hitoshura25/cvefixes huggingface dataset:
CVE-2023-33975 (C, published 2023-05-30T18:15Z)
Description: value: RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. In version 2023.01 and prior, an attacker can send a crafted frame to the device resulting in an out of bounds write in the packet buffer. The overflow can be used to corrupt other packets and the allocator metadata. Corrupting a pointer will easily lead to denial of service. While carefully manipulating the allocator metadata gives an attacker the possibility to write data to arbitrary locations and thus execute arbitrary code. This issue is fixed in pull request 19680. As a workaround, disable support for fragmented IP datagrams.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/RIOT-OS/RIOT
Files changed:
sys/net/gnrc/network_layer/sixlowpan/frag/rb/gnrc_sixlowpan_frag_rb.c
Commit message: gnrc_sixlowpan_frag_rb: fix OOB write in _rbuf_add


Vulnerable code:

Fixed code:
                    /* Check, if fragment is still small enough to fit datagram size.
                     * `offset` is 0, as this is the first fragment so it does not have to be added
                     * here. */
                    if (frag_size > entry.super->datagram_size) {
                        DEBUG_PUTS(
                           "6lo rfrag: fragment too big for resulting datagram, "
                           "discarding datagram\n"
                        );
                        gnrc_pktbuf_release(entry.rbuf->pkt);
                        gnrc_pktbuf_release(pkt);
                        gnrc_sixlowpan_frag_rb_remove(entry.rbuf);
                        return RBUF_ADD_ERROR;
                    }
CVE-2018-1152 (C, published 2018-06-18T14:29Z)
Description: value: libjpeg-turbo 1.5.90 is vulnerable to a denial of service vulnerability caused by a divide by zero when processing a crafted BMP image.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-369 \u2014 Divide By Zero
The product divides a value by zero.
Repository: https://github.com/libjpeg-turbo/libjpeg-turbo
Files changed:
ChangeLog.md
rdbmp.c
Commit message: tjLoadImage(): Fix FPE triggered by malformed BMP

In rdbmp.c, it is necessary to guard against 32-bit overflow/wraparound
when allocating the row buffer, because since BMP files have 32-bit
width and height fields, the value of biWidth can be up to 4294967295.
Specifically, if biWidth is 1073741824 and cinfo->input_components = 4,
then the samplesperrow argument in alloc_sarray() would wrap around to
0, and a division by zero error would occur at line 458 in jmemmgr.c.

If biWidth is set to a higher value, then samplesperrow would wrap
around to a small number, which would likely cause a buffer overflow
(this has not been tested or verified.)


Vulnerable code:
 * Copyright (C) 2015, 2017, D. R. Commander.

Fixed code:
4. Fixed an issue whereby a specially-crafted malformed BMP file, one in which
the header specified an image width of 1073741824 pixels, would trigger a
floating point exception (division by zero) in the `tjLoadImage()` function
when attempting to load the BMP file into a 4-component image buffer.

 * Copyright (C) 2015, 2017-2018, D. R. Commander.
  /* Ensure that biWidth * cinfo->input_components doesn't exceed the maximum
     value of the JDIMENSION type.  This is only a danger with BMP files, since
     their width and height fields are 32-bit integers. */
  if ((unsigned long long)biWidth *
      (unsigned long long)cinfo->input_components > 0xFFFFFFFFULL)
    ERREXIT(cinfo, JERR_WIDTH_OVERFLOW);
CVE-2018-14498 (C, published 2019-03-07T23:29Z)
Description: value: get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/libjpeg-turbo/libjpeg-turbo
Files changed:
ChangeLog.md
cderror.h
rdbmp.c
rdppm.c
Commit message: cjpeg: Fix OOB read caused by malformed 8-bit BMP

... in which one or more of the color indices is out of range for the
number of palette entries.

Fix partly borrowed from jpeg-9c.  This commit also adopts Guido's
JERR_PPM_OUTOFRANGE enum value in lieu of our project-specific
JERR_PPM_TOOLARGE enum value.

