hitoshura25/cvefixes huggingface dataset:
CVE-2016-9317 (Other, published 2017-01-26T15:59Z)
Description: value: The gdImageCreate function in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (system hang) via an oversized image.
Severity: HIGH (CVSS v3 base score: 5.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/libgd/libgd
Files changed:
src/gd.c
tests/CMakeLists.txt
tests/Makefile.am
tests/gdimagecreate/.gitignore
tests/gdimagecreate/CMakeLists.txt
tests/gdimagecreate/Makemodule.am
tests/gdimagecreate/bug00340.c
Commit message: Fix #340: System frozen

gdImageCreate() doesn't check for oversized images and as such is prone
to DoS vulnerabilities. We fix that by applying the same overflow check
that is already in place for gdImageCreateTrueColor().

CVE-2016-9317


Vulnerable code:

Fixed code:

		gdimagecreate
include gdimagecreate/Makemodule.am
/bug00340
SET(TESTS_FILES
	bug00340
)

ADD_GD_TESTS()
libgd_test_programs += \
	gdimagecreate/bug00340

EXTRA_DIST += \
	gdimagecreate/CMakeLists.txt
/**
 * Regression test for <https://github.com/libgd/libgd/issues/340>
 *
 * We're testing that trying to create an oversized image fails early,
 * triggering an appropriate warning.
 */


#include <string.h>
#include "gd.h"
#include "gd_errors.h"
#include "gdtest.h"


#define MSG "product of memory allocation multiplication would exceed INT_MAX, failing operation gracefully\n"


void error_handler(int priority, const char *format, ...)
{
    gdTestAssert(priority == GD_WARNING);
    gdTestAssert(!strcmp(format, MSG));
}


int main()
{
    gdImagePtr im;

    im = gdImageCreate(64970, 65111);
    gdTestAssert(im == NULL);

    return gdNumFailures();
}
CVE-2016-9933 (Other, published 2017-01-04T20:59Z)
Description: value: Stack consumption vulnerability in the gdImageFillToBorder function in gd.c in the GD Graphics Library (aka libgd) before 2.2.2, as used in PHP before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (segmentation violation) via a crafted imagefilltoborder call that triggers use of a negative color value.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/libgd/libgd
Files changed:
src/gd.c
tests/gdimagefilltoborder/.gitignore
tests/gdimagefilltoborder/CMakeLists.txt
tests/gdimagefilltoborder/Makemodule.am
Commit message: fix #215 gdImageFillToBorder stack-overflow when invalid color is used


Vulnerable code:
	if (border < 0) {
	gdimagefilltoborder/bug00037

Fixed code:
	if (border < 0 || color < 0) {
	if (!im->trueColor) {
		if ((color > (im->colorsTotal - 1)) || (border > (im->colorsTotal - 1))) {
			return;
		}
    }

/github_bug_215
	github_bug_215
	gdimagefilltoborder/bug00037 \
	gdimagefilltoborder/github_bug_215
CVE-2018-14553 (C, published 2020-02-11T13:15Z)
Description: value: gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to crash an application via a specific function call sequence. Only affects PHP when linked with an external libgd (not bundled).
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/libgd/libgd
Files changed:
src/gd.c
tests/gdimageclone/.gitignore
tests/gdimageclone/CMakeLists.txt
tests/gdimageclone/Makemodule.am
tests/gdimageclone/style.c
Commit message: Fix potential NULL pointer dereference in gdImageClone()


Vulnerable code:
	if (src->styleLength > 0) {
		dst->styleLength = src->styleLength;
		dst->stylePos    = src->stylePos;
		for (i = 0; i < src->styleLength; i++) {
			dst->style[i] = src->style[i];
		}
	}

	gdimageclone/bug00300

Fixed code:
		dst->stylePos = src->stylePos;
/style
	style
	gdimageclone/bug00300 \
	gdimageclone/style
/**
 * Cloning an image should exactly reproduce all style related data
 */


#include <string.h>
#include "gd.h"
#include "gdtest.h"


int main()
{
    gdImagePtr im, clone;
    int style[] = {0, 0, 0};

    im = gdImageCreate(8, 8);
    gdImageSetStyle(im, style, sizeof(style)/sizeof(style[0]));

    clone = gdImageClone(im);
    gdTestAssert(clone != NULL);

    gdTestAssert(clone->styleLength == im->styleLength);
    gdTestAssert(clone->stylePos == im->stylePos);
    gdTestAssert(!memcmp(clone->style, im->style, sizeof(style)/sizeof(style[0])));

    gdImageDestroy(clone);
    gdImageDestroy(im);

    return gdNumFailures();
}
CVE-2021-40145 (Unknown, published 2021-08-26T01:15Z)
Description: value: gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. NOTE: the vendor's position is "The GD2 image format is a proprietary image format of libgd. It has to be regarded as being obsolete, and should only be used for development and testing purposes.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/libgd/libgd
Files changed:
Commit message: Merge pull request #713 from me22bee/_gdImageGd2

gdImageGd2Ptr memory leak

Vulnerable code:

