hitoshura25/cvefixes huggingface dataset:
CVE-2015-5273 (Other, published 2015-12-07T18:59Z)
Description: value: The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users to write to arbitrary files via a symlink attack on unpacked.cpio in a pre-created directory with a predictable name in /var/tmp.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/abrt/abrt
Files changed:
src/plugins/Makefile.am
src/plugins/abrt-action-install-debuginfo-to-abrt-cache.c
Commit message: a-a-i-d-to-abrt-cache: make own random temporary directory

The set-user-ID wrapper must use own new temporary directory in order to
avoid security issues with unpacking specially crafted debuginfo
packages that might be used to create files or symlinks anywhere on the
file system as the abrt user.

Withot the forking code the temporary directory would remain on the
filesystem in the case where all debuginfo data are already available.
This is caused by the fact that the underlying libreport functionality
accepts path to a desired temporary directory and creates it only if
necessary. Otherwise, the directory is not touched at all.

This commit addresses CVE-2015-5273

Signed-off-by: Jakub Filak <jfilak@redhat.com>


Vulnerable code:
    /* name, -v, --ids, -, -y, -e, EXACT, -r, REPO, --, NULL */
    const char *args[11];
    execvp(EXECUTABLE, (char **)args);
    error_msg_and_die("Can't execute %s", EXECUTABLE);

Fixed code:
    -DLARGE_DATA_TMP_DIR=\"$(LARGE_DATA_TMP_DIR)\" \
    char tmp_directory[] = LARGE_DATA_TMP_DIR"/abrt-tmp-debuginfo.XXXXXX";
    if (mkdtemp(tmp_directory) == NULL)
        perror_msg_and_die("Failed to create working directory");

    log_info("Created working directory: %s", tmp_directory);

    /* name, -v, --ids, -, -y, -e, EXACT, -r, REPO, -t, PATH, --, NULL */
    const char *args[13];
        args[i++] = "--tmpdir";
        args[i++] = tmp_directory;
    pid_t pid = fork();
    if (pid < 0)
        perror_msg_and_die("fork");

    if (pid == 0)
    {
        execvp(EXECUTABLE, (char **)args);
        error_msg_and_die("Can't execute %s", EXECUTABLE);
    }

    int status;
    if (safe_waitpid(pid, &status, 0) < 0)
        perror_msg_and_die("waitpid");

    if (rmdir(tmp_directory) >= 0)
        log_info("Removed working directory: %s", tmp_directory);
    else if (errno != ENOENT)
        perror_msg("Failed to remove working directory");

    /* Normal execution should exit here. */
    if (WIFEXITED(status))
        return WEXITSTATUS(status);

    if (WIFSIGNALED(status))
        error_msg_and_die("Child terminated with signal %d", WTERMSIG(status));

    error_msg_and_die("Child exit failed");
CVE-2015-5287 (C, published 2015-12-07T18:59Z)
Description: value: The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/abrt/abrt
Files changed:
src/hooks/abrt-hook-ccpp.c
Commit message: ccpp: save abrt core files only to new files

Prior this commit abrt-hook-ccpp saved a core file generated by a
process running a program whose name starts with "abrt" in
DUMP_LOCATION/$(basename program)-coredump. If the file was a symlink,
the hook followed and wrote core file to the symlink's target.

Addresses CVE-2015-5287

Signed-off-by: Jakub Filak <jfilak@redhat.com>


Vulnerable code:
        int abrt_core_fd = xopen3(path, O_WRONLY | O_CREAT | O_TRUNC, 0600);

Fixed code:
        unlink(path);
        int abrt_core_fd = xopen3(path, O_WRONLY | O_CREAT | O_EXCL, 0600);
CVE-2021-32806 (Unknown, published 2021-08-02T19:15Z)
Description: value: Products.isurlinportal is a replacement for isURLInPortal method in Plone. Versions of Products.isurlinportal prior to 1.2.0 have an Open Redirect vulnerability. Various parts of Plone use the 'is url in portal' check for security, mostly to see if it is safe to redirect to a url. A url like `https://example.org` is not in the portal. The url `https:example.org` without slashes is considered to be in the portal. When redirecting, some browsers go to `https://example.org`, others give an error. Attackers may use this to redirect victims to their site, especially as part of a phishing attack. The problem has been patched in Products.isurlinportal 1.2.0.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/plone/Products.isurlinportal
Files changed:
Commit message: Merge pull request from GHSA-q3m9-9fj2-mfwr

Treat urls like https:example.org without slashes as outside the portal.

