hitoshura25/cvefixes huggingface dataset:
CVE-2023-29416 (C, published 2023-04-06T05:15Z)
Description: value: An issue was discovered in libbzip3.a in bzip3 before 1.3.0. A bz3_decode_block out-of-bounds write can occur with a crafted archive because bzip3 does not follow the required procedure for interacting with libsais.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/kspalaiologos/bzip3
Files changed:
include/common.h
src/libbz3.c
Commit message: tentative libsais safety patches



Vulnerable code:
    bz3_state->sais_array = malloc((block_size + 128) * sizeof(s32));
    memset(bz3_state->sais_array, 0, sizeof(s32) * (block_size + 128));

Fixed code:
#define BWT_BOUND(x) ((x) + 128)
    bz3_state->sais_array = malloc(BWT_BOUND(block_size) * sizeof(s32));
    memset(bz3_state->sais_array, 0, sizeof(s32) * BWT_BOUND(block_size));
    memset(state->sais_array, 0, sizeof(s32) * BWT_BOUND(state->block_size));
    memset(b2, 0, size_src);
CVE-2023-29418 (C, published 2023-04-06T05:15Z)
Description: value: An issue was discovered in libbzip3.a in bzip3 before 1.2.3. There is an xwrite out-of-bounds read.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/kspalaiologos/bzip3
Files changed:
src/libbz3.c
src/main.c
Commit message: safety checks for decoding/testing when the buffer size and block size are inconsistent, tentative CRC32 version for BE systems (needs further verification on SPARC?)



Vulnerable code:
    while (size--) crc = crc32Table[(crc ^ *(buf++)) & 0xff] ^ (crc >> 8);
    return crc;

Fixed code:
    // Test endianness. The code needs to be different for LE and BE systems.
    u32 test = 1;
    if (*(u8 *) &test) {
        while (size--) crc = crc32Table[(crc ^ *(buf++)) & 0xff] ^ (crc >> 8);
        return crc;
    } else {
        while (size--) crc = crc32Table[((crc >> 24) ^ *(buf++)) & 0xff] ^ (crc << 8);
        return crc;
    }
                if(old_size > block_size + 31) {
                    fprintf(stderr, "Failed to decode a block: Inconsistent headers.\n");
                    return 1;
                }
                if(old_size > block_size + 31) {
                    fprintf(stderr, "Failed to decode a block: Inconsistent headers.\n");
                    return 1;
                }
                    if(old_sizes[i] > block_size + 31) {
                        fprintf(stderr, "Failed to decode a block: Inconsistent headers.\n");
                        return 1;
                    }
                    if(old_sizes[i] > block_size + 31) {
                        fprintf(stderr, "Failed to decode a block: Inconsistent headers.\n");
                        return 1;
                    }
    if(output != f2)
        free(output);
CVE-2023-29419 (C, published 2023-04-06T05:15Z)
Description: value: An issue was discovered in libbzip3.a in bzip3 before 1.2.3. There is a bz3_decode_block out-of-bounds read.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/kspalaiologos/bzip3
Files changed:
src/libbz3.c
Commit message: mRLE: decoding bounds



Vulnerable code:
static void mrled(u8 * RESTRICT in, u8 * RESTRICT out, s32 outlen) {
    while (op < outlen) {
            for (run = 0; (pc = in[ip++]) == 255; run += 255)
        mrled(b1, b2, orig_size);

Fixed code:
static int mrled(u8 * RESTRICT in, u8 * RESTRICT out, s32 outlen, s32 maxin) {
    if(maxin < 32)
        return 1;

    while (op < outlen && ip < maxin) {
            for (run = 0; (pc = in[ip++]) == 255 && ip < maxin; run += 255)

    return op != outlen;
        int err = mrled(b1, b2, orig_size, size_src);
        if(err) {
            state->last_error = BZ3_ERR_CRC;
            return -1;
        }
CVE-2023-29420 (C, published 2023-04-06T05:15Z)
Description: value: An issue was discovered in libbzip3.a in bzip3 before 1.2.3. There is a crash caused by an invalid memmove in bz3_decode_block.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/kspalaiologos/bzip3
Files changed:
src/libbz3.c
Commit message: store mode: check for truncation



Vulnerable code:
        if (data_size - 8 > 64) {

Fixed code:
        if (data_size - 8 > 64 || data_size < 8) {
CVE-2020-15156 (JavaScript, published 2020-08-26T19:15Z)
Description: value: In nodebb-plugin-blog-comments before version 0.7.0, a logged in user is vulnerable to an XSS attack which could allow a third party to post on their behalf on the forum. This is due to lack of CSRF validation.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/psychobunny/nodebb-plugin-blog-comments
Files changed:
library.js
Commit message: fix: CSRF issues