Fixes #258


Vulnerable code:
 * Modified 2009 by Guido Vollbeding.
JMESSAGE(JERR_PPM_TOOLARGE, "Integer value too large in PPM file")
 * Modified 2009-2010 by Guido Vollbeding.
  int maxval;
    ERREXIT(cinfo, JERR_PPM_TOOLARGE);
      ERREXIT(cinfo, JERR_PPM_TOOLARGE);
      ERREXIT(cinfo, JERR_PPM_TOOLARGE);
      ERREXIT(cinfo, JERR_PPM_TOOLARGE);
      ERREXIT(cinfo, JERR_PPM_TOOLARGE);

Fixed code:
8. Fixed out-of-bounds read in cjpeg that occurred when attempting to compress
a specially-crafted malformed color-index (8-bit-per-sample) BMP file in which
some of the samples (color indices) exceeded the bounds of the BMP file's color
table.

 * Modified 2009-2017 by Guido Vollbeding.
JMESSAGE(JERR_BMP_OUTOFRANGE, "Numeric value out of range in BMP file")
JMESSAGE(JERR_PPM_OUTOFRANGE, "Numeric value out of range in PPM file")
 * Modified 2009-2017 by Guido Vollbeding.
  int cmap_length;              /* colormap length */
  int cmaplen = source->cmap_length;
      if (t >= cmaplen)
        ERREXIT(cinfo, JERR_BMP_OUTOFRANGE);
      if (t >= cmaplen)
        ERREXIT(cinfo, JERR_BMP_OUTOFRANGE);
        if (t >= cmaplen)
          ERREXIT(cinfo, JERR_BMP_OUTOFRANGE);
        if (t >= cmaplen)
          ERREXIT(cinfo, JERR_BMP_OUTOFRANGE);
    source->cmap_length = (int)biClrUsed;
  unsigned int maxval;
    ERREXIT(cinfo, JERR_PPM_OUTOFRANGE);
      ERREXIT(cinfo, JERR_PPM_OUTOFRANGE);
      ERREXIT(cinfo, JERR_PPM_OUTOFRANGE);
      ERREXIT(cinfo, JERR_PPM_OUTOFRANGE);
      ERREXIT(cinfo, JERR_PPM_OUTOFRANGE);
CVE-2020-13790 (C, published 2020-06-03T19:15Z)
Description: value: libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/libjpeg-turbo/libjpeg-turbo
Files changed:
ChangeLog.md
rdppm.c
Commit message: rdppm.c: Fix buf overrun caused by bad binary PPM

This extends the fix in 1e81b0c3ea26f4ea8f56de05367469333de64a9f to
include binary PPM files with maximum values < 255, thus preventing a
malformed binary PPM input file with those specifications from
triggering an overrun of the rescale array and potentially crashing
cjpeg, TJBench, or any program that uses the tjLoadImage() function.

Fixes #433


Vulnerable code:
maximum value defined in the file's header.  libjpeg-turbo 1.4.2 already
included a similar fix for ASCII PPM/PGM files.  Note that these issues were
not security bugs, since they were confined to the cjpeg program and did not
affect any of the libjpeg-turbo libraries.
 * Copyright (C) 2015-2017, D. R. Commander.
                                  (size_t)(((long)maxval + 1L) *

Fixed code:
3. Fixed an issue in the PPM reader that caused a buffer overrun in cjpeg,
TJBench, or the `tjLoadImage()` function if one of the values in a binary
PPM/PGM input file exceeded the maximum value defined in the file's header and
that maximum value was less than 255.  libjpeg-turbo 1.5.0 already included a
similar fix for binary PPM/PGM files with maximum values greater than 255.

