hitoshura25/cvefixes huggingface dataset:
CVE-2017-14164 (C, published 2017-09-06T18:29Z)
Description: value: A size-validation issue was discovered in opj_j2k_write_sot in lib/openjp2/j2k.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service (heap-based buffer overflow affecting opj_write_bytes_LE in lib/openjp2/cio.c) or possibly remote code execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-14152.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/uclouvain/openjpeg
Files changed:
src/lib/openjp2/j2k.c
Commit message: opj_j2k_write_sot(): fix potential write heap buffer overflow (#991)


Vulnerable code:
 * @param       p_data           FIXME DOC
 * @param       p_data_written   FIXME DOC
    if (! opj_j2k_write_sot(p_j2k, p_data, &l_current_nb_bytes_written, p_stream,
        if (! opj_j2k_write_sot(p_j2k, p_data, &l_current_nb_bytes_written, p_stream,
            if (! opj_j2k_write_sot(p_j2k, p_data, &l_current_nb_bytes_written, p_stream,

Fixed code:
 * @param       p_data           Output buffer
 * @param       p_total_data_size Output buffer size
 * @param       p_data_written   Number of bytes written into stream
                                  OPJ_UINT32 p_total_data_size,
                                  OPJ_UINT32 p_total_data_size,
    if (p_total_data_size < 12) {
        opj_event_msg(p_manager, EVT_ERROR,
                      "Not enough bytes in output buffer to write SOT marker\n");
        return OPJ_FALSE;
    }

    if (! opj_j2k_write_sot(p_j2k, p_data, p_total_data_size,
                            &l_current_nb_bytes_written, p_stream,
        if (! opj_j2k_write_sot(p_j2k, p_data,
                                p_total_data_size,
                                &l_current_nb_bytes_written,
                                p_stream,
            if (! opj_j2k_write_sot(p_j2k, p_data,
                                    p_total_data_size,
                                    &l_current_nb_bytes_written, p_stream,
CVE-2017-14164 (C, published 2017-09-06T18:29Z)
Description: value: A size-validation issue was discovered in opj_j2k_write_sot in lib/openjp2/j2k.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service (heap-based buffer overflow affecting opj_write_bytes_LE in lib/openjp2/cio.c) or possibly remote code execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-14152.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/uclouvain/openjpeg
Files changed:
src/lib/openjp2/j2k.c
Commit message: opj_j2k_write_sot(): fix potential write heap buffer overflow (#991)


Vulnerable code:
 * @param       p_data           FIXME DOC
 * @param       p_data_written   FIXME DOC
    if (! opj_j2k_write_sot(p_j2k, p_data, &l_current_nb_bytes_written, p_stream,
        if (! opj_j2k_write_sot(p_j2k, p_data, &l_current_nb_bytes_written, p_stream,
            if (! opj_j2k_write_sot(p_j2k, p_data, &l_current_nb_bytes_written, p_stream,

Fixed code:
 * @param       p_data           Output buffer
 * @param       p_total_data_size Output buffer size
 * @param       p_data_written   Number of bytes written into stream
                                  OPJ_UINT32 p_total_data_size,
                                  OPJ_UINT32 p_total_data_size,
    if (p_total_data_size < 12) {
        opj_event_msg(p_manager, EVT_ERROR,
                      "Not enough bytes in output buffer to write SOT marker\n");
        return OPJ_FALSE;
    }

    if (! opj_j2k_write_sot(p_j2k, p_data, p_total_data_size,
                            &l_current_nb_bytes_written, p_stream,
        if (! opj_j2k_write_sot(p_j2k, p_data,
                                p_total_data_size,
                                &l_current_nb_bytes_written,
                                p_stream,
            if (! opj_j2k_write_sot(p_j2k, p_data,
                                    p_total_data_size,
                                    &l_current_nb_bytes_written, p_stream,
CVE-2018-20847 (C, published 2019-06-26T18:15Z)
Description: value: An improper computation of p_tx0, p_tx1, p_ty0 and p_ty1 in the function opj_get_encoding_parameters in openjp2/pi.c in OpenJPEG through 2.3.0 can lead to an integer overflow.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/uclouvain/openjpeg
Files changed:
src/lib/openjp2/pi.c
src/lib/openjp2/tcd.c
Commit message: [trunk] fixed a buffer overflow in opj_tcd_init_decode_tile

