hitoshura25/cvefixes huggingface dataset:
CVE-2019-13223 (C, published 2019-08-15T17:15Z)
Description: value: A reachable assertion in the lookup1_values function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service by opening a crafted Ogg Vorbis file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-617 \u2014 Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Repository: https://github.com/nothings/stb
Files changed:
stb_vorbis.c
Commit message: Fix seven bugs discovered and fixed by ForAllSecure:

CVE-2019-13217: heap buffer overflow in start_decoder()
CVE-2019-13218: stack buffer overflow in compute_codewords()
CVE-2019-13219: uninitialized memory in vorbis_decode_packet_rest()
CVE-2019-13220: out-of-range read in draw_line()
CVE-2019-13221: issue with large 1D codebooks in lookup1_values()
CVE-2019-13222: unchecked NULL returned by get_window()
CVE-2019-13223: division by zero in predict_point()


Vulnerable code:
   assert(pow((float) r+1, dim) > entries);
   assert((int) floor(pow((float) r, dim)) <= entries); // (int),floor() as above
      LINE_OP(output[x], inverse_db_table[y]);
         LINE_OP(output[x], inverse_db_table[y]);
   assert(0);
            c->lookup_values = lookup1_values(c->entries, c->dimensions);

Fixed code:
//    1.17    - 2019-07-08 - fix CVE-2019-13217..CVE-2019-13223 (by ForAllSecure)
   if (pow((float) r+1, dim) <= entries)
      return -1;
   if ((int) floor(pow((float) r, dim)) > entries)
      return -1;
      LINE_OP(output[x], inverse_db_table[y&255]);
         LINE_OP(output[x], inverse_db_table[y&255]);
      if (w == NULL) return 0;
            if (current_length >= 32) return error(f, VORBIS_invalid_setup);
            int values = lookup1_values(c->entries, c->dimensions);
            if (values < 0) return error(f, VORBIS_invalid_setup);
            c->lookup_values = (uint32) values;
         for (j=0; j < g->values-1; ++j)
            if (p[j].x == p[j+1].x)
               return error(f, VORBIS_invalid_setup);
         if (m->coupling_steps > f->channels) return error(f, VORBIS_invalid_setup);
    1.17    - 2019-07-08 - fix CVE-2019-13217, -13218, -13219, -13220, -13221, -13223, -13223
                           found with Mayhem by ForAllSecure
    1.16    - 2019-03-04 - fix warnings
    1.15    - 2019-02-07 - explicit failure if Ogg Skeleton data is found
    1.14    - 2018-02-11 - delete bogus dealloca usage
    1.13    - 2018-01-29 - fix truncation of last frame (hopefully)
CVE-2021-3645 (JavaScript, published 2021-09-10T11:15Z)
Description: value: merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/viking04/merge
Files changed:
index.js
package-lock.json
test/test.js
Commit message: Fix for Prototype Pollution


Vulnerable code:
console.log(a)

Fixed code:
        //fix for prototype pollution
        if (key === "__proto__" || key === "constructor") continue;
{
  "name": "@viking04/merge",
  "version": "1.0.1",
  "lockfileVersion": 2,
  "requires": true,
  "packages": {
    "": {
      "name": "@viking04/merge",
      "version": "1.0.1",
      "license": "MIT"
    }
  }
}
console.log(a)

//Test case for prototype pollution fix
var prototype_pollution_test = JSON.parse('{"__proto__":{"polluted":true}}')
merge(a,prototype_pollution_test)
console.log({}.polluted)
CVE-2023-47625 (C++, published 2023-11-13T21:15Z)
Description: value: PX4 autopilot is a flight control solution for drones. In affected versions a global buffer overflow vulnerability exists in the CrsfParser_TryParseCrsfPacket function in /src/drivers/rc/crsf_rc/CrsfParser.cpp:298 due to the invalid size check. A malicious user may create an RC packet remotely and that packet goes into the device where the _rcs_buf reads. The global buffer overflow vulnerability will be triggered and the drone can behave unexpectedly. This issue has been addressed in version 1.14.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/PX4/PX4-Autopilot
Files changed:
src/drivers/rc/crsf_rc/CrsfParser.cpp
Commit message: fix crsf_rc: prevent potential buffer overflow for unknown packets

The length check for unknown packets did not include PACKET_SIZE_TYPE_SIZE
and CRC_SIZE, and hence working_index could overflow CRSF_MAX_PACKET_LEN,
triggering invalid memory access further down in QueueBuffer_PeekBuffer.

