hitoshura25/cvefixes huggingface dataset:
CVE-2022-25865 (JSON, published 2022-05-13T20:15Z)
Description: value: The package workspace-tools before 0.18.4 are vulnerable to Command Injection via git argument injection. When calling the fetchRemoteBranch(remote: string, remoteBranch: string, cwd: string) function, both the remote and remoteBranch parameters are passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-88 \u2014 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
The product constructs a string for a command to be executed by a separate component
in another control sphere, but it does not properly delimit the
intended arguments, options, or switches within that command string.
Repository: https://github.com/microsoft/workspace-tools
Files changed:
change/workspace-tools-01b53966-7f59-4ab9-abd7-ac355a7ae3b1.json
src/git.ts
Commit message: Fix git fetch - addresses a potential security concern regarding git fetch (#103)

* fixes a potential security issue where fetch --upload-pack can allow for command injection

* Change files

Vulnerable code:
  const results = git(["fetch", remote], { cwd });
  const results = git(["fetch", remote, remoteBranch], { cwd });

Fixed code:
{
  "type": "patch",
  "comment": "fixes a potential security issue where fetch --upload-pack can allow for command injection",
  "packageName": "workspace-tools",
  "email": "kchau@microsoft.com",
  "dependentChangeType": "patch"
}
  const results = git(["fetch", "--", remote], { cwd });
  const results = git(["fetch", "--", remote, remoteBranch], { cwd });
CVE-2019-13173 (JavaScript, published 2019-07-02T20:15Z)
Description: value: fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted file. The fstream.DirWriter() function is vulnerable.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/npm/fstream
Files changed:
lib/writer.js
Commit message: Clobber a Link if it's in the way of a File

Fixes https://github.com/npm/node-tar/issues/212


Vulnerable code:
    if (currentType !== self.type) {

Fixed code:
    if (currentType !== self.type || self.type === 'File' && current.nlink > 1) {
CVE-2022-29215 (PHP, published 2022-05-21T00:15Z)
Description: value: RegionProtect is a plugin that allows users to manage certain events in certain regions of the world. Versions prior to 1.1.0 contain a YAML injection vulnerability that can cause an instant server crash if the passed arguments are not matched. Version 1.1.0 contains a patch for this issue. As a workaround, restrict operator permissions to untrusted people and avoid entering arguments likely to cause a crash.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-88 \u2014 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
The product constructs a string for a command to be executed by a separate component
in another control sphere, but it does not properly delimit the
intended arguments, options, or switches within that command string.
Repository: https://github.com/kaidomc-pm-pl/RegionProtect
Files changed:
src/kaidoMC/RegionProtect/RegionProtect.php
Commit message: Patch the hole

Thanks to @SOF3 for finding this vulnerability!

Co-Authored-By: Jonathan Chan Kwan Yin <sofe2038@gmail.com>


Vulnerable code:

Fixed code:
			if (!preg_match('/^[\w]+$/', $result[2])) {
				$sender->sendMessage(TextFormat::RED . "Invalid region name! Only alphanumeric characters allowed.");
				return;
			}
CVE-2020-8981 (PHP, published 2020-02-13T17:15Z)
Description: value: A cross-site scripting (XSS) vulnerability was discovered in the Source Integration plugin before 1.6.2 and 2.x before 2.3.1 for MantisBT. The repo_delete.php Delete Repository page allows execution of arbitrary code via a repo name (if CSP settings permit it). This is related to CVE-2018-16362.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/mantisbt-plugins/source-integration
Files changed:
Source/pages/repo_delete.php
Commit message: Fix XSS in Delete Repository page

Fixes #338


Vulnerable code:
helper_ensure_confirmed( sprintf( plugin_lang_get( 'ensure_delete' ), $t_repo->name ), plugin_lang_get( 'delete_repository' ) );

Fixed code:
$t_message = sprintf( plugin_lang_get( 'ensure_delete' ), string_attribute( $t_repo->name ) );
helper_ensure_confirmed( $t_message, plugin_lang_get( 'delete_repository' ) );
CVE-2018-1000050 (C, published 2018-02-09T23:29Z)
Description: value: Sean Barrett stb_vorbis version 1.12 and earlier contains a Buffer Overflow vulnerability in All vorbis decoding paths. that can result in memory corruption, denial of service, comprised execution of host program. This attack appear to be exploitable via Victim must open a specially crafted Ogg Vorbis file. This vulnerability appears to have been fixed in 1.13.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/nothings/stb
Files changed:
stb_vorbis.c
Commit message: fix unchecked length in stb_vorbis that could crash on corrupt/invalid files


