hitoshura25/cvefixes huggingface dataset:
CVE-2014-125070 (Python, published 2023-01-08T18:15Z)
Description: value: A vulnerability has been found in yanheven console and classified as problematic. Affected by this vulnerability is the function get_zone_hosts/AvailabilityZonesTable of the file openstack_dashboard/dashboards/admin/aggregates/tables.py. The manipulation leads to cross site scripting. The attack can be launched remotely. The patch is named ba908ae88d5925f4f6783eb234cc4ea95017472b. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217651.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/yanheven/console
Files changed:
openstack_dashboard/dashboards/admin/aggregates/tables.py
Commit message: Fix XSS issue with the unordered_list filter

When using the unordered_list filter in a Horizon table (as opposed to
a template directly), autoescaping is not set by default and the input
wasn't sanitised.

Closes-Bug: #1349491
Change-Id: Id82eefe48ccb17a158751ec65d24f3ac779380ec


Vulnerable code:
                          filters=(filters.unordered_list,))
                             filters=(filters.unordered_list,))
                          filters=(filters.unordered_list,))

Fixed code:
def safe_unordered_list(value):
    return filters.unordered_list(value, autoescape=True)


                          filters=(safe_unordered_list,))
                             filters=(safe_unordered_list,))
                          filters=(safe_unordered_list,))
CVE-2011-2161 (C, published 2011-05-20T22:55Z)
Description: value: The ape_read_header function in ape.c in libavformat in FFmpeg before 0.5.4, as used in MPlayer, VideoLAN VLC media player, and other products, allows remote attackers to cause a denial of service (application crash) via an APE (aka Monkey's Audio) file that contains a header but no frames.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-399 \u2014 Resource Management Errors
Weaknesses in this category are related to improper management of system resources.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavformat/ape.c
Commit message: Do not attempt to decode APE file with no frames

This fixes invalid reads/writes with this sample:
http://packetstorm.linuxsecurity.com/1103-exploits/vlc105-dos.txt


Vulnerable code:

Fixed code:
    if(!ape->totalframes){
        av_log(s, AV_LOG_ERROR, "No frames in the file!\n");
        return AVERROR(EINVAL);
    }
CVE-2013-4263 (C, published 2013-11-23T17:55Z)
Description: value: libavfilter in FFmpeg before 2.0.1 has unspecified impact and remote vectors related to a crafted "plane," which triggers an out-of-bounds heap write.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavfilter/vf_boxblur.c
libavfilter/vf_delogo.c
libavfilter/vf_fieldmatch.c
libavfilter/vf_fieldorder.c
libavfilter/vf_gradfun.c
libavfilter/vf_hflip.c
libavfilter/vf_kerndeint.c
libavfilter/vf_lut.c
libavfilter/vf_pad.c
libavfilter/vf_showinfo.c
libavfilter/vf_vignette.c
Commit message: avfilter: fix plane validity checks

Fixes out of array accesses

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>


Vulnerable code:
    for (plane = 0; in->data[plane] && plane < 4; plane++)
    for (plane = 0; in->data[plane] && plane < 4; plane++)
    for (plane = 0; plane < 4 && in->data[plane]; plane++) {
    for (plane = 0; plane < 4 && src->data[plane]; plane++)
    for (plane = 0; plane < 4 && frame->data[plane]; plane++) {
    for (p = 0; p < 4 && in->data[p]; p++) {
    for (plane = 0; plane < 4 && in->data[plane]; plane++) {
    for (plane = 0; inpic->data[plane] && plane < 4; plane++) {
        for (plane = 0; plane < 4 && in->data[plane]; plane++) {
    for (plane = 0; plane < 4 && frame->data[plane]; plane++) {
        for (i = 0; i < 4 && out->data[i]; i++) {
    for (plane = 0; plane < 4 && frame->data[plane]; plane++) {
    for (plane = 1; plane < 4 && frame->data[plane]; plane++)
        for (plane = 0; plane < 4 && in->data[plane]; plane++) {