Also the working_segment_size was wrong for unknown packets.

Credits for finding this go to @Pwn9uin.


Vulnerable code:
				working_segment_size = packet_size + PACKET_SIZE_TYPE_SIZE;
				if (working_segment_size > CRSF_MAX_PACKET_LEN) {

Fixed code:
				working_segment_size = packet_size - PACKET_SIZE_TYPE_SIZE;
				if (working_index + working_segment_size + CRC_SIZE > CRSF_MAX_PACKET_LEN) {
CVE-2024-39904 (C++, published 2024-07-11T16:15Z)
Description: value: VNote is a note-taking platform. Prior to 3.18.1, a code execution vulnerability existed in VNote, which allowed an attacker to execute arbitrary programs on the victim's system. A crafted URI can be used in a note to perform this attack using file:/// as a link. For example, file:///C:/WINDOWS/system32/cmd.exe. This allows attackers to execute arbitrary programs by embedding a reference to a local executable file such as file:///C:/WINDOWS/system32/cmd.exe and file:///C:/WINDOWS/system32/calc.exe. This vulnerability can be exploited by creating and sharing specially crafted notes. An attacker could send a crafted note file and perform further attacks. This vulnerability is fixed in 3.18.1.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/vnotex/vnote
Files changed:
src/utils/widgetutils.cpp
Commit message: check link before open


Vulnerable code:

Fixed code:
#include <widgets/messageboxhelper.h>
#include <widgets/mainwindow.h>
    const auto scheme = p_url.scheme();
    if (scheme != "http" && scheme != "https") {
        // Prompt for user.
        int ret = MessageBoxHelper::questionYesNo(MessageBoxHelper::Warning,
                                                  MainWindow::tr("Are you sure to open link (%1)?").arg(p_url.toString()),
                                                  MainWindow::tr("Malicious link might do harm to your device."),
                                                  QString(),
                                                  nullptr);
        if (ret == QMessageBox::No) {
            return;
        }
    }
CVE-2016-5350 (C, published 2016-08-07T16:59Z)
Description: value: epan/dissectors/packet-dcerpc-spoolss.c in the SPOOLS component in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles unexpected offsets, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-399 \u2014 Resource Management Errors
Weaknesses in this category are related to improper management of system resources.
Repository: https://github.com/wireshark/wireshark
Files changed:
epan/dissectors/packet-dcerpc-spoolss.c
Commit message: SPOOLSS: Try to avoid an infinite loop.

Use tvb_reported_length_remaining in dissect_spoolss_uint16uni. Make
sure our offset always increments in dissect_spoolss_keybuffer.

Change-Id: I7017c9685bb2fa27161d80a03b8fca4ef630e793
Reviewed-on: https://code.wireshark.org/review/14687
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>


Vulnerable code:
	remaining = tvb_captured_length_remaining(tvb, offset);
	while (offset < end_offset)

Fixed code:
	remaining = tvb_reported_length_remaining(tvb, offset);
	while (offset > 0 && offset < end_offset) {
	}
CVE-2016-5351 (C, published 2016-08-07T16:59Z)
Description: value: epan/crypt/airpdcap.c in the IEEE 802.11 dissector in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles the lack of an EAPOL_RSN_KEY, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/wireshark/wireshark
Files changed:
epan/crypt/airpdcap.c
Commit message: Make sure EAPOL body is big enough for a EAPOL_RSN_KEY.

