hitoshura25/cvefixes huggingface dataset:
CVE-2015-7519 (Other, published 2016-01-08T19:59Z)
Description: value: agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X_User header.
Severity: MEDIUM (CVSS v3 base score: 3.7)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/phusion/passenger
Files changed:
CHANGELOG
src/agent/Core/Controller/SendRequest.cpp
Commit message: Fix CVE-2015-7519 header collision vulnerability


Vulnerable code:
		if ((it->header->hash == HTTP_CONTENT_LENGTH.hash()
			|| it->header->hash == HTTP_CONTENT_TYPE.hash()
			|| it->header->hash == HTTP_CONNECTION.hash())
		 && (psg_lstr_cmp(&it->header->key, P_STATIC_STRING("content-type"))
			|| psg_lstr_cmp(&it->header->key, P_STATIC_STRING("content-length"))
			|| psg_lstr_cmp(&it->header->key, P_STATIC_STRING("connection"))))

Fixed code:
 * Fixes a header collision vulnerability (CVE-2015-7519, medium severity). Please see our blog for detailed vulnerability description and advisory. Thanks to the SUSE security team for reporting this issue.
static bool
isAlphaNum(char ch) {
	return (ch >= '0' && ch <= '9') || (ch >= 'a' && ch <= 'z') || (ch >= 'A' && ch <= 'Z');
}

/**
 * For CGI, alphanum headers with optional dashes are mapped to UPP3R_CAS3. This
 * function can be used to reject non-alphanum/dash headers that would end up with
 * the same mapping (e.g. upp3r_cas3 and upp3r-cas3 would end up the same, and
 * potentially collide each other in the receiving application). This is
 * used to fix CVE-2015-7519.
 */
static bool
containsNonAlphaNumDash(const LString &s) {
	const LString::Part *part = s.start;
	while (part != NULL) {
		for (unsigned int i = 0; i < part->size; i++) {
			const char start = part->data[i];
			if (start != '-' && !isAlphaNum(start)) {
				return true;
			}
		}
		part = part->next;
	}
	return false;
}

		// This header-skipping is not accounted for in determineHeaderSizeForSessionProtocol(), but
		// since we are only reducing the size it just wastes some mem bytes.
		if ((
				(it->header->hash == HTTP_CONTENT_LENGTH.hash()
						|| it->header->hash == HTTP_CONTENT_TYPE.hash()
						|| it->header->hash == HTTP_CONNECTION.hash()
				) && (psg_lstr_cmp(&it->header->key, P_STATIC_STRING("content-type"))
						|| psg_lstr_cmp(&it->header->key, P_STATIC_STRING("content-length"))
						|| psg_lstr_cmp(&it->header->key, P_STATIC_STRING("connection"))
				)
			) || containsNonAlphaNumDash(it->header->key)
		   )
CVE-2016-10345 (Other, published 2017-04-18T20:59Z)
Description: value: In Phusion Passenger before 5.1.0, a known /tmp filename was used during passenger-install-nginx-module execution, which could allow local attackers to gain the privileges of the passenger user.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/phusion/passenger
Files changed:
CHANGELOG
bin/passenger-install-nginx-module
Commit message: Fix writing a tmp file with a predictable name in
passenger-install-nginx-module.

With access to the system, a user could plant a symlink in /tmp that
resulted in a chosen-file overwrite attempt whenever
passenger-install-nginx-module was run, using the access rights of
the executing user, potentially even with chosen content.

Vulnerable code:
PhusionPassenger.require_passenger_lib 'utils/tmpio'
      @pcre_is_installed = begin
        File.open('/tmp/passenger-check.c', 'w') do |f|
          f.puts("#include <pcre.h>")
        end
        Dir.chdir('/tmp') do
          # Nginx checks for PCRE in multiple places...
          system("(gcc -I/usr/local/include -I/usr/include/pcre " <<
            "-I/usr/pkg/include -I/opt/local/include " <<
            "-c passenger-check.c) >/dev/null 2>/dev/null")
      ensure
        File.unlink('/tmp/passenger-check.c') rescue nil
        File.unlink('/tmp/passenger-check.o') rescue nil

Fixed code:
 * Fixes a file overwrite vulnerability caused by a predictable temporary file being written by `passenger-install-nginx-module`. Thanks to Jeremy Evans for reporting this.
require 'tmpdir'
      Dir.mktmpdir do |safe_tmpdir|
        @pcre_is_installed = begin
          File.open("#{safe_tmpdir}/passenger-check.c", 'w') do |f|
            f.puts("#include <pcre.h>")
          end
          Dir.chdir("#{safe_tmpdir}") do
            # Nginx checks for PCRE in multiple places...
            system("(gcc -I/usr/local/include -I/usr/include/pcre " <<
              "-I/usr/pkg/include -I/opt/local/include " <<
              "-c passenger-check.c) >/dev/null 2>/dev/null")
          end
        ensure
          File.unlink("#{safe_tmpdir}/passenger-check.c") rescue nil
          File.unlink("#{safe_tmpdir}/passenger-check.o") rescue nil
CVE-2017-16355 (C, published 2017-12-14T22:29Z)
Description: value: In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root folder to a file of choice and querying passenger-status --show=xml.
Severity: LOW (CVSS v3 base score: 4.7)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/phusion/passenger
Files changed:
src/agent/Core/SpawningKit/Spawner.h
Commit message: Disable unused feature.

Vulnerable code:
		inferApplicationInfo(info);

Fixed code:
#ifdef false
#endif
CVE-2018-12615 (C++, published 2018-06-21T15:29Z)
Description: value: An issue was discovered in switchGroup() in agent/ExecHelper/ExecHelperMain.cpp in Phusion Passenger before 5.3.2. The set of groups (gidset) is not set correctly, leaving it up to randomness (i.e., uninitialized memory) which supplementary groups are actually being set while lowering privileges.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-732 \u2014 Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Repository: https://github.com/phusion/passenger
Files changed:
src/agent/ExecHelper/ExecHelperMain.cpp
Commit message: ExecHelperMain: fix privilege lowering code


Vulnerable code:

Fixed code:
				for (int i = 0; i < ngroups; i++) {
					gidset[i] = groups[i];
				}
CVE-2017-6889 (C, published 2017-05-15T18:29Z)
Description: value: An integer overflow error within the "foveon_load_camf()" function (dcraw_foveon.c) in LibRaw-demosaic-pack-GPL2 before 0.18.2 can be exploited to cause a heap-based buffer overflow.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/LibRaw/LibRaw-demosaic-pack-GPL2
Files changed:
dcraw_foveon.c
Commit message: Fixed possible foveon buffer overrun (Secunia SA750000)


Vulnerable code:
  ushort huff[512], vpred[2][2], hpred[2];
  ushort huff[258], vpred[2][2] = {{512,512},{512,512}}, hpred[2];

Fixed code:
  ushort huff[1024], vpred[2][2], hpred[2];
  ushort huff[1024], vpred[2][2] = {{512,512},{512,512}}, hpred[2];
#ifdef LIBRAW_LIBRARY_BUILD
  if(wide>32767 || high > 32767 || wide*high > 20000000)
     throw LIBRAW_EXCEPTION_IO_CORRUPT;
#endif
CVE-2017-6890 (C, published 2017-05-15T18:29Z)
Description: value: A boundary error within the "foveon_load_camf()" function (dcraw_foveon.c) when initializing a huffman table in LibRaw-demosaic-pack-GPL2 before 0.18.2 can be exploited to cause a stack-based buffer overflow.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/LibRaw/LibRaw-demosaic-pack-GPL2
Files changed:
dcraw_foveon.c
Commit message: Fixed possible foveon buffer overrun (Secunia SA750000)


Vulnerable code:
  ushort huff[512], vpred[2][2], hpred[2];
  ushort huff[258], vpred[2][2] = {{512,512},{512,512}}, hpred[2];

Fixed code:
  ushort huff[1024], vpred[2][2], hpred[2];
  ushort huff[1024], vpred[2][2] = {{512,512},{512,512}}, hpred[2];
#ifdef LIBRAW_LIBRARY_BUILD
  if(wide>32767 || high > 32767 || wide*high > 20000000)
     throw LIBRAW_EXCEPTION_IO_CORRUPT;
#endif
CVE-2020-15253 (PHP, published 2020-10-14T19:15Z)
Description: value: Versions of Grocy <= 2.7.1 are vulnerable to Cross-Site Scripting via the Create Shopping List module, that is rendered upon deleting that Shopping List. The issue was also found in users, batteries, chores, equipment, locations, quantity units, shopping locations, tasks, taskcategories, product groups, recipes and products. Authentication is required to exploit these issues and Grocy should not be publicly exposed. The linked reference details a proof-of-concept.
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/grocy/grocy
Files changed:
views/shoppinglist.blade.php
Commit message: Excape shopping list item notes (references #996)


Vulnerable code:
						@if(!empty($listItem->product_id)) {{ FindObjectInArrayByPropertyValue($products, 'id', $listItem->product_id)->name }}<br>@endif<em>{!! nl2br($listItem->note) !!}</em>
							@if(!empty($listItem->product_id)) {{ FindObjectInArrayByPropertyValue($products, 'id', $listItem->product_id)->name }}<br>@endif<em>{!! nl2br($listItem->note) !!}</em>

Fixed code:
						@if(!empty($listItem->product_id)) {{ FindObjectInArrayByPropertyValue($products, 'id', $listItem->product_id)->name }}<br>@endif<em>{!! nl2br(e($listItem->note)) !!}</em>
							@if(!empty($listItem->product_id)) {{ FindObjectInArrayByPropertyValue($products, 'id', $listItem->product_id)->name }}<br>@endif<em>{!! nl2br(e($listItem->note)) !!}</em>
CVE-2015-8842 (Other, published 2016-04-20T16:59Z)
Description: value: tmpfiles.d/systemd.conf in systemd before 229 uses weak permissions for /var/log/journal/%m/system.journal, which allows local users to obtain sensitive information by reading the file.
Severity: LOW (CVSS v3 base score: 3.3)
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/systemd/systemd
Files changed:
tmpfiles.d/systemd.conf.m4
Commit message: tmpfiles: set acls on system.journal explicitly

https://github.com/systemd/systemd/issues/1397


Vulnerable code:

Fixed code:
z /var/log/journal/%m/system.journal 0640 root systemd-journal - -
a+ /var/log/journal/%m/system.journal - - - - group:adm:r--,group:wheel:r--
CVE-2016-10156 (C, published 2017-01-23T07:59Z)
Description: value: A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowing local attackers to escalate their privileges to root. This is fixed in v229.
Severity: HIGH (CVSS v3 base score: 7.8)
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/systemd/systemd
Files changed:
src/basic/fs-util.c
src/core/timer.c
src/test/test-conf-files.c
Commit message: util-lib: use MODE_INVALID as invalid value for mode_t everywhere


Vulnerable code:
        if (mode > 0) {
        return touch_file(path, false, USEC_INFINITY, UID_INVALID, GID_INVALID, 0);
                touch_file(t->stamp_path, true, t->last_trigger.realtime, UID_INVALID, GID_INVALID, 0);
                        touch_file(t->stamp_path, true, USEC_INFINITY, UID_INVALID, GID_INVALID, 0);
                assert_se(touch_file(path, true, USEC_INFINITY, UID_INVALID, GID_INVALID, 0) == 0);

Fixed code:
        if (mode != MODE_INVALID) {
        return touch_file(path, false, USEC_INFINITY, UID_INVALID, GID_INVALID, MODE_INVALID);
                touch_file(t->stamp_path, true, t->last_trigger.realtime, UID_INVALID, GID_INVALID, MODE_INVALID);
                        touch_file(t->stamp_path, true, USEC_INFINITY, UID_INVALID, GID_INVALID, MODE_INVALID);
#include "parse-util.h"
                assert_se(touch_file(path, true, USEC_INFINITY, UID_INVALID, GID_INVALID, MODE_INVALID) == 0);
CVE-2016-10156 (C, published 2017-01-23T07:59Z)
Description: value: A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowing local attackers to escalate their privileges to root. This is fixed in v229.
Severity: HIGH (CVSS v3 base score: 7.8)
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/systemd/systemd
Files changed:
src/basic/fs-util.c
Commit message: basic: fix touch() creating files with 07777 mode

mode_t is unsigned, so MODE_INVALID < 0 can never be true.

This fixes a possible DoS where any user could fill /run by writing to
a world-writable /run/systemd/show-status.


Vulnerable code:
        fd = open(path, O_WRONLY|O_CREAT|O_CLOEXEC|O_NOCTTY, mode > 0 ? mode : 0644);

Fixed code:
        fd = open(path, O_WRONLY|O_CREAT|O_CLOEXEC|O_NOCTTY,
                        (mode == 0 || mode == MODE_INVALID) ? 0644 : mode);
CVE-2017-9217 (C, published 2017-05-24T05:29Z)
Description: value: systemd-resolved through 233 allows remote attackers to cause a denial of service (daemon crash) via a crafted DNS response with an empty question section.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/systemd/systemd
Files changed:
src/resolve/resolved-dns-packet.c
Commit message: resolved: bugfix of null pointer p->question dereferencing (#6020)

See https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1621396

Vulnerable code:

Fixed code:
        if (!p->question)
                return 0;
CVE-2018-20839 (Unknown, published 2019-05-17T04:29Z)
Description: value: systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or using Ctrl-Alt-F1 and Ctrl-Alt-F2. This occurs because the KDGKBMODE (aka current keyboard mode) check is mishandled.
Severity: MEDIUM (CVSS v3 base score: 9.8)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/systemd/systemd
Files changed:
Commit message: Merge pull request #12378 from rbalint/vt-kbd-reset-check

