hitoshura25/cvefixes huggingface dataset:
CVE-2024-36119 (PHP, published 2024-05-30T21:15Z)
Description: value: Statamic is a, Laravel + Git powered CMS designed for building websites. In affected versions users registering via the `user:register_form` tag will have their password confirmation stored in plain text in their user file. This only affects sites matching **all** of the following conditions: 1. Running Statamic versions between 5.3.0 and 5.6.1. (This version range represents only one calendar week), 2. Using the `user:register_form` tag. 3. Using file-based user accounts. (Does not affect users stored in a database.), 4. Has users that have registered during that time period. (Existing users are not affected.). Additionally passwords are only visible to users that have access to read user yaml files, typically developers of the application itself. This issue has been patched in version 5.6.2, however any users registered during that time period and using the affected version range will still have the the `password_confirmation` value in their yaml files. We recommend that affected users have their password reset. System administrators are advised to upgrade their deployments. There are no known workarounds for this vulnerability. Anyone who commits their files to a public git repo, may consider clearing the sensitive data from the git history as it is likely that passwords were uploaded.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/statamic/cms
Files changed:
src/Http/Requests/UserRegisterRequest.php
tests/Tags/User/RegisterFormTest.php
Commit message: [5.x] Prevent user registration form saving `password_confirmation` (#10228)

Co-authored-by: Duncan McClean <duncan@duncanmcclean.com>


Vulnerable code:
            ->except(['email', 'groups', 'roles', 'super']);

Fixed code:
            ->except(['email', 'groups', 'roles', 'super', 'password_confirmation']);
use Statamic\Facades\Role;
use Statamic\Facades\UserGroup;
    /** @test */
    public function it_ensures_some_fields_arent_saved()
    {
        UserGroup::make('client')->title('Client')->save();
        Role::make('admin')->title('Admin')->save();

        $this->assertNull(User::findByEmail('san@holo.com'));
        $this->assertFalse(auth()->check());

        $this
            ->post('/!/auth/register', [
                'email' => 'san@holo.com',
                'password' => 'chewbacca',
                'password_confirmation' => 'chewbacca',
                'groups' => ['client'],
                'roles' => ['admin'],
                'super' => true,
            ])
            ->assertSessionHasNoErrors()
            ->assertLocation('/');

        $user = User::findByEmail('san@holo.com');

        $this->assertEquals($user->groups()->count(), 0);
        $this->assertEquals($user->roles()->count(), 0);
        $this->assertNull($user->get('super'));
        $this->assertNull($user->get('password_confirmation'));
    }
CVE-2020-28451 (JavaScript, published 2022-08-02T14:15Z)
Description: value: This affects the package image-tiler before 2.0.2.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/MrP/image-tiler
Files changed:
index.js
spec/image-tiler.spec.js
Commit message: fix command injection vuln


Vulnerable code:
var execSync = require('child_process').execSync;
        patternedFilenameWithoutTheFilename = pattern.replace(new RegExp(path.sep+'[^'+path.sep+']*$'), '')
        .replace(/\{z\}/, '' + zoom);
    .then(()=>{
        var command = 'convert ' + inPath +
            ' -crop ' + tileSize + 'x' + tileSize +
            ' -set filename:tile "' + patternedFilename + '"' +
            ' -quality ' + quality + ' +repage +adjoin' +
            ' "' + outPath + '/%[filename:tile]' + dotExtension + '"' ;
        execSync(command);
    });
    execSync('convert ' + inPath + ' ' + inPathMpc);
                execSync('convert ' + inPathMpc + ' -resize 50% -quality ' + quality + ' ' + newInPath);
        .then(()=>tileRec(inPath, outPath, zoom, tileSize, tempDir, pattern, zoomToDisplay, options.invertZoom, quality))
        .then(()=>rimraf(tempDir));
var execSync = require('child_process').execSync;
            execSync('node bin/image-tiler spec/small.png ' + tempDir + ' small_test_result_{z}_{x}_{y}.png');
            .then(done)
            .catch(done.fail);

