hitoshura25/cvefixes huggingface dataset:
CVE-2016-5357 (C, published 2016-08-07T16:59Z)
Description: value: wiretap/netscreen.c in the NetScreen file parser in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles sscanf unsigned-integer processing, which allows remote attackers to cause a denial of service (application crash) via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/wireshark/wireshark
Files changed:
wiretap/netscreen.c
Commit message: Don't treat the packet length as unsigned.

The scanf family of functions are as annoyingly bad at handling unsigned
numbers as strtoul() is - both of them are perfectly willing to accept a
value beginning with a negative sign as an unsigned value.  When using
strtoul(), you can compensate for this by explicitly checking for a '-'
as the first character of the string, but you can't do that with
sscanf().

So revert to having pkt_len be signed, and scanning it with %d, but
check for a negative value and fail if we see a negative value.

Bug: 12396
Change-Id: I54fe8f61f42c32b5ef33da633ece51bbcda8c95f
Reviewed-on: https://code.wireshark.org/review/15220
Reviewed-by: Guy Harris <guy@alum.mit.edu>


Vulnerable code:
	guint		pkt_len;
	guint		offset = 0;
	if (sscanf(line, "%9d.%9d: %15[a-z0-9/:.-](%1[io]) len=%9u:%12s->%12s/",

Fixed code:
	int		pkt_len;
	int		offset = 0;
	if (sscanf(line, "%9d.%9d: %15[a-z0-9/:.-](%1[io]) len=%9d:%12s->%12s/",
	if (pkt_len < 0) {
		*err = WTAP_ERR_BAD_FILE;
		*err_info = g_strdup("netscreen: packet header has a negative packet length");
		return FALSE;
	}
CVE-2024-24476 (C, published 2024-02-21T19:15Z)
Description: value: A buffer overflow in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the pan/addr_resolv.c, and ws_manuf_lookup_str(), size components. NOTE: this is disputed by the vendor because neither release 4.2.0 nor any other release was affected.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/wireshark/wireshark
Files changed:
epan/addr_resolv.c
epan/addr_resolv.h
epan/address_types.c
Commit message: addr_resolv: Fix a heap buffer overflow

Make sure we always pass at least 6 bytes to ws_manuf_lookup_str().

Fixes #19344.


Vulnerable code:
manuf_name_lookup(const guint8 *addr)
        manuf_value = manuf_name_lookup(addr);
get_manuf_name(const guint8 *addr)
    manuf_value = manuf_name_lookup(addr);
    return get_manuf_name(tvb_get_ptr(tvb, offset, 3));
get_manuf_name_if_known(const guint8 *addr)
    return get_manuf_name_if_known(tvb_get_ptr(tvb, offset, 3));
    manuf_value = manuf_name_lookup(addr);
extern const gchar *get_manuf_name(const guint8 *addr);
WS_DLL_PUBLIC const gchar *get_manuf_name_if_known(const guint8 *addr);
        return get_manuf_name(oui);
        return get_manuf_name(oui);

Fixed code:
manuf_name_lookup(const guint8 *addr, size_t size)
    ws_return_val_if(size < 6, NULL);

    size_t addr_size = sizeof(tp->addr);
        manuf_value = manuf_name_lookup(addr, addr_size);
get_manuf_name(const guint8 *addr, size_t size)
    manuf_value = manuf_name_lookup(addr, size);
    guint8 buf[6] = { 0 };
    tvb_memcpy(tvb, buf, offset, 3);
    return get_manuf_name(buf, sizeof(buf));
get_manuf_name_if_known(const guint8 *addr, size_t size)
    ws_return_val_if(size != 6, NULL);

    guint8 buf[6] = { 0 };
    tvb_memcpy(tvb, buf, offset, 3);
    return get_manuf_name_if_known(buf, sizeof(buf));
    manuf_value = manuf_name_lookup(addr, 8);
extern const gchar *get_manuf_name(const guint8 *addr, size_t size);
WS_DLL_PUBLIC const gchar *get_manuf_name_if_known(const guint8 *addr, size_t size);
        return get_manuf_name(oui, sizeof(oui));
        return get_manuf_name(oui, sizeof(oui));
CVE-2024-24478 (C, published 2024-02-21T17:15Z)
Description: value: An issue in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the packet-bgp.c, dissect_bgp_open(tvbuff_t*tvb, proto_tree*tree, packet_info*pinfo), optlen components. NOTE: this is disputed by the vendor because neither release 4.2.0 nor any other release was affected.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/wireshark/wireshark
Files changed:
epan/dissectors/packet-bgp.c
Commit message: BGP: Optlen must be a 16 bit integer now

The extended option length in RFC 9072 must be stored in
a 16 bit integer to avoid stepping the offset by the wrong
value due to overflow.

Fixup commit a9a62ff576ae79e0d6afb3214a5d409ec4cdf9d7


Vulnerable code:
    guint8          optlen;    /* Option Length */
          NULL, 0x0, "Optional Parameters Extension dedetected", HFILL }},
          NULL, 0x0, "Optional Parameters Extension dedetected", HFILL }},

Fixed code:
    uint16_t        optlen;    /* Option Length */
          NULL, 0x0, "Optional Parameters Extension detected", HFILL }},
          NULL, 0x0, "Optional Parameters Extension detected", HFILL }},
CVE-2016-10140 (Unknown, published 2017-01-13T09:59Z)
Description: value: Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled with ZoneMinder v1.30 and v1.29, which allows a remote unauthenticated attacker to browse all directories in the web root, e.g., a remote unauthenticated attacker can view all CCTV images on the server via the /events URI.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/ZoneMinder/ZoneMinder
Files changed:
Commit message: Merge pull request #1697 from connortechnology/apache_indexes

Apache indexes

Vulnerable code:

Fixed code:
CVE-2019-5736 (Unknown, published 2019-02-11T19:29Z)
Description: value: runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
Severity: HIGH (CVSS v3 base score: 8.6)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/opencontainers/runc
Files changed:
Commit message: merge branch 'cve-2019-5736'

  nsenter: clone /proc/self/exe to avoid exposing host binary to container

Fixes: CVE-2019-5736
LGTMs: @cyphar @crosbymichael


Vulnerable code:

Fixed code:
CVE-2021-43784 (Unknown, published 2021-12-06T18:15Z)
Description: value: runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc, netlink is used internally as a serialization system for specifying the relevant container configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte array attribute could result in the length overflowing and the attribute contents being parsed as netlink messages for container configuration. This vulnerability requires the attacker to have some control over the configuration of the container and would allow the attacker to bypass the namespace restrictions of the container by simply adding their own netlink payload which disables all namespaces. The main users impacted are those who allow untrusted images with untrusted configurations to run on their machines (such as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround, one may try disallowing untrusted namespace paths from your container. It should be noted that untrusted namespace paths would allow the attacker to disable namespace protections entirely even in the absence of this bug.
Severity: MEDIUM (CVSS v3 base score: 5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/opencontainers/runc
Files changed:
Commit message: Merge pull request from GHSA-v95c-p5hm-xq8f

runc init: avoid netlink message length overflows

Vulnerable code:

Fixed code:
CVE-2022-29162 (Unknown, published 2022-05-17T21:15Z)
Description: value: runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set. This bug has been fixed in runc 1.1.2. This fix changes `runc exec --cap` behavior such that the additional capabilities granted to the process being executed (as specified via `--cap` arguments) do not include inheritable capabilities. In addition, `runc spec` is changed to not set any inheritable capabilities in the created example OCI spec (`config.json`) file.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-276 \u2014 Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
Repository: https://github.com/opencontainers/runc
Files changed:
Commit message: Merge pull request from GHSA-f3fp-gc8g-vw66

runc: do not set inheritable capabilities

Vulnerable code:

Fixed code:
CVE-2023-25809 (Unknown, published 2023-03-29T19:15Z)
Description: value: runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or 2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected. Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`.

Severity: nan (CVSS v3 base score: 6.3)
Weakness: CWE-281 \u2014 Improper Preservation of Permissions
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
Repository: https://github.com/opencontainers/runc
Files changed:
Commit message: Merge pull request from GHSA-m8cg-xc2p-r3fc

rootless: fix /sys/fs/cgroup mounts

Vulnerable code:

Fixed code:
CVE-2024-21626 (Unknown, published 2024-01-31T22:15Z)
Description: value: runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a container escape by giving access to the host filesystem ("attack 2"). The same attack could be used by a malicious image to allow a container process to gain access to the host filesystem through runc run ("attack 1"). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries, allowing for complete container escapes ("attack 3a" and "attack 3b"). runc 1.1.12 includes patches for this issue. 
Severity: nan (CVSS v3 base score: 8.6)
Weakness: CWE-668 \u2014 Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Repository: https://github.com/opencontainers/runc
Files changed:
Commit message: Merge pull request from GHSA-xr7r-f8xq-vfvv

fix GHSA-xr7r-f8xq-vfvv and harden fd leaks

Vulnerable code:

Fixed code:
CVE-2022-24900 (Unknown, published 2022-04-29T14:15Z)
Description: value: Piano LED Visualizer is software that allows LED lights to light up as a person plays a piano connected to a computer. Version 1.3 and prior are vulnerable to a path traversal attack. The `os.path.join` call is unsafe for use with untrusted input. When the `os.path.join` call encounters an absolute path, it ignores all the parameters it has encountered till that point and starts working with the new absolute path. Since the "malicious" parameter represents an absolute path, the result of `os.path.join` ignores the static directory completely. Hence, untrusted input is passed via the `os.path.join` call to `flask.send_file` can lead to path traversal attacks. A patch with a fix is available on the `master` branch of the GitHub repository. This can also be fixed by preventing flow of untrusted data to the vulnerable `send_file` function. In case the application logic necessiates this behaviour, one can either use the `flask.safe_join` to join untrusted paths or replace `flask.send_file` calls with `flask.send_from_directory` calls.
Severity: MEDIUM (CVSS v3 base score: 8.6)
Weakness: CWE-668 \u2014 Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Repository: https://github.com/onlaj/Piano-LED-Visualizer
Files changed:
Commit message: Merge pull request #351 from porcupineyhairs/FixPathInjection

Fix Path Traversal Vulnerability

Vulnerable code:

Fixed code:
CVE-2023-46729 (TypeScript, published 2023-11-10T01:15Z)
Description: value: sentry-javascript provides Sentry SDKs for JavaScript. An unsanitized input of Next.js SDK tunnel endpoint allows sending HTTP requests to arbitrary URLs and reflecting the response back to the user. This issue only affects users who have Next.js SDK tunneling feature enabled. The problem has been fixed in version 7.77.0.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/getsentry/sentry-javascript
Files changed:
packages/nextjs/src/config/withSentryConfig.ts
Commit message: fix(nextjs): Strictly validate tunnel target parameters (#9415)



Vulnerable code:
          value: '(?<orgid>.*)',
          value: '(?<projectid>.*)',

Fixed code:
          value: '(?<orgid>[a-fA-F0-9]*)',
          value: '(?<projectid>\\d*)',
CVE-2017-7875 (C, published 2017-04-14T18:59Z)
Description: value: In wallpaper.c in feh before v2.18.3, if a malicious client pretends to be the E17 window manager, it is possible to trigger an out-of-boundary heap write while receiving an IPC message. An integer overflow leads to a buffer overflow and/or a double free.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/derf/feh
Files changed:
src/wallpaper.c
Commit message: Fix double-free/OOB-write while receiving IPC data

If a malicious client pretends to be the E17 window manager, it is
possible to trigger an out of boundary heap write while receiving an
IPC message.

The length of the already received message is stored in an unsigned
short, which overflows after receiving 64 KB of data. It's comparably
small amount of data and therefore achievable for an attacker.

When len overflows, realloc() will either be called with a small value
and therefore chars will be appended out of bounds, or len + 1 will be
exactly 0, in which case realloc() behaves like free(). This could be
abused for a later double-free attack as it's even possible to overwrite
the free information -- but this depends on the malloc implementation.

Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>


Vulnerable code:
	static unsigned short len = 0;

Fixed code:
	static size_t len = 0;
CVE-2024-24751 (Unknown, published 2024-02-13T19:15Z)
Description: value: sf_event_mgt is an event management and registration extension for the TYPO3 CMS based on ExtBase and Fluid. In affected versions the existing access control check for events in the backend module got broken during the update of the extension to TYPO3 12.4, because the `RedirectResponse` from the `$this->redirect()` function was never handled. This issue has been addressed in version 7.4.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/derhansen/sf_event_mgt
Files changed:
Commit message: Merge branch 'task/security-fix-admin-module'


Vulnerable code:

Fixed code:
CVE-2024-24751 (Unknown, published 2024-02-13T19:15Z)
Description: value: sf_event_mgt is an event management and registration extension for the TYPO3 CMS based on ExtBase and Fluid. In affected versions the existing access control check for events in the backend module got broken during the update of the extension to TYPO3 12.4, because the `RedirectResponse` from the `$this->redirect()` function was never handled. This issue has been addressed in version 7.4.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/derhansen/sf_event_mgt
Files changed:
Commit message: Merge branch 'task/security-fix-admin-module'


Vulnerable code:

Fixed code:
CVE-2021-32722 (PHP, published 2021-06-28T20:15Z)
Description: value: GlobalNewFiles is a mediawiki extension. Versions prior to 48be7adb70568e20e961ea1cb70904454a671b1d are affected by an uncontrolled resource consumption vulnerability. A large amount of page moves within a short space of time could overwhelm Database servers due to improper handling of load balancing and a lack of an appropriate index. As a workaround, one may avoid use of the extension unless additional rate limit at the MediaWiki level or via PoolCounter / MySQL is enabled. A patch is available in version 48be7adb70568e20e961ea1cb70904454a671b1d.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/miraheze/GlobalNewFiles
Files changed:
extension.json
includes/GlobalNewFilesHooks.php
Commit message: Use PageMoveComplete hook (#17)



Vulnerable code:
		"TitleMoveComplete": [
			"GlobalNewFilesHooks::onTitleMoveComplete"
	public static function onTitleMoveComplete( $title, $newTitle, $user, $oldid, $newid, $reason, $revision ) {
		if ( $title->inNamespace( NS_FILE ) ) {
				new GlobalNewFilesMoveJob( [ 'oldtitle' => $title, 'newtitle' => $newTitle ] )

Fixed code:
		"PageMoveComplete": [
			"GlobalNewFilesHooks::onPageMoveComplete"
	public static function onPageMoveComplete( $old, $new, $userIdentity, $pageid, $redirid, $reason, $revision ) {
		$oldTitle = Title::newFromLinkTarget( $old );
		$newTitle = Title::newFromLinkTarget( $new );

		if ( $oldTitle->inNamespace( NS_FILE ) ) {
				new GlobalNewFilesMoveJob( [ 'oldtitle' => $oldTitle, 'newtitle' => $newTitle ] )