hitoshura25/cvefixes huggingface dataset:
CVE-2023-23456 (C++, published 2023-01-12T19:15Z)
Description: value: A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack() in p_tmt.cpp file. The flow allows an attacker to cause a denial of service (abort) via a crafted file.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/upx/upx
Files changed:
src/p_tmt.cpp
Commit message: p_tmt: more sanity of input, cleanup MemBuffer usage

https://github.com/upx/upx/issues/632
	modified:   src/p_tmt.cpp


Vulnerable code:
    if (!imagesize || file_size <= imagesize || file_size <= entry || file_size <= relocsize) {
    mb_wrkmem.alloc(rsize + EXTRA_INFO); // relocations
    if (find_le32(ibuf, 128, get_le32("UPX ")) >= 0)

Fixed code:
    if (imagesize < sizeof(ih) || entry < sizeof(ih) || file_size <= imagesize ||
        file_size <= entry || file_size <= relocsize) {
    mb_wrkmem.alloc(rsize + EXTRA_INFO + 4); // relocations + original entry point + relocsize
    if (find_le32(ibuf, UPX_MIN(128u, usize), get_le32("UPX ")) >= 0)
CVE-2023-23457 (C++, published 2023-01-12T19:15Z)
Description: value: A Segmentation fault was found in UPX in PackLinuxElf64::invert_pt_dynamic() in p_lx_elf.cpp. An attacker with a crafted input file allows invalid memory address access that could lead to a denial of service.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/upx/upx
Files changed:
src/p_lx_elf.cpp
Commit message: invert_pt_dynamic: fix thinko; PackLinuxElf64help1 insist on ELF

https://github.com/upx/upx/issues/631
	modified:   src/p_lx_elf.cpp


Vulnerable code:
    if (ehdri.e_ident[Elf32_Ehdr::EI_CLASS]!=Elf32_Ehdr::ELFCLASS32
    if (ehdri.e_ident[Elf64_Ehdr::EI_CLASS]!=Elf64_Ehdr::ELFCLASS64
                dt_names[k], dt_offsets[n_off]);

Fixed code:
    if (memcmp((char const *)&ehdri, "\x7f\x45\x4c\x46", 4)  // "\177ELF"
    || ehdri.e_ident[Elf32_Ehdr::EI_CLASS]!=Elf32_Ehdr::ELFCLASS32
    if (memcmp((char const *)&ehdri, "\x7f\x45\x4c\x46", 4)  // "\177ELF"
    || ehdri.e_ident[Elf64_Ehdr::EI_CLASS]!=Elf64_Ehdr::ELFCLASS64
                k, dt_offsets[n_off]);
CVE-2021-3751 (C, published 2021-09-15T07:15Z)
Description: value: libmobi is vulnerable to Out-of-bounds Write
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/bfabiszewski/libmobi
Files changed:
src/buffer.c
Commit message: fix oob write bug inside libmobi


Vulnerable code:
        if (buf->offset < aoffset) {
            debug_print("%s", "End of buffer\n");

Fixed code:
        if ( (buf->offset < aoffset) || (buf->offset + len > buf->maxlen) ) {
            debug_print("%s", "Beyond start/end of buffer\n");
CVE-2021-3881 (C, published 2021-10-15T14:15Z)
Description: value: libmobi is vulnerable to Out-of-bounds Read
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/bfabiszewski/libmobi
Files changed:
src/compression.c
src/compression.h
src/read.c
Commit message: Fix potential out-of-buffer read while parsing corrupt file, closes #35, #36


Vulnerable code:
                code_length++;
    uint32_t mincode_table[33]; /**< Table of big-endian mincodes from HUFF record data2 */
    uint32_t maxcode_table[33]; /**< Table of big-endian maxcodes from HUFF record data2 */
    for (int i = 1; i < 33; i++) {

Fixed code:
                if (++code_length >= HUFF_CODETABLE_SIZE) {
                    debug_print("Wrong offset to mincode table: %hhu\n", code_length);
                    return MOBI_DATA_CORRUPT;
                }
#define HUFF_CODETABLE_SIZE 33 /**< Size of min- and maxcode tables */
    uint32_t mincode_table[HUFF_CODETABLE_SIZE]; /**< Table of big-endian mincodes from HUFF record data2 */
    uint32_t maxcode_table[HUFF_CODETABLE_SIZE]; /**< Table of big-endian maxcodes from HUFF record data2 */
    for (int i = 1; i < HUFF_CODETABLE_SIZE; i++) {
CVE-2021-3888 (C, published 2021-10-19T13:15Z)
Description: value: libmobi is vulnerable to Use of Out-of-range Pointer Offset
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/bfabiszewski/libmobi
Files changed:
src/read.c
Commit message: Fix potential out-of-buffer read while parsing corrupt file, closes #38