A pointer to a EAPOL_RSN_KEY is set on the packet presuming the
whole EAPOL_RSN_KEY is there.  That's not always the case for
fuzzed/malicious captures.

Bug: 11585
Change-Id: Ib94b8aceef444c7820e43b969596efdb8dbecccd
Reviewed-on: https://code.wireshark.org/review/15540
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>


Vulnerable code:
        if ((tot_len-offset-4) < bodyLength) { /* Only check if frame is long enough for eapol header, ignore tailing garbage, see bug 9065 */

Fixed code:
        if (((tot_len-offset-4) < bodyLength) || (bodyLength < sizeof(EAPOL_RSN_KEY))) { /* Only check if frame is long enough for eapol header, ignore tailing garbage, see bug 9065 */
CVE-2016-5352 (C, published 2016-08-07T16:59Z)
Description: value: epan/crypt/airpdcap.c in the IEEE 802.11 dissector in Wireshark 2.x before 2.0.4 mishandles certain length values, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/wireshark/wireshark
Files changed:
epan/crypt/airpdcap.c
Commit message: Sanity check eapol_len in AirPDcapDecryptWPABroadcastKey

Bug: 12175
Change-Id: Iaf977ba48f8668bf8095800a115ff9a3472dd893
Reviewed-on: https://code.wireshark.org/review/15326
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Tested-by: Peter Wu <peter@lekensteyn.nl>


Vulnerable code:
    if (key_bytes_len < GROUP_KEY_MIN_LEN || key_bytes_len > eapol_len - sizeof(EAPOL_RSN_KEY)) {

Fixed code:
    if ((key_bytes_len < GROUP_KEY_MIN_LEN) ||
        (eapol_len < sizeof(EAPOL_RSN_KEY)) ||
        (key_bytes_len > eapol_len - sizeof(EAPOL_RSN_KEY))) {
CVE-2016-5353 (C, published 2016-08-07T16:59Z)
Description: value: epan/dissectors/packet-umts_fp.c in the UMTS FP dissector in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles the reserved C/T value, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/wireshark/wireshark
Files changed:
epan/dissectors/packet-umts_fp.c
Commit message: UMTS_FP: fix handling reserved C/T value

The spec puts the reserved value at 0xf but our internal table has 'unknown' at
0; since all the other values seem to be offset-by-one, just take the modulus
0xf to avoid running off the end of the table.

Bug: 12191
Change-Id: I83c8fb66797bbdee52a2246fb1eea6e37cbc7eb0
Reviewed-on: https://code.wireshark.org/review/15722
Reviewed-by: Evan Huus <eapache@gmail.com>
Petri-Dish: Evan Huus <eapache@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>


Vulnerable code:
                                c_t = tvb_get_bits8(tvb, tb_bit_off/*(2+p_conv_data->num_dch_in_flow)*8*/, 4);    /* c_t = tvb_get_guint8(tvb, offset);*/
                                macinf->lchid[j+chan] = c_t+1;
                                macinf->content[j+chan] = lchId_type_table[c_t+1];    /*Base MAC content on logical channel id (Table is in packet-nbap.h)*/
                                rlcinf->mode[j+chan] = lchId_rlc_map[c_t+1];    /*Based RLC mode on logical channel id*/

Fixed code:
                                c_t = (tvb_get_bits8(tvb, tb_bit_off/*(2+p_conv_data->num_dch_in_flow)*8*/, 4) + 1) % 0xf;    /* c_t = tvb_get_guint8(tvb, offset);*/
                                macinf->lchid[j+chan] = c_t;
                                macinf->content[j+chan] = lchId_type_table[c_t];    /*Base MAC content on logical channel id (Table is in packet-nbap.h)*/
                                rlcinf->mode[j+chan] = lchId_rlc_map[c_t];    /*Based RLC mode on logical channel id*/
CVE-2016-5354 (C, published 2016-08-07T16:59Z)
Description: value: The USB subsystem in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles class types, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/wireshark/wireshark
Files changed:
epan/dissectors/packet-u3v.c
epan/dissectors/packet-usb-audio.c
epan/dissectors/packet-usb-masstorage.c
epan/dissectors/packet-usb-video.c
epan/dissectors/packet-usb.h
Commit message: Make class "type" for USB conversations.

