hitoshura25/cvefixes huggingface dataset:
CVE-2023-5632 (C, published 2023-10-18T09:15Z)
Description: value: In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT event to be added, which results excessive CPU consumption. This could be used by a malicious actor to perform denial of service type attack. This issue is fixed in 2.0.6



Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-834 \u2014 Excessive Iteration
The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
Repository: https://github.com/eclipse/mosquitto
Files changed:
lib/packet_mosq.c
Commit message: Unconditionally adding an event to the epoll causes 100% CPU usage. This happens when the connection to the server is established and the client has not sent any data yet.

Signed-off-by: Przemek Zygmunt <p.zygmunt@acsoftware.pl>


Vulnerable code:
	mux__add_out(mosq);

Fixed code:
	if (mosq->current_out_packet) {
	   mux__add_out(mosq);
	}
CVE-2024-1879 (Other, published 2024-06-06T18:15Z)
Description: value: A Cross-Site Request Forgery (CSRF) vulnerability in significant-gravitas/autogpt version v0.5.0 allows attackers to execute arbitrary commands on the AutoGPT server. The vulnerability stems from the lack of protections on the API endpoint receiving instructions, enabling an attacker to direct a user running AutoGPT in their local network to a malicious website. This site can then send crafted requests to the AutoGPT server, leading to command execution. The issue is exacerbated by CORS being enabled for arbitrary origins by default, allowing the attacker to read the response of all cross-site queries. This vulnerability was addressed in version 5.1.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/significant-gravitas/autogpt
Files changed:
autogpts/autogpt/.env.template
Commit message: fix(agent): Update .env.template to match changes in 370615e


Vulnerable code:
## SMART_LLM - Smart language model (Default: gpt-4-turbo-preview)
# SMART_LLM=gpt-4-turbo-preview
## FAST_LLM - Fast language model (Default: gpt-3.5-turbo-0125)
# FAST_LLM=gpt-3.5-turbo-0125

Fixed code:
## SMART_LLM - Smart language model (Default: gpt-4-turbo)
# SMART_LLM=gpt-4-turbo
## FAST_LLM - Fast language model (Default: gpt-3.5-turbo)
# FAST_LLM=gpt-3.5-turbo
CVE-2024-1880 (Other, published 2024-06-06T19:15Z)
Description: value: An OS command injection vulnerability exists in the MacOS Text-To-Speech class MacOSTTS of the significant-gravitas/autogpt project, affecting versions up to v0.5.0. The vulnerability arises from the improper neutralization of special elements used in an OS command within the `_speech` method of the MacOSTTS class. Specifically, the use of `os.system` to execute the `say` command with user-supplied text allows for arbitrary code execution if an attacker can inject shell commands. This issue is triggered when the AutoGPT instance is run with the `--speak` option enabled and configured with `TEXT_TO_SPEECH_PROVIDER=macos`, reflecting back a shell injection snippet. The impact of this vulnerability is the potential execution of arbitrary code on the instance running AutoGPT. The issue was addressed in version 5.1.0.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/significant-gravitas/autogpt
Files changed:
autogpts/autogpt/.env.template
Commit message: fix(agent): Update .env.template to match changes in 370615e


Vulnerable code:
## SMART_LLM - Smart language model (Default: gpt-4-turbo-preview)
# SMART_LLM=gpt-4-turbo-preview
## FAST_LLM - Fast language model (Default: gpt-3.5-turbo-0125)
# FAST_LLM=gpt-3.5-turbo-0125

