hitoshura25/cvefixes huggingface dataset:
CVE-2021-26927 (C, published 2021-02-23T20:15Z)
Description: value: A flaw was found in jasper before 2.0.25. A null pointer dereference in jp2_decode in jp2_dec.c may lead to program crash and denial of service.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/jasper-software/jasper
Files changed:
src/libjasper/jp2/jp2_dec.c
Commit message: Fixes #264.

The JP2 decoder was allowing the decoding of a code stream to be
attempted when the stream has inconsistent values for the number of
components and/or the component types.  For such invalid streams,
only a warning would be issued and decoding would proceed.  This is
dangerous, however, as it can lead to many unexpected paths through
the code, which in some cases have been demonstrated to result in
security vulnerabilities.  This code change makes decoding of these
types invalid code streams a hard error.


Vulnerable code:
		jas_eprintf("warning: number of components mismatch\n");
		jas_eprintf("warning: component data type mismatch (IHDR)\n");
		if (dec->bpcc->data.bpcc.numcmpts != JAS_CAST(jas_uint, jas_image_numcmpts(
		  dec->image))) {
			jas_eprintf("warning: number of components mismatch\n");
					jas_eprintf("warning: component data type mismatch (BPCC)\n");

Fixed code:
		jas_eprintf("error: number of components mismatch (IHDR)\n");
		goto error;
		jas_eprintf("error: component data type mismatch (IHDR)\n");
		goto error;
		if (dec->bpcc->data.bpcc.numcmpts !=
		  JAS_CAST(jas_uint, jas_image_numcmpts(dec->image))) {
			jas_eprintf("error: number of components mismatch (BPCC)\n");
			goto error;
					jas_eprintf("error: component data type mismatch (BPCC)\n");
						goto error;
CVE-2024-31744 (C, published 2024-04-19T13:15Z)
Description: value: In Jasper 4.2.2, the jpc_streamlist_remove function in src/libjasper/jpc/jpc_dec.c:2407 has an assertion failure vulnerability, allowing attackers to cause a denial of service attack through a specific image file.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/jasper-software/jasper
Files changed:
src/libjasper/jpc/jpc_dec.c
Commit message: Fixes #381.

Added a missing check to the jpc_dec_process_sod function of the JPC codec.
Added another image to the test set.


Vulnerable code:
		if (!(tile->pkthdrstream = jpc_streamlist_remove(dec->pkthdrstreams, 0))) {

Fixed code:
		if (jpc_streamlist_numstreams(dec->pkthdrstreams) != 0 &&
		  !(tile->pkthdrstream = jpc_streamlist_remove(dec->pkthdrstreams,
		  0))) {
CVE-2019-16768 (Markdown, published 2019-12-05T20:15Z)
Description: value: In affected versions of Sylius, exception messages from internal exceptions (like database exception) are wrapped by \Symfony\Component\Security\Core\Exception\AuthenticationServiceException and propagated through the system to UI. Therefore, some internal system information may leak and be visible to the customer. A validation message with the exception details will be presented to the user when one will try to log into the shop. This has been patched in versions 1.3.14, 1.4.10, 1.5.7, and 1.6.3.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-209 \u2014 Generation of Error Message Containing Sensitive Information
The product generates an error message that includes sensitive information about its environment, users, or associated data.
Repository: https://github.com/Sylius/Sylius
Files changed:
CHANGELOG-1.3.md
Commit message: Generate changelog for v1.3.14


Vulnerable code:

Fixed code:
## v1.3.14 (2019-12-03)

### CVE-2019-16768: Internal exception message exposure in login action.

#### Details

Exception messages from internal exceptions (like database exception) are wrapped by 
`\Symfony\Component\Security\Core\Exception\AuthenticationServiceException` and propagated through the system to UI. 
Therefore, some internal system information may leak and be visible to the customer.

A validation message with the exception details will be presented to the user when one will try to log into the shop.

#### Workaround

This release patches the reported vulnerability. The `src/Sylius/Bundle/UiBundle/Resources/views/Security/_login.html.twig` 
file from Sylius should be overridden and `{{ messages.error(last_error.message) }}` changed to `{{ messages.error(last_error.messageKey) }}`.
CVE-2024-34349 (Unknown, published 2024-05-14T15:38Z)
Description: value: Sylius is an open source eCommerce platform. Prior to 1.12.16 and 1.13.1, there is a possibility to execute javascript code in the Admin panel. In order to perform an XSS attack input a script into Name field in which of the resources: Taxons, Products, Product Options or Product Variants. The code will be executed while using an autocomplete field with one of the listed entities in the Admin Panel. Also for the taxons in the category tree on the product form.The issue is fixed in versions: 1.12.16, 1.13.1.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Sylius/Sylius
Files changed:
Commit message: bug #76 Fix potential xss in admin panel (mpysiak)

This PR was merged into the 1.12 branch.

Discussion
----------

| Q               | A
|-----------------|-----
| Branch?         | 1.12
| Bug fix?        | yes
| New feature?    | no
| BC breaks?      | no
| Deprecations?   | no
| Related tickets | n/a
| License         | MIT

Fixes potential xss in admin panel (Taxons and Products)

Commits
-------

d4812f9c14c7b2acc1f2f64cff363533e4c77b41 Fix potential xss in admin panel
29d18a39935e4d6e3d59bac5ebca798bfff00fe2 Use function from UIBundle
c11c424c1cd4918a71831152f69bc9b1915d542d Fix product-auto-complete
a17de6d1ed47155277732bcfab61fb491cac8cb6 Test adding new taxon
d25edf3ff097dbb704ecf4dc35b766526008516a Test adding new simple product
63c3cf7a12ff7e1471ef3af2e2141c474e42aa03 Test adding similar products
679e79352156f19e1747ab1d735070187b3788d7 Fixes after CR


Vulnerable code:

Fixed code:
CVE-2019-25078 (C, published 2022-12-13T18:15Z)
Description: value: A vulnerability classified as problematic was found in pacparser up to 1.3.x. Affected by this vulnerability is the function pacparser_find_proxy of the file src/pacparser.c. The manipulation of the argument url leads to buffer overflow. Attacking locally is a requirement. Upgrading to version 1.4.0 is able to address this issue. The name of the patch is 853e8f45607cb07b877ffd270c63dbcdd5201ad9. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-215443.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/manugarg/pacparser
Files changed:
src/pacparser.c
Commit message: Fix possible memory overwrite vulnerability. (#134)



Vulnerable code:
		"Invalid hostname: hostname can't have single quotes.");
  script = (char*) malloc(32 + strlen(url) + strlen(host));

Fixed code:
      "Invalid hostname: hostname can't have single quotes.");
  script = (char*) malloc(32 + strlen(sanitized_url) + strlen(host));
CVE-2023-52086 (Unknown, published 2023-12-26T18:15Z)
Description: value: resumable.php (aka PHP backend for resumable.js) 0.1.4 before 3c6dbf5 allows arbitrary file upload anywhere in the filesystem via ../ in multipart/form-data content to upload.php. (File overwrite hasn't been possible with the code available in GitHub in recent years, however.)
Severity: nan (CVSS v3 base score: 8.1)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/dilab/resumable.php
Files changed:
Commit message: Merge pull request #39 from code-lts/security-fix

Fix remote arbitrary file upload in any directory of the file system

Vulnerable code:

Fixed code:
CVE-2020-36599 (Ruby, published 2022-08-18T23:15Z)
Description: value: lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the message_key value.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-116 \u2014 Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Repository: https://github.com/omniauth/omniauth
Files changed:
lib/omniauth/failure_endpoint.rb
Commit message: Merge branch '2_0-indev' into fix-path-prefix-when-redirecting-on-failure

Vulnerable code:
       new_path = "#{env['SCRIPT_NAME']}#{strategy_path_prefix}/failure?message=#{message_key}#{origin_query_param}#{strategy_name_query_param}"