maximum value defined in the file's header and that maximum value was greater
than 255.  libjpeg-turbo 1.4.2 already included a similar fix for ASCII PPM/PGM
files.  Note that these issues were not security bugs, since they were confined
to the cjpeg program and did not affect any of the libjpeg-turbo libraries.
 * Copyright (C) 2015-2017, 2020, D. R. Commander.
                                  (size_t)(((long)MAX(maxval, 255) + 1L) *
CVE-2023-2804 (C, published 2023-05-25T22:15Z)
Description: value: A heap-based buffer overflow issue was discovered in libjpeg-turbo in h2v2_merged_upsample_internal() function of jdmrgext.c file. The vulnerability can only be exploited with 12-bit data precision for which the range of the sample data type exceeds the valid sample range, hence, an attacker could craft a 12-bit lossless JPEG image that contains out-of-range 12-bit samples. An application attempting to decompress such image using merged upsampling would lead to segmentation fault or buffer overflows, causing an application to crash.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/libjpeg-turbo/libjpeg-turbo
Files changed:
ChangeLog.md
jdlossls.c
Commit message: Lossless decomp: Range-limit 12-bit samples

12-bit is the only data precision for which the range of the sample data
type exceeds the valid sample range, so it is possible to craft a 12-bit
lossless JPEG image that contains out-of-range 12-bit samples.
Attempting to decompress such an image using color quantization or merged
upsampling (NOTE: libjpeg-turbo cannot generate YCbCr or subsampled
lossless JPEG images, but it can decompress them) caused segfaults or
buffer overruns when those algorithms attempted to use the out-of-range
sample values as array indices.  This commit modifies the lossless
decompressor so that it range-limits the output of the scaler when using
12-bit samples.

Fixes #670
Fixes #672
Fixes #673
Fixes #674
Fixes #675
Fixes #676
Fixes #677
Fixes #678
Fixes #679
Fixes #681
Fixes #683


Vulnerable code:
 * Copyright (C) 2022, D. R. Commander.

Fixed code:
2. Fixed various segfaults and buffer overruns that occurred when attempting to
decompress various specially-crafted malformed 12-bit-per-component lossless
JPEG images.  These issues were caused by out-of-range sample values that were
not range-limited before being used as array indices.  The issues were specific
to 12-bit data precision, since that is the only data precision for which the
range of the sample data type exceeds the valid sample range.

 * Copyright (C) 2022-2023, D. R. Commander.
#if BITS_IN_JSAMPLE == 12
    /* 12-bit is the only data precision for which the range of the sample data
     * type exceeds the valid sample range.  Thus, we need to range-limit the
     * samples, because other algorithms may try to use them as array indices.
     */
    *output_buf++ = (_JSAMPLE)((*diff_buf++ << cinfo->Al) & 0xFFF);
#else
#endif
#if BITS_IN_JSAMPLE == 12
    *output_buf++ = (_JSAMPLE)((*diff_buf++) & 0xFFF);
#else
#endif
CVE-2024-21907 (C#, published 2024-01-03T16:15Z)
Description: value: Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.

Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-755 \u2014 Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
Repository: https://github.com/JamesNK/Newtonsoft.Json
Files changed:
Src/Newtonsoft.Json.Tests/Serialization/JsonSerializerTest.cs
Src/Newtonsoft.Json/JsonReader.cs
Src/Newtonsoft.Json/JsonSerializer.cs
Src/Newtonsoft.Json/JsonSerializerSettings.cs
Commit message: Change JsonReader and JsonSerializer default max depth to 128 (#2462)



Vulnerable code:
        /// The default value is <c>null</c>.
        /// The default value is <c>null</c>.
            get => _maxDepth;

Fixed code:

        [Test]
        public void SetMaxDepth_DepthExceeded()
        {
            JsonTextReader reader = new JsonTextReader(new StringReader("[[['text']]]"));
            Assert.AreEqual(128, reader.MaxDepth);

            JsonSerializerSettings settings = new JsonSerializerSettings();
            Assert.AreEqual(128, settings.MaxDepth);
            Assert.AreEqual(false, settings._maxDepthSet);