Fixed code:
## SMART_LLM - Smart language model (Default: gpt-4-turbo)
# SMART_LLM=gpt-4-turbo
## FAST_LLM - Fast language model (Default: gpt-3.5-turbo)
# FAST_LLM=gpt-3.5-turbo
CVE-2024-1881 (Other, published 2024-06-06T19:15Z)
Description: value: AutoGPT, a component of significant-gravitas/autogpt, is vulnerable to an improper neutralization of special elements used in an OS command ('OS Command Injection') due to a flaw in its shell command validation function. Specifically, the vulnerability exists in versions v0.5.0 up to but not including 5.1.0. The issue arises from the application's method of validating shell commands against an allowlist or denylist, where it only checks the first word of the command. This allows an attacker to bypass the intended restrictions by crafting commands that are executed despite not being on the allowlist or by including malicious commands not present in the denylist. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary shell commands.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/significant-gravitas/autogpt
Files changed:
autogpts/autogpt/.env.template
Commit message: fix(agent): Update .env.template to match changes in 370615e


Vulnerable code:
## SMART_LLM - Smart language model (Default: gpt-4-turbo-preview)
# SMART_LLM=gpt-4-turbo-preview
## FAST_LLM - Fast language model (Default: gpt-3.5-turbo-0125)
# FAST_LLM=gpt-3.5-turbo-0125

Fixed code:
## SMART_LLM - Smart language model (Default: gpt-4-turbo)
# SMART_LLM=gpt-4-turbo
## FAST_LLM - Fast language model (Default: gpt-3.5-turbo)
# FAST_LLM=gpt-3.5-turbo
CVE-2014-9496 (C, published 2015-01-16T16:59Z)
Description: value: The sd2_parse_rsrc_fork function in sd2.c in libsndfile allows attackers to have unspecified impact via vectors related to a (1) map offset or (2) rsrc marker, which triggers an out-of-bounds read.
Severity: LOW (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/erikd/libsndfile
Files changed:
src/sd2.c
Commit message: src/sd2.c : Fix two potential buffer read overflows.

Closes: https://github.com/erikd/libsndfile/issues/93


Vulnerable code:
	{	marker = read_rsrc_marker (&rsrc, rsrc.type_offset + k * 8) ;

Fixed code:
	if (rsrc.map_offset + 28 > rsrc.rsrc_len)
	{	psf_log_printf (psf, "Bad map offset.\n") ;
		goto parse_rsrc_fork_cleanup ;
		} ;

	{	if (rsrc.type_offset + k * 8 > rsrc.rsrc_len)
		{	psf_log_printf (psf, "Bad rsrc marker.\n") ;
			goto parse_rsrc_fork_cleanup ;
			} ;

		marker = read_rsrc_marker (&rsrc, rsrc.type_offset + k * 8) ;
CVE-2014-9756 (C, published 2015-11-19T20:59Z)
Description: value: The psf_fwrite function in file_io.c in libsndfile allows attackers to cause a denial of service (divide-by-zero error and application crash) via unspecified vectors related to the headindex variable.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-369 \u2014 Divide By Zero
The product divides a value by zero.
Repository: https://github.com/erikd/libsndfile
Files changed:
src/file_io.c
Commit message: src/file_io.c : Prevent potential divide-by-zero.

Closes: https://github.com/erikd/libsndfile/issues/92


Vulnerable code:
** Copyright (C) 2002-2013 Erik de Castro Lopo <erikd@mega-nerd.com>

Fixed code:
** Copyright (C) 2002-2014 Erik de Castro Lopo <erikd@mega-nerd.com>
	if (bytes == 0 || items == 0)
		return 0 ;
CVE-2017-6892 (C, published 2017-06-12T16:29Z)
Description: value: In libsndfile version 1.0.28, an error in the "aiff_read_chanmap()" function (aiff.c) can be exploited to cause an out-of-bounds read memory access via a specially crafted AIFF file.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/erikd/libsndfile
Files changed:
src/aiff.c
Commit message: src/aiff.c: Fix a buffer read overflow

Secunia Advisory SA76717.