Vulnerable code:

Fixed code:
    if (huffcdic->index_count != huffcdic->index_read) {
        debug_print("CDIC: wrong read index count: %zu, total: %zu\n", huffcdic->index_read, huffcdic->index_count);
        return MOBI_DATA_CORRUPT;
    }
CVE-2021-3889 (C, published 2021-10-19T13:15Z)
Description: value: libmobi is vulnerable to Use of Out-of-range Pointer Offset
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/bfabiszewski/libmobi
Files changed:
src/compression.c
src/compression.h
src/read.c
Commit message: Fix potential out-of-buffer read while parsing corrupt file, closes #35, #36


Vulnerable code:
                code_length++;
    uint32_t mincode_table[33]; /**< Table of big-endian mincodes from HUFF record data2 */
    uint32_t maxcode_table[33]; /**< Table of big-endian maxcodes from HUFF record data2 */
    for (int i = 1; i < 33; i++) {

Fixed code:
                if (++code_length >= HUFF_CODETABLE_SIZE) {
                    debug_print("Wrong offset to mincode table: %hhu\n", code_length);
                    return MOBI_DATA_CORRUPT;
                }
#define HUFF_CODETABLE_SIZE 33 /**< Size of min- and maxcode tables */
    uint32_t mincode_table[HUFF_CODETABLE_SIZE]; /**< Table of big-endian mincodes from HUFF record data2 */
    uint32_t maxcode_table[HUFF_CODETABLE_SIZE]; /**< Table of big-endian maxcodes from HUFF record data2 */
    for (int i = 1; i < HUFF_CODETABLE_SIZE; i++) {
CVE-2022-1533 (Other, published 2022-04-29T11:15Z)
Description: value: Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11. This vulnerability is capable of arbitrary code execution.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/bfabiszewski/libmobi
Files changed:
ChangeLog
src/index.c
Commit message: Fix wrong boundary checks in inflections parser resulting in stack buffer over-read with corrupt input


Vulnerable code:
            if (pos < 0 || pos > *decoded_size) {
                debug_print("Position setting failed (%s)\n", decoded);
                return MOBI_DATA_CORRUPT;
            }
                if (l < 0 || d + l > decoded + INDX_INFLBUF_SIZEMAX) {
                if (l < 0 || d + l > decoded + INDX_INFLBUF_SIZEMAX) {

Fixed code:
2022-04-27: Fix wrong boundary checks in inflections parser resulting in stack buffer over-read with corrupt input
                if (pos < 0 || l < 0 || d + l > decoded + INDX_INFLBUF_SIZEMAX) {
                if (pos < 0 || l < 0 || s + l > decoded + INDX_INFLBUF_SIZEMAX) {
CVE-2022-1534 (Other, published 2022-04-29T11:15Z)
Description: value: Buffer Over-read at parse_rawml.c:1416 in GitHub repository bfabiszewski/libmobi prior to 0.11. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.
Severity: LOW (CVSS v3 base score: 7.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/bfabiszewski/libmobi
Files changed:
ChangeLog
src/parse_rawml.c
Commit message: Fix array boundary check when parsing inflections which could result in buffer over-read with corrupt input


Vulnerable code:
2022-04-23: Fix faulty checks for array boundary which caused buffer over-read
2022-04-23: Fix issue with corrupt files with tagvalues_count = 0 that caused heap buffer over-read

Fixed code:
2022-04-26: Fix array boundary check when parsing inflections which could result in buffer over-read with corrupt input
2022-04-23: Fix faulty checks for array boundary which caused buffer over-read with corrupt input
2022-04-23: Fix issue with corrupt files with tagvalues_count = 0 that caused null pointer dereference
            if (parts[j] >= infl->entries_count) {
                debug_print("%s\n", "Invalid entry offset");
                return MOBI_DATA_CORRUPT;
            }
CVE-2022-1907 (Other, published 2022-05-27T09:15Z)
Description: value: Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/bfabiszewski/libmobi
Files changed:
ChangeLog
src/parse_rawml.c
Commit message: Fix boundary checking error in markup search, that could cause buffer over-read with corrupt input


Vulnerable code:
                if (*(data - 1) == '/' && *data == '>') {
            if (*(data - 1) == '/' && *data == '>') {
            if (*(data - 1) == '/' && *data == '>') {

Fixed code:
2022-05-03: Fix boundary checking error in markup search, that could cause buffer over-read with corrupt input
                if (data <= data_end && *(data - 1) == '/' && *data == '>') {
            if (data <= data_end && *(data - 1) == '/' && *data == '>') {
            if (length && *(data - 1) == '/' && *data == '>') {
CVE-2022-1908 (Other, published 2022-05-27T09:15Z)
Description: value: Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/bfabiszewski/libmobi
Files changed:
ChangeLog
src/parse_rawml.c
Commit message: Fix boundary checking error in markup search, that could cause buffer over-read with corrupt input


Vulnerable code:
                if (*(data - 1) == '/' && *data == '>') {
            if (*(data - 1) == '/' && *data == '>') {
            if (*(data - 1) == '/' && *data == '>') {

Fixed code:
2022-05-03: Fix boundary checking error in markup search, that could cause buffer over-read with corrupt input
                if (data <= data_end && *(data - 1) == '/' && *data == '>') {
            if (data <= data_end && *(data - 1) == '/' && *data == '>') {
            if (length && *(data - 1) == '/' && *data == '>') {
CVE-2022-1987 (Other, published 2022-06-03T08:15Z)
Description: value: Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/bfabiszewski/libmobi
Files changed:
ChangeLog
src/index.c
Commit message: Fix: index entry label not being zero-terminated with corrupt input


Vulnerable code:
 @param[in,out] output Output string
 @return Size of read label
 @param[in,out] output Output buffer (INDX_LABEL_SIZEMAX bytes)
 @return Number of bytes read
    char text[INDX_LABEL_SIZEMAX];

Fixed code:
2022-05-05: Fix: index entry label not being zero-terminated with corrupt input
 @param[in,out] output Output buffer (INDX_LABEL_SIZEMAX + 1 bytes)
 @return Length of output string (without null terminator), on error buf->error set to MOBI_RET status
 @param[in,out] output Output buffer (INDX_LABEL_SIZEMAX + 1 bytes)
 @return Length of output string (without null terminator)
    char text[INDX_LABEL_SIZEMAX + 1];
        if (buf->error != MOBI_SUCCESS) {
            debug_print("Buffer error reading label: %d\n", buf->error);
            return MOBI_DATA_CORRUPT;
        }
CVE-2022-2279 (C, published 2022-07-01T09:15Z)
Description: value: NULL Pointer Dereference in GitHub repository bfabiszewski/libmobi prior to 0.11.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/bfabiszewski/libmobi
Files changed:
ChangeLog
src/opf.c
src/util.c
tools/common.c
Commit message: Fix undefined behavior when passing null to strdup


Vulnerable code:
                opf->metadata->x_meta->dictionary_in_lang = calloc(OPF_META_MAX_TAGS, sizeof(char*));
                if (opf->metadata->x_meta->dictionary_in_lang == NULL) {
                    debug_print("%s\n", "Memory allocation failed");
                    return MOBI_MALLOC_FAILED;
                }
                opf->metadata->x_meta->dictionary_in_lang[0] = strdup(mobi_get_locale_string(dict_lang_in));
                opf->metadata->x_meta->dictionary_out_lang = calloc(OPF_META_MAX_TAGS, sizeof(char*));
                if (opf->metadata->x_meta->dictionary_out_lang == NULL) {
                    debug_print("%s\n", "Memory allocation failed");
                    return MOBI_MALLOC_FAILED;
                uint32_t dict_lang_in = *m->mh->dict_output_lang;
                opf->metadata->x_meta->dictionary_out_lang[0] = strdup(mobi_get_locale_string(dict_lang_in));
 @return Pointer to locale string in mobi_locale array
            printf(": %s => %s", locale_in, locale_out);

Fixed code:
2022-04-27: Fix undefined behavior when passing null to strdup
                const char *lang = mobi_get_locale_string(dict_lang_in);
                if (lang) {
                    opf->metadata->x_meta->dictionary_in_lang = calloc(OPF_META_MAX_TAGS, sizeof(char*));
                    if (opf->metadata->x_meta->dictionary_in_lang == NULL) {
                        debug_print("%s\n", "Memory allocation failed");
                        return MOBI_MALLOC_FAILED;
                    }
                    opf->metadata->x_meta->dictionary_in_lang[0] = strdup(lang);
                }
                uint32_t dict_lang_out = *m->mh->dict_output_lang;
                const char *lang = mobi_get_locale_string(dict_lang_out);
                if (lang) {
                    opf->metadata->x_meta->dictionary_out_lang = calloc(OPF_META_MAX_TAGS, sizeof(char*));
                    if (opf->metadata->x_meta->dictionary_out_lang == NULL) {
                        debug_print("%s\n", "Memory allocation failed");
                        return MOBI_MALLOC_FAILED;
                    }
                    opf->metadata->x_meta->dictionary_out_lang[0] = strdup(lang);
 @return Pointer to locale string in mobi_locale array or NULL on error
            printf(": %s => %s", locale_in ? locale_in : "unknown", locale_out ? locale_out : "unknown");
CVE-2022-29788 (Other, published 2022-06-02T14:15Z)
Description: value: libmobi before v0.10 contains a NULL pointer dereference via the component mobi_buffer_getpointer. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted mobi file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/bfabiszewski/libmobi
Files changed:
ChangeLog
src/index.c
Commit message: Fix issue with corrupt files with tagvalues_count = 0 that caused null pointer dereference


