hitoshura25/cvefixes huggingface dataset:
CVE-2015-3296 (JSON, published 2017-09-21T14:29Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in NodeBB before 0.7 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) javascript: or (2) data: URLs.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/julianlam/nodebb-plugin-markdown
Files changed:
index.js
package.json
Commit message: updated plugin to use markdown-it instead of remarkable, and updated validateLink method to discard all data-uris, until a solution is developed upstream.


Vulnerable code:
	var	Remarkable = require('remarkable'),
					parser = new Remarkable(_self.config);
    "remarkable": "^1.3.0"

Fixed code:
	var	MarkdownIt = require('markdown-it'),
					parser = new MarkdownIt(_self.config);

					// Override the link validator from MarkdownIt, so you cannot link directly to a data-uri
					parser.validateLink = function(url) {
						var BAD_PROTOCOLS    = [ 'vbscript', 'javascript', 'file', 'data' ];
						var str = url.trim().toLowerCase();

						if (str.indexOf(':') >= 0 && BAD_PROTOCOLS.indexOf(str.split(':')[0]) >= 0) {
							return false;
						}
						return true;
					}
    "markdown-it": "^4.0.3"
CVE-2021-23370 (JavaScript, published 2021-04-12T14:15Z)
Description: value: This affects the package swiper before 6.5.1.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/nolimits4web/swiper
Files changed:
src/utils/utils.js
Commit message: fix(core): fixed __proto__ pollution


Vulnerable code:
      const keysArray = Object.keys(Object(nextSource));

Fixed code:
      const keysArray = Object.keys(Object(nextSource)).filter((key) => key !== '__proto__');
CVE-2020-36651 (JavaScript, published 2023-01-18T01:15Z)
Description: value: A vulnerability has been found in youngerheart nodeserver and classified as critical. Affected by this vulnerability is an unknown functionality of the file nodeserver.js. The manipulation leads to path traversal. The identifier of the patch is c4c0f0138ab5afbac58e03915d446680421bde28. It is recommended to apply a patch to fix this issue. The identifier VDB-218461 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/youngerheart/nodeserver
Files changed:
nodeserver.js
Commit message: [FIX] Path traversal sanitizing request path

Vulnerable code:
    
    var nowTemp = host.frondend + (request.url.replace('/', '') || host.baseTemp);

Fixed code:

    var nowTemp = (host.frondend + (request.url.replace('/', '') || host.baseTemp)).replace(/\.\./g, '');
CVE-2013-2145 (Other, published 2013-08-19T23:55Z)
Description: value: The cpansign verify functionality in the Module::Signature module before 0.72 for Perl allows attackers to bypass the signature check and execute arbitrary code via a SIGNATURE file with a "special unknown cipher" that references an untrusted module in Digest/.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/audreyt/module-signature
Files changed:
Changes
META.yml
README
lib/Module/Signature.pm
Commit message: * 0.72 with an improved path checker from @fweimer


Vulnerable code:
version: 0.71
$Module::Signature::VERSION = '0.71';
    local @INC = grep { /^[^.]/ } @INC;

Fixed code:
[Changes for 0.72 - Wed Jun  5 23:19:02 CST 2013]

* Only allow loading Digest::* from absolute paths in @INC,
  by ensuring they begin with \ or / characters.

  Contributed by: Florian Weimer

version: 0.72
    Dist::Zilla::Plugin::Signature

$Module::Signature::VERSION = '0.72';
    local @INC = grep { m{^[\\/]} } @INC;
CVE-2013-2145 (Other, published 2013-08-19T23:55Z)
Description: value: The cpansign verify functionality in the Module::Signature module before 0.72 for Perl allows attackers to bypass the signature check and execute arbitrary code via a SIGNATURE file with a "special unknown cipher" that references an untrusted module in Digest/.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/audreyt/module-signature
Files changed:
Changes
META.yml
lib/Module/Signature.pm
Commit message: * Version 71 with advisory from @fweimer


Vulnerable code:
version: 0.70
$Module::Signature::VERSION = '0.70';
        my ($base, $variant) = ($algorithm =~ /^(\w+?)(\d+)$/g) or die;
        my ($base, $variant) = ($algorithm =~ /^(\w+?)(\d+)$/g) or die;
        my ($base, $variant) = ($algorithm =~ /^(\w+?)(\d+)$/g) or die;

Fixed code:
[Changes for 0.71 - Tue Jun  4 18:24:10 CST 2013]

* Constrain the user-specified digest name to /^\w+\d+$/.

* Avoid loading Digest::* from relative paths in @INC.