Vulnerable code:
// Originally sponsored by RAD Game Tools. Seeking sponsored
// by Phillip Bennefall, Marc Andersen, Aaron Baker, Elias Software,
// Aras Pranckevicius, and Sean Barrett.
   int n_read = r->end - r->begin;
         int n_read = r->end - r->begin;

Fixed code:
// Originally sponsored by RAD Game Tools. Seeking implementation
// sponsored by Phillip Bennefall, Marc Andersen, Aaron Baker,
// Elias Software, Aras Pranckevicius, and Sean Barrett.
//    1.12    - 2017/11/21 - limit residue begin/end to blocksize/2 to avoid large temp allocs in bad/corrupt files
// n is 1/2 of the blocksize --
// specification: "Correct per-vector decode length is [n]/2"
   unsigned int actual_size = rtype == 2 ? n*2 : n;
   unsigned int limit_r_begin = (r->begin < actual_size ? r->begin : actual_size);
   unsigned int limit_r_end   = (r->end   < actual_size ? r->end   : actual_size);
   int n_read = limit_r_end - limit_r_begin;
         unsigned int actual_size = f->blocksize_1 / 2;
         unsigned int limit_r_begin = r->begin < actual_size ? r->begin : actual_size;
         unsigned int limit_r_end   = r->end   < actual_size ? r->end   : actual_size;
         int n_read = limit_r_end - limit_r_begin;
      // maximum reasonable partition size is f->blocksize_1

    1.12    - 2017/11/21 - limit residue begin/end to blocksize/2 to avoid large temp allocs in bad/corrupt files
    1.11    - 2017/07/23 - fix MinGW compilation
CVE-2019-13217 (C, published 2019-08-15T17:15Z)
Description: value: A heap buffer overflow in the start_decoder function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service or execute arbitrary code by opening a crafted Ogg Vorbis file.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/nothings/stb
Files changed:
stb_vorbis.c
Commit message: Fix seven bugs discovered and fixed by ForAllSecure:

CVE-2019-13217: heap buffer overflow in start_decoder()
CVE-2019-13218: stack buffer overflow in compute_codewords()
CVE-2019-13219: uninitialized memory in vorbis_decode_packet_rest()
CVE-2019-13220: out-of-range read in draw_line()
CVE-2019-13221: issue with large 1D codebooks in lookup1_values()
CVE-2019-13222: unchecked NULL returned by get_window()
CVE-2019-13223: division by zero in predict_point()


Vulnerable code:
   assert(pow((float) r+1, dim) > entries);
   assert((int) floor(pow((float) r, dim)) <= entries); // (int),floor() as above
      LINE_OP(output[x], inverse_db_table[y]);
         LINE_OP(output[x], inverse_db_table[y]);
   assert(0);
            c->lookup_values = lookup1_values(c->entries, c->dimensions);

Fixed code:
//    1.17    - 2019-07-08 - fix CVE-2019-13217..CVE-2019-13223 (by ForAllSecure)
   if (pow((float) r+1, dim) <= entries)
      return -1;
   if ((int) floor(pow((float) r, dim)) > entries)
      return -1;
      LINE_OP(output[x], inverse_db_table[y&255]);
         LINE_OP(output[x], inverse_db_table[y&255]);
      if (w == NULL) return 0;
            if (current_length >= 32) return error(f, VORBIS_invalid_setup);
            int values = lookup1_values(c->entries, c->dimensions);
            if (values < 0) return error(f, VORBIS_invalid_setup);
            c->lookup_values = (uint32) values;
         for (j=0; j < g->values-1; ++j)
            if (p[j].x == p[j+1].x)
               return error(f, VORBIS_invalid_setup);
         if (m->coupling_steps > f->channels) return error(f, VORBIS_invalid_setup);
    1.17    - 2019-07-08 - fix CVE-2019-13217, -13218, -13219, -13220, -13221, -13223, -13223
                           found with Mayhem by ForAllSecure
    1.16    - 2019-03-04 - fix warnings
    1.15    - 2019-02-07 - explicit failure if Ogg Skeleton data is found
    1.14    - 2018-02-11 - delete bogus dealloca usage
    1.13    - 2018-01-29 - fix truncation of last frame (hopefully)
CVE-2019-13218 (C, published 2019-08-15T17:15Z)
Description: value: Division by zero in the predict_point function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service by opening a crafted Ogg Vorbis file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-369 \u2014 Divide By Zero
The product divides a value by zero.
Repository: https://github.com/nothings/stb
Files changed:
stb_vorbis.c
Commit message: Fix seven bugs discovered and fixed by ForAllSecure:

CVE-2019-13217: heap buffer overflow in start_decoder()
CVE-2019-13218: stack buffer overflow in compute_codewords()
CVE-2019-13219: uninitialized memory in vorbis_decode_packet_rest()
CVE-2019-13220: out-of-range read in draw_line()
CVE-2019-13221: issue with large 1D codebooks in lookup1_values()
CVE-2019-13222: unchecked NULL returned by get_window()
CVE-2019-13223: division by zero in predict_point()


Vulnerable code:
   assert(pow((float) r+1, dim) > entries);
   assert((int) floor(pow((float) r, dim)) <= entries); // (int),floor() as above
      LINE_OP(output[x], inverse_db_table[y]);
         LINE_OP(output[x], inverse_db_table[y]);
   assert(0);
            c->lookup_values = lookup1_values(c->entries, c->dimensions);

Fixed code:
//    1.17    - 2019-07-08 - fix CVE-2019-13217..CVE-2019-13223 (by ForAllSecure)
   if (pow((float) r+1, dim) <= entries)
      return -1;
   if ((int) floor(pow((float) r, dim)) > entries)
      return -1;
      LINE_OP(output[x], inverse_db_table[y&255]);
         LINE_OP(output[x], inverse_db_table[y&255]);
      if (w == NULL) return 0;
            if (current_length >= 32) return error(f, VORBIS_invalid_setup);
            int values = lookup1_values(c->entries, c->dimensions);
            if (values < 0) return error(f, VORBIS_invalid_setup);
            c->lookup_values = (uint32) values;
         for (j=0; j < g->values-1; ++j)
            if (p[j].x == p[j+1].x)
               return error(f, VORBIS_invalid_setup);
         if (m->coupling_steps > f->channels) return error(f, VORBIS_invalid_setup);
    1.17    - 2019-07-08 - fix CVE-2019-13217, -13218, -13219, -13220, -13221, -13223, -13223
                           found with Mayhem by ForAllSecure
    1.16    - 2019-03-04 - fix warnings
    1.15    - 2019-02-07 - explicit failure if Ogg Skeleton data is found
    1.14    - 2018-02-11 - delete bogus dealloca usage
    1.13    - 2018-01-29 - fix truncation of last frame (hopefully)
CVE-2019-13219 (C, published 2019-08-15T17:15Z)
Description: value: A NULL pointer dereference in the get_window function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service by opening a crafted Ogg Vorbis file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/nothings/stb
Files changed:
stb_vorbis.c
Commit message: Fix seven bugs discovered and fixed by ForAllSecure:

CVE-2019-13217: heap buffer overflow in start_decoder()
CVE-2019-13218: stack buffer overflow in compute_codewords()
CVE-2019-13219: uninitialized memory in vorbis_decode_packet_rest()
CVE-2019-13220: out-of-range read in draw_line()
CVE-2019-13221: issue with large 1D codebooks in lookup1_values()
CVE-2019-13222: unchecked NULL returned by get_window()
CVE-2019-13223: division by zero in predict_point()


Vulnerable code:
   assert(pow((float) r+1, dim) > entries);
   assert((int) floor(pow((float) r, dim)) <= entries); // (int),floor() as above
      LINE_OP(output[x], inverse_db_table[y]);
         LINE_OP(output[x], inverse_db_table[y]);
   assert(0);
            c->lookup_values = lookup1_values(c->entries, c->dimensions);