Vulnerable code:
            for (size_t k = 0; k < t.tagvalues_count - 1; k += 2) {

Fixed code:
2022-04-23: Fix issue with corrupt files with tagvalues_count = 0 that caused heap buffer over-read
            for (size_t k = 0; k + 1 < t.tagvalues_count; k += 2) {
CVE-2014-2567 (C++, published 2014-03-21T10:55Z)
Description: value: The OpenConnectionTask::handleStateHelper function in Imap/Tasks/OpenConnectionTask.cpp in Trojita before 0.4.1 allows man-in-the-middle attackers to trigger use of cleartext for saving a message into a (1) sent or (2) draft folder via a PREAUTH response that prevents later use of the STARTTLS command.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/jktjkt/trojita
Files changed:
src/Imap/Tasks/OpenConnectionTask.cpp
tests/Imap/test_Imap_Tasks_OpenConnection.cpp
tests/Imap/test_Imap_Tasks_OpenConnection.h
Commit message: IMAP: refuse to work when STARTTLS is required but server sends PREAUTH

Oops, we cannot send STARTTLS when the connection is already authenticated.
This is serious enough to warrant an error; an attacker might be going after a
plaintext of a message we're going to APPEND, etc.

Thanks to Arnt Gulbrandsen on the imap-protocol ML for asking what happens when
we're configured to request STARTTLS and a PREAUTH is received, and to Michael M
Slusarz for starting that discussion.

Hope the error message is readable enough.

CVE: CVE-2014-2567


Vulnerable code:

Fixed code:
            if (model->m_startTls) {
                // Oops, we cannot send STARTTLS when the connection is already authenticated.
                // This is serious enough to warrant an error; an attacker might be going after a plaintext
                // of a message we're going to APPEND, etc.
                // Thanks to Arnt Gulbrandsen on the imap-protocol ML for asking what happens when we're configured
                // to request STARTTLS and a PREAUTH is received, and to Michael M Slusarz for starting that discussion.
                logout(tr("Configuration requires sending STARTTLS, but the IMAP server greets us with PREAUTH. "
                          "Encryption cannot be established. If this configuration worked previously, someone "
                          "is after your data and they are pretty smart."));
                return true;
            }
/** @short What happens when the server responds with PREAUTH and we want STARTTLS? */
void ImapModelOpenConnectionTest::testPreauthWithStartTlsWanted()
{
    cleanup(); init(true); // yuck, but I can't come up with anything better...

    cEmpty();
    cServer("* PREAUTH hi there\r\n");
    QCOMPARE(failedSpy->size(), 1);
    QVERIFY(completedSpy->isEmpty());
    QVERIFY(authSpy->isEmpty());
    QVERIFY(startTlsUpgradeSpy->isEmpty());
}

    void testPreauthWithStartTlsWanted();
CVE-2023-4913 (PHP, published 2023-09-12T15:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository cecilapp/cecil prior to 7.47.1.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/cecilapp/cecil
Files changed:
resources/server/router.php
Commit message: Fix security issues (#1782)



Vulnerable code:
$path = urldecode(parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH));
if (!file_exists($filename) || is_dir($filename)) {

Fixed code:
$path = htmlspecialchars(urldecode(parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH)));
if ((realpath($filename) === false || strpos(realpath($filename), realpath($_SERVER['DOCUMENT_ROOT'])) !== 0) || !file_exists($filename) || is_dir($filename)) {
CVE-2023-4914 (PHP, published 2023-09-12T15:15Z)
Description: value: Relative Path Traversal in GitHub repository cecilapp/cecil prior to 7.47.1.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/cecilapp/cecil
Files changed:
resources/server/router.php
Commit message: Fix security issues (#1782)



Vulnerable code:
$path = urldecode(parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH));
if (!file_exists($filename) || is_dir($filename)) {

Fixed code:
$path = htmlspecialchars(urldecode(parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH)));
if ((realpath($filename) === false || strpos(realpath($filename), realpath($_SERVER['DOCUMENT_ROOT'])) !== 0) || !file_exists($filename) || is_dir($filename)) {
CVE-2021-31571 (C, published 2021-04-22T18:15Z)
Description: value: The kernel in Amazon Web Services FreeRTOS before 10.4.3 has an integer overflow in queue.c for queue creation.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/FreeRTOS/FreeRTOS-Kernel
Files changed:
queue.c
Commit message: add assert for addition overflow on queue creation (#225)



Vulnerable code:

Fixed code:
        /* Check for addition overflow. */
        configASSERT( ( sizeof( Queue_t ) + xQueueSizeInBytes ) >  xQueueSizeInBytes );