Vulnerable code:

Fixed code:
CVE-2015-5659 (Ruby, published 2015-10-11T01:59Z)
Description: value: SQL injection vulnerability in Network Applied Communication Laboratory Pref Shimane CMS 2.x before 2.0.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/NaCl-Ltd/pref-shimane-cms
Files changed:
pref-shimane-cms/CHANGELOG.md
pref-shimane-cms/app/controllers/concerns/susanoo/pages_controller.rb
pref-shimane-cms/config/initializers/version.rb
Commit message: SQLインジェクションにより、情報を不正取得できてしまう不具合を修正


Vulnerable code:

    VERSION = '2.0.0'

Fixed code:
# Changelog

## Version 2.0.1 (2015/10/7)

* Bugfix

  * SQLインジェクションにより、情報を不正取得できてしまう不具合を修正

## Version 2.0.0 (2014/9/6)

* 初期リリース

        #
        #=== ソート順を返す
        #
        def order_by
          order_option = ''
          if valid_order_params?
            direction = self.order_direction || 'ASC'
            order_option = "#{self.order_column} #{direction}"
          end
          order_option.present? ? order_option : @@default_order
        end

        #
        #=== ソートパラメータを検証する
        #
        def valid_order_params?
          if self.order_column.blank?
            return false
          end

          permit_column_params = ['pages.name', 'page_contents.last_modified']
          permit_dir_params = ['ASC', 'DESC']

          unless permit_column_params.include?(self.order_column)
            return false
          end

          if self.order_direction.present? &&
            !permit_dir_params.include?(self.order_direction.upcase)
            return false
          end

          return true
        end

    VERSION = '2.0.1'
CVE-2015-5659 (Ruby, published 2015-10-11T01:59Z)
Description: value: SQL injection vulnerability in Network Applied Communication Laboratory Pref Shimane CMS 2.x before 2.0.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/NaCl-Ltd/pref-shimane-cms
Files changed:
pref-shimane-cms/lib/susanoo/search_form.rb
Commit message: 検索フォームクラスごとにソート順を作成するよう修正


Vulnerable code:
      order_option = ''
      if self.order_column
        direction = self.order_direction || 'ASC'
        order_option = "#{self.order_column} #{direction}"
      end
      order_option.present? ? order_option : @@default_order

Fixed code:
    # 子クラスでオーバーライドすること
    #
CVE-2019-17545 (C++, published 2019-10-14T02:15Z)
Description: value: GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB threshold is exceeded.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/OSGeo/gdal
Files changed:
gdal/ogr/ogr_expat.cpp
Commit message: OGRExpatRealloc(): fix double-free when size to allocate is above the default 10MB threshold. Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16178. Credit to OSS Fuzz


Vulnerable code:
    free(ptr);

Fixed code:
CVE-2019-17546 (C, published 2019-10-14T02:15Z)
Description: value: tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a "Negative-size-param" condition.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/OSGeo/gdal
Files changed:
gdal/frmts/gtiff/libtiff/tif_getimage.c
Commit message: Internal libtiff: fix integer overflow potentially causing write heap buffer overflow, especially on 32 bit builds. Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16443. Credit to OSS Fuzz


Vulnerable code:
		    ((row + img->row_offset)%rowsperstrip + nrowsub) * scanline)==(tmsize_t)(-1)
                            ((row + img->row_offset)%rowsperstrip + nrow) * scanline)==(tmsize_t)(-1)
		    p0, ((row + img->row_offset)%rowsperstrip + nrow) * scanline)==(tmsize_t)(-1)
                                            p1, ((row + img->row_offset)%rowsperstrip + nrow) * scanline) == (tmsize_t)(-1)
                                            p2, ((row + img->row_offset)%rowsperstrip + nrow) * scanline) == (tmsize_t)(-1)
			    pa, ((row + img->row_offset)%rowsperstrip + nrow) * scanline)==(tmsize_t)(-1)