            // Default should be the same
            Assert.AreEqual(reader.MaxDepth, settings.MaxDepth);

            settings.MaxDepth = 2;
            Assert.AreEqual(2, settings.MaxDepth);
            Assert.AreEqual(true, settings._maxDepthSet);

            JsonSerializer serializer = JsonSerializer.Create(settings);
            Assert.AreEqual(2, serializer.MaxDepth);

            ExceptionAssert.Throws<JsonReaderException>(
                () => serializer.Deserialize(reader),
                "The reader's MaxDepth of 2 has been exceeded. Path '[0][0]', line 1, position 3.");
        }

        [Test]
        public void SetMaxDepth_DepthNotExceeded()
        {
            JsonTextReader reader = new JsonTextReader(new StringReader("['text']"));
            JsonSerializerSettings settings = new JsonSerializerSettings();

            settings.MaxDepth = 2;

            JsonSerializer serializer = JsonSerializer.Create(settings);
            Assert.AreEqual(2, serializer.MaxDepth);

            serializer.Deserialize(reader);

            Assert.AreEqual(128, reader.MaxDepth);
        }
        /// A null value means there is no maximum. 
        /// The default value is <c>128</c>.
            _maxDepth = 128;
        /// The default value is <c>128</c>.
        internal const int DefaultMaxDepth = 128;
        /// The default value is <c>128</c>.
            get => _maxDepthSet ? _maxDepth : DefaultMaxDepth;
CVE-2021-41175 (PHP, published 2021-10-26T14:15Z)
Description: value: Pi-hole's Web interface (based on AdminLTE) provides a central location to manage one's Pi-hole and review the statistics generated by FTLDNS. Prior to version 5.8, cross-site scripting is possible when adding a client via the groups-clients management page. This issue was patched in version 5.8.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pi-hole/AdminLTE
Files changed:
scripts/pi-hole/js/groups-clients.js
scripts/pi-hole/php/groups.php
Commit message: Merge pull request from GHSA-mhr8-7rvg-8r43

* Prevent possible XSS attack vector on add_client
Update JS code to prevent possible XSS vector

Co-authored-by: Harold Kim <root@stypr.com>
Signed-off-by: Adam Warner <me@adamwarner.co.uk>

* Fix both addClient and deleteClient to prevent XSS

Signed-off-by: Harold Kim <root@stypr.com>

Co-authored-by: Harold Kim <root@stypr.com>

Vulnerable code:
  var ip = $("#select").val().trim();
  var ip = tr.find("#ip_" + id).text();

Fixed code:
  var ip = utils.escapeHtml($("#select").val().trim());
  var ip = utils.escapeHtml(tr.find("#ip_" + id).text());
            // Encode $ip variable to prevent XSS
            $ip = htmlspecialchars($ip);
CVE-2022-31029 (Unknown, published 2022-07-07T22:15Z)
Description: value: AdminLTE is a Pi-hole Dashboard for stats and configuration. In affected versions inserting code like `<script>alert("XSS")</script>` in the field marked with "Domain to look for" and hitting <kbd>enter</kbd> (or clicking on any of the buttons) will execute the script. The user must be logged in to use this vulnerability. Usually only administrators have login access to pi-hole, minimizing the risks. Users are advised to upgrade. There are no known workarounds for this issue.
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pi-hole/AdminLTE
Files changed:
Commit message: Merge pull request from GHSA-cfr5-rqm5-9vhp

Fix/ghsa-cfr5-rqm5-9vhp - Possible XSS in queryads.php

Vulnerable code:

Fixed code:
CVE-2024-1118 (PHP, published 2024-02-07T11:15Z)
Description: value: The Podlove Subscribe button plugin for WordPress is vulnerable to UNION-based SQL Injection via the 'button' attribute of the podlove-subscribe-button shortcode in all versions up to, and including, 1.3.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/podlove/podlove-subscribe-button-wp-plugin
Files changed:
model/base.php
Commit message: fix: missing escaping in sql query


