hitoshura25/cvefixes huggingface dataset:
CVE-2020-10378 (C, published 2020-06-25T19:15Z)
Description: value: In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/python-pillow/Pillow
Files changed:
src/libImaging/PcxDecode.c
Commit message: Fix OOB Access on PcxDecode.c


Vulnerable code:
    if (strcmp(im->mode, "1") == 0 && state->xsize > state->bytes * 8) {
        state->errcode = IMAGING_CODEC_OVERRUN;
        return -1;
    } else if (strcmp(im->mode, "P") == 0 && state->xsize > state->bytes) {

Fixed code:
    if ((state->xsize * state->bits + 7) / 8 > state->bytes) {
CVE-2020-10379 (Unknown, published 2020-06-25T19:15Z)
Description: value: In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/python-pillow/Pillow
Files changed:
Commit message: Merge pull request #4507 from hugovk/fix_tiff

Fix 2 buffer overflows in TIFF decoding

Vulnerable code:

Fixed code:
CVE-2021-28676 (C, published 2021-06-02T16:15Z)
Description: value: An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-835 \u2014 Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Repository: https://github.com/python-pillow/Pillow
Files changed:
Tests/test_file_fli.py
src/libImaging/FliDecode.c
Commit message: Fix FLI DOS -- CVE-2021-28676

* FliDecode did not properly check that the block advance was
  non-zero, potentally leading to an infinite loop on load.
* This dates to the PIL Fork
* Found with oss-fuzz


Vulnerable code:

Fixed code:


@pytest.mark.parametrize(
    "test_file",
    [
        "Tests/images/timeout-9139147ce93e20eb14088fe238e541443ffd64b3.fli",
        "Tests/images/timeout-bff0a9dc7243a8e6ede2408d2ffa6a9964698b87.fli",
    ],
)
@pytest.mark.timeout(timeout=3)
def test_timeouts(test_file):
    with open(test_file, "rb") as f:
        with Image.open(f) as im:
            with pytest.raises(OSError):
                im.load()
        if (advance == 0 ) {
            // If there's no advance, we're in in infinite loop
            state->errcode = IMAGING_CODEC_BROKEN;
            return -1;
        }
CVE-2022-45198 (Unknown, published 2022-11-14T07:15Z)
Description: value: Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).
Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/python-pillow/Pillow
Files changed:
Commit message: Merge pull request #6403 from radarhere/gif_decompression_bomb

Added release notes for #6402

Vulnerable code:

Fixed code:
CVE-2022-45199 (Unknown, published 2022-11-14T07:15Z)
Description: value: Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/python-pillow/Pillow
Files changed:
Commit message: Merge pull request #6700 from hugovk/security-samples_per_pixel-sec



Vulnerable code:

Fixed code:
CVE-2023-44271 (Other, published 2023-11-03T05:15Z)
Description: value: An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/python-pillow/Pillow
Files changed:
Tests/test_imagefont.py
docs/reference/ImageFont.rst
docs/releasenotes/10.0.0.rst
src/PIL/ImageFont.py
Commit message: Added ImageFont.MAX_STRING_LENGTH


Vulnerable code:

Fixed code:
def test_too_many_characters(font):
    with pytest.raises(ValueError):
        font.getlength("A" * 1000001)
    with pytest.raises(ValueError):
        font.getbbox("A" * 1000001)
    with pytest.raises(ValueError):
        font.getmask2("A" * 1000001)

    transposed_font = ImageFont.TransposedFont(font)
    with pytest.raises(ValueError):
        transposed_font.getlength("A" * 1000001)

    default_font = ImageFont.load_default()
    with pytest.raises(ValueError):
        default_font.getlength("A" * 1000001)
    with pytest.raises(ValueError):
        default_font.getbbox("A" * 1000001)


.. warning::
    To protect against potential DOS attacks when using arbitrary strings as
    text input, Pillow will raise a ``ValueError`` if the number of characters
    is over a certain limit, :py:data:`MAX_STRING_LENGTH`.

    This threshold can be changed by setting
    :py:data:`MAX_STRING_LENGTH`. It can be disabled by setting
    ``ImageFont.MAX_STRING_LENGTH = None``.


Constants
---------

.. data:: MAX_STRING_LENGTH

    Set to 1,000,000, to protect against potential DOS attacks. Pillow will
    raise a ``ValueError`` if the number of characters is over this limit. The
    check can be disabled by setting ``ImageFont.MAX_STRING_LENGTH = None``.
Added ImageFont.MAX_STRING_LENGTH
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

To protect against potential DOS attacks when using arbitrary strings as text
input, Pillow will now raise a ``ValueError`` if the number of characters
passed into ImageFont methods is over a certain limit,
:py:data:`PIL.ImageFont.MAX_STRING_LENGTH`.