Fixed code:
		uint32 temp;
		temp = (row + img->row_offset)%rowsperstrip + nrowsub;
		if( scanline > 0 && temp > (size_t)(TIFF_TMSIZE_T_MAX / scanline) )
		{
			TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in gtStripContig");
			return 0;
		}
		    temp * scanline)==(tmsize_t)(-1)
                uint32 temp;
                temp = (row + img->row_offset)%rowsperstrip + nrow;
                if( scanline > 0 && temp > (size_t)(TIFF_TMSIZE_T_MAX / scanline) )
                {
                        TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in gtStripSeparate");
                        return 0;
                }
                            temp * scanline)==(tmsize_t)(-1)
		    p0, temp * scanline)==(tmsize_t)(-1)
                                            p1, temp * scanline) == (tmsize_t)(-1)
                                            p2, temp * scanline) == (tmsize_t)(-1)
			    pa, temp * scanline)==(tmsize_t)(-1)
CVE-2019-17546 (C, published 2019-10-14T02:15Z)
Description: value: tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a "Negative-size-param" condition.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/OSGeo/gdal
Files changed:
gdal/frmts/gtiff/libtiff/tif_getimage.c
Commit message: Internal libtiff: fix integer overflow potentially causing write heap buffer overflow, especially on 32 bit builds. Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16443. Credit to OSS Fuzz


Vulnerable code:
		    ((row + img->row_offset)%rowsperstrip + nrowsub) * scanline)==(tmsize_t)(-1)
                            ((row + img->row_offset)%rowsperstrip + nrow) * scanline)==(tmsize_t)(-1)
		    p0, ((row + img->row_offset)%rowsperstrip + nrow) * scanline)==(tmsize_t)(-1)
                                            p1, ((row + img->row_offset)%rowsperstrip + nrow) * scanline) == (tmsize_t)(-1)
                                            p2, ((row + img->row_offset)%rowsperstrip + nrow) * scanline) == (tmsize_t)(-1)
			    pa, ((row + img->row_offset)%rowsperstrip + nrow) * scanline)==(tmsize_t)(-1)

Fixed code:
		uint32 temp;
		temp = (row + img->row_offset)%rowsperstrip + nrowsub;
		if( scanline > 0 && temp > (size_t)(TIFF_TMSIZE_T_MAX / scanline) )
		{
			TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in gtStripContig");
			return 0;
		}
		    temp * scanline)==(tmsize_t)(-1)
                uint32 temp;
                temp = (row + img->row_offset)%rowsperstrip + nrow;
                if( scanline > 0 && temp > (size_t)(TIFF_TMSIZE_T_MAX / scanline) )
                {
                        TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in gtStripSeparate");
                        return 0;
                }
                            temp * scanline)==(tmsize_t)(-1)
		    p0, temp * scanline)==(tmsize_t)(-1)
                                            p1, temp * scanline) == (tmsize_t)(-1)
                                            p2, temp * scanline) == (tmsize_t)(-1)
			    pa, temp * scanline)==(tmsize_t)(-1)
CVE-2019-25050 (C++, published 2021-07-20T07:15Z)
Description: value: netCDF in GDAL 2.4.2 through 3.0.4 has a stack-based buffer overflow in nc4_get_att (called from nc4_get_att_tc and nc_get_att_text) and in uffd_cleanup (called from netCDFDataset::~netCDFDataset and netCDFDataset::~netCDFDataset).
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/OSGeo/gdal
Files changed:
gdal/frmts/netcdf/netcdfsg.cpp
Commit message: netCDF: avoid buffer overflow. master only. Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15143. Credit to OSS Fuzz


Vulnerable code:
        alloc = "";

        
        char attr_vals[NC_MAX_NAME + 1];
        memset(attr_vals, 0, NC_MAX_NAME + 1);
        if(nc_get_att_text(ncid, varId, attrName, attr_vals) != NC_NOERR)
        {
            return alloc;
        }
        alloc = std::string(attr_vals);

Fixed code:

            alloc.clear();
        alloc.resize(len);
        memset(&alloc[0], 0, len);
        nc_get_att_text(ncid, varId, attrName, &alloc[0]);
CVE-2021-45943 (Unknown, published 2022-01-01T01:15Z)
Description: value: GDAL 3.3.0 through 3.4.0 has a heap-based buffer overflow in PCIDSK::CPCIDSKFile::ReadFromFile (called from PCIDSK::CPCIDSKSegment::ReadFromFile and PCIDSK::CPCIDSKBinarySegment::CPCIDSKBinarySegment).
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/OSGeo/gdal
Files changed:
Commit message: Merge pull request #4944 from rouault/fix_ossfuzz_41993