USB dissectors can't assume that only their class type has been passed around in the conversation.  Make explicit check that class type expected matches the dissector and stop/prevent dissection if there isn't a match.

Bug: 12356
Change-Id: Ib23973a4ebd0fbb51952ffc118daf95e3389a209
Reviewed-on: https://code.wireshark.org/review/15212
Petri-Dish: Michael Mann <mmann78@netscape.net>
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Petri-Dish: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>


Vulnerable code:

    void *class_data;	/* private class/id decode data */

Fixed code:
        usb_conv_info->class_data_type = USB_CONV_U3V;
    } else if (usb_conv_info->class_data_type != USB_CONV_U3V) {
        /* Don't dissect if another USB type is in the conversation */
        return 0;
        usb_conv_info->class_data_type = USB_CONV_AUDIO;
    } else if (usb_conv_info->class_data_type != USB_CONV_AUDIO) {
        /* Don't dissect if another USB type is in the conversation */
        return 0;
        usb_conv_info->class_data_type = USB_CONV_MASS_STORAGE;
    } else if (usb_conv_info->class_data_type != USB_CONV_MASS_STORAGE) {
        /* Don't dissect if another USB type is in the conversation */
        return 0;
            usb_conv_info->class_data_type = USB_CONV_VIDEO;
        } else if (usb_conv_info->class_data_type != USB_CONV_VIDEO) {
            /* Stop dissection if another USB type is in the conversation */
            return descriptor_len;
enum usb_conv_class_data_type {USB_CONV_UNKNOWN = 0, USB_CONV_U3V, USB_CONV_AUDIO, USB_CONV_VIDEO, USB_CONV_MASS_STORAGE};

    void *class_data;           /* private class/id decode data */
    enum usb_conv_class_data_type class_data_type;
CVE-2016-5355 (C, published 2016-08-07T16:59Z)
Description: value: wiretap/toshiba.c in the Toshiba file parser in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles sscanf unsigned-integer processing, which allows remote attackers to cause a denial of service (application crash) via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/wireshark/wireshark
Files changed:
wiretap/toshiba.c
Commit message: Fix packet length handling.

Treat the packet length as unsigned - it shouldn't be negative in the
file.  If it is, that'll probably cause the sscanf to fail, so we'll
report the file as bad.

Check it against WTAP_MAX_PACKET_SIZE to make sure we don't try to
allocate a huge amount of memory, just as we do in other file readers.

Use the now-validated packet size as the length in
ws_buffer_assure_space(), so we are certain to have enough space, and
don't allocate too much space.

Bug: 12394
Change-Id: Ifa023ce70f7a2697bf151009b035a6e6cf8d5d90
Reviewed-on: https://code.wireshark.org/review/15169
Reviewed-by: Guy Harris <guy@alum.mit.edu>


Vulnerable code:
/*
 * XXX - is this the biggest packet we can get?
 */
#define TOSHIBA_MAX_PACKET_LEN	16384

	int	pkt_len, pktnum, hr, min, sec, csec;
	num_items_scanned = sscanf(line+64, "LEN=%9d", &pkt_len);
	ws_buffer_assure_space(buf, TOSHIBA_MAX_PACKET_LEN);

Fixed code:
	guint	pkt_len;
	int	pktnum, hr, min, sec, csec;
	num_items_scanned = sscanf(line+64, "LEN=%9u", &pkt_len);
	if (pkt_len > WTAP_MAX_PACKET_SIZE) {
		/*
		 * Probably a corrupt capture file; don't blow up trying
		 * to allocate space for an immensely-large packet.
		 */
		*err = WTAP_ERR_BAD_FILE;
		*err_info = g_strdup_printf("toshiba: File has %u-byte packet, bigger than maximum of %u",
		    pkt_len, WTAP_MAX_PACKET_SIZE);
		return FALSE;
	}
	ws_buffer_assure_space(buf, pkt_len);
CVE-2016-5355 (C, published 2016-08-07T16:59Z)
Description: value: wiretap/toshiba.c in the Toshiba file parser in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles sscanf unsigned-integer processing, which allows remote attackers to cause a denial of service (application crash) via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/wireshark/wireshark
Files changed:
wiretap/toshiba.c
Commit message: Don't treat the packet length as unsigned.