Vulnerable code:
		app.post('/comments/reply', Comments.replyToComment);
		app.post('/comments/publish', Comments.publishArticle);

Fixed code:
		app.post('/comments/reply', middleware.applyCSRF, Comments.replyToComment);
		app.post('/comments/publish', middleware.applyCSRF, Comments.publishArticle);
CVE-2020-10990 (Unknown, published 2020-03-27T00:15Z)
Description: value: An XXE issue exists in Accenture Mercury before 1.12.28 because of the platformlambda/core/serializers/SimpleXmlParser.java component.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-611 \u2014 Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Repository: https://github.com/Accenture/mercury
Files changed:
Commit message: Merge pull request #14 from Accenture/security/xml-xxe-1-2020

v1.12.28 with rest-automation improvements and XXE patch

Vulnerable code:

Fixed code:
CVE-2024-28864 (Unknown, published 2024-03-18T22:15Z)
Description: value: SecureProps is a PHP library designed to simplify the encryption and decryption of property data in objects. A vulnerability in SecureProps version 1.2.0 and 1.2.1 involves a regex failing to detect tags during decryption of encrypted data. This occurs when the encrypted data has been encoded with `NullEncoder` and passed to `TagAwareCipher`, and contains special characters such as `\n`. As a result, the decryption process is skipped since the tags are not detected. This causes the encrypted data to be returned in plain format.  The vulnerability affects users who implement `TagAwareCipher` with any base cipher that has `NullEncoder` (not default). The patch for the issue has been released. Users are advised to update to version 1.2.2. As a workaround, one may use the default `Base64Encoder` with the base cipher decorated with `TagAwareCipher` to prevent special characters in the encrypted string from interfering with regex tag detection logic.  This workaround is safe but may involve double encoding since `TagAwareCipher` uses `NullEncoder` by default.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/IlicMiljan/Secure-Props
Files changed:
Commit message: Merge pull request #21 from IlicMiljan/fix-parsing-tagged-encrypted-data

Fix Parsing Tagged Encrypted Data

Vulnerable code:

Fixed code:
CVE-2017-20188 (JavaScript, published 2024-01-02T15:15Z)
Description: value: A vulnerability has been found in Zimbra zm-ajax up to 8.8.1 and classified as problematic. Affected by this vulnerability is the function XFormItem.prototype.setError of the file WebRoot/js/ajax/dwt/xforms/XFormItem.js. The manipulation of the argument message leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 8.8.2 is able to address this issue. The identifier of the patch is 8d039d6efe80780adc40c6f670c06d21de272105. It is recommended to upgrade the affected component. The identifier VDB-249421 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 4.7)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Zimbra/zm-ajax
Files changed:
WebRoot/js/ajax/dwt/xforms/XFormItem.js
Commit message: ZCS-1795 Persistent XSS happens on textbox

Issue:
- Error text in form fields were executing text in dom, which can be used for XSS attacks

Resolution:
- Before adding error to DOM, html encode the text to make sure it is not executed in browser
- This is done at a generic place so it will affect error display for all form fields


Vulnerable code:
	if (container) container.innerHTML = message;

Fixed code:
	if (container) container.innerHTML = AjxStringUtil.htmlEncode(message);
CVE-2017-18239 (Scala, published 2018-03-18T03:29Z)
Description: value: A time-sensitive equality check on the JWT signature in the JsonWebToken.validate method in main/scala/authentikat/jwt/JsonWebToken.scala in authentikat-jwt (aka com.jason-goodwin/authentikat-jwt) version 0.4.5 and earlier allows the supplier of a JWT token to guess bit after bit of the signature by repeating validation requests.
Severity: MEDIUM (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/jasongoodwin/authentikat-jwt
Files changed:
src/main/scala/authentikat/jwt/JsonWebToken.scala
Commit message: Use constant-time string comparison for sigs

Fixed #12


Vulnerable code:
        providedSignature.contentEquals(signature)

Fixed code:
        java.security.MessageDigest.isEqual(providedSignature.getBytes(), signature.getBytes())
CVE-2019-16774 (PHP, published 2019-12-12T23:15Z)
Description: value: In phpfastcache before 5.1.3, there is a possible object injection vulnerability in cookie driver.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/PHPSocialNetwork/phpfastcache
Files changed:
src/phpFastCache/Drivers/Cookie/Driver.php
Commit message: Fixed critical vulnerability on cookie driver