Update issue 431


Vulnerable code:
	*p_tx0 = opj_int_max((OPJ_INT32)(p_cp->tx0 + p * p_cp->tdx), (OPJ_INT32)p_image->x0);
	*p_tx1 = opj_int_min((OPJ_INT32)(p_cp->tx0 + (p + 1) * p_cp->tdx), (OPJ_INT32)p_image->x1);
	*p_ty0 = opj_int_max((OPJ_INT32)(p_cp->ty0 + q * p_cp->tdy), (OPJ_INT32)p_image->y0);
	*p_ty1 = opj_int_min((OPJ_INT32)(p_cp->ty0 + (q + 1) * p_cp->tdy), (OPJ_INT32)p_image->y1);
	l_tile->x0 = opj_int_max((OPJ_INT32)(l_cp->tx0 + p * l_cp->tdx), (OPJ_INT32)l_image->x0);
	l_tile->y0 = opj_int_max((OPJ_INT32)(l_cp->ty0 + q * l_cp->tdy), (OPJ_INT32)l_image->y0);
	l_tile->x1 = opj_int_min((OPJ_INT32)(l_cp->tx0 + (p + 1) * l_cp->tdx), (OPJ_INT32)l_image->x1);
	l_tile->y1 = opj_int_min((OPJ_INT32)(l_cp->ty0 + (q + 1) * l_cp->tdy), (OPJ_INT32)l_image->y1);

Fixed code:
	*p_tx0 = (OPJ_INT32)opj_uint_max(p_cp->tx0 + p * p_cp->tdx, p_image->x0);
	*p_tx1 = (OPJ_INT32)opj_uint_min(p_cp->tx0 + (p + 1) * p_cp->tdx, p_image->x1);
	*p_ty0 = (OPJ_INT32)opj_uint_max(p_cp->ty0 + q * p_cp->tdy, p_image->y0);
	*p_ty1 = (OPJ_INT32)opj_uint_min(p_cp->ty0 + (q + 1) * p_cp->tdy, p_image->y1);
	l_tile->x0 = (OPJ_INT32)opj_uint_max(l_cp->tx0 + p * l_cp->tdx, l_image->x0);
	l_tile->y0 = (OPJ_INT32)opj_uint_max(l_cp->ty0 + q * l_cp->tdy, l_image->y0);
	l_tile->x1 = (OPJ_INT32)opj_uint_min(l_cp->tx0 + (p + 1) * l_cp->tdx, l_image->x1);
	l_tile->y1 = (OPJ_INT32)opj_uint_min(l_cp->ty0 + (q + 1) * l_cp->tdy, l_image->y1);
CVE-2018-7648 (C, published 2018-03-02T16:29Z)
Description: value: An issue was discovered in mj2/opj_mj2_extract.c in OpenJPEG 2.3.0. The output prefix was not checked for length, which could overflow a buffer, when providing a prefix with 50 or more characters on the command line.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/uclouvain/openjpeg
Files changed:
src/bin/mj2/opj_mj2_extract.c
Commit message: opj_mj2_extract: Check provided output prefix for length

This uses snprintf() with correct buffer length instead of sprintf(), which
prevents a buffer overflow when providing a long output prefix. Furthermore
the program exits with an error when the provided output prefix is too long.

Fixes #1088.