Found by: Laurent Delosieres, Secunia Research at Flexera Software


Vulnerable code:
	{	size_t chanmap_size = psf->sf.channels * sizeof (psf->channel_map [0]) ;

Fixed code:
	{	size_t chanmap_size = SF_MIN (psf->sf.channels, layout_tag & 0xffff) * sizeof (psf->channel_map [0]) ;
CVE-2017-7585 (C, published 2017-04-07T20:59Z)
Description: value: In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/erikd/libsndfile
Files changed:
src/flac.c
Commit message: src/flac.c: Improve error handling

Especially when dealing with corrupt or malicious files.


Vulnerable code:
	FLAC__bool bufferbackup ;
		**	Not sure why this code is here and not elsewhere.
		**	Removing it causes valgrind errors.
		pflac->bufferbackup = SF_TRUE ;
	pflac->bufferbackup = SF_FALSE ;
		if (FLAC__stream_decoder_get_state (pflac->fsd) >= FLAC__STREAM_DECODER_END_OF_STREAM)

Fixed code:

		** This pointer is reset to NULL each time the current frame has been
		** decoded. Somehow its used during encoding and decoding.
	if (pflac->remain % channels != 0)
	{	psf_log_printf (psf, "Error: pflac->remain %u    channels %u\n", pflac->remain, channels) ;
		return 0 ;
		} ;

	FLAC__StreamDecoderState state ;
	state = FLAC__stream_decoder_get_state (pflac->fsd) ;
	if (state > FLAC__STREAM_DECODER_END_OF_STREAM)
	{	psf_log_printf (psf, "FLAC__stream_decoder_get_state returned %s\n", FLAC__StreamDecoderStateString [state]) ;
		/* Current frame is busted, so NULL the pointer. */
		pflac->frame = NULL ;
		} ;

		state = FLAC__stream_decoder_get_state (pflac->fsd) ;
		if (state >= FLAC__STREAM_DECODER_END_OF_STREAM)
		{	psf_log_printf (psf, "FLAC__stream_decoder_get_state returned %s\n", FLAC__StreamDecoderStateString [state]) ;
			/* Current frame is busted, so NULL the pointer. */
			pflac->frame = NULL ;
			} ;
CVE-2017-7586 (C, published 2017-04-07T20:59Z)
Description: value: In libsndfile before 1.0.28, an error in the "header_read()" function (common.c) when handling ID3 tags can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/erikd/libsndfile
Files changed:
src/id3.c
Commit message: src/id3.c : Improve error handling


Vulnerable code:
** Copyright (C) 2010-2011 Erik de Castro Lopo <erikd@mega-nerd.com>
		psf_binheader_readf (psf, "p", psf->fileoffset) ;
		return 1 ;

Fixed code:
** Copyright (C) 2010-2017 Erik de Castro Lopo <erikd@mega-nerd.com>
		if (psf->fileoffset < psf->filelength)
		{	psf_binheader_readf (psf, "p", psf->fileoffset) ;
			return 1 ;
			} ;
CVE-2017-7741 (C, published 2017-04-12T18:59Z)
Description: value: In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a segmentation violation (with write memory access) via a specially crafted FLAC file during a resample attempt, a similar issue to CVE-2017-7585.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/erikd/libsndfile
Files changed:
src/flac.c
Commit message: src/flac.c: Improve error handling

Especially when dealing with corrupt or malicious files.


Vulnerable code:
	FLAC__bool bufferbackup ;
		**	Not sure why this code is here and not elsewhere.
		**	Removing it causes valgrind errors.
		pflac->bufferbackup = SF_TRUE ;
	pflac->bufferbackup = SF_FALSE ;
		if (FLAC__stream_decoder_get_state (pflac->fsd) >= FLAC__STREAM_DECODER_END_OF_STREAM)

Fixed code:

		** This pointer is reset to NULL each time the current frame has been
		** decoded. Somehow its used during encoding and decoding.
	if (pflac->remain % channels != 0)
	{	psf_log_printf (psf, "Error: pflac->remain %u    channels %u\n", pflac->remain, channels) ;
		return 0 ;
		} ;