This threshold can be changed by setting
:py:data:`PIL.ImageFont.MAX_STRING_LENGTH`. It can be disabled by setting
``ImageFont.MAX_STRING_LENGTH = None``.

MAX_STRING_LENGTH = 1000000


def _string_length_check(text):
    if MAX_STRING_LENGTH is not None and len(text) > MAX_STRING_LENGTH:
        msg = "too many characters in string"
        raise ValueError(msg)


        _string_length_check(text)
        _string_length_check(text)
        _string_length_check(text)
        _string_length_check(text)
        _string_length_check(text)
        _string_length_check(text)
CVE-2023-43669 (Markdown, published 2023-09-21T06:15Z)
Description: value: The Tungstenite crate before 0.20.1 for Rust allows remote attackers to cause a denial of service (minutes of CPU consumption) via an excessive length of an HTTP header in a client handshake. The length affects both how many times a parse is attempted (e.g., thousands of times) and the average amount of data for each parse attempt (e.g., millions of bytes).
Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/snapview/tungstenite-rs
Files changed:
CHANGELOG.md
Commit message: Update changelog


Vulnerable code:

Fixed code:
# 0.20.1

- Fixes [CVE-2023-43669](https://github.com/snapview/tungstenite-rs/pull/379).
CVE-2022-4524 (PHP, published 2022-12-15T21:15Z)
Description: value: A vulnerability, which was classified as problematic, was found in Roots soil Plugin up to 4.0.x. Affected is the function language_attributes of the file src/Modules/CleanUpModule.php. The manipulation of the argument language leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 4.1.0 is able to address this issue. The name of the patch is 0c9151e00ab047da253e5cdbfccb204dd423269d. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215904.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/roots/soil
Files changed:
src/Modules/CleanUpModule.php
Commit message: 🔒️ XSS fix on `language_attributes` (#285)



Vulnerable code:
        $lang = get_bloginfo('language');

Fixed code:
        $lang = esc_attr(get_bloginfo('language'));
CVE-2021-45010 (PHP, published 2022-03-15T12:15Z)
Description: value: A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attackers (with valid user accounts) to upload malicious PHP files to the webroot, leading to code execution.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/prasathmani/tinyfilemanager
Files changed:
tinyfilemanager.php
Commit message: Patched the RCE (#636)

I have patched the file upload directory traversal to Authenticated Remote Code Execution Vulnerability.

Vulnerable code:
        $fullPath = $path . '/' . $_REQUEST['fullpath'];

Fixed code:
        $fullPath = $path . '/' . str_replace("./","_",$_REQUEST['fullpath']);
CVE-2022-1000 (PHP, published 2022-03-17T11:15Z)
Description: value: Path Traversal in GitHub repository prasathmani/tinyfilemanager prior to 2.4.7.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/prasathmani/tinyfilemanager
Files changed:
tinyfilemanager.php
Commit message: apply fix to path traversal vulnerability (#718)

Co-authored-by: João Maurício <joao.goncalves.mauricio@pwc.com>

Vulnerable code:
    $ext = strtolower(pathinfo($filename, PATHINFO_EXTENSION));
        $fullPath = $path . '/' . str_replace("./","_",$_REQUEST['fullpath']);
            $fullPath = str_replace($ext_1, '', $fullPath) .'_'. date('ymdHis'). $ext_1;

Fixed code:
    $ext = pathinfo($filename, PATHINFO_FILENAME) != '' ? strtolower(pathinfo($filename, PATHINFO_EXTENSION)) : '';
        $fullPath = $path . '/' . basename($_REQUEST['fullpath']);
            $fullPath = $path . '/' . basename($_REQUEST['fullpath'], $ext_1) .'_'. date('ymdHis'). $ext_1;
CVE-2023-51664 (TypeScript, published 2023-12-27T17:15Z)
Description: value: tj-actions/changed-files is a Github action to retrieve all files and directories. Prior to 41.0.0, the `tj-actions/changed-files` workflow allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. This issue may lead to arbitrary command execution in the GitHub Runner. This vulnerability has been addressed in version 41.0.0. Users are advised to upgrade.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/tj-actions/changed-files
Files changed:
src/utils.ts
Commit message: fix: update characters escaped by safe output (#1815)



Vulnerable code:
    cleanedValue = cleanedValue.replace(
      /[^\x20-\x7E]|[:*?"<>|;`$()&!]/g,
      '\\$&'
    )