The scanf family of functions are as annoyingly bad at handling unsigned
numbers as strtoul() is - both of them are perfectly willing to accept a
value beginning with a negative sign as an unsigned value.  When using
strtoul(), you can compensate for this by explicitly checking for a '-'
as the first character of the string, but you can't do that with
sscanf().

So revert to having pkt_len be signed, and scanning it with %d, but
check for a negative value and fail if we see a negative value.

Bug: 12394
Change-Id: I4b19b95f2e1ffc96dac5c91bff6698c246f52007
Reviewed-on: https://code.wireshark.org/review/15230
Reviewed-by: Guy Harris <guy@alum.mit.edu>


Vulnerable code:
	guint	pkt_len;
	int	pktnum, hr, min, sec, csec;
	num_items_scanned = sscanf(line+64, "LEN=%9u", &pkt_len);

Fixed code:
	int	pkt_len, pktnum, hr, min, sec, csec;
	num_items_scanned = sscanf(line+64, "LEN=%9d", &pkt_len);
	if (pkt_len < 0) {
		*err = WTAP_ERR_BAD_FILE;
		*err_info = g_strdup("toshiba: packet header has a negative packet length");
		return FALSE;
	}
CVE-2016-5356 (C, published 2016-08-07T16:59Z)
Description: value: wiretap/cosine.c in the CoSine file parser in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles sscanf unsigned-integer processing, which allows remote attackers to cause a denial of service (application crash) via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/wireshark/wireshark
Files changed:
wiretap/cosine.c
Commit message: Don't treat the packet length as unsigned.

The scanf family of functions are as annoyingly bad at handling unsigned
numbers as strtoul() is - both of them are perfectly willing to accept a
value beginning with a negative sign as an unsigned value.  When using
strtoul(), you can compensate for this by explicitly checking for a '-'
as the first character of the string, but you can't do that with
sscanf().

So revert to having pkt_len be signed, and scanning it with %d, but
check for a negative value and fail if we see a negative value.

Bug: 12395
Change-Id: I43b458a73b0934e9a5c2c89d34eac5a8f21a7455
Reviewed-on: https://code.wireshark.org/review/15223
Reviewed-by: Guy Harris <guy@alum.mit.edu>


Vulnerable code:
	int	yy, mm, dd, hr, min, sec, csec;
	guint	pkt_len;
		   "%4d-%2d-%2d,%2d:%2d:%2d.%9d: %5s (%127[A-Za-z0-9/:]), Length:%9u, Pro:%9d, Off:%9d, Pri:%9d, RM:%9d, Err:%9d [%8x, %8x]",
		   "%5s (%127[A-Za-z0-9/:]), Length:%9u, Pro:%9d, Off:%9d, Pri:%9d, RM:%9d, Err:%9d [%8x, %8x]",

Fixed code:
	int	yy, mm, dd, hr, min, sec, csec, pkt_len;
		   "%4d-%2d-%2d,%2d:%2d:%2d.%9d: %5s (%127[A-Za-z0-9/:]), Length:%9d, Pro:%9d, Off:%9d, Pri:%9d, RM:%9d, Err:%9d [%8x, %8x]",
		   "%5s (%127[A-Za-z0-9/:]), Length:%9d, Pro:%9d, Off:%9d, Pri:%9d, RM:%9d, Err:%9d [%8x, %8x]",
	if (pkt_len < 0) {
		*err = WTAP_ERR_BAD_FILE;
		*err_info = g_strdup("cosine: packet header has a negative packet length");
		return FALSE;
	}