Fixed code:
CVE-2021-40812 (Unknown, published 2021-09-08T21:15Z)
Description: value: The GD Graphics Library (aka LibGD) through 2.3.2 has an out-of-bounds read because of the lack of certain gdGetBuf and gdPutBuf return value checks.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/libgd/libgd
Files changed:
Commit message: Merge pull request #755 from libgd/bug/750

Partial fix for #750, BMP and WebP. Gif's usage of PutBuf needs too much refactoring for the actual gain here."

Vulnerable code:

Fixed code:
CVE-2021-23568 (JavaScript, published 2022-01-10T14:10Z)
Description: value: The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/eggjs/extend2
Files changed:
.github/workflows/nodejs.yml
index.js
package.json
test/index.js
Commit message: fix: __proto__ copy (#2)



Vulnerable code:
sudo: false
language: node_js
node_js:
  - '4'
  - '6'
  - '7'
install:
  - npm i npminstall && npminstall
script:
  - npm run ci
after_script:
  - npminstall codecov && codecov
environment:
  matrix:
    - nodejs_version: '4'
    - nodejs_version: '6'
    - nodejs_version: '7'

install:
  - ps: Install-Product node $env:nodejs_version
  - npm i npminstall && node_modules\.bin\npminstall

test_script:
  - node --version
  - npm --version
  - npm run ci

build: off
    "egg-ci": "^1.5.0",
    "version": "4, 6, 7"

Fixed code:
# This workflow will do a clean install of node dependencies, build the source code and run tests across different versions of node
# For more information see: https://help.github.com/actions/language-and-framework-guides/using-nodejs-with-github-actions

name: Node.js CI

on:
  push:
    branches:
      - main
      - master
  pull_request:
    branches:
      - main
      - master
  schedule:
    - cron: '0 2 * * *'

jobs:
  build:
    runs-on: ${{ matrix.os }}

    strategy:
      fail-fast: false
      matrix:
        node-version: [6, 8, 10, 12, 14, 16]
        os: [ubuntu-latest, windows-latest, macos-latest]

    steps:
    - name: Checkout Git Source
      uses: actions/checkout@v2

    - name: Use Node.js ${{ matrix.node-version }}
      uses: actions/setup-node@v1
      with:
        node-version: ${{ matrix.node-version }}

    - name: Install Dependencies
      run: npm i -g npminstall@latest-3 && npminstall

    - name: Continuous Integration
      run: npm run ci

    - name: Code Coverage
      uses: codecov/codecov-action@v1
      with:
        token: ${{ secrets.CODECOV_TOKEN }}
      if (name === '__proto__') continue;

    "type": "github",
    "version": "6, 8, 10, 12, 14, 16"

test('fix __proto__ copy', function (t) {
  var r = extend(true, {}, JSON.parse('{"__proto__": {"polluted": "yes"}}'));
  t.deepEqual(
    JSON.stringify(r),
    '{}',
    'It should not copy __proto__'
  );
  t.deepEqual(
    ''.polluted,
    undefined,
    'It should not affect object prototype'
  );
  t.end();
});
CVE-2024-34455 (Other, published 2024-05-03T19:15Z)
Description: value: Buildroot before 0b2967e lacks the sticky bit for the /dev/shm directory. A fix was released in 2024.02.2.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/buildroot/buildroot
Files changed:
package/skeleton-init-sysv/skeleton/etc/fstab
Commit message: package/skeleton-init-sysv: Set sticky bit on /dev/shm

/dev/shm is a world-writable directory, like /tmp, and should also
have the sticky bit set.  Without this, any user can delete and
replace another user's files in /dev/shm.

This bug has been present since /dev/shm was added to the skeleton
/etc/fstab, but appears to have been fixed for systems using systemd
by commit 76fc9275f14e "system: separate sysv and systemd parts of the
skeleton" which went into Buildroot 2017.08.

Signed-off-by: Ben Hutchings <ben.hutchings@mind.be>
Fixes: 22fde22e35f98f7830c2f8955465532328348cd1
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>


Vulnerable code:
tmpfs		/dev/shm	tmpfs	mode=0777	0	0

Fixed code:
tmpfs		/dev/shm	tmpfs	mode=1777	0	0
CVE-2020-27208 (C, published 2021-05-21T12:15Z)
Description: value: The flash read-out protection (RDP) level is not enforced during the device initialization phase of the SoloKeys Solo 4.0.0 & Somu and the Nitrokey FIDO2 token. This allows an adversary to downgrade the RDP level and access secrets such as private ECC keys from SRAM via the debug interface.
Severity: MEDIUM (CVSS v3 base score: 6.8)
Weakness: CWE-326 \u2014 Inadequate Encryption Strength
The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
Repository: https://github.com/solokeys/solo
Files changed:
targets/stm32l432/src/device.c
targets/stm32l432/src/flash.c
Commit message: patches to improve resistance to fault injection


Vulnerable code:
#if BOOT_TO_DFU
    flash_option_bytes_init(1);
#else
    flash_option_bytes_init(0);
#endif

    __enable_irq();

Fixed code:
#if BOOT_TO_DFU
    flash_option_bytes_init(1);
#else
    flash_option_bytes_init(0);
#endif


    /* Perform option byte loading which triggers a device reset. */
    FLASH->CR |= FLASH_CR_OBL_LAUNCH;

    while (true);
CVE-2022-1586 (C, published 2022-05-16T21:15Z)
Description: value: An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/PCRE2Project/pcre2
Files changed:
src/pcre2_jit_compile.c
Commit message: Fix incorrect value reading in JIT.


Vulnerable code:
    if (*cc == PT_CLIST && *cc == XCL_PROP)

Fixed code:
    if (*cc == PT_CLIST && cc[-1] == XCL_PROP)
CVE-2022-1586 (C, published 2022-05-16T21:15Z)
Description: value: An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/PCRE2Project/pcre2
Files changed:
ChangeLog
src/pcre2_jit_compile.c
src/pcre2_jit_test.c
Commit message: Fixed a unicode properrty matching issue in JIT


Vulnerable code:
    if (*cc == PT_CLIST)

Fixed code:
23. Fixed a unicode properrty matching issue in JIT. The character was not
fully read in caseless matching.

    if (*cc == PT_CLIST && *cc == XCL_PROP)
	{ CMUP, 0, 0, 0, "[^S]\\B", "\xe2\x80\x8a" },
CVE-2022-41409 (Other, published 2023-07-18T14:15Z)
Description: value: Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/PCRE2Project/pcre2
Files changed:
ChangeLog
src/pcre2test.c
testdata/testinput2
testdata/testoutput2
Commit message: Diagnose negative repeat value in pcre2test subject line


Vulnerable code:
    if (i-- == 0)
      fprintf(outfile, "** Zero repeat not allowed\n");

Fixed code:
20. A negative repeat value in a pcre2test subject line was not being 
diagnosed, leading to infinite looping.

    if (i-- <= 0)
      fprintf(outfile, "** Zero or negative repeat not allowed\n");
--
    \[X]{-10}

--
    \[X]{-10}
** Zero or negative repeat not allowed
CVE-2023-6461 (JavaScript, published 2023-12-01T14:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository viliusle/minipaint prior to 4.14.0.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/viliusle/minipaint
Files changed:
src/js/core/gui/gui-layers.js
src/js/modules/layer/rename.js
Commit message: XSS fix (layers name)


Vulnerable code:
				html += '	<button class="layer_name" id="layer_name" data-id="' + value.id + '">' + value.name + '</button>';
				{name: "name", title: "Name:", value: config.layer.name},

Fixed code:

				var layer_title = this.Helper.escapeHtml(value.name);
				html += '	<button class="layer_name" id="layer_name" data-id="' + value.id + '">' + layer_title + '</button>';
import Helper_class from './../../libs/helpers.js';
		this.Helper = new Helper_class();
		var name_ = this.Helper.escapeHtml(config.layer.name);

				{name: "name", title: "Name:", value: name_},
CVE-2022-31101 (Unknown, published 2022-06-27T23:15Z)
Description: value: prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can perform SQL injection. This issue is fixed in version 2.1.1. Users are advised to upgrade. There are no known workarounds for this issue.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/PrestaShop/blockwishlist
Files changed:
Commit message: Merge pull request from GHSA-2jx3-5j9v-prpp

Validate order by and order way

Vulnerable code:

Fixed code:
CVE-2024-2217 (Python, published 2024-04-10T17:15Z)
Description: value: gaizhenbiao/chuanhuchatgpt is vulnerable to improper access control, allowing unauthorized access to the `config.json` file. This vulnerability is present in both authenticated and unauthenticated versions of the application, enabling attackers to obtain sensitive information such as API keys (`openai_api_key`, `google_palm_api_key`, `xmchat_api_key`, etc.), configuration details, and user credentials. The issue stems from the application's handling of HTTP requests for the `config.json` file, which does not properly restrict access based on user authentication.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/gaizhenbiao/chuanhuchatgpt
Files changed:
ChuanhuChatbot.py
Commit message: bugfix: added blocked paths to protect sensitive files


Vulnerable code:

Fixed code:
        blocked_paths=["config.json", "files", "models", "lora", "modules"],
CVE-2017-1001004 (JavaScript, published 2017-11-27T14:29Z)
Description: value: typed-function before 0.10.6 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary execution.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/josdejong/typed-function
Files changed:
HISTORY.md
test/security.test.js
typed-function.js
Commit message: Fixed a security issue allowing to execute aritrary JavaScript code via a specially prepared function name of a typed function


Vulnerable code:
      var _name = name || '';
      var _args = getArgs(maxParams(_signatures));
      code.push('function ' + _name + '(' + _args.join(', ') + ') {');
      code.push('  var name = \'' + _name + '\';');

Fixed code:
## not yet released, version 0.10.6

- Fixed a security issue allowing to execute aritrary JavaScript code via a 
  specially prepared function name of a typed function. Thanks Masato Kinugawa.


var assert = require('assert');
var typed = require('../typed-function');

describe('security', function () {

  it ('should not allow bad code in the function name', function () {
    // simple example:
    // var fn = typed("(){}+console.log('hacked...');function a", {     
    //   "": function () {} 
    // });

    // example resulting in throwing an error
    var fn = typed("(){}+(function(){throw new Error('Hacked... should not have executed this function!!!')})();function a", { 
      "": function () {} 
    });
  })
})
      // safeName is a conservative replacement of characters 
      // to prevend being able to inject JS code at the place of the function name 
      // the name is useful for stack trackes therefore we want have it there
      var safeName = (name || '').replace(/[^a-zA-Z0-9_$]/g, '_')
      var args = getArgs(maxParams(_signatures));
      code.push('function ' + safeName + '(' + args.join(', ') + ') {');
      code.push('  var name = ' + JSON.stringify(name || '') + ';');
CVE-2016-2347 (C, published 2017-04-21T20:59Z)
Description: value: Integer underflow in the decode_level3_header function in lib/lha_file_header.c in Lhasa before 0.3.1 allows remote attackers to execute arbitrary code via a crafted archive.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/fragglet/lhasa
Files changed:
lib/lha_file_header.c
Commit message: Fix integer underflow vulnerability in L3 decode.

Marcin 'Icewall' Noga of Cisco TALOS discovered that the level 3 header
decoding routines were vulnerable to an integer underflow, if the 32-bit
header length was less than the base level 3 header length. This could
lead to an exploitable heap corruption condition.

Thanks go to Marcin Noga and Regina Wilson of Cisco TALOS for reporting
this vulnerability.


Vulnerable code:
	if (header_len > LEVEL_3_MAX_HEADER_LEN) {

Fixed code:
	if (nbytes > LEVEL_3_MAX_HEADER_LEN) {
		return NULL;
	}

	if (header_len > LEVEL_3_MAX_HEADER_LEN
	 || header_len < RAW_DATA_LEN(header)) {
CVE-2019-25091 (Python, published 2022-12-27T23:15Z)
Description: value: A vulnerability classified as problematic has been found in nsupdate.info. This affects an unknown part of the file src/nsupdate/settings/base.py of the component CSRF Cookie Handler. The manipulation of the argument CSRF_COOKIE_HTTPONLY leads to cookie without 'httponly' flag. It is possible to initiate the attack remotely. The name of the patch is 60a3fe559c453bc36b0ec3e5dd39c1303640a59a. It is recommended to apply a patch to fix this issue. The identifier VDB-216909 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-1004 \u2014 Sensitive Cookie Without 'HttpOnly' Flag
The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.
Repository: https://github.com/nsupdate-info/nsupdate.info
Files changed:
src/nsupdate/settings/base.py
Commit message: Set HTTPONLY to CSRF cookies


Vulnerable code:
CSRF_COOKIE_HTTPONLY = False

Fixed code:
CSRF_COOKIE_HTTPONLY = True