Vulnerable code:
        sprintf(outfilename, "%s_%05d.j2k", argv[2], snum);

Fixed code:
        {
            int num = snprintf(outfilename, sizeof(outfilename),
                               "%s_%05d.j2k", argv[2],
                               snum);
            if (num >= sizeof(outfilename)) {
                fprintf(stderr, "maximum length of output prefix exceeded\n");
                free(frame_codestream);
                return 1;
            }
        }

            free(frame_codestream);
CVE-2019-12973 (C, published 2019-06-26T18:15Z)
Description: value: In OpenJPEG 2.3.1, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. This issue is similar to CVE-2018-6616.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-834 \u2014 Excessive Iteration
The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
Repository: https://github.com/uclouvain/openjpeg
Files changed:
src/bin/jp2/convertbmp.c
Commit message: convertbmp: detect invalid file dimensions early

width/length dimensions read from bmp headers are not necessarily
valid. For instance they may have been maliciously set to very large
values with the intention to cause DoS (large memory allocation, stack
overflow). In these cases we want to detect the invalid size as early
as possible.

This commit introduces a counter which verifies that the number of
written bytes corresponds to the advertized width/length.

Fixes #1059 (CVE-2018-6616).


Vulnerable code:
    OPJ_UINT32 x, y;
    x = y = 0U;

Fixed code:
    OPJ_UINT32 x, y, written;
    x = y = written = 0U;
                written++;
                    written++;

    if (written != width * height) {
        fprintf(stderr, "warning, image's actual size does not match advertized one\n");
        return OPJ_FALSE;
    }
CVE-2021-34363 (Python, published 2021-06-10T11:15Z)
Description: value: The thefuck (aka The Fuck) package before 3.31 for Python allows Path Traversal that leads to arbitrary file deletion via the "undo archive operation" feature.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/nvbn/thefuck
Files changed:
thefuck/rules/dirty_untar.py
thefuck/rules/dirty_unzip.py
Commit message: NA: Fix possible changes in files outside of working directory (#1206)



Vulnerable code:

Fixed code:
            if not os.path.abspath(file).startswith(os.getcwd()):
                # it's unsafe to overwrite files outside of the current directory
                continue

            if not os.path.abspath(file).startswith(os.getcwd()):
                # it's unsafe to overwrite files outside of the current directory
                continue
CVE-2022-36084 (TypeScript, published 2022-09-08T22:15Z)
Description: value: cruddl is software for creating a GraphQL API for a database, using the GraphQL SDL to model a schema. If cruddl starting with version 1.1.0 and prior to versions 2.7.0 and 3.0.2 is used to generate a schema that uses `@flexSearchFulltext`, users of that schema may be able to inject arbitrary AQL queries that will be forwarded to and executed by ArangoDB. Schemas that do not use `@flexSearchFulltext` are not affected. The attacker needs to have `READ` permission to at least one root entity type that has `@flexSearchFulltext` enabled. The issue has been fixed in version 3.0.2 and in version 2.7.0 of cruddl. As a workaround, users can temporarily remove `@flexSearchFulltext` from their schemas.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/AEB-labs/cruddl
Files changed:
src/database/arangodb/aql-generator.ts
src/database/arangodb/arangodb-adapter.ts
Commit message: Use regular aql framework for flex search expression tokenization


Vulnerable code:
export function generateTokenizationQuery(tokensFiltered: ReadonlyArray<FlexSearchTokenizable>) {
    const fragments: string[] = [];
        fragments.push(`token_${i}: TOKENS("${value.expression}", "${value.analyzer}")`);
    const query = `RETURN { ${fragments.join(',\n')} }`;
    return query;
        const cursor = await this.db.query(generateTokenizationQuery(tokenizationsFiltered));