Fixed code:
var execFileSync = require('child_process').execFileSync;
        patternedFilenameWithoutTheFilename = pattern.replace(new RegExp(path.sep + '[^' + path.sep + ']*$'), '')
            .replace(/\{z\}/, '' + zoom);
        .then(() => {
            var args = [inPath,
                '-crop', tileSize + 'x' + tileSize,
                '-set', 'filename:tile', patternedFilename,
                '-quality', quality, '+repage', '+adjoin',
                outPath + '/%[filename:tile]' + dotExtension];
            execFileSync('convert', args);
        });
    execFileSync('convert', [inPath, inPathMpc]);
                execFileSync('convert', [inPathMpc, '-resize', '50%', '-quality', quality, newInPath]);
        .then(() => tileRec(inPath, outPath, zoom, tileSize, tempDir, pattern, zoomToDisplay, options.invertZoom, quality))
        .then(() => rimraf(tempDir));
var execFileSync = require('child_process').execFileSync;
            execFileSync('node', ['bin/image-tiler', 'spec/small.png', tempDir, 'small_test_result_{z}_{x}_{y}.png']);
                .then(done)
                .catch(done.fail);
CVE-2019-17383 (Unknown, published 2019-10-09T16:15Z)
Description: value: The netaddr gem before 2.0.4 for Ruby has misconfigured file permissions, such that a gem install may result in 0777 permissions in the target filesystem.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-276 \u2014 Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
Repository: https://github.com/dspinhirne/netaddr-rb
Files changed:
Commit message: Merge pull request #20 from infakt-HNP/master

FIX for file permissions - using too high causes that gem install set 777 on files installed in system

Vulnerable code:

Fixed code:
CVE-2017-8932 (Other, published 2017-07-06T16:29Z)
Description: value: A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in Go before 1.7.6 and 1.8.x before 1.8.2 causes incorrect results to be generated for specific input points. An adaptive attack can be mounted to progressively extract the scalar input to ScalarMult by submitting crafted points and observing failures to the derive correct output. This leads to a full key recovery attack against static ECDH, as used in popular JWT libraries.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-682 \u2014 Incorrect Calculation
The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.
Repository: https://github.com/golang/go
Files changed:
src/crypto/elliptic/elliptic_test.go
src/crypto/elliptic/p256_asm_amd64.s
Commit message: crypto/elliptic: fix carry bug in x86-64 P-256 implementation.

Patch from Vlad Krasnov and confirmed to be under CLA.

Fixes #20040.

Change-Id: Ieb8436c4dcb6669a1620f1e0d257efd047b1b87c
Reviewed-on: https://go-review.googlesource.com/41070
Run-TryBot: Adam Langley <agl@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>


Vulnerable code:
	ADCQ $0, mul0
	CMOVQNE acc0, acc4
	CMOVQNE acc1, acc5
	CMOVQNE acc2, acc6
	CMOVQNE acc3, acc7

Fixed code:
type scalarMultTest struct {
	k          string
	xIn, yIn   string
	xOut, yOut string
}

var p256MultTests = []scalarMultTest{
	{
		"2a265f8bcbdcaf94d58519141e578124cb40d64a501fba9c11847b28965bc737",
		"023819813ac969847059028ea88a1f30dfbcde03fc791d3a252c6b41211882ea",
		"f93e4ae433cc12cf2a43fc0ef26400c0e125508224cdb649380f25479148a4ad",
		"4d4de80f1534850d261075997e3049321a0864082d24a917863366c0724f5ae3",
		"a22d2b7f7818a3563e0f7a76c9bf0921ac55e06e2e4d11795b233824b1db8cc0",
	},
	{
		"313f72ff9fe811bf573176231b286a3bdb6f1b14e05c40146590727a71c3bccd",
		"cc11887b2d66cbae8f4d306627192522932146b42f01d3c6f92bd5c8ba739b06",
		"a2f08a029cd06b46183085bae9248b0ed15b70280c7ef13a457f5af382426031",
		"831c3f6b5f762d2f461901577af41354ac5f228c2591f84f8a6e51e2e3f17991",
		"93f90934cd0ef2c698cc471c60a93524e87ab31ca2412252337f364513e43684",
	},
}


	for i, e := range p256MultTests {
		x, _ := new(big.Int).SetString(e.xIn, 16)
		y, _ := new(big.Int).SetString(e.yIn, 16)
		k, _ := new(big.Int).SetString(e.k, 16)
		expectedX, _ := new(big.Int).SetString(e.xOut, 16)
		expectedY, _ := new(big.Int).SetString(e.yOut, 16)

		xx, yy := p256.ScalarMult(x, y, k.Bytes())
		if xx.Cmp(expectedX) != 0 || yy.Cmp(expectedY) != 0 {
			t.Errorf("#%d: got (%x, %x), want (%x, %x)", i, xx, yy, expectedX, expectedY)
		}
	}
	ANDQ $1, mul0
	CMOVQEQ acc0, acc4
	CMOVQEQ acc1, acc5
	CMOVQEQ acc2, acc6
	CMOVQEQ acc3, acc7
CVE-2022-35411 (Python, published 2022-07-08T19:15Z)
Description: value: rpc.py through 0.6.0 allows Remote Code Execution because an unpickle occurs when the "serializer: pickle" HTTP header is sent. In other words, although JSON (not Pickle) is the default data format, an unauthenticated client can cause the data to be processed with unpickle.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-522 \u2014 Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Repository: https://github.com/abersheeran/rpc.py
Files changed:
rpcpy/serializers.py
Commit message: PickleSerializer is turned off by default