  Contributed by: Florian Weimer

version: 0.71
$Module::Signature::VERSION = '0.71';

    # Avoid loading Digest::* from relative paths in @INC.
    local @INC = grep { /^[^.]/ } @INC;

    # Constrain algorithm name to be of form ABC123.
    my ($base, $variant) = ($algorithm =~ /^([_a-zA-Z]+)([0-9]+)$/g)
        or die "Malformed algorithm name: $algorithm (should match /\\w+\\d+/)";
CVE-2015-3406 (Other, published 2019-11-29T21:15Z)
Description: value: The PGP signature parsing in Module::Signature before 0.74 allows remote attackers to cause the unsigned portion of a SIGNATURE file to be treated as the signed portion via unspecified vectors.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-681 \u2014 Incorrect Conversion between Numeric Types
When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
Repository: https://github.com/audreyt/module-signature
Files changed:
Makefile.PL
README
lib/Module/Signature.pm
Commit message: * Fix issues reported by John Lightsey


Vulnerable code:
    唐鳳 <cpan@audreyt.org>
$Module::Signature::VERSION = '0.73_01';
    my %args = ( skip => 1, @_ );
        ) : ()), $SIGNATURE
    my $rv = $pgp->handle( Filename => $SIGNATURE )
    open D, $sigfile or die "Could not open $sigfile: $!";
        open D, $sigfile or die "Could not open $sigfile: $!";
        open D, $sigfile or die "Could not open $sigfile: $!";
        next if (1 .. /^-----BEGIN PGP SIGNED MESSAGE-----/);
        last if /^-----BEGIN PGP SIGNATURE/;

    return ((split(/\n+/, $signature, 2))[1]);
        open S, $SIGNATURE or die "Could not open $SIGNATURE: $!";
    open D, "$sigfile.tmp" or die "Cannot open $sigfile.tmp: $!";
    open S, ">$sigfile" or do {
            open F, $file or die "Cannot open $file for reading: $!";
唐鳳 E<lt>cpan@audreyt.orgE<gt>

Fixed code:
requires        'File::Temp';
    Audrey Tang <cpan@audreyt.org>
$Module::Signature::VERSION = '0.74';
        last if $line eq '-----BEGIN PGP SIGNATURE-----';
        next if $line =~ /^---/ .. $line eq '';
    my %args = ( @_ );
        my $_maniskip = &ExtUtils::Manifest::maniskip;
        local *ExtUtils::Manifest::maniskip = sub { sub {
            return unless $skip;
            return $_maniskip->(@_);
        } };
    require File::Temp;
    my $fh = File::Temp->new();
    print $fh $sigtext;
    close $fh;

        ) : ()), $fh->filename
    unlink $fh->filename;
    my $rv = $pgp->handle( Data => $sigtext )
    open D, "< $sigfile" or die "Could not open $sigfile: $!";
        open D, '<', $sigfile or die "Could not open $sigfile: $!";
        open D, "< $sigfile" or die "Could not open $sigfile: $!";
    my $begin = "-----BEGIN PGP SIGNED MESSAGE-----\n";
    my $end = "-----END PGP SIGNATURE-----\n";
        next if (1 .. ($_ eq $begin));
        return "$begin$signature" if $_ eq $end;
    return;
    $str1 =~ s/^-----BEGIN PGP SIGNED MESSAGE-----\n(?:.+\n)*\n//;
    $str1 =~ s/-----BEGIN PGP SIGNATURE-----\n(?:.+\n)*$//;
        open S, "< $SIGNATURE" or die "Could not open $SIGNATURE: $!";
    open D, "< $sigfile.tmp" or die "Cannot open $sigfile.tmp: $!";
    open S, "> $sigfile" or do {
            open F, "< $file" or die "Cannot open $file for reading: $!";
Audrey Tang E<lt>cpan@audreyt.orgE<gt>
CVE-2015-3407 (Other, published 2015-05-19T18:59Z)
Description: value: Module::Signature before 0.74 allows remote attackers to bypass signature verification for files via a signature file that does not list the files.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/audreyt/module-signature
Files changed:
Makefile.PL
README
lib/Module/Signature.pm
Commit message: * Fix issues reported by John Lightsey


Vulnerable code:
    唐鳳 <cpan@audreyt.org>
$Module::Signature::VERSION = '0.73_01';
    my %args = ( skip => 1, @_ );
        ) : ()), $SIGNATURE
    my $rv = $pgp->handle( Filename => $SIGNATURE )
    open D, $sigfile or die "Could not open $sigfile: $!";
        open D, $sigfile or die "Could not open $sigfile: $!";
        open D, $sigfile or die "Could not open $sigfile: $!";
        next if (1 .. /^-----BEGIN PGP SIGNED MESSAGE-----/);
        last if /^-----BEGIN PGP SIGNATURE/;

    return ((split(/\n+/, $signature, 2))[1]);
        open S, $SIGNATURE or die "Could not open $SIGNATURE: $!";
    open D, "$sigfile.tmp" or die "Cannot open $sigfile.tmp: $!";
    open S, ">$sigfile" or do {
            open F, $file or die "Cannot open $file for reading: $!";
唐鳳 E<lt>cpan@audreyt.orgE<gt>

Fixed code:
requires        'File::Temp';
    Audrey Tang <cpan@audreyt.org>
$Module::Signature::VERSION = '0.74';
        last if $line eq '-----BEGIN PGP SIGNATURE-----';
        next if $line =~ /^---/ .. $line eq '';
    my %args = ( @_ );
        my $_maniskip = &ExtUtils::Manifest::maniskip;
        local *ExtUtils::Manifest::maniskip = sub { sub {
            return unless $skip;
            return $_maniskip->(@_);
        } };
    require File::Temp;
    my $fh = File::Temp->new();
    print $fh $sigtext;
    close $fh;

        ) : ()), $fh->filename
    unlink $fh->filename;
    my $rv = $pgp->handle( Data => $sigtext )
    open D, "< $sigfile" or die "Could not open $sigfile: $!";
        open D, '<', $sigfile or die "Could not open $sigfile: $!";
        open D, "< $sigfile" or die "Could not open $sigfile: $!";
    my $begin = "-----BEGIN PGP SIGNED MESSAGE-----\n";
    my $end = "-----END PGP SIGNATURE-----\n";
        next if (1 .. ($_ eq $begin));
        return "$begin$signature" if $_ eq $end;
    return;
    $str1 =~ s/^-----BEGIN PGP SIGNED MESSAGE-----\n(?:.+\n)*\n//;
    $str1 =~ s/-----BEGIN PGP SIGNATURE-----\n(?:.+\n)*$//;
        open S, "< $SIGNATURE" or die "Could not open $SIGNATURE: $!";
    open D, "< $sigfile.tmp" or die "Cannot open $sigfile.tmp: $!";
    open S, "> $sigfile" or do {
            open F, "< $file" or die "Cannot open $file for reading: $!";
Audrey Tang E<lt>cpan@audreyt.orgE<gt>
CVE-2015-3408 (Other, published 2015-05-19T18:59Z)
Description: value: Module::Signature before 0.74 allows remote attackers to execute arbitrary shell commands via a crafted SIGNATURE file which is not properly handled when generating checksums from a signed manifest.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/audreyt/module-signature
Files changed:
Makefile.PL
README
lib/Module/Signature.pm
Commit message: * Fix issues reported by John Lightsey


Vulnerable code:
    唐鳳 <cpan@audreyt.org>
$Module::Signature::VERSION = '0.73_01';
    my %args = ( skip => 1, @_ );
        ) : ()), $SIGNATURE
    my $rv = $pgp->handle( Filename => $SIGNATURE )
    open D, $sigfile or die "Could not open $sigfile: $!";
        open D, $sigfile or die "Could not open $sigfile: $!";
        open D, $sigfile or die "Could not open $sigfile: $!";
        next if (1 .. /^-----BEGIN PGP SIGNED MESSAGE-----/);
        last if /^-----BEGIN PGP SIGNATURE/;

    return ((split(/\n+/, $signature, 2))[1]);
        open S, $SIGNATURE or die "Could not open $SIGNATURE: $!";
    open D, "$sigfile.tmp" or die "Cannot open $sigfile.tmp: $!";
    open S, ">$sigfile" or do {
            open F, $file or die "Cannot open $file for reading: $!";
唐鳳 E<lt>cpan@audreyt.orgE<gt>

Fixed code:
requires        'File::Temp';
    Audrey Tang <cpan@audreyt.org>
$Module::Signature::VERSION = '0.74';
        last if $line eq '-----BEGIN PGP SIGNATURE-----';
        next if $line =~ /^---/ .. $line eq '';
    my %args = ( @_ );
        my $_maniskip = &ExtUtils::Manifest::maniskip;
        local *ExtUtils::Manifest::maniskip = sub { sub {
            return unless $skip;
            return $_maniskip->(@_);
        } };
    require File::Temp;
    my $fh = File::Temp->new();
    print $fh $sigtext;
    close $fh;

        ) : ()), $fh->filename
    unlink $fh->filename;
    my $rv = $pgp->handle( Data => $sigtext )
    open D, "< $sigfile" or die "Could not open $sigfile: $!";
        open D, '<', $sigfile or die "Could not open $sigfile: $!";
        open D, "< $sigfile" or die "Could not open $sigfile: $!";
    my $begin = "-----BEGIN PGP SIGNED MESSAGE-----\n";
    my $end = "-----END PGP SIGNATURE-----\n";
        next if (1 .. ($_ eq $begin));
        return "$begin$signature" if $_ eq $end;
    return;
    $str1 =~ s/^-----BEGIN PGP SIGNED MESSAGE-----\n(?:.+\n)*\n//;
    $str1 =~ s/-----BEGIN PGP SIGNATURE-----\n(?:.+\n)*$//;
        open S, "< $SIGNATURE" or die "Could not open $SIGNATURE: $!";
    open D, "< $sigfile.tmp" or die "Cannot open $sigfile.tmp: $!";
    open S, "> $sigfile" or do {
            open F, "< $file" or die "Cannot open $file for reading: $!";
Audrey Tang E<lt>cpan@audreyt.orgE<gt>
CVE-2015-3409 (Perl, published 2015-05-19T18:59Z)
Description: value: Untrusted search path vulnerability in Module::Signature before 0.75 allows local users to gain privileges via a Trojan horse module under the current working directory, as demonstrated by a Trojan horse Text::Diff module.
Severity: HIGH (CVSS v3 base score: )
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/audreyt/module-signature
Files changed:
lib/Module/Signature.pm
Commit message: * Avoid loading modules from relative paths in @INC for Text::Diff etc.

  Also reported by John Lightsey.


Vulnerable code:

Fixed code:
    # Avoid loading modules from relative paths in @INC.
    local @INC = grep { File::Spec->file_name_is_absolute($_) } @INC;
CVE-2021-23342 (JavaScript, published 2021-02-19T17:15Z)
Description: value: This affects the package docsify before 4.12.0. It is possible to bypass the remediation done by CVE-2020-7680 and execute malicious JavaScript through the following methods 1) When parsing HTML from remote URLs, the HTML code on the main page is sanitized, but this sanitization is not taking place in the sidebar. 2) The isURL external check can be bypassed by inserting more “////” characters
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/docsifyjs/docsify
Files changed:
src/core/fetch/index.js
test/e2e/security.test.js
Commit message: fix: isExternal check with malformed URL + tests (#1510)

Fix #1477. Fix #1126. Follow-up to #1489.

Vulnerable code:
    /^([^:/?#]+:)?(?:\/\/([^/?#]*))?([^?#]+)?(\?[^#]*)?(#.*)?/

Fixed code:
    /^([^:/?#]+:)?(?:\/{2,}([^/?#]*))?([^?#]+)?(\?[^#]*)?(#.*)?/
const docsifyInit = require('../helpers/docsify-init');

describe(`Security`, function() {
  const sharedOptions = {
    markdown: {
      homepage: '# Hello World',
    },
    routes: {
      'test.md': '# Test Page',
    },
  };

  describe(`Cross Site Scripting (XSS)`, function() {
    const slashStrings = ['//', '///'];

    for (const slashString of slashStrings) {
      const hash = `#${slashString}domain.com/file.md`;

      test(`should not load remote content from hash (${hash})`, async () => {
        await docsifyInit(sharedOptions);
        await expect(page).toHaveText('#main', 'Hello World');
        await page.evaluate(() => (location.hash = '#/test'));
        await expect(page).toHaveText('#main', 'Test Page');
        await page.evaluate(newHash => {
          location.hash = newHash;
        }, hash);
        await expect(page).toHaveText('#main', 'Hello World');
        expect(page.url()).toMatch(/#\/$/);
      });
    }
  });
});
CVE-2019-15296 (C, published 2019-08-21T07:15Z)
Description: value: An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The faad_resetbits function in libfaad/bits.c is affected by a buffer overflow vulnerability. The number of bits to be read is determined by ld->buffer_size - words*4, cast to uint32. If ld->buffer_size - words*4 is negative, a buffer overflow is later performed via getdword_n(&ld->start[words], ld->bytes_left).
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/knik0/faad2
Files changed:
libfaad/bits.c
libfaad/syntax.c
Commit message: Fix a couple buffer overflows

https://hackerone.com/reports/502816
https://hackerone.com/reports/507858

https://github.com/videolan/vlc/blob/master/contrib/src/faad2/faad2-fix-overflows.patch