Fixed code:
export function generateTokenizationQuery(tokensFiltered: ReadonlyArray<FlexSearchTokenizable>): AQLFragment {
    const fragments: AQLFragment[] = [];
        fragments.push(aql`${aql.identifier('token_' + i)}: TOKENS(${value.expression}, ${value.analyzer})`);
    return aql`RETURN { ${aql.join(fragments, aql`',\n`)} }`;
        const aqlFragment = generateTokenizationQuery(tokenizationsFiltered);
        const queryCode = aqlFragment.getCode();
        const cursor = await this.db.query(queryCode.code, queryCode.boundValues);
CVE-2022-0855 (JavaScript, published 2022-03-04T19:15Z)
Description: value: Improper Resolution of Path Equivalence in GitHub repository microweber-dev/whmcs_plugin prior to 0.0.4.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-706 \u2014 Use of Incorrectly-Resolved Name or Reference
The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
Repository: https://github.com/microweber-dev/whmcs_plugin
Files changed:
modules/addons/microweber_addon/order/embed.js
Commit message: update


Vulnerable code:

Fixed code:
        var domain_check = (new URL(hash));
        domain_check = domain_check.hostname;

        if(window.location.hostname != domain_check){
            alert('You are trying to load a domain search from a different domain. Please use the same domain.');
            return;
        }
CVE-2021-41093 (Other, published 2021-10-04T19:15Z)
Description: value: Wire is an open source secure messenger. In affected versions if the an attacker gets an old but valid access token they can take over an account by changing the email. This issue has been resolved in version 3.86 which uses a new endpoint which additionally requires an authentication cookie. See wire-ios-sync-engine and wire-ios-transport references. This is the root advisory that pulls the changes together.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/wireapp/wire-ios
Files changed:
Cartfile.resolved
Commit message: Merge pull request from GHSA-6f4c-phfj-m255

* Pin components

* Bump components

Vulnerable code:
github "wireapp/wire-ios-sync-engine" "385.0.0"
github "wireapp/wire-ios-transport" "77.0.4"

Fixed code:
github "wireapp/wire-ios-sync-engine" "385.0.1"
github "wireapp/wire-ios-transport" "77.1.0"
CVE-2021-41094 (Swift, published 2021-10-04T19:15Z)
Description: value: Wire is an open source secure messenger. Users of Wire by Bund may bypass the mandatory encryption at rest feature by simply disabling their device passcode. Upon launching, the app will attempt to enable encryption at rest by generating encryption keys via the Secure Enclave, however it will fail silently if no device passcode is set. The user has no indication that encryption at rest is not active since the feature is hidden to them. This issue has been resolved in version 3.70
Severity: LOW (CVSS v3 base score: 4.6)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/wireapp/wire-ios
Files changed:
Wire-iOS/Generated/Strings+Generated.swift
Wire-iOS/Resources/Base.lproj/Localizable.strings
Wire-iOS/Sources/AppRootRouter.swift
Commit message: Merge pull request from GHSA-h4m7-pr8h-j7rf

* Show alert when logged out due to missing biometric passcode

* Update copy

* Revert strings file change

* Update copy

Vulnerable code:
            rootViewController.presentAlertWithOKButton(title: "account_deleted_session_expired_alert.title".localized,
                                                        message: "account_deleted_session_expired_alert.message".localized)

Fixed code:
    internal enum AccountDeletedMissingPasscodeAlert {
      /// In order to use Wire, please set a passcode in your device settings.
      internal static let message = L10n.tr("Localizable", "account_deleted_missing_passcode_alert.message")
      /// No Device Passcode
      internal static let title = L10n.tr("Localizable", "account_deleted_missing_passcode_alert.title")
    }
"account_deleted_missing_passcode_alert.title" = "No device passcode";
"account_deleted_missing_passcode_alert.message" = "In order to use Wire, please set a passcode in your device settings.";

            rootViewController.presentAlertWithOKButton(
                title: L10n.Localizable.AccountDeletedSessionExpiredAlert.title,
                message: L10n.Localizable.AccountDeletedSessionExpiredAlert.message)

        case .biometricPasscodeNotAvailable:
            rootViewController.presentAlertWithOKButton(
                title: L10n.Localizable.AccountDeletedMissingPasscodeAlert.title,
                message: L10n.Localizable.AccountDeletedMissingPasscodeAlert.message)
CVE-2022-31009 (Swift, published 2022-06-23T07:15Z)
Description: value: wire-ios is an iOS client for the Wire secure messaging application. Invalid accent colors of Wire communication partners may render the iOS Wire Client partially unusable by causing it to crash multiple times on launch. These invalid accent colors can be used by and sent between Wire users. The root cause was an unnecessary assert statement when converting an integer value into the corresponding enum value, causing an exception instead of a fallback to a default value. This issue is fixed in [wire-ios](https://github.com/wireapp/wire-ios/commit/caa0e27dbe51f9edfda8c7a9f017d93b8cfddefb) and in Wire for iOS 3.100. There is no workaround available, but users may use other Wire clients (such as the [web app](https://app.wire.com)) to continue using Wire, or upgrade their client.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-617 \u2014 Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Repository: https://github.com/wireapp/wire-ios
Files changed:
Wire-iOS/Sources/Helpers/ColorScheme.swift
Commit message: chore: remove unnecessary assert SQCORE-1299 (#5660)

* chore: remove unnecessary assert

* empty

Vulnerable code:

        assert(accentColor.rawValue <= ZMAccentColor.max.rawValue)


        return background.mix(UIColor(fromZMAccentColor: accentColor), amount: coefficient)

Fixed code:
import WireCommonComponents
        let accentColor = AccentColor(ZMAccentColor: accentColor) ?? .strongBlue
        return background.mix(UIColor(for: accentColor), amount: coefficient)
CVE-2024-0241 (Other, published 2024-01-04T21:15Z)
Description: value: encoded_id-rails versions before 1.0.0.beta2 are affected by an uncontrolled resource consumption vulnerability. A remote and unauthenticated attacker might cause a denial of service condition by sending an HTTP request with an extremely long "id" parameter.


Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/stevegeek/encoded_id-rails
Files changed:
encoded_id-rails.gemspec
Commit message: Update encoded_id dependency to address GHSA-3px7-jm2p-6h2c


Vulnerable code:
  spec.add_dependency "encoded_id", "~> 1.0.0.rc2"

Fixed code:
  spec.add_dependency "encoded_id", "~> 1.0.0.rc3"
CVE-2021-25994 (PHP, published 2022-01-03T07:15Z)
Description: value: In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/userfrosting/UserFrosting
Files changed:
CHANGELOG.md
app/sprinkles/core/config/production.php
Commit message: Placeholder for `site.uri.public` in production


Vulnerable code:

Fixed code:
## Unreleased

### Security
- Added placeholder URL for `site.uri.public` in configuration to guard against Host Header Injection attacks by default in production.

        'uri' => [
            'public' => 'https://example.com',
        ],
CVE-2019-25073 (Go, published 2022-12-27T22:15Z)
Description: value: Improper path sanitization in github.com/goadesign/goa before v3.0.9, v2.0.10, or v1.4.3 allow remote attackers to read files outside of the intended directory.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/goadesign/goa
Files changed:
service.go
Commit message: v1: Prevent directory path traversal in FileHandler (#2388)

* Add check for attempted path traversal.

* Re-work check for attempted path traversal.

* Fix linting errors.


Vulnerable code:

Fixed code:
		// prevent path traversal
		if attemptsPathTraversal(req.URL.Path, path) {
			return ErrNotFound(req.URL.Path)
		}
func attemptsPathTraversal(req string, path string) bool {
	if !strings.Contains(req, "..") {
		return false
	}

	currentPathIdx := 0
	if idx := strings.LastIndex(path, "/*"); idx > -1 && idx < len(path)-1 {
		req = req[idx+1:]
	}
	for _, runeValue := range strings.FieldsFunc(req, isSlashRune) {
		if runeValue == ".." {
			currentPathIdx--
			if currentPathIdx < 0 {
				return true
			}
		} else {
			currentPathIdx++
		}
	}
	return false
}

func isSlashRune(r rune) bool {
	return os.IsPathSeparator(uint8(r))
}