PCIDSK: fix write heap-buffer-overflow. Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41993

Vulnerable code:

Fixed code:
CVE-2020-36193 (PHP, published 2021-01-18T20:15Z)
Description: value: Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/pear/Archive_Tar
Files changed:
Archive/Tar.php
tests/out_of_path_fnames.phpt
Commit message: Disallow symlinks to out-of-path filenames


Vulnerable code:

Fixed code:
                        if (strpos(realpath(dirname($v_header['link'])), realpath($p_path)) !== 0) {
                            $this->_error(
                                 'Out-of-path file extraction {'
                                 . $v_header['filename'] . ' --> ' .
                                 $v_header['link'] . '}'
                            );
                            return false;
                        }
--TEST--
tests writes to out-of-path filenames
--SKIPIF--
--FILE--
<?php
require_once dirname(__FILE__) . '/setup.php.inc';
$tar = new Archive_Tar(dirname(__FILE__) . '/out_of_path_symlink.tar');
$tar->extract();
$phpunit->assertErrors(array(array('package' => 'PEAR_Error', 'message' => "Out-of-path file extraction {symlink --> /tmp/}")), 'after 1');
$phpunit->assertFileNotExists('symlink/whatever-filename', 'Out-of-path filename should not have succeeded');
echo 'tests done';
?>
--CLEAN--
<?php
@unlink("symlink");
?>
--EXPECT--
tests done
CVE-2020-36193 (PHP, published 2021-01-18T20:15Z)
Description: value: Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/pear/Archive_Tar
Files changed:
Archive/Tar.php
tests/out_of_path_fnames.phpt
Commit message: Disallow symlinks to out-of-path filenames


Vulnerable code:

Fixed code:
                        if (strpos(realpath(dirname($v_header['link'])), realpath($p_path)) !== 0) {
                            $this->_error(
                                 'Out-of-path file extraction {'
                                 . $v_header['filename'] . ' --> ' .
                                 $v_header['link'] . '}'
                            );
                            return false;
                        }
--TEST--
tests writes to out-of-path filenames
--SKIPIF--
--FILE--
<?php
require_once dirname(__FILE__) . '/setup.php.inc';
$tar = new Archive_Tar(dirname(__FILE__) . '/out_of_path_symlink.tar');
$tar->extract();
$phpunit->assertErrors(array(array('package' => 'PEAR_Error', 'message' => "Out-of-path file extraction {symlink --> /tmp/}")), 'after 1');
$phpunit->assertFileNotExists('symlink/whatever-filename', 'Out-of-path filename should not have succeeded');
echo 'tests done';
?>
--CLEAN--
<?php
@unlink("symlink");
?>
--EXPECT--
tests done
CVE-2021-32610 (Unknown, published 2021-07-30T14:15Z)
Description: value: In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.
Severity: LOW (CVSS v3 base score: 7.1)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/pear/Archive_Tar
Files changed:
Commit message: Merge pull request #40 from mcdruid/master

Add tests for symlink security fixes (CVE-2021-32610) [tests + patch by Drew Webber]

Vulnerable code:

Fixed code:
CVE-2024-1485 (Unknown, published 2024-02-14T00:15Z)
Description: value: A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the `parent` or `plugin` keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-23 \u2014 Relative Path Traversal
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
Repository: https://github.com/devfile/registry-support
Files changed:
Commit message: Merge pull request #197 from Jdubrick/security-fix

Vulnerability Fix

Vulnerable code:

Fixed code:
CVE-2021-4251 (PHP, published 2022-12-18T22:15Z)
Description: value: A vulnerability classified as problematic was found in as. This vulnerability affects the function getFullURL of the file include.cdn.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 4acad1e3d2c34c017473ceea442fb3e3e078b2bd. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216208.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-707 \u2014 Improper Neutralization
The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
Repository: https://github.com/andrewsauder/as
Files changed:
include.cdn.php
Commit message: fix xss vulnerability


Vulnerable code:
        return '<?php echo trim( getFullURL(), '/'); ?>';

Fixed code:
        return '<?php echo trim( htmlspecialchars( getFullURL(), ENT_QUOTES ), '/'); ?>';