VT kbd reset check

Vulnerable code:

Fixed code:
CVE-2019-20386 (C, published 2020-01-21T06:15Z)
Description: value: An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory leak may occur.
Severity: LOW (CVSS v3 base score: 2.4)
Weakness: CWE-401 \u2014 Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
Repository: https://github.com/systemd/systemd
Files changed:
src/login/logind-button.c
Commit message: bus_open leak sd_event_source when udevadm trigger。

On my host, when executing the udevadm trigger, I only receive the change event, which causes memleak

Vulnerable code:

Fixed code:
        
        b->io_event_source = sd_event_source_unref(b->io_event_source);
CVE-2020-1712 (Unknown, published 2020-03-31T17:15Z)
Description: value: A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/systemd/systemd
Files changed:
Commit message: Merge branch 'polkit-ref-count'


Vulnerable code:

Fixed code:
CVE-2020-1712 (C, published 2020-03-31T17:15Z)
Description: value: A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/systemd/systemd
Files changed:
src/libsystemd/libsystemd.sym
src/libsystemd/sd-bus/sd-bus.c
src/systemd/sd-bus.h
Commit message: sd-bus: introduce API for re-enqueuing incoming messages

When authorizing via PolicyKit we want to process incoming method calls
twice: once to process and figure out that we need PK authentication,
and a second time after we aquired PK authentication to actually execute
the operation. With this new call sd_bus_enqueue_for_read() we have a
way to put an incoming message back into the read queue for this
purpose.

This might have other uses too, for example debugging.


Vulnerable code:

Fixed code:
        sd_bus_enqeue_for_read;

_public_ int sd_bus_enqeue_for_read(sd_bus *bus, sd_bus_message *m) {
        int r;

        assert_return(bus, -EINVAL);
        assert_return(bus = bus_resolve(bus), -ENOPKG);
        assert_return(m, -EINVAL);
        assert_return(m->sealed, -EINVAL);
        assert_return(!bus_pid_changed(bus), -ECHILD);

        if (!BUS_IS_OPEN(bus->state))
                return -ENOTCONN;

        /* Re-enqeue a message for reading. This is primarily useful for PolicyKit-style authentication,
         * where we want accept a message, then determine we need to interactively authenticate the user, and
         * when we have that process the message again. */

        r = bus_rqueue_make_room(bus);
        if (r < 0)
                return r;

        bus->rqueue[bus->rqueue_size++] = bus_message_ref_queued(m, bus);
        return 0;
}
int sd_bus_enqeue_for_read(sd_bus *bus, sd_bus_message *m);
CVE-2020-1712 (C, published 2020-03-31T17:15Z)
Description: value: A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/systemd/systemd
Files changed:
TODO
man/sd_bus_enqueue_for_read.xml
src/libsystemd/libsystemd.sym
src/libsystemd/sd-bus/sd-bus.c
src/shared/bus-polkit.c
src/systemd/sd-bus.h
Commit message: Fix typo in function name


Vulnerable code:
  enqeue stop jobs from a defer event that processes queue instead of
    that are determined to be necessary to autorize a newly incoming method call: when the PolicyKit response
        sd_bus_enqeue_for_read;
_public_ int sd_bus_enqeue_for_read(sd_bus *bus, sd_bus_message *m) {
        /* Re-enqeue a message for reading. This is primarily useful for PolicyKit-style authentication,
         * where we want accept a message, then determine we need to interactively authenticate the user, and
         * when we have that process the message again. */
        r = sd_bus_enqeue_for_read(sd_bus_message_get_bus(q->request), q->request);
int sd_bus_enqeue_for_read(sd_bus *bus, sd_bus_message *m);

Fixed code:
  enqueue stop jobs from a defer event that processes queue instead of
    that are determined to be necessary to authorize a newly incoming method call: when the PolicyKit response
        sd_bus_enqueue_for_read;
_public_ int sd_bus_enqueue_for_read(sd_bus *bus, sd_bus_message *m) {
        /* Re-enqueue a message for reading. This is primarily useful for PolicyKit-style authentication,
         * where we accept a message, then determine we need to interactively authenticate the user, and then
         * we want to process the message again. */
        r = sd_bus_enqueue_for_read(sd_bus_message_get_bus(q->request), q->request);
int sd_bus_enqueue_for_read(sd_bus *bus, sd_bus_message *m);