Vulnerable code:
        $x = isset($_COOKIE[ $keyword ]) ? $this->decode(json_decode($_COOKIE[ $keyword ], true)) : false;

Fixed code:
        $x = isset($_COOKIE[ $keyword ]) ? json_decode($_COOKIE[ $keyword ], true) : false;
CVE-2021-37704 (Unknown, published 2021-08-12T20:15Z)
Description: value: PhpFastCache is a high-performance backend cache system (packagist package phpfastcache/phpfastcache). In versions before 6.1.5, 7.1.2, and 8.0.7 the `phpinfo()` can be exposed if the `/vendor` is not protected from public access. This is a rare situation today since the vendor directory is often located outside the web directory or protected via server rule (.htaccess, etc). Only the v6, v7 and v8 will be patched respectively in 8.0.7, 7.1.2, 6.1.5. Older versions such as v5, v4 are not longer supported and will **NOT** be patched. As a workaround, protect the `/vendor` directory from public access.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-668 \u2014 Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Repository: https://github.com/PHPSocialNetwork/phpfastcache
Files changed:
Commit message: Merge pull request #813 from Geolim4/master

[V8] Fixed vulnerability issue that cause exposed phpinfo() in some situations

Vulnerable code:

Fixed code:
CVE-2020-7640 (JSON, published 2020-04-27T22:15Z)
Description: value: pixl-class prior to 1.0.3 allows execution of arbitrary commands. The members argument of the create function can be controlled by users without any sanitization.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/jhuckaby/pixl-class
Files changed:
class.js
package.json
Commit message: Version 1.0.3

Fixes code injection vulnerability reported by Synk.io.
No longer uses eval (which is evil anyway).


Vulnerable code:
			var code = members.__parent.toString();
			var args = code.substring( code.indexOf("(")+1, code.indexOf(")") );
			var inner_code = code.substring( code.indexOf("{")+1, code.lastIndexOf("}") );
			eval('constructor = function ('+args+') {'+inner_code+'};');
  "name": "pixl-class",
  "version": "1.0.2",
  "description": "A simple module for creating classes, with inheritance and mixins.",
  "author": "Joseph Huckaby <jhuckaby@gmail.com>",
  "homepage": "https://github.com/jhuckaby/pixl-class",
  "license": "MIT",
  "main": "class.js",
  "repository": {
    "type": "git",
    "url": "https://github.com/jhuckaby/pixl-class"
  },
  "bugs": {
    "url": "https://github.com/jhuckaby/pixl-class/issues"
  },
  "keywords": [
    "oop",
    "class"
  ],
  "dependencies": {},
  "devDependencies": {}

Fixed code:
			var parent = members.__parent;
			constructor = function() {
				var args = Array.prototype.slice.call(arguments);
				parent.apply( this, args );
			};
	"name": "pixl-class",
	"version": "1.0.3",
	"description": "A simple module for creating classes, with inheritance and mixins.",
	"author": "Joseph Huckaby <jhuckaby@gmail.com>",
	"homepage": "https://github.com/jhuckaby/pixl-class",
	"license": "MIT",
	"main": "class.js",
	"repository": {
		"type": "git",
		"url": "https://github.com/jhuckaby/pixl-class"
	},
	"bugs": {
		"url": "https://github.com/jhuckaby/pixl-class/issues"
	},
	"keywords": [
		"oop",
		"class"
	],
	"dependencies": {},
	"devDependencies": {}
CVE-2016-7545 (Other, published 2017-01-19T20:59Z)
Description: value: SELinux policycoreutils allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call.
Severity: HIGH (CVSS v3 base score: 8.8)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/SELinuxProject/selinux
Files changed:
policycoreutils/sandbox/sandbox
Commit message: sandbox: create a new session for sandboxed processes

It helps to prevent sandboxed processes to inject arbitrary commands
into the parent.

Signed-off-by: Petr Lautrbach <plautrba@redhat.com>


Vulnerable code:
            selinux.setexeccon(self.__execcon)
            rc = subprocess.Popen(self.__cmds).wait()
            selinux.setexeccon(None)
            return rc

Fixed code:
            pid = os.fork()
            if pid == 0:
                rc = os.setsid()
                if rc:
                    return rc
                selinux.setexeccon(self.__execcon)
                os.execv(self.__cmds[0], self.__cmds)
            rc = os.waitpid(pid, 0)
            return os.WEXITSTATUS(rc[1])
CVE-2021-36085 (C, published 2021-07-01T03:15Z)
Description: value: The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __verify_map_perm_classperms and hashtab_map).
Severity: LOW (CVSS v3 base score: 3.3)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/SELinuxProject/selinux
Files changed:
libsepol/cil/src/cil_reset_ast.c
Commit message: libsepol/cil: Destroy classperm list when resetting map perms

Map perms share the same struct as regular perms, but only the
map perms use the classperms field. This field is a pointer to a
list of classperms that is created and added to when resolving
classmapping rules, so the map permission doesn't own any of the
data in the list and this list should be destroyed when the AST is
reset.

When resetting a perm, destroy the classperms list without destroying
the data in the list.

Signed-off-by: James Carter <jwcart2@gmail.com>


Vulnerable code:
	cil_reset_classperms_list(perm->classperms);

Fixed code:
	cil_list_destroy(&perm->classperms, CIL_FALSE);
CVE-2021-36086 (C, published 2021-07-01T03:15Z)
Description: value: The CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from cil_reset_classperms_set and cil_reset_classperms_list).
Severity: LOW (CVSS v3 base score: 3.3)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/SELinuxProject/selinux
Files changed:
libsepol/cil/src/cil_reset_ast.c
Commit message: libsepol/cil: cil_reset_classperms_set() should not reset classpermission

In struct cil_classperms_set, the set field is a pointer to a
struct cil_classpermission which is looked up in the symbol table.
Since the cil_classperms_set does not create the cil_classpermission,
it should not reset it.

Set the set field to NULL instead of resetting the classpermission
that it points to.

Signed-off-by: James Carter <jwcart2@gmail.com>


Vulnerable code:
	cil_reset_classpermission(cp_set->set);

Fixed code:
	if (cp_set == NULL) {
		return;
	}

	cp_set->set = NULL;
CVE-2015-10096 (Ruby, published 2023-03-20T05:15Z)
Description: value: A vulnerability, which was classified as critical, was found in Zarthus IRC Twitter Announcer Bot up to 1.1.0. This affects the function get_tweets of the file lib/twitterbot/plugins/twitter_announcer.rb. The manipulation of the argument tweet leads to command injection. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 1.1.1 is able to address this issue. The patch is named 6b1941b7fc2c70e1f40981b43c84a2c20cc12bd3. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-223383.
Severity: nan (CVSS v3 base score: 8.1)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/Zarthus/irc-twitter-bot
Files changed:
lib/twitterbot/plugins/twitter_announcer.rb
lib/twitterbot/version.rb
Commit message: Prevent edge-case exploitation that allows execution of arbitrary fantasy commands.

This commit replaces \r\n with '.  ' in tweets.

An edge-case issue where you may be able to exploit the bot having op.
Should you be the one being tracked, you could insert a newline in your tweet, and follow it up for "!ban <someone>" to execute a fantasy command.

This exploit requires a lot of requirements to be met. Mainly the fact that the bot has permissions in the channel, and that the followed person is associated and aware of the possibility.


Vulnerable code:
            tweets << { account: name, tweet: tweet.text, time: tweet.created_at, uri: tweet.uri.to_s, id: tweet.id }
  VERSION_BUILD = 0

Fixed code:
            twtext = tweet.text.gsub("\r?\n", '.  ')
            tweets << { account: name, tweet: twtext, time: tweet.created_at, uri: tweet.uri.to_s, id: tweet.id }
  VERSION_BUILD = 1
CVE-2017-20176 (PHP, published 2023-02-06T04:15Z)
Description: value: A vulnerability classified as problematic was found in ciubotaru share-on-diaspora 0.7.9. This vulnerability affects unknown code of the file new_window.php. The manipulation of the argument title/url leads to cross site scripting. The attack can be initiated remotely. The name of the patch is fb6fae2f8a9b146471450b5b0281046a17d1ac8d. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-220204.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/ciubotaru/share-on-diaspora
Files changed:
trunk/new_window.php
Commit message: Fix reflected XSS in new_window.php


Vulnerable code:
            document.getElementsByTagName('body')[0].innerHTML = "Sharing <b>" + title + "</b> (" + url + ") to " + localStorage["lastPod"];
            document.getElementById("shareurl").innerHTML = url;

Fixed code:
// Use to prevent XSS
// Code from http://shebang.brandonmintern.com/foolproof-html-escaping-in-javascript/
// Use the browser's built-in functionality to quickly and safely escape
// the string
function escapeHtml(str) {
    var div = document.createElement('div');
    div.appendChild(document.createTextNode(str));
    return div.innerHTML;
}

            document.getElementsByTagName('body')[0].innerHTML = "Sharing <b>" + escapeHtml(title) + "</b> (" + escapeHtml(url) + ") to " + escapeHtml(localStorage["lastPod"]);
            document.getElementById("shareurl").innerHTML = escapeHtml(url);