Fixed code:
    for (plane = 0; plane < 4 && in->data[plane] && in->linesize[plane]; plane++)
    for (plane = 0; plane < 4 && in->data[plane] && in->linesize[plane]; plane++)
    for (plane = 0; plane < 4 && in->data[plane] && in->linesize[plane]; plane++) {
    for (plane = 0; plane < 4 && src->data[plane] && src->linesize[plane]; plane++)
    for (plane = 0; plane < 4 && frame->data[plane] && frame->linesize[plane]; plane++) {
    for (p = 0; p < 4 && in->data[p] && in->linesize[p]; p++) {
    for (plane = 0; plane < 4 && in->data[plane] && in->linesize[plane]; plane++) {
    for (plane = 0; plane < 4 && inpic->data[plane] && inpic->linesize[plane]; plane++) {
        for (plane = 0; plane < 4 && in->data[plane] && in->linesize[plane]; plane++) {
    for (plane = 0; plane < 4 && frame->data[plane] && frame->linesize[plane]; plane++) {
        for (i = 0; i < 4 && out->data[i] && out->linesize[i]; i++) {
    for (plane = 0; plane < 4 && frame->data[plane] && frame->linesize[plane]; plane++) {
    for (plane = 1; plane < 4 && frame->data[plane] && frame->linesize[plane]; plane++)
        for (plane = 0; plane < 4 && in->data[plane] && in->linesize[plane]; plane++) {
CVE-2013-4264 (C, published 2013-11-23T17:55Z)
Description: value: The kempf_decode_tile function in libavcodec/g2meet.c in FFmpeg before 2.0.1 allows remote attackers to cause a denial of service (out-of-bounds heap write) via a G2M4 encoded file.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/g2meet.c
Commit message: avcodec/g2meet: fix src pointer checks in kempf_decode_tile()

Fixes Ticket2842

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>


Vulnerable code:
    if (src_end - src < zsize)

Fixed code:
    if (src_end - src < zsize + (sub_type != 2))
                if (src >= src_end)
                    return AVERROR_INVALIDDATA;
CVE-2013-4265 (C, published 2013-11-23T17:55Z)
Description: value: The av_reallocp_array function in libavutil/mem.c in FFmpeg before 2.0.1 has an unspecified impact and remote vectors related to a "wrong return code" and a resultant NULL pointer dereference.
Severity: HIGH (CVSS v3 base score: )
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavutil/mem.c
Commit message: avutil/mem: Fix flipped condition

Fixes return code and later null pointer dereference

Found-by: Laurent Butti <laurentb@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>


Vulnerable code:
    if (!*ptrptr && !(nmemb && size))

Fixed code:
    if (!*ptrptr && nmemb && size)
CVE-2013-7008 (C, published 2013-12-09T16:36Z)
Description: value: The decode_slice_header function in libavcodec/h264.c in FFmpeg before 2.1 incorrectly relies on a certain droppable field, which allows remote attackers to cause a denial of service (deadlock) or possibly have unspecified other impact via crafted H.264 data.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/h264.c
Commit message: avcodec/h264: do not trust last_pic_droppable when marking pictures as done

This simplifies the code and fixes a deadlock

Fixes Ticket2927
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>


Vulnerable code:
            if (!last_pic_droppable && h0->cur_pic_ptr->tf.owner == h0->avctx) {
                if (!last_pic_droppable && last_pic_structure != PICT_FRAME) {
                    if (!last_pic_droppable && last_pic_structure != PICT_FRAME) {

Fixed code:
            if (h0->cur_pic_ptr->tf.owner == h0->avctx) {
                if (last_pic_structure != PICT_FRAME) {
                    if (last_pic_structure != PICT_FRAME) {
CVE-2013-7009 (C, published 2013-12-09T16:36Z)
Description: value: The rpza_decode_stream function in libavcodec/rpza.c in FFmpeg before 2.1 does not properly maintain a pointer to pixel data, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Apple RPZA data.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/rpza.c
Commit message: avcodec/rpza: Perform pointer advance and checks before using the pointers

Fixes out of array accesses
Fixes Ticket2850

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>


Vulnerable code:
    int pixel_ptr = 0;
                ADVANCE_BLOCK();
                ADVANCE_BLOCK();
            ADVANCE_BLOCK();

Fixed code:
    int pixel_ptr = -4;
                ADVANCE_BLOCK()
                ADVANCE_BLOCK();
            ADVANCE_BLOCK();
CVE-2013-7010 (C, published 2013-12-09T16:36Z)
Description: value: Multiple integer signedness errors in libavcodec/dsputil.c in FFmpeg before 2.1 allow remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted data.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-189 \u2014 Numeric Errors
Weaknesses in this category are related to improper calculation or conversion of numbers.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/dsputil.c
Commit message: avcodec/dsputil: fix signedness in sizeof() comparissions