Fixed code:
//    1.17    - 2019-07-08 - fix CVE-2019-13217..CVE-2019-13223 (by ForAllSecure)
   if (pow((float) r+1, dim) <= entries)
      return -1;
   if ((int) floor(pow((float) r, dim)) > entries)
      return -1;
      LINE_OP(output[x], inverse_db_table[y&255]);
         LINE_OP(output[x], inverse_db_table[y&255]);
      if (w == NULL) return 0;
            if (current_length >= 32) return error(f, VORBIS_invalid_setup);
            int values = lookup1_values(c->entries, c->dimensions);
            if (values < 0) return error(f, VORBIS_invalid_setup);
            c->lookup_values = (uint32) values;
         for (j=0; j < g->values-1; ++j)
            if (p[j].x == p[j+1].x)
               return error(f, VORBIS_invalid_setup);
         if (m->coupling_steps > f->channels) return error(f, VORBIS_invalid_setup);
    1.17    - 2019-07-08 - fix CVE-2019-13217, -13218, -13219, -13220, -13221, -13223, -13223
                           found with Mayhem by ForAllSecure
    1.16    - 2019-03-04 - fix warnings
    1.15    - 2019-02-07 - explicit failure if Ogg Skeleton data is found
    1.14    - 2018-02-11 - delete bogus dealloca usage
    1.13    - 2018-01-29 - fix truncation of last frame (hopefully)
CVE-2019-13220 (C, published 2019-08-15T17:15Z)
Description: value: Use of uninitialized stack variables in the start_decoder function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service or disclose sensitive information by opening a crafted Ogg Vorbis file.
Severity: MEDIUM (CVSS v3 base score: 7.1)
Weakness: CWE-908 \u2014 Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
Repository: https://github.com/nothings/stb
Files changed:
stb_vorbis.c
Commit message: Fix seven bugs discovered and fixed by ForAllSecure:

CVE-2019-13217: heap buffer overflow in start_decoder()
CVE-2019-13218: stack buffer overflow in compute_codewords()
CVE-2019-13219: uninitialized memory in vorbis_decode_packet_rest()
CVE-2019-13220: out-of-range read in draw_line()
CVE-2019-13221: issue with large 1D codebooks in lookup1_values()
CVE-2019-13222: unchecked NULL returned by get_window()
CVE-2019-13223: division by zero in predict_point()


Vulnerable code:
   assert(pow((float) r+1, dim) > entries);
   assert((int) floor(pow((float) r, dim)) <= entries); // (int),floor() as above
      LINE_OP(output[x], inverse_db_table[y]);
         LINE_OP(output[x], inverse_db_table[y]);
   assert(0);
            c->lookup_values = lookup1_values(c->entries, c->dimensions);

Fixed code:
//    1.17    - 2019-07-08 - fix CVE-2019-13217..CVE-2019-13223 (by ForAllSecure)
   if (pow((float) r+1, dim) <= entries)
      return -1;
   if ((int) floor(pow((float) r, dim)) > entries)
      return -1;
      LINE_OP(output[x], inverse_db_table[y&255]);
         LINE_OP(output[x], inverse_db_table[y&255]);
      if (w == NULL) return 0;
            if (current_length >= 32) return error(f, VORBIS_invalid_setup);
            int values = lookup1_values(c->entries, c->dimensions);
            if (values < 0) return error(f, VORBIS_invalid_setup);
            c->lookup_values = (uint32) values;
         for (j=0; j < g->values-1; ++j)
            if (p[j].x == p[j+1].x)
               return error(f, VORBIS_invalid_setup);
         if (m->coupling_steps > f->channels) return error(f, VORBIS_invalid_setup);
    1.17    - 2019-07-08 - fix CVE-2019-13217, -13218, -13219, -13220, -13221, -13223, -13223
                           found with Mayhem by ForAllSecure
    1.16    - 2019-03-04 - fix warnings
    1.15    - 2019-02-07 - explicit failure if Ogg Skeleton data is found
    1.14    - 2018-02-11 - delete bogus dealloca usage
    1.13    - 2018-01-29 - fix truncation of last frame (hopefully)
CVE-2019-13221 (C, published 2019-08-15T17:15Z)
Description: value: A stack buffer overflow in the compute_codewords function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service or execute arbitrary code by opening a crafted Ogg Vorbis file.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/nothings/stb
Files changed:
stb_vorbis.c
Commit message: Fix seven bugs discovered and fixed by ForAllSecure:

CVE-2019-13217: heap buffer overflow in start_decoder()
CVE-2019-13218: stack buffer overflow in compute_codewords()
CVE-2019-13219: uninitialized memory in vorbis_decode_packet_rest()
CVE-2019-13220: out-of-range read in draw_line()
CVE-2019-13221: issue with large 1D codebooks in lookup1_values()
CVE-2019-13222: unchecked NULL returned by get_window()
CVE-2019-13223: division by zero in predict_point()