Fixed code:
+
+      new_path = "#{env['SCRIPT_NAME']}#{strategy_path_prefix}/failure?message=#{Rack::Utils.escape(message_key)}#{origin_query_param}#{strategy_name_query_param}"
CVE-2015-10088 (C, published 2023-03-05T05:15Z)
Description: value: A vulnerability, which was classified as critical, was found in ayttm up to 0.5.0.89. This affects the function http_connect in the library libproxy/proxy.c. The manipulation leads to format string. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The patch is named 40e04680018614a7d2b68566b261b061a0597046. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-222267.
Severity: nan (CVSS v3 base score: 8.1)
Weakness: CWE-134 \u2014 Use of Externally-Controlled Format String
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
Repository: https://github.com/ayttm/ayttm
Files changed:
libproxy/proxy.c
Commit message: Fix format string vulnerability

Reported by Kapil Anand on ayttm-users:
https://sourceforge.net/p/ayttm/mailman/message/34397158/

This patch does the following two things:

1. Makes sure debug_print is only used in DEBUG mode and not in non-DEBUG mode
2. Since debug_print is basically printf, we don't really need to first
   snprintf into a buffer and then print the buffer.
3. We no longer need debug_buff


Vulnerable code:
	char debug_buff[512];
#ifndef DEBUG
	snprintf(debug_buff, sizeof(debug_buff), "<%s>\n", cmd);
	debug_print(debug_buff);
#ifndef DEBUG
	snprintf(debug_buff, sizeof(debug_buff), "<%s>\n", inputline);
	debug_print(debug_buff);
#ifndef DEBUG
		snprintf(debug_buff, sizeof(debug_buff), "<%s>\n", inputline);
		debug_print(debug_buff);

Fixed code:
#ifdef DEBUG
	debug_print("<%s>\n", cmd);
#ifdef DEBUG
	debug_print("<%s>\n", inputline);
#ifdef DEBUG
		debug_print("<%s>\n", inputline);
CVE-2018-8729 (Other, published 2018-03-15T17:29Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pojome/activity-log
Files changed:
README.md
readme.txt
Commit message: Update changelog


Vulnerable code:

Fixed code:
### 2.4.1 ###
* Fix : Escape title before saving to database

= 2.4.1 =
* Fix : Escape title before saving to database
CVE-2018-8729 (PHP, published 2018-03-15T17:29Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pojome/activity-log
Files changed:
classes/class-aal-activity-log-list-table.php
hooks/class-aal-hook-attachment.php
hooks/class-aal-hook-comments.php
hooks/class-aal-hook-posts.php
Commit message: Fix potential security issue


Vulnerable code:
		$return = $item->object_name;
				$return = sprintf( '<a href="%s">%s</a>', get_edit_post_link( $item->object_id ), $item->object_name );
					$return = sprintf( '<a href="%s">%s</a>', get_edit_term_link( $item->object_id, $item->object_subtype ), $item->object_name );
					$pt     = get_post_type_object( $item->object_name );
			'object_name'    => get_the_title( $post->ID ),
}
			'object_name'    => get_the_title( $comment->comment_post_ID ),
}
		$title = get_the_title( $post );

Fixed code:
		$return = esc_html( $item->object_name );
				$return = sprintf( '<a href="%s">%s</a>', get_edit_post_link( $item->object_id ), esc_html( $item->object_name ) );
					$return = sprintf( '<a href="%s">%s</a>', get_edit_term_link( $item->object_id, $item->object_subtype ), esc_html( $item->object_name ) );
					$pt = get_post_type_object( $item->object_name );
			'object_name'    => esc_html( get_the_title( $post->ID ) ),
}
			'object_name'    => esc_html( get_the_title( $comment->comment_post_ID ) ),
}
		$title = esc_html( get_the_title( $post ) );
CVE-2022-32065 (Java, published 2022-07-13T15:15Z)
Description: value: An arbitrary file upload vulnerability in the background management module of RuoYi v4.7.3 and below allows attackers to execute arbitrary code via a crafted HTML file.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/yangzongzhuan/RuoYi
Files changed:
ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysProfileController.java
ruoyi-common/src/main/java/com/ruoyi/common/exception/file/InvalidExtensionException.java
Commit message: 用户头像上传格式限制


Vulnerable code:
                String avatar = FileUploadUtils.upload(RuoYiConfig.getAvatarPath(), file);
        super("filename : [" + filename + "], extension : [" + extension + "], allowed extension : [" + Arrays.toString(allowedExtension) + "]");

Fixed code:
import com.ruoyi.common.utils.file.MimeTypeUtils;
                String avatar = FileUploadUtils.upload(RuoYiConfig.getAvatarPath(), file, MimeTypeUtils.IMAGE_EXTENSION);
        super("文件[" + filename + "]后缀[" + extension + "]不正确，请上传 [" + Arrays.toString(allowedExtension) + "]格式文件");
CVE-2013-2016 (C, published 2019-12-30T22:15Z)
Description: value: A flaw was found in the way qemu v1.3.0 and later (virtio-rng) validates addresses when guest accesses the config space of a virtio device. If the virtio device has zero/small sized config space, such as virtio-rng, a privileged guest user could use this flaw to access the matching host's qemu address space and thus increase their privileges on the host.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-269 \u2014 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Repository: https://github.com/qemu/qemu
Files changed:
hw/virtio/virtio.c
Commit message: virtio: properly validate address before accessing config

There are several several issues in the current checking:

- The check was based on the minus of unsigned values which can overflow
- It was done after .{set|get}_config() which can lead crash when config_len
  is zero since vdev->config is NULL

Fix this by:

- Validate the address in virtio_pci_config_{read|write}() before
  .{set|get}_config
- Use addition instead minus to do the validation

Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Petr Matousek <pmatouse@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Petr Matousek <pmatouse@redhat.com>
Message-id: 1367905369-10765-1-git-send-email-jasowang@redhat.com
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>


Vulnerable code:
    k->get_config(vdev, vdev->config);

    if (addr > (vdev->config_len - sizeof(val)))
    k->get_config(vdev, vdev->config);

    if (addr > (vdev->config_len - sizeof(val)))
    k->get_config(vdev, vdev->config);

    if (addr > (vdev->config_len - sizeof(val)))
    if (addr > (vdev->config_len - sizeof(val)))
    if (addr > (vdev->config_len - sizeof(val)))
    if (addr > (vdev->config_len - sizeof(val)))

Fixed code:
    if (addr + sizeof(val) > vdev->config_len) {
    }

    k->get_config(vdev, vdev->config);
    if (addr + sizeof(val) > vdev->config_len) {
    }

    k->get_config(vdev, vdev->config);
    if (addr + sizeof(val) > vdev->config_len) {
    }

    k->get_config(vdev, vdev->config);
    if (addr + sizeof(val) > vdev->config_len) {
    }
    if (addr + sizeof(val) > vdev->config_len) {
    }
    if (addr + sizeof(val) > vdev->config_len) {
    }
CVE-2015-5239 (C, published 2020-01-23T20:15Z)
Description: value: Integer overflow in the VNC display driver in QEMU before 2.1.0 allows attachers to cause a denial of service (process crash) via a CLIENT_CUT_TEXT message, which triggers an infinite loop.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-835 \u2014 Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Repository: https://github.com/qemu/qemu
Files changed:
ui/vnc.c
Commit message: ui/vnc: limit client_cut_text msg payload size

currently a malicious client could define a payload
size of 2^32 - 1 bytes and send up to that size of
data to the vnc server. The server would allocated
that amount of memory which could easily create an
out of memory condition.

This patch limits the payload size to 1MB max.

Please note that client_cut_text messages are currently
silently ignored.

Signed-off-by: Peter Lieven <pl@kamp.de>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>


Vulnerable code:
        if (len == 1)

            if (dlen > 0)

Fixed code:
        if (len == 1) {
        }
            if (dlen > (1 << 20)) {
                error_report("vnc: client_cut_text msg payload has %u bytes"
                             " which exceeds our limit of 1MB.", dlen);
                vnc_client_error(vs);
                break;
            }
            if (dlen > 0) {
            }
CVE-2015-5745 (C, published 2020-01-23T20:15Z)
Description: value: Buffer overflow in the send_control_msg function in hw/char/virtio-serial-bus.c in QEMU before 2.4.0 allows guest users to cause a denial of service (QEMU process crash) via a crafted virtio control message.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/qemu/qemu
Files changed:
hw/char/virtio-serial-bus.c
Commit message: virtio-serial: fix ANY_LAYOUT

Don't assume a specific layout for control messages.
Required by virtio 1.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Amit Shah <amit.shah@redhat.com>
Reviewed-by: Jason Wang <jasowang@redhat.com>


Vulnerable code:
    memcpy(elem.in_sg[0].iov_base, buf, len);

Fixed code:
    /* TODO: detect a buffer that's too short, set NEEDS_RESET */
    iov_from_buf(elem.in_sg, elem.in_num, 0, buf, len);
CVE-2017-2630 (C, published 2018-07-27T18:29Z)
Description: value: A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network Block Device (NBD) client support. The flaw could occur while processing server's response to a 'NBD_OPT_LIST' request. A malicious NBD server could use this issue to crash a remote NBD client resulting in DoS or potentially execute arbitrary code on client host with privileges of the QEMU process.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-121 \u2014 Stack-based Buffer Overflow
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
Repository: https://github.com/qemu/qemu
Files changed:
nbd/client.c
Commit message: nbd/client: fix drop_sync [CVE-2017-2630]

Comparison symbol is misused. It may lead to memory corruption.
Introduced in commit 7d3123e.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20170203154757.36140-6-vsementsov@virtuozzo.com>
[eblake: add CVE details, update conditional]
Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Marc-AndrÃ© Lureau <marcandre.lureau@redhat.com>
Message-Id: <20170307151627.27212-1-eblake@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


Vulnerable code:
    buffer = sizeof(small) < size ? small : g_malloc(MIN(65536, size));

Fixed code:
    buffer = sizeof(small) >= size ? small : g_malloc(MIN(65536, size));
CVE-2017-8284 (C, published 2017-04-26T14:59Z)
Description: value: The disas_insn function in target/i386/translate.c in QEMU before 2.9.0, when TCG mode without hardware acceleration is used, does not limit the instruction size, which allows local users to gain privileges by creating a modified basic block that injects code into a setuid program, as demonstrated by procmail. NOTE: the vendor has stated "this bug does not violate any security guarantees QEMU makes.
Severity: MEDIUM (CVSS v3 base score: 7)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/qemu/qemu
Files changed:
target/i386/translate.c
Commit message: tcg/i386: Check the size of instruction being translated

This fixes the bug: 'user-to-root privesc inside VM via bad translation
caching' reported by Jann Horn here:
https://bugs.chromium.org/p/project-zero/issues/detail?id=1122

Reviewed-by: Richard Henderson <rth@twiddle.net>
CC: Peter Maydell <peter.maydell@linaro.org>
CC: Paolo Bonzini <pbonzini@redhat.com>
Reported-by: Jann Horn <jannh@google.com>
Signed-off-by: Pranith Kumar <bobby.prani@gmail.com>
Message-Id: <20170323175851.14342-1-bobby.prani@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


Vulnerable code:

Fixed code:
    /* x86 has an upper limit of 15 bytes for an instruction. Since we
     * do not want to decode and generate IR for an illegal
     * instruction, the following check limits the instruction size to
     * 25 bytes: 14 prefix + 1 opc + 6 (modrm+sib+ofs) + 4 imm */
    if (s->pc - pc_start > 14) {
        goto illegal_op;
    }