	FLAC__StreamDecoderState state ;
	state = FLAC__stream_decoder_get_state (pflac->fsd) ;
	if (state > FLAC__STREAM_DECODER_END_OF_STREAM)
	{	psf_log_printf (psf, "FLAC__stream_decoder_get_state returned %s\n", FLAC__StreamDecoderStateString [state]) ;
		/* Current frame is busted, so NULL the pointer. */
		pflac->frame = NULL ;
		} ;

		state = FLAC__stream_decoder_get_state (pflac->fsd) ;
		if (state >= FLAC__STREAM_DECODER_END_OF_STREAM)
		{	psf_log_printf (psf, "FLAC__stream_decoder_get_state returned %s\n", FLAC__StreamDecoderStateString [state]) ;
			/* Current frame is busted, so NULL the pointer. */
			pflac->frame = NULL ;
			} ;
CVE-2017-7742 (C, published 2017-04-12T18:59Z)
Description: value: In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a segmentation violation (with read memory access) via a specially crafted FLAC file during a resample attempt, a similar issue to CVE-2017-7585.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/erikd/libsndfile
Files changed:
src/flac.c
Commit message: src/flac.c: Improve error handling

Especially when dealing with corrupt or malicious files.


Vulnerable code:
	FLAC__bool bufferbackup ;
		**	Not sure why this code is here and not elsewhere.
		**	Removing it causes valgrind errors.
		pflac->bufferbackup = SF_TRUE ;
	pflac->bufferbackup = SF_FALSE ;
		if (FLAC__stream_decoder_get_state (pflac->fsd) >= FLAC__STREAM_DECODER_END_OF_STREAM)

Fixed code:

		** This pointer is reset to NULL each time the current frame has been
		** decoded. Somehow its used during encoding and decoding.
	if (pflac->remain % channels != 0)
	{	psf_log_printf (psf, "Error: pflac->remain %u    channels %u\n", pflac->remain, channels) ;
		return 0 ;
		} ;

	FLAC__StreamDecoderState state ;
	state = FLAC__stream_decoder_get_state (pflac->fsd) ;
	if (state > FLAC__STREAM_DECODER_END_OF_STREAM)
	{	psf_log_printf (psf, "FLAC__stream_decoder_get_state returned %s\n", FLAC__StreamDecoderStateString [state]) ;
		/* Current frame is busted, so NULL the pointer. */
		pflac->frame = NULL ;
		} ;

		state = FLAC__stream_decoder_get_state (pflac->fsd) ;
		if (state >= FLAC__STREAM_DECODER_END_OF_STREAM)
		{	psf_log_printf (psf, "FLAC__stream_decoder_get_state returned %s\n", FLAC__StreamDecoderStateString [state]) ;
			/* Current frame is busted, so NULL the pointer. */
			pflac->frame = NULL ;
			} ;
CVE-2020-36639 (Other, published 2023-01-04T10:15Z)
Description: value: A vulnerability has been found in AlliedModders AMX Mod X on Windows and classified as critical. This vulnerability affects the function cmdVoteMap of the file plugins/adminvote.sma of the component Console Command Handler. The manipulation of the argument amx_votemap leads to path traversal. The patch is identified as a5f2b5539f6d61050b68df8b22ebb343a2862681. It is recommended to apply a patch to fix this issue. VDB-217354 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/alliedmodders/amxmodx
Files changed:
plugins/adminvote.sma
Commit message: adminvote.sma exploit fix (#823)

* Restrict having ".." character sequence in amx_votemap command arguments

Fixes exploit on Windows servers that allows executing potentially dangerous console commands

* Fix typo

containi -> contain

Vulnerable code:

Fixed code:

		if (contain(g_optionName[g_validMaps], "..") != -1)
			continue
CVE-2023-44451 (C, published 2024-05-03T03:16Z)
Description: value: Linux Mint Xreader EPUB File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Mint Xreader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of EPUB files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-21897.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/linuxmint/xreader
Files changed:
backend/epub/epub-document.c
Commit message: epub: Prevent path traversal when extracting files [CVE-2023-44451]

Test each file's resolved path against the temporary directory
before extracting.