Vulnerable code:
   assert(pow((float) r+1, dim) > entries);
   assert((int) floor(pow((float) r, dim)) <= entries); // (int),floor() as above
      LINE_OP(output[x], inverse_db_table[y]);
         LINE_OP(output[x], inverse_db_table[y]);
   assert(0);
            c->lookup_values = lookup1_values(c->entries, c->dimensions);

Fixed code:
//    1.17    - 2019-07-08 - fix CVE-2019-13217..CVE-2019-13223 (by ForAllSecure)
   if (pow((float) r+1, dim) <= entries)
      return -1;
   if ((int) floor(pow((float) r, dim)) > entries)
      return -1;
      LINE_OP(output[x], inverse_db_table[y&255]);
         LINE_OP(output[x], inverse_db_table[y&255]);
      if (w == NULL) return 0;
            if (current_length >= 32) return error(f, VORBIS_invalid_setup);
            int values = lookup1_values(c->entries, c->dimensions);
            if (values < 0) return error(f, VORBIS_invalid_setup);
            c->lookup_values = (uint32) values;
         for (j=0; j < g->values-1; ++j)
            if (p[j].x == p[j+1].x)
               return error(f, VORBIS_invalid_setup);
         if (m->coupling_steps > f->channels) return error(f, VORBIS_invalid_setup);
    1.17    - 2019-07-08 - fix CVE-2019-13217, -13218, -13219, -13220, -13221, -13223, -13223
                           found with Mayhem by ForAllSecure
    1.16    - 2019-03-04 - fix warnings
    1.15    - 2019-02-07 - explicit failure if Ogg Skeleton data is found
    1.14    - 2018-02-11 - delete bogus dealloca usage
    1.13    - 2018-01-29 - fix truncation of last frame (hopefully)
CVE-2019-13222 (C, published 2019-08-15T17:15Z)
Description: value: An out-of-bounds read of a global buffer in the draw_line function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service or disclose sensitive information by opening a crafted Ogg Vorbis file.
Severity: MEDIUM (CVSS v3 base score: 7.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/nothings/stb
Files changed:
stb_vorbis.c
Commit message: Fix seven bugs discovered and fixed by ForAllSecure:

CVE-2019-13217: heap buffer overflow in start_decoder()
CVE-2019-13218: stack buffer overflow in compute_codewords()
CVE-2019-13219: uninitialized memory in vorbis_decode_packet_rest()
CVE-2019-13220: out-of-range read in draw_line()
CVE-2019-13221: issue with large 1D codebooks in lookup1_values()
CVE-2019-13222: unchecked NULL returned by get_window()
CVE-2019-13223: division by zero in predict_point()


Vulnerable code:
   assert(pow((float) r+1, dim) > entries);
   assert((int) floor(pow((float) r, dim)) <= entries); // (int),floor() as above
      LINE_OP(output[x], inverse_db_table[y]);
         LINE_OP(output[x], inverse_db_table[y]);
   assert(0);
            c->lookup_values = lookup1_values(c->entries, c->dimensions);

Fixed code:
//    1.17    - 2019-07-08 - fix CVE-2019-13217..CVE-2019-13223 (by ForAllSecure)
   if (pow((float) r+1, dim) <= entries)
      return -1;
   if ((int) floor(pow((float) r, dim)) > entries)
      return -1;
      LINE_OP(output[x], inverse_db_table[y&255]);
         LINE_OP(output[x], inverse_db_table[y&255]);
      if (w == NULL) return 0;
            if (current_length >= 32) return error(f, VORBIS_invalid_setup);
            int values = lookup1_values(c->entries, c->dimensions);
            if (values < 0) return error(f, VORBIS_invalid_setup);
            c->lookup_values = (uint32) values;
         for (j=0; j < g->values-1; ++j)
            if (p[j].x == p[j+1].x)
               return error(f, VORBIS_invalid_setup);
         if (m->coupling_steps > f->channels) return error(f, VORBIS_invalid_setup);
    1.17    - 2019-07-08 - fix CVE-2019-13217, -13218, -13219, -13220, -13221, -13223, -13223
                           found with Mayhem by ForAllSecure
    1.16    - 2019-03-04 - fix warnings
    1.15    - 2019-02-07 - explicit failure if Ogg Skeleton data is found
    1.14    - 2018-02-11 - delete bogus dealloca usage
    1.13    - 2018-01-29 - fix truncation of last frame (hopefully)