelBinder.cs
Commit message: For security reasons complex types transported via in 'ModelBase.CustomProperties' must be decorated with 'CustomModelPartAttribute' now.


Vulnerable code:

    [Serializable]
			object value;
			if (TryGetCustomThreadProperties(false, out dict) && dict.TryGetValue(key, out value))

Fixed code:
	[CustomModelPart]
	[CustomModelPart]
    [AttributeUsage(AttributeTargets.Class, AllowMultiple = false, Inherited = false)]
	public sealed class CustomModelPartAttribute : Attribute
    {
    }
	
	[Serializable]
			if (TryGetCustomThreadProperties(false, out dict) && dict.TryGetValue(key, out var value))
using System.Security;
					if (!valueType.HasAttribute<CustomModelPartAttribute>(false))
                    {
						throw new SecurityException("For security reasons complex types in '{0}' must be decorated with the '{1}' attribute.".FormatInvariant(
							typeof(CustomPropertiesDictionary).AssemblyQualifiedNameWithoutVersion(), 
							typeof(CustomModelPartAttribute).AssemblyQualifiedNameWithoutVersion()));
                    }
CVE-2020-36364 (C#, published 2021-05-19T19:15Z)
Description: value: An issue was discovered in Smartstore (aka SmartStoreNET) before 4.1.0. Administration/Controllers/ImportController.cs allows path traversal (for copy and delete actions) in the ImportController.Create method via a TempFileName field.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/smartstore/SmartStoreNET
Files changed:
src/Presentation/SmartStore.Web/Administration/Controllers/ImportController.cs
Commit message: Resolves #2112 Path traversal vulnerability


Vulnerable code:

Fixed code:
            if (PathHelper.HasInvalidFileNameChars(model.TempFileName))
            {
                return new HttpStatusCodeResult(HttpStatusCode.BadRequest, "Invalid file name.");
            }
CVE-2021-32607 (Other, published 2021-05-12T15:15Z)
Description: value: An issue was discovered in Smartstore (aka SmartStoreNET) through 4.1.1. Views/PrivateMessages/View.cshtml does not call HtmlUtils.SanitizeHtml on a private message.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/smartstore/SmartStoreNET
Files changed:
src/Presentation/SmartStore.Web/Views/PrivateMessages/View.cshtml
Commit message: Fixed text issue in private messages of forum


Vulnerable code:
                        @Html.Raw(Model.Message)

Fixed code:
@using SmartStore.Core.Html;
                        @Html.Raw(HtmlUtils.SanitizeHtml(Model.Message, true))
CVE-2021-32608 (Other, published 2021-05-12T15:15Z)
Description: value: An issue was discovered in Smartstore (aka SmartStoreNET) through 4.1.1. Views/Boards/Partials/_ForumPost.cshtml does not call HtmlUtils.SanitizeHtml on certain text for a forum post.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/smartstore/SmartStoreNET
Files changed:
src/Presentation/SmartStore.Web/Views/Boards/Partials/_ForumPost.cshtml
Commit message: Fixed text issue in forum posts


Vulnerable code:
                
							<span class="pr-1">@T("Forum.Status"):</span>
							<span class="stat-value">@T("Forum.Moderator")</span>
							<span class="pr-1">@T("Forum.TotalPosts"):</span>
							<span class="stat-value">@Model.ForumPostCount.ToString("N0")</span>
							<span class="stat-value">@Model.CustomerJoinDate.ToNativeString("d")</span>
							<span class="stat-value">@Model.CustomerLocation</span>
				    {
				    }
				    <span class="stat-value">@Model.PostCreatedOnStr</span>
				    <span class="vote-count stat-value">@Model.VoteCount.ToString("N0")</span>
                    @Html.Raw(Model.FormattedText)

Fixed code:
@using SmartStore.Core.Html;


                            <span class="pr-1">@T("Forum.Status"):</span>
                            <span class="stat-value">@T("Forum.Moderator")</span>
                            <span class="pr-1">@T("Forum.TotalPosts"):</span>
                            <span class="stat-value">@Model.ForumPostCount.ToString("N0")</span>
                            <span class="stat-value">@Model.CustomerJoinDate.ToNativeString("d")</span>
                            <span class="stat-value">@Model.CustomerLocation</span>
                    {
                    }
                    <span class="stat-value">@Model.PostCreatedOnStr</span>
                    <span class="vote-count stat-value">@Model.VoteCount.ToString("N0")</span>
                    @Html.Raw(HtmlUtils.SanitizeHtml(Model.FormattedText))
CVE-2023-45897 (C, published 2023-10-28T21:15Z)
Description: value: exfatprogs before 1.2.2 allows out-of-bounds memory access, such as in read_file_dentry_set.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/exfatprogs/exfatprogs
Files changed:
fsck/fsck.c
Commit message: fsck: fix out-of-bounds memory access

The size of utf16_name is ENTRY_NAME_MAX, we should pass
ENTRY_NAME_MAX to exfat_utf16_len(), not ENTRY_NAME_MAX*2.

exfat_utf16_enc() returns the length of the utf16-encoded
filename, it is not needed to call exfat_utf16_len().

Signed-off-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>


Vulnerable code:
		int name_len, ret;
		name_len = exfat_utf16_len(utf16_name, ENTRY_NAME_MAX * 2);
		hash = exfat_calc_name_hash(iter->exfat, utf16_name, (int)name_len);
		stream_de->stream_name_len = (__u8)name_len;

Fixed code:
		int ret;
		ret >>= 1;
		hash = exfat_calc_name_hash(iter->exfat, utf16_name, ret);
		stream_de->stream_name_len = (__u8)ret;
CVE-2023-45897 (C, published 2023-10-28T21:15Z)
Description: value: exfatprogs before 1.2.2 allows out-of-bounds memory access, such as in read_file_dentry_set.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/exfatprogs/exfatprogs
Files changed:
exfat2img/exfat2img.c
Commit message: exfat2img: fix out-of-bounds write in read_file_dentry_set

if SecondaryCount is greater than (2 + the max number
of File Name entries), writing to memory outside
the node->name could happen.

Reported-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>


Vulnerable code:
	for (i = 2; i <= file_de->file_num_ext; i++) {

Fixed code:
	for (i = 2; i <= MIN(file_de->file_num_ext, 1 + MAX_NAME_DENTRIES); i++) {
CVE-2023-45897 (C, published 2023-10-28T21:15Z)
Description: value: exfatprogs before 1.2.2 allows out-of-bounds memory access, such as in read_file_dentry_set.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/exfatprogs/exfatprogs
Files changed:
fsck/fsck.c
include/exfat_ondisk.h
Commit message: fsck: fix out-of-bounds write in read_file_dentry_set

if SecondaryCount is greater than (2 + the max number
of File Name entries), writing to memory outside
the node->name could happen.

Reported-by: Maxim Suhanov <dfirblog@gmail.com>
Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com>
Reviewed-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>


Vulnerable code:
	for (i = 2; i <= file_de->file_num_ext; i++) {

Fixed code:
	for (i = 2; i <= MIN(file_de->file_num_ext, 1 + MAX_NAME_DENTRIES); i++) {
#define MAX_NAME_DENTRIES	17
CVE-2024-37310 (C++, published 2024-07-10T20:15Z)
Description: value: EVerest is an EV charging software stack. An integer overflow in the "v2g_incoming_v2gtp" function in the v2g_server.cpp implementation can allow a remote attacker to overflow the process' heap. This vulnerability is fixed in 2024.3.1 and 2024.6.0.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/EVerest/everest-core
Files changed:
modules/EvseV2G/v2g_server.cpp
Commit message: Fix EvseV2G: Prevent interger overflow after reading v2gtp message length (#706)

Signed-off-by: Sebastian Lukas <sebastian.lukas@pionix.de>

Vulnerable code:
        dlog(DLOG_LEVEL_ERROR, "payload too long: have %d, would need %d", DEFAULT_BUFFER_SIZE,

Fixed code:
#define UINT32_MAX   0xFFFFFFFF
    if (conn->payload_len >= UINT32_MAX - V2GTP_HEADER_LENGTH) {
        dlog(DLOG_LEVEL_ERROR, "Prevent integer overflow - payload too long: have %d, would need %u",
             DEFAULT_BUFFER_SIZE, conn->payload_len);
        return -1;
    }

        dlog(DLOG_LEVEL_ERROR, "payload too long: have %d, would need %u", DEFAULT_BUFFER_SIZE,
CVE-2022-24895 (PHP, published 2023-02-03T22:15Z)
Description: value: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. This issue has been fixed in the 4.4 branch. 


Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-384 \u2014 Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
Repository: https://github.com/symfony/security-bundle
Files changed:
Resources/config/security.xml
Tests/Functional/CsrfFormLoginTest.php
Tests/Functional/LogoutTest.php
composer.json
Commit message: [Security/Http] Remove CSRF tokens from storage on successful login



Vulnerable code:
        static::$container->get('security.csrf.token_storage')->setToken('foo', 'bar');
        $this->assertTrue(static::$container->get('security.csrf.token_storage')->hasToken('foo'));
        $this->assertSame('bar', static::$container->get('security.csrf.token_storage')->getToken('foo'));
        "symfony/security-http": "^4.4.5"

Fixed code:
            <argument type="service" id="security.csrf.token_storage" on-invalid="ignore" />
        static::$container->get('security.csrf.token_storage')->setToken('foo', 'bar');
        $this->assertFalse(static::$container->get('security.csrf.token_storage')->hasToken('foo'));

        static::$container->get('security.csrf.token_storage')->setToken('foo', 'bar');
        $this->assertTrue(static::$container->get('security.csrf.token_storage')->hasToken('foo'));

        static::$container->get('security.csrf.token_storage')->setToken('foo', 'bar');
        "symfony/security-http": "^4.4.50"
CVE-2024-41130 (C++, published 2024-07-22T18:15Z)
Description: value: llama.cpp provides LLM inference in C/C++. Prior to b3427, llama.cpp contains a null pointer dereference in gguf_init_from_file. This vulnerability is fixed in b3427.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/ggerganov/llama.cpp
Files changed:
examples/gguf/gguf.cpp
ggml/src/ggml.c
Commit message: gguf : handle null name during init (#8587)



Vulnerable code:
            for (uint64_t j = 0; j < i; ++j) {

Fixed code:
    if (!ctx) {
        fprintf(stderr, "%s: failed to load '%s'\n", __func__, fname.c_str());
        return false;
    }

            for (uint64_t j = 0; j < i && ok; ++j) {
CVE-2016-6298 (Python, published 2016-09-01T23:59Z)
Description: value: The _Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack (MMA).
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/latchset/jwcrypto
Files changed:
jwcrypto/jwa.py
Commit message: CVE-2016-6298: Million Messages Attack mitigation

RFC 3218 describes an oracle attack called Million Messages Attack
against RSA with PKCS1 v1.5 padding.

Depending on how JWEs are used a server may become an Oracle, and the
mitigation presecribed in RFC 3218 2.3.2 need to be implemented.

Many thanks to Dennis Detering for his responsible disclosure and help
verifying the mitigation approach.

Resolves #65
Signed-off-by: Simo Sorce <simo@redhat.com>
Closes #66


Vulnerable code:

Fixed code:
    def unwrap(self, key, bitsize, ek, headers):
        self._check_key(key)
        # Address MMA attack by implementing RFC 3218 - 2.3.2. Random Filling
        # provides a random cek that will cause the decryption engine to
        # run to the end, but will fail decryption later.

        # always generate a random cek so we spend roughly the
        # same time as in the exception side of the branch
        cek = _randombits(bitsize)
        try:
            cek = super(_Rsa15, self).unwrap(key, bitsize, ek, headers)
            # always raise so we always run through the exception handling
            # code in all cases
            raise Exception('Dummy')
        except Exception:  # pylint: disable=broad-except
            return cek
CVE-2024-28102 (Python, published 2024-03-21T02:52Z)
Description: value: JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. Version 1.5.6 fixes this vulnerability by limiting the maximum token length.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/latchset/jwcrypto
Files changed:
jwcrypto/jwe.py
jwcrypto/tests.py
Commit message: Address potential DoS with high compression ratio

Fixes CVE-2024-28102

Signed-off-by: Simo Sorce <simo@redhat.com>


Vulnerable code:

Fixed code:
# Limit the amount of data we are willing to decompress by default.
default_max_compressed_size = 256 * 1024

            if len(data) > default_max_compressed_size:
                raise InvalidJWEData(
                    'Compressed data exceeds maximum allowed'
                    'size' + f' ({default_max_compressed_size})')
    def test_jwe_decompression_max(self):
        key = jwk.JWK(kty='oct', k=base64url_encode(b'A' * (128 // 8)))
        payload = '{"u": "' + "u" * 400000000 + '", "uu":"' \
            + "u" * 400000000 + '"}'
        protected_header = {
            "alg": "A128KW",
            "enc": "A128GCM",
            "typ": "JWE",
            "zip": "DEF",
        }
        enc = jwe.JWE(payload.encode('utf-8'),
                      recipient=key,
                      protected=protected_header).serialize(compact=True)
        with self.assertRaises(jwe.InvalidJWEData):
            check = jwe.JWE()
            check.deserialize(enc)
            check.decrypt(key)

        defmax = jwe.default_max_compressed_size
        jwe.default_max_compressed_size = 1000000000
        # ensure we can eraise the limit and decrypt
        check = jwe.JWE()
        check.deserialize(enc)
        check.decrypt(key)
        jwe.default_max_compressed_size = defmax
CVE-2022-1231 (Java, published 2022-04-15T15:15Z)
Description: value: XSS via Embedded SVG in SVG Diagram Format in GitHub repository plantuml/plantuml prior to 1.2022.4. Stored XSS in the context of the diagram embedder. Depending on the actual context, this ranges from stealing secrets to account hijacking or even to code execution for example in desktop applications. Web based applications are the ones most affected. Since the SVG format allows clickable links in diagrams, it is commonly used in plugins for web based projects (like the Confluence plugin, etc. see https://plantuml.com/de/running).
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/plantuml/plantuml
Files changed:
src/net/sourceforge/plantuml/ugraphic/UImageSvg.java
Commit message: wip


Vulnerable code:
	private String clean(String svg) {
		svg = svg.toLowerCase().replaceAll("\\s", "");
		if (svg.contains("<script>"))
		if (svg.contains("</script>"))
		if (svg.contains("<foreignobject"))
		if (svg.contains("</foreignobject>"))

Fixed code:
	private String clean(final String svg) {
		final String svg2 = svg.toLowerCase().replaceAll("\\s", "");
		if (svg2.contains("<script>"))
		if (svg2.contains("</script>"))
		if (svg2.contains("<foreignobject"))
		if (svg2.contains("</foreignobject>"))
CVE-2014-125059 (C, published 2023-01-07T13:15Z)
Description: value: A vulnerability, which was classified as problematic, has been found in sternenseemann sternenblog. This issue affects the function blog_index of the file main.c. The manipulation of the argument post_path leads to file inclusion. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 0.1.0 is able to address this issue. The identifier of the patch is cf715d911d8ce17969a7926dea651e930c27e71a. It is recommended to upgrade the affected component. The identifier VDB-217613 was assigned to this vulnerability. NOTE: This case is rather theoretical and probably won't happen. Maybe only on obscure Web servers.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-73 \u2014 External Control of File Name or Path
The product allows user input to control or influence paths or file names that are used in filesystem operations.
Repository: https://github.com/sternenseemann/sternenblog
Files changed:
main.c
Commit message: fixed LFI vulnerability


Vulnerable code:

Fixed code:
	if(strlen(post_path) != 0 || post_path[0] == '.'
			|| strchr(post_path, '/') == NULL) {
		send_header("Content-type", "text/plain");
		terminate_headers();
		printf("No, my dear h4xxx0r :)\nYou won\'t do that :p\n");
		return;
	}
CVE-2018-0429 (C, published 2018-08-09T20:29Z)
Description: value: Stack-based buffer overflow in the Cisco Thor decoder before commit 18de8f9f0762c3a542b1122589edb8af859d9813 allows local users to cause a denial of service (segmentation fault) and execute arbitrary code via a crafted non-conformant Thor bitstream.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/cisco/thor
Files changed:
dec/decode_block.c
dec/read_bits.c
Commit message: Fix possible stack overflows in decoder for illegal bit streams

Fixes CVE-2018-0429
A vulnerability in the Thor decoder (available at:
https://github.com/cisco/thor) could allow an authenticated, local
attacker to cause segmentation faults and stack overflows when using a
non-conformant Thor bitstream as input.
The vulnerability is due to lack of input validation when parsing the
bitstream. A successful exploit could allow the attacker to cause a
stack overflow and potentially inject and execute arbitrary code.


Vulnerable code:
  if (split_flag){

Fixed code:
  if (split_flag && size >= MIN_BLOCK_SIZE){
  decoder_info->log2_sb_size = clip(decoder_info->log2_sb_size, log2i(MIN_BLOCK_SIZE), log2i(MAX_SB_SIZE));