Vulnerable code:
    PickleSerializer.name: PickleSerializer(),
    PickleSerializer.content_type: PickleSerializer(),

Fixed code:
# Since the release of pickle to the external network may lead to
# arbitrary code execution vulnerabilities, this serialization
# method is not enabled by default. It is recommended to turn it on
# when there is physical isolation from the outside.

    # PickleSerializer.name: PickleSerializer(),
    # PickleSerializer.content_type: PickleSerializer(),
CVE-2021-37524 (PHP, published 2022-07-01T18:15Z)
Description: value: Cross Site Scripting (XSS) vulnerability in FusionPBX 4.5.26 allows remote unauthenticated users to inject arbitrary web script or HTML via an unsanitized "path" parameter in resources/login.php.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/fusionpbx/fusionpbx
Files changed:
resources/login.php
Commit message: Fix XSS on login page by removing $_REQUEST[path]


Vulnerable code:
//set the requested destination after login
	if (!empty($_REQUEST['path'])) {
		$_SESSION['login']['destination']['url'] = $_REQUEST['path'];
	}


Fixed code:
CVE-2021-43404 (PHP, published 2021-11-05T18:15Z)
Description: value: An issue was discovered in FusionPBX before 4.5.30. The FAX file name may have risky characters.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/fusionpbx/fusionpbx
Files changed:
app/fax/fax_send.php
Commit message: Change the fax file name to md5 to avoid characters that present a security risk.

Vulnerable code:
				$fax_name = $_files['name'][$index];
				$fax_name = preg_replace('/\\.[^.\\s]{3,4}$/', '', $fax_name);
				$fax_name = str_replace(" ", "_", $fax_name);

				//lua doesn't seem to like special chars with env:GetHeader
				$fax_name = str_replace(";", "_", $fax_name);
				$fax_name = str_replace(",", "_", $fax_name);
				$fax_name = str_replace("'", "_", $fax_name);
				$fax_name = str_replace("!", "_", $fax_name);
				$fax_name = str_replace("@", "_", $fax_name);
				$fax_name = str_replace("#", "_", $fax_name);
				$fax_name = str_replace("$", "_", $fax_name);
				$fax_name = str_replace("%", "_", $fax_name);
				$fax_name = str_replace("^", "_", $fax_name);
				$fax_name = str_replace("`", "_", $fax_name);
				$fax_name = str_replace("~", "_", $fax_name);
				$fax_name = str_replace("&", "_", $fax_name);
				$fax_name = str_replace("(", "_", $fax_name);
				$fax_name = str_replace(")", "_", $fax_name);
				$fax_name = str_replace("+", "_", $fax_name);
				$fax_name = str_replace("=", "_", $fax_name);
						event_socket_mkdir($dir_fax_temp);

Fixed code:
				//use a safe file name
				$fax_name = md5($_files['name'][$index]);
				//rename the file
						mkdir($dir_fax_temp, 0770);
CVE-2021-43405 (PHP, published 2021-11-05T18:15Z)
Description: value: An issue was discovered in FusionPBX before 4.5.30. The fax_extension may have risky characters (it is not constrained to be numeric).
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/fusionpbx/fusionpbx
Files changed:
app/fax/fax_send.php
Commit message: Require the fax_extension to be numeric.

Need to validate that the fax_extension really is numeric. Also replace event_socket_mkdir that makes a directory with mkdir.lua and use a php mkdir function instead. We want to offload this off of FreeSWITCH and its safer to use the PHP function.

Vulnerable code:
	Portions created by the Initial Developer are Copyright (C) 2008-2020
		if (strlen($_REQUEST["fax_extension"]) > 0) {
	if (strlen($fax_extension) > 0) {
				event_socket_mkdir($_SESSION['switch']['storage']['dir']);
				event_socket_mkdir($_SESSION['switch']['storage']['dir'].'/fax');
				event_socket_mkdir($_SESSION['switch']['storage']['dir'].'/fax/'.$_SESSION['domain_name']);
				event_socket_mkdir($fax_dir.'/'.$fax_extension);
				event_socket_mkdir($dir_fax_inbox);
				event_socket_mkdir($dir_fax_sent);
				event_socket_mkdir($dir_fax_temp);

Fixed code:
	Portions created by the Initial Developer are Copyright (C) 2008-2021
		if (isset($_REQUEST["fax_extension"]) && is_numeric($_REQUEST["fax_extension"])) {
	if (isset($fax_extension) && is_numeric($fax_extension)) {
				mkdir($_SESSION['switch']['storage']['dir'], 0770);
				mkdir($_SESSION['switch']['storage']['dir'].'/fax', 0770);
				mkdir($_SESSION['switch']['storage']['dir'].'/fax/'.$_SESSION['domain_name'], 0770);
				mkdir($fax_dir.'/'.$fax_extension, 0770);
				mkdir($dir_fax_inbox, 0770);
				mkdir($dir_fax_sent, 0770);
				mkdir($dir_fax_temp, 0770);
CVE-2021-43406 (PHP, published 2021-11-05T18:15Z)
Description: value: An issue was discovered in FusionPBX before 4.5.30. The fax_post_size may have risky characters (it is not constrained to preset values).
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/fusionpbx/fusionpbx
Files changed:
app/fax/fax_send.php
Commit message: Force the fax_page_size to only preset allowed values.

Vulnerable code:

Fixed code:
				$page_width = 8.5; //in
				$page_height = 11; //in
				break;
				$fax_page_size = 'letter';
CVE-2024-24539 (PHP, published 2024-03-18T03:15Z)
Description: value: FusionPBX before 5.2.0 does not validate a session.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/fusionpbx/fusionpbx
Files changed:
core/authentication/resources/classes/authentication.php
resources/check_auth.php
Commit message: Security - validate session

Vulnerable code:
				//get the groups assigned to the user 
	if (function_exists('session_start')) { 
	if (!isset($_SESSION['authorized']) || (isset($_SESSION['authorized']) && !$_SESSION['authorized'])) {

Fixed code:
				//used to validate the session
					$_SESSION["user_hash"] = hash('sha256', $_SERVER['REMOTE_ADDR'].$_SERVER['HTTP_USER_AGENT']);

				//get the groups assigned to the user
	if (function_exists('session_start')) {
//if session authorized is not set then set the default value to false
	if (!isset($_SESSION['authorized'])) {
		$_SESSION['authorized'] = false;
	}

//validate the session address
	if ($_SESSION['authorized'] && $_SESSION["user_hash"] !== hash('sha256', $_SERVER['REMOTE_ADDR'].$_SERVER['HTTP_USER_AGENT'])) {
		session_destroy();
		header("Location: ".PROJECT_PATH."/?path=".urlencode($target_path));
	}

	if (!$_SESSION['authorized']) {
CVE-2021-21291 (Go, published 2021-02-02T19:15Z)
Description: value: OAuth2 Proxy is an open-source reverse proxy and static file server that provides authentication using Providers (Google, GitHub, and others) to validate accounts by email, domain or group. In OAuth2 Proxy before version 7.0.0, for users that use the whitelist domain feature, a domain that ended in a similar way to the intended domain could have been allowed as a redirect. For example, if a whitelist domain was configured for ".example.com", the intention is that subdomains of example.com are allowed. Instead, "example.com" and "badexample.com" could also match. This is fixed in version 7.0.0 onwards. As a workaround, one can disable the whitelist domain feature and run separate OAuth2 Proxy instances for each subdomain.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/oauth2-proxy/oauth2-proxy
Files changed:
oauthproxy.go
oauthproxy_test.go
Commit message: Merge pull request from GHSA-4mf2-f3wh-gvf2



Vulnerable code:
		for _, domain := range p.whitelistDomains {
			domainHostname, domainPort := splitHostPort(strings.TrimLeft(domain, "."))
			if domainHostname == "" {
			if (redirectHostname == domainHostname) || (strings.HasPrefix(domain, ".") && strings.HasSuffix(redirectHostname, domainHostname)) {
				if (domainPort == "*") ||
					(domainPort == redirectPort) ||
					(domainPort == "" && redirectPort == "") {

Fixed code:
		for _, allowedDomain := range p.whitelistDomains {
			allowedHost, allowedPort := splitHostPort(allowedDomain)
			if allowedHost == "" {
			if redirectHostname == strings.TrimPrefix(allowedHost, ".") ||
				(strings.HasPrefix(allowedHost, ".") &&
					strings.HasSuffix(redirectHostname, allowedHost)) {
				if allowedPort == "*" ||
					allowedPort == redirectPort ||
					(allowedPort == "" && redirectPort == "") {
		{
			Desc:           "openRedirectPartialSubdomain",
			Redirect:       "http://evilbar.foo",
			ExpectedResult: false,
		},
CVE-2022-39296 (PHP, published 2022-10-11T18:15Z)
Description: value: MelisAssetManager provides deliveries of Melis Platform's assets located in every module's public folder. Attackers can read arbitrary files on affected versions of `melisplatform/melis-asset-manager`, leading to the disclosure of sensitive information. Conducting this attack does not require authentication. Users should immediately upgrade to `melisplatform/melis-asset-manager` >= 5.0.1. This issue was addressed by restricting access to files to intended directories only.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/melisplatform/melis-asset-manager
Files changed:
src/Module.php
Commit message: added checking if the requested file is inside the intended directory


Vulnerable code:
        if (is_file($pathFile))
                            if (is_file($pathFile))

Fixed code:
        if (is_file($pathFile) && $this->checkFileInFolder($pathFile, $_SERVER['DOCUMENT_ROOT']))
                            if (is_file($pathFile) && $this->checkFileInFolder($pathFile, $path . '/public/'))
     /*checks if the file is inside the given folder*/
    protected function checkFileInFolder($file, $folder)
    {       
        $path = realpath($file);        
        if ($path !== false) {
            if (strpos($path, realpath($folder)) !== 0) {                   
                throw new \Exception('Requested resource is outside of ' . $folder);
            } else {              
                return true;
            }
        } else {                   
            return false;
        }
    }
CVE-2013-2124 (C, published 2014-05-27T14:55Z)
Description: value: Double free vulnerability in inspect-fs.c in LibguestFS 1.20.x before 1.20.7, 1.21.x, 1.22.0, and 1.23.0 allows remote attackers to cause a denial of service (crash) via empty guest files.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/libguestfs/libguestfs
Files changed:
src/inspect-fs.c
Commit message: inspection: Fix double-free when certain guest files are empty.

The following commit:

  commit 5a3da366268825b26b470cde35658b67c1d11cd4
  Author: Richard W.M. Jones <rjones@redhat.com>
  Date:   Thu Jan 24 17:07:38 2013 +0000

      inspect: Use CLEANUP_* macros in inspection code.

can cause a double-free along an error path when certain guest files
are empty where we expected those files to contain at least one line.

This causes virt-inspector to crash when run on these guests.

The following is a test case which demonstrates the crash.
`f20rawhidex64' is a Fedora guest, but with small adjustments to the
test you could use any Linux guest for this test.

  $ qemu-img create -f qcow2 -b f20rawhidex64 /tmp/test.qcow2
  Formatting '/tmp/test.qcow2', fmt=qcow2 size=21474836480 backing_file='f20rawhidex64' encryption=off cluster_size=65536 lazy_refcounts=off
  $ guestfish -i -a /tmp/test.qcow2 -- rm /etc/redhat-release : touch /etc/redhat-release
  $ virt-inspector /tmp/test.qcow2
  *** glibc detected *** virt-inspector: double free or corruption (fasttop): 0x00007f18bc9925a0 ***
  ======= Backtrace: =========
  /lib64/libc.so.6(+0x34ecc7ca8e)[0x7f18b8e64a8e]
  /lib64/libguestfs.so.0(+0x3f91898078)[0x7f18ba13c078]
  /lib64/libguestfs.so.0(+0x3f91899761)[0x7f18ba13d761]
  /lib64/libguestfs.so.0(+0x3f91896d12)[0x7f18ba13ad12]
  /lib64/libguestfs.so.0(+0x3f91894140)[0x7f18ba138140]
  /lib64/libguestfs.so.0(guestfs_inspect_os+0x35)[0x7f18ba0bcc35]
  virt-inspector(main+0x547)[0x7f18ba7c57d7]
  /lib64/libc.so.6(__libc_start_main+0xf5)[0x7f18b8e09a05]
  virt-inspector(+0x6665)[0x7f18ba7c7665]

This is a denial of service, but not likely to be exploitable.

(Found by Coverity)


Vulnerable code:
  CLEANUP_FREE char **lines = NULL; /* sic: not CLEANUP_FREE_STRING_LIST */

Fixed code:
  char **lines = NULL; /* sic: not CLEANUP_FREE_STRING_LIST */
  free (lines);