Fixed code:
    cleanedValue = cleanedValue.replace(/[^\x20-\x7E]|[:*?<>|;`$()&!]/g, '\\$&')
CVE-2023-51664 (TypeScript, published 2023-12-27T17:15Z)
Description: value: tj-actions/changed-files is a Github action to retrieve all files and directories. Prior to 41.0.0, the `tj-actions/changed-files` workflow allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. This issue may lead to arbitrary command execution in the GitHub Runner. This vulnerability has been addressed in version 41.0.0. Users are advised to upgrade.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/tj-actions/changed-files
Files changed:
README.md
src/utils.ts
Commit message: fix: update safe output regex and the docs (#1805)

Co-authored-by: jackton1 <jackton1@users.noreply.github.com>
Co-authored-by: GitHub Action <action@github.com>
Co-authored-by: Tonye Jack <jtonye@ymail.com>

Vulnerable code:
    cleanedValue = cleanedValue.replace(/[$()`|&;]/g, '\\$&')

Fixed code:
    # Apply sanitization to output filenames before being set as 
    # output. 
    # Type: boolean
    # Default: "true"
    safe_output: ''

    cleanedValue = cleanedValue.replace(
      /[^\x20-\x7E]|[:*?"<>|;`$()&!]/g,
      '\\$&'
    )
CVE-2021-44833 (Go, published 2021-12-12T06:15Z)
Description: value: The CLI 1.0.0 for Amazon AWS OpenSearch has weak permissions for the configuration file.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-276 \u2014 Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
Repository: https://github.com/opensearch-project/opensearch-cli
Files changed:
commands/root.go
Commit message: Update default folder and file permission

Update folder path to 700 and file path to 600.

Signed-off-by: Vijayan Balasubramanian <balasvij@amazon.com>


Vulnerable code:
	folderPermission      = 0755 // only owner can write, while everyone can read and execute
		err := os.Mkdir(folderPath, folderPermission)

Fixed code:
	FolderPermission      = 0700 // only owner can read, write and execute
	FilePermission        = 0600 // only owner can read and write
		err := os.Mkdir(folderPath, FolderPermission)
	if err = f.Chmod(FilePermission); err != nil {
		return err
	}
CVE-2019-13389 (PHP, published 2020-03-20T19:15Z)
Description: value: RainLoop Webmail before 1.13.0 lacks XSS protection mechanisms such as xlink:href validation, the X-XSS-Protection header, and the Content-Security-Policy header.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/RainLoop/rainloop-webmail
Files changed:
rainloop/v/0.0.0/app/libraries/MailSo/Base/HtmlUtils.php
rainloop/v/0.0.0/app/libraries/RainLoop/Config/Application.php
rainloop/v/0.0.0/app/libraries/RainLoop/Service.php
rainloop/v/0.0.0/app/libraries/RainLoop/ServiceActions.php
Commit message: Improved app security


Vulnerable code:

Fixed code:
			$sLinkHref = \trim($oElement->getAttribute('xlink:href'));
			if ($sLinkHref && !\preg_match('/^(http[s]?):/i', $sLinkHref) && '//' !== \substr($sLinkHref, 0, 2))
			{
				$oElement->setAttribute('data-x-blocked-xlink-href', $sLinkHref);
				$oElement->removeAttribute('xlink:href');
			}
			
				'x_xss_protection_header'	=> array('1; mode=block'),
				
		$sXssProtectionOptionsHeader = \trim($this->oActions->Config()->Get('security', 'x_xss_protection_header', ''));
		if (0 < \strlen($sXssProtectionOptionsHeader))
		{
			@\header('X-XSS-Protection: '.$sXssProtectionOptionsHeader, true);
		}

		else
		{
			@\header('X-XSS-Protection: 1; mode=block');
		}
					@\header('Content-Security-Policy: default-src \'self\'; script-src \'none\'; style-src \'none\'; frame-src \'none\'; child-src \'none\'', true);
CVE-2023-45286 (Go, published 2023-11-28T17:15Z)
Description: value: A race condition in go-resty can result in HTTP request body disclosure across requests. This condition can be triggered by calling sync.Pool.Put with the same *bytes.Buffer more than once, when request retries are enabled and a retry occurs. The call to sync.Pool.Get will then return a bytes.Buffer that hasn't had bytes.Buffer.Reset called on it. This dirty buffer will contain the HTTP request body from an unrelated request, and go-resty will append the current HTTP request body to it, sending two bodies in one request. The sync.Pool in question is defined at package level scope, so a completely unrelated server could receive the request body.
Severity: nan (CVSS v3 base score: 5.9)
Weakness: CWE-362 \u2014 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
Repository: https://github.com/go-resty/resty
Files changed:
middleware.go
Commit message: Don't put the same bytes.Buffer into sync.Pool twice (#745)