Vulnerable code:
    ld->bytes_left = ld->buffer_size - words*4;

Fixed code:
    if (ld->buffer_size < words * 4)
        ld->bytes_left = 0;
    else
        ld->bytes_left = ld->buffer_size - words*4;
        if (i >= MAX_CHANNELS - num_excl_chan - 7)
            return n;
CVE-2021-26567 (C, published 2021-02-26T22:15Z)
Description: value: Stack-based buffer overflow vulnerability in frontend/main.c in faad2 before 2.2.7.1 allow local attackers to execute arbitrary code via filename and pathname options.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/knik0/faad2
Files changed:
frontend/main.c
Commit message: Dynamically allocate file name buffers.


Vulnerable code:
** $Id: main.c,v 1.87 2012/03/02 15:28:44 knik Exp $
    char aacFileName[255];
    char audioFileName[255];
    char adtsFileName[255];

Fixed code:
** $Id: main.c,v 1.88 2012/03/04 09:59:02 knik Exp $
    char *aacFileName = NULL;
    char *audioFileName = NULL;
    char *adtsFileName = NULL;
                audioFileName = (char *) malloc(sizeof(char) * (strlen(optarg) + 1));
                if (audioFileName == NULL)
                {
                    faad_fprintf(stderr, "Error allocating memory for audioFileName.\n");
                    return 1;
                }
                adtsFileName = (char *) malloc(sizeof(char) * (strlen(optarg) + 1));
                if (adtsFileName == NULL)
                {
                    faad_fprintf(stderr, "Error allocating memory for adtsFileName.\n");
                    return 1;
                }
    aacFileName = (char *) malloc(sizeof(char) * (strlen(argv[optind]) + 1));
    if (aacFileName == NULL)
    {
        faad_fprintf(stderr, "Error allocating memory for aacFileName.\n");
        return 1;
    }
        audioFileName = (char *) malloc(sizeof(char) * (strlen(aacFileName) + strlen(file_ext[format]) + 1));
        if (audioFileName == NULL)
        {
            faad_fprintf(stderr, "Error allocating memory for audioFileName.\n");
            return 1;
        }
    if (audioFileName != NULL)
      free (audioFileName);
    if (adtsFileName != NULL)
      free (adtsFileName);

    if (aacFileName != NULL)
      free (aacFileName);
CVE-2021-32272 (C, published 2021-09-20T16:15Z)
Description: value: An issue was discovered in faad2 before 2.10.0. A heap-buffer-overflow exists in the function stszin located in mp4read.c. It allows an attacker to cause Code Execution.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/knik0/faad2
Files changed:
frontend/mp4read.c
Commit message: fix heap-buffer-overflow in mp4read.c

This originated from an integer overflow: If mp4config.frame.ents
would be read-in with a value of (uint32t)(-1), it would overflow to 0
in the size calculation for the allocation in the next line. The
malloc() function would then successfully return a pointer to a memory
region of size 0, which will cause a segfault when written to.

Fixes #57.


Vulnerable code:
    // fixme: check atom size

Fixed code:

    if (!(mp4config.frame.ents + 1))
        return ERR_FAIL;
CVE-2022-39245 (Other, published 2022-09-26T14:15Z)
Description: value: Mist is the command-line interface for the makedeb Package Repository. Prior to version 0.9.5, a user-provided `sudo` binary via the `PATH` variable can allow a local user to run arbitrary commands on the user's system with root permissions. Versions 0.9.5 and later contain a patch. No known workarounds exist.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-426 \u2014 Untrusted Search Path
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
Repository: https://github.com/makedeb/mist
Files changed:
CHANGELOG.md
Cargo.lock
Cargo.toml
makedeb/PKGBUILD
src/util.rs
Commit message: Ensure 'sudo' binary used for permission checks isn't user supplied


Vulnerable code:
version = "0.9.4"
version = "0.9.4"
pkgver=0.9.4
        let mut cmd = self::run_as_normal_user("sudo");
        let mut cmd = super::ProcCommand::new("sudo");

Fixed code:
## [0.9.5] - 2022-09-25
### Security
- Ensure `sudo` binary used for permission checks isn't one supplied by the user in the `PATH` variable.

version = "0.9.5"
version = "0.9.5"
pkgver=0.9.5
        let mut cmd = self::run_as_normal_user("/usr/bin/sudo");
        let mut cmd = super::ProcCommand::new("/usr/bin/sudo");