Fixes:
CVE-2023-44451 - Linux Mint Xreader EPUB File Parsing Directory
Traversal Remote Code Execution Vulnerability.

This vulnerability was discovered by:
Febin Mon Saji working with Trend Micro Zero Day Initiative


Vulnerable code:
extract_one_file(EpubDocument* epub_document,GError ** error)
    outfile = g_file_new_for_path(gfilepath->str);
        if ( extract_one_file(epub_document,&err) == FALSE )

Fixed code:
extract_one_file(EpubDocument* epub_document, GFile *tmp_gfile, GError ** error)
    outfile = g_file_new_for_path (gfilepath->str);
    g_autofree gchar *rpath = g_file_get_relative_path (tmp_gfile, outfile);

    if (rpath == NULL)
    {
        g_set_error_literal (error,
                             EV_DOCUMENT_ERROR,
                             EV_DOCUMENT_ERROR_INVALID,
                             _("epub file is invalid or corrupt"));
        g_critical ("Invalid filename in Epub container - '%s'", (gchar *) currentfilename);
        g_object_unref (outfile);
        result = FALSE;
        goto out;
    }

    GFile *tmp_gfile = NULL;
    tmp_gfile = g_file_new_for_path (epub_document->tmp_archive_dir);

        if ( extract_one_file(epub_document, tmp_gfile, &err) == FALSE )
    g_clear_object (&tmp_gfile);
CVE-2017-20187 (PHP, published 2023-11-05T21:15Z)
Description: value: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Magnesium-PHP up to 0.3.0. It has been classified as problematic. Affected is the function formatEmailString of the file src/Magnesium/Message/Base.php. The manipulation of the argument email/name leads to injection. Upgrading to version 0.3.1 is able to address this issue. The patch is identified as 500d340e1f6421007413cc08a8383475221c2604. It is recommended to upgrade the affected component. VDB-244482 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/floriangaerber/Magnesium-PHP
Files changed:
src/Magnesium/Message/Base.php
Commit message: Fix exploit of user's names/emails breaking "To"

Before being added to the "To" string, emails and names are cleared of <
> , and names are additionally cleared of @. See
Magnesium\Message\Base::removeToStringBreakingSymbols() DocBlock for
more details.


Vulnerable code:
        ? sprintf('%s <%s>', $name, $email)
        : $email;

Fixed code:
        ? sprintf(
            '%s <%s>',
            $this->removeToStringBreakingSymbols($name, false),
            $this->removeToStringBreakingSymbols($email, true))
        : $this->removeToStringBreakingSymbols($email, true);
    }

    /**
     *
     * Should a user have chosen a name like "no1@example.com, Not Okay <no2@example.com>, Sherbert",
     * Mailgun would accept the following to: "user@example.com, user2@example.com, no1@example.com, Not Okay <no2@example.com>, Sherbert <hello@example.com>"
     * and would send it accordingly, which is unwanted behavior.
     * Removing only "," breaks the To-string, sending the message to
     * "user@example.com, user2@example.com, no1@example.com Not Okay <no2@example.com> Sherbert" hello@example.com,
     * revealing email addresses of other users.
     * Removing only either of "<,>" or "@," breaks the string the same way.
     * Only removing "<>@," from the string prevents breaking (as far as I know).
     *
     * Also use an input validation library like Respect/Validation or find
     * another way to prevent emails and names from containing "<>,"!
     *
     * @param string $string
     * @param bool   $isEmail
     *
     * @return string
     */
    protected function removeToStringBreakingSymbols(string $string, bool $isEmail)
    {
        return str_replace($isEmail ? ['>', '<', ','] : ['>', '<', ',', '@'], '', $string);