Vulnerable code:
	releaseBuffer(r.bodyBuf)

Fixed code:
CVE-2024-27301 (Unknown, published 2024-03-14T19:15Z)
Description: value: Support App is an opensource application specialized in managing Apple devices. It's possible to abuse a vulnerability inside the postinstall installer script to make the installer execute arbitrary code as root. The cause of the vulnerability is the fact that the shebang `#!/bin/zsh` is being used. When the installer is executed it asks for the users password to be executed as root. However, it'll still be using the $HOME of the user and therefore loading the file  `$HOME/.zshenv` when the `postinstall` script is executed.
An attacker could add malicious code to `$HOME/.zshenv` and it will be executed when the app is installed. An attacker may leverage this vulnerability to escalate privilege on the system. This issue has been addressed in version 2.5.1 Rev 2. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/root3nl/SupportApp
Files changed:
Commit message: Merge pull request from GHSA-jr78-247f-rhqc

Add -no-rcs to zsh shebang

Vulnerable code:

Fixed code:
CVE-2014-9140 (C, published 2014-12-05T16:59Z)
Description: value: Buffer overflow in the ppp_hdlc function in print-ppp.c in tcpdump 4.6.2 and earlier allows remote attackers to cause a denial of service (crash) cia a crafted PPP packet.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-ppp.c
Commit message: Do bounds checking when unescaping PPP.

Clean up a const issue while we're at it.


Vulnerable code:
	u_char *b, *s, *t, c;
	b = (uint8_t *)malloc(length);
	for (s = (u_char *)p, t = b, i = length; i > 0; i--) {
			if (i > 1) {
				i--;
				c = *s++ ^ 0x20;
			} else
				continue;

Fixed code:
	u_char *b, *t, c;
	const u_char *s;
	b = (u_char *)malloc(length);
	for (s = p, t = b, i = length; i > 0 && ND_TTEST(*s); i--) {
			if (i <= 1 || !ND_TTEST(*s))
				break;
			i--;
			c = *s++ ^ 0x20;
CVE-2015-3138 (C, published 2017-09-28T01:29Z)
Description: value: print-wb.c in tcpdump before 4.7.4 allows remote attackers to cause a denial of service (segmentation fault and process crash).
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-wb.c
Commit message: whiteboard: fixup a few reversed tests (GH #446)

This is a follow-up to commit 3a3ec26.


Vulnerable code:
	if (!ND_TTEST2(cp, len)) {
	while (--n >= 0 && !ND_TTEST(*ps)) {
		for (ie = io + ps->nid; io < ie && !ND_TTEST(*io); ++io) {

Fixed code:
	if (ND_TTEST2(cp, len)) {
	while (--n >= 0 && ND_TTEST(*ps)) {
		for (ie = io + ps->nid; io < ie && ND_TTEST(*io); ++io) {
CVE-2017-12893 (Other, published 2017-09-14T06:29Z)
Description: value: The SMB/CIFS parser in tcpdump before 4.9.2 has a buffer over-read in smbutil.c:name_len().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
smbutil.c
tests/TESTLIST
tests/nbns-valgrind.out
Commit message: CVE-2017-12893/SMB/CIFS: Add a bounds check in name_len().

After we advance the pointer by the length value in the buffer, make
sure it points to something in the captured data.

This fixes a buffer over-read discovered by Forcepoint's security
researchers Otto Airamo & Antti Levomäki.

Add a test using the capture file supplied by the reporter(s).


Vulnerable code:

Fixed code:
	ND_TCHECK2(*s, 1);
# bad packets from Otto Airamo and Antti Levomäki
nbns-valgrind		nbns-valgrind.pcap		nbns-valgrind.out	-vvv -e

00:0c:85:0e:a5:ff > 00:00:0c:07:ac:f0, ethertype IPv4 (0x0800), length 92: (tos 0x0, ttl 127, id 38615, offset 0, flags [none], proto UDP (17), length 78)
    10.49.248.228.137 > 10.48.161.241.137: 
>>> NBT UDP PACKET(137): QUERY; REQUEST; UNICAST
TrnID=0x8D40
OpCode=0
NmFlags=0x10
Rcode=0
QueryCount=1
AnswerCount=0
AuthorityCount=0
AddressRecCount=0
QuestionRecords:
Name=
WARNING: Short packet. Try increasing the snap length