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>


Vulnerable code:
    for(i=0; i<=w-sizeof(long); i+=sizeof(long)){
    for(i=0; i<=w-sizeof(long); i+=sizeof(long)){

Fixed code:
    for(i=0; i<=w-(int)sizeof(long); i+=sizeof(long)){
    for(i=0; i<=w-(int)sizeof(long); i+=sizeof(long)){
CVE-2013-7011 (C, published 2013-12-09T16:36Z)
Description: value: The read_header function in libavcodec/ffv1dec.c in FFmpeg before 2.1 does not prevent changes to global parameters, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted FFV1 data.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/ffv1dec.c
Commit message: ffv1dec: check that global parameters dont change in version 0/1

Such changes are not allowed nor supported

Fixes Ticket2906

Found-by: ami_stuff
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>


Vulnerable code:
        f->chroma_planes  = get_rac(c, state);
        f->chroma_h_shift = get_symbol(c, state, 0);
        f->chroma_v_shift = get_symbol(c, state, 0);
        f->transparency   = get_rac(c, state);

Fixed code:
        int chroma_planes, chroma_h_shift, chroma_v_shift, transparency;
        chroma_planes  = get_rac(c, state);
        chroma_h_shift = get_symbol(c, state, 0);
        chroma_v_shift = get_symbol(c, state, 0);
        transparency   = get_rac(c, state);

        if (f->plane_count) {
            if (   chroma_planes != f->chroma_planes
                || chroma_h_shift!= f->chroma_h_shift
                || chroma_v_shift!= f->chroma_v_shift
                || transparency  != f->transparency) {
                av_log(f->avctx, AV_LOG_ERROR, "Invalid change of global parameters\n");
                return AVERROR_INVALIDDATA;
            }
        }

        f->chroma_planes  = chroma_planes;
        f->chroma_h_shift = chroma_h_shift;
        f->chroma_v_shift = chroma_v_shift;
        f->transparency   = transparency;
CVE-2013-7012 (C, published 2013-12-09T16:36Z)
Description: value: The get_siz function in libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not prevent attempts to use non-zero image offsets, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG2000 data.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/jpeg2000dec.c
Commit message: avcodec/jpeg2000dec: non zero image offsets are not supported

Fixes out of array accesses
Fixes Ticket3080
Found-by: ami_stuff
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>


Vulnerable code:

Fixed code:
    if (s->image_offset_x || s->image_offset_y) {
        avpriv_request_sample(s->avctx, "Support for image offsets");
        return AVERROR_PATCHWELCOME;
    }
CVE-2013-7013 (C, published 2013-12-09T16:36Z)
Description: value: The g2m_init_buffers function in libavcodec/g2meet.c in FFmpeg before 2.1 uses an incorrect ordering of arithmetic operations, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Go2Webinar data.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-189 \u2014 Numeric Errors
Weaknesses in this category are related to improper calculation or conversion of numbers.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/g2meet.c
Commit message: avcodec/g2meet: Fix order of align and pixel size multiplication.

Fixes out of array accesses
Fixes Ticket2922

Found-by: ami_stuff
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>


Vulnerable code:
        c->tile_stride = FFALIGN(c->tile_width * 3, 16);

Fixed code:
        c->tile_stride = FFALIGN(c->tile_width, 16) * 3;
CVE-2013-7014 (C, published 2013-12-09T16:36Z)
Description: value: Integer signedness error in the add_bytes_l2_c function in libavcodec/pngdsp.c in FFmpeg before 2.1 allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted PNG data.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-189 \u2014 Numeric Errors
Weaknesses in this category are related to improper calculation or conversion of numbers.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/pngdsp.c
Commit message: avcodec/pngdsp: fix (un)signed type in end comparission

Fixes out of array accesses
Fixes Ticket2919

Found_by: ami_stuff
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>


Vulnerable code:
    for (i = 0; i <= w - sizeof(long); i += sizeof(long)) {

Fixed code:
    for (i = 0; i <= w - (int)sizeof(long); i += sizeof(long)) {
CVE-2013-7015 (C, published 2013-12-09T16:36Z)
Description: value: The flashsv_decode_frame function in libavcodec/flashsv.c in FFmpeg before 2.1 does not properly validate a certain height value, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Flash Screen Video data.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/flashsv.c
Commit message: avcodec/flashsv: check diff_start/height

Fixes out of array accesses
Fixes Ticket2844

Found-by: ami_stuff
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>


Vulnerable code:

Fixed code:
                    if (s->diff_start + s->diff_height > cur_blk_height) {
                        av_log(avctx, AV_LOG_ERROR, "Block parameters invalid\n");
                        return AVERROR_INVALIDDATA;
                    }
CVE-2013-7016 (C, published 2013-12-09T16:36Z)
Description: value: The get_siz function in libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not ensure the expected sample separation, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG2000 data.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/jpeg2000dec.c
Commit message: avcodec/jpeg2000dec: Check cdx/y values more carefully

Some invalid values where not handled correctly in the later pixel
format matching code.
Fixes out of array accesses
Fixes Ticket2848

Found-by: Piotr Bandurski <ami_stuff@o2.pl>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>


Vulnerable code:
        if (!s->cdx[i] || !s->cdy[i]) {

Fixed code:
        if (   !s->cdx[i] || s->cdx[i] == 3 || s->cdx[i] > 4
            || !s->cdy[i] || s->cdy[i] == 3 || s->cdy[i] > 4) {
CVE-2013-7017 (C, published 2013-12-09T16:36Z)
Description: value: libavcodec/jpeg2000.c in FFmpeg before 2.1 allows remote attackers to cause a denial of service (invalid pointer dereference) or possibly have unspecified other impact via crafted JPEG2000 data.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/jpeg2000.c
Commit message: jpeg2000: fix dereferencing invalid pointers

Found-by: Laurent Butti <laurentb@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>


Vulnerable code:
        reslevel->band = av_malloc_array(reslevel->nbands, sizeof(*reslevel->band));
            band->prec = av_malloc_array(reslevel->num_precincts_x *
                Jpeg2000Prec *prec = band->prec + precno;
                av_freep(&prec->zerobits);
                av_freep(&prec->cblkincl);
                av_freep(&prec->cblk);

Fixed code:
        reslevel->band = av_calloc(reslevel->nbands, sizeof(*reslevel->band));
            band->prec = av_calloc(reslevel->num_precincts_x *
                if (band->prec) {
                    Jpeg2000Prec *prec = band->prec + precno;
                    av_freep(&prec->zerobits);
                    av_freep(&prec->cblkincl);
                    av_freep(&prec->cblk);
                }
CVE-2013-7018 (C, published 2013-12-09T16:36Z)
Description: value: libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not ensure the use of valid code-block dimension values, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG2000 data.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/jpeg2000dec.c
Commit message: jpeg2000: check log2_cblk dimensions

Fixes out of array access
Fixes Ticket2895

Found-by: Piotr Bandurski <ami_stuff@o2.pl>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>


Vulnerable code:

Fixed code:
    if (c->log2_cblk_width > 6 || c->log2_cblk_height > 6) {
        avpriv_request_sample(s->avctx, "cblk size > 64");
        return AVERROR_PATCHWELCOME;
    }

    av_assert0(width  <= JPEG2000_MAX_CBLKW);
    av_assert0(height <= JPEG2000_MAX_CBLKH);
CVE-2013-7019 (C, published 2013-12-09T16:36Z)
Description: value: The get_cox function in libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not properly validate the reduction factor, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG2000 data.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/jpeg2000dec.c
Commit message: avcodec/jpeg2000dec: fix context consistency with too large lowres

Fixes out of array accesses
Fixes Ticket2898

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>


Vulnerable code:
    if (c->nreslevels < s->reduction_factor)
        c->nreslevels2decode = 1;
    else
        c->nreslevels2decode = c->nreslevels - s->reduction_factor;

Fixed code:
    if (c->nreslevels <= s->reduction_factor) {
        /* we are forced to update reduction_factor as its requested value is
           not compatible with this bitstream, and as we might have used it
           already in setup earlier we have to fail this frame until
           reinitialization is implemented */
        av_log(s->avctx, AV_LOG_ERROR, "reduction_factor too large for this bitstream, max is %d\n", c->nreslevels - 1);
        s->reduction_factor = c->nreslevels - 1;
        return AVERROR(EINVAL);
    }

    c->nreslevels2decode = c->nreslevels - s->reduction_factor;