Vulnerable code:
		$row = $wpdb->get_row(
			'SELECT * FROM ' . static::table_name() . ' WHERE ' . $property .  ' = \'' . $value . '\' LIMIT 0,1'
		);

Fixed code:
		$query = $wpdb->prepare('SELECT * FROM ' . static::table_name() . ' WHERE ' . $property .  ' = \'%s\' LIMIT 0,1', $value);
		$row = $wpdb->get_row($query);
CVE-2019-16930 (C++, published 2019-09-28T22:15Z)
Description: value: Zcashd in Zcash before 2.0.7-3 allows discovery of the IP address of a full node that owns a shielded address, related to mishandling of exceptions during deserialization of note plaintexts. This affects anyone who has disclosed their zaddr to a third party.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-755 \u2014 Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
Repository: https://github.com/zcash/zcash
Files changed:
src/zcash/Note.cpp
Commit message: Ignore exceptions when deserializing note plaintexts


Vulnerable code:
    CDataStream ss(SER_NETWORK, PROTOCOL_VERSION);
    ss << pt.get();
    SaplingOutgoingPlaintext ret;
    ss >> ret;
    assert(ss.size() == 0);
    return ret;
    CDataStream ss(SER_NETWORK, PROTOCOL_VERSION);
    ss << pt.get();

    ss >> ret;

    assert(ss.size() == 0);
    CDataStream ss(SER_NETWORK, PROTOCOL_VERSION);
    ss << pt.get();

    ss >> ret;
    assert(ss.size() == 0);


Fixed code:
    try {
        CDataStream ss(SER_NETWORK, PROTOCOL_VERSION);
        ss << pt.get();
        SaplingOutgoingPlaintext ret;
        ss >> ret;
        assert(ss.size() == 0);
        return ret;
    } catch (const boost::thread_interrupted&) {
        throw;
    } catch (...) {
        return boost::none;
    }
    try {
        CDataStream ss(SER_NETWORK, PROTOCOL_VERSION);
        ss << pt.get();
        ss >> ret;
        assert(ss.size() == 0);
    } catch (const boost::thread_interrupted&) {
        throw;
    } catch (...) {
        return boost::none;
    }
    try {
        CDataStream ss(SER_NETWORK, PROTOCOL_VERSION);
        ss << pt.get();
        ss >> ret;
        assert(ss.size() == 0);
    } catch (const boost::thread_interrupted&) {
        throw;
    } catch (...) {
        return boost::none;
    }
CVE-2019-15119 (Go, published 2019-08-16T15:15Z)
Description: value: lib/install/install.go in cnlh nps through 0.23.2 uses 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps, leading to a file overwrite by a local user.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-732 \u2014 Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Repository: https://github.com/cnlh/nps
Files changed:
lib/install/install.go
Commit message: Change to 755, fixes #176


Vulnerable code:
				os.Chmod("/usr/local/bin/nps", 0777)
			os.Chmod("/usr/bin/nps", 0777)

Fixed code:
				os.Chmod("/usr/local/bin/nps", 0755)
			os.Chmod("/usr/bin/nps", 0755)
CVE-2020-5227 (Unknown, published 2020-01-28T23:15Z)
Description: value: Feedgen (python feedgen) before 0.9.0 is susceptible to XML Denial of Service attacks. The *feedgen* library allows supplying XML as content for some of the available fields. This XML will be parsed and integrated into the existing XML tree. During this process, feedgen is vulnerable to XML Denial of Service Attacks (e.g. XML Bomb). This becomes a concern in particular if feedgen is used to include content from untrused sources and if XML (including XHTML) is directly included instead of providing plain tex content only. This problem has been fixed in feedgen 0.9.0 which disallows XML entity expansion and external resources.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-776 \u2014 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
Repository: https://github.com/lkiesow/python-feedgen
Files changed:
Commit message: Merge pull request from GHSA-g8q7-xv52-hf9f

Prevent XML Denial of Service Attacks

Vulnerable code:

Fixed code: