hitoshura25/cvefixes huggingface dataset:
CVE-2022-32201 (C++, published 2022-06-02T14:16Z)
Description: value: In libjpeg 1.63, there is a NULL pointer dereference in Component::SubXOf in component.hpp.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/thorfdbg/libjpeg
Files changed:
codestream/entropyparser.cpp
marker/scan.cpp
Commit message: Added a check whether all components in a scan are actually present.


Vulnerable code:
** $Id: entropyparser.cpp,v 1.24 2021/09/08 10:30:06 thor Exp $
  // The residual scan uses all components here, not just for, but
** $Id: scan.cpp,v 1.117 2021/11/15 07:39:43 thor Exp $

Fixed code:
** $Id: entropyparser.cpp,v 1.25 2022/05/30 14:05:58 thor Exp $
  // The residual scan uses all components here, not just four, but
** $Id: scan.cpp,v 1.118 2022/05/30 14:06:11 thor Exp $
  // Check whether all components are there.
  for(UBYTE i = 0;i < m_ucCount && i < 4;i++) {
    if (ComponentOf(i) == NULL) {
      JPG_THROW(MALFORMED_STREAM,"Scan::CreateParser",
                "found a component ID in a scan that does not exist");
    }
  }
  //
CVE-2022-32202 (C++, published 2022-06-02T14:16Z)
Description: value: In libjpeg 1.63, there is a NULL pointer dereference in LineBuffer::FetchRegion in linebuffer.cpp.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/thorfdbg/libjpeg
Files changed:
control/linebitmaprequester.cpp
Commit message: Fixed a NULL-pointer access in the line-based reconstruction process
in case no valid scan was found and no data is present.


Vulnerable code:
** $Id: linebitmaprequester.cpp,v 1.36 2021/07/22 13:18:36 thor Exp $
            FetchRegion(x,*m_pppImage[i],dst);

Fixed code:
** $Id: linebitmaprequester.cpp,v 1.37 2022/05/31 10:16:52 thor Exp $
            if (*m_pppImage[i]) {
              FetchRegion(x,*m_pppImage[i],dst);
            } else {
              memset(dst,0,sizeof(LONG) * 64);
            }
CVE-2022-32978 (C++, published 2022-06-10T15:15Z)
Description: value: There is an assertion failure in SingleComponentLSScan::ParseMCU in singlecomponentlsscan.cpp in libjpeg before 1.64 via an empty JPEG-LS scan.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-617 \u2014 Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Repository: https://github.com/thorfdbg/libjpeg
Files changed:
README
codestream/sampleinterleavedlsscan.cpp
codestream/singlecomponentlsscan.cpp
Commit message: Fixed handling of empty JPEG-LS scans.


Vulnerable code:
Standard JPEG compression, with 422 subsampling:
** $Id: sampleinterleavedlsscan.cpp,v 1.15 2014/11/14 15:41:32 thor Exp $
  assert(lines > 0);
** $Id: singlecomponentlsscan.cpp,v 1.18 2014/11/14 15:41:32 thor Exp $
  
  assert(lines > 0);

Fixed code:
Standard JPEG compression, with 420 subsampling:
** $Id: sampleinterleavedlsscan.cpp,v 1.16 2022/06/08 10:54:55 thor Exp $

  if (lines == 0)
    return false;
  
** $Id: singlecomponentlsscan.cpp,v 1.19 2022/06/08 10:54:55 thor Exp $

  if (lines == 0)
    return false;
CVE-2017-5847 (C, published 2017-02-09T15:59Z)
Description: value: The gst_asf_demux_process_ext_content_desc function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving extended content descriptors.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/GStreamer/gst-plugins-ugly
Files changed:
gst/asfdemux/gstasfdemux.c
Commit message: asfdemux: Check that we have enough data available before parsing bool/uint extended content descriptors

https://bugzilla.gnome.org/show_bug.cgi?id=777955


Vulnerable code:
          guint uint_val = GST_READ_UINT32_LE (value);
          gboolean bool_val = GST_READ_UINT32_LE (value);

Fixed code:
          guint uint_val;

          if (value_len < 4)
            break;

          uint_val = GST_READ_UINT32_LE (value);
          gboolean bool_val;

          if (value_len < 4)
            break;

          bool_val = GST_READ_UINT32_LE (value);
CVE-2013-4558 (C, published 2013-12-07T20:55Z)
Description: value: The get_parent_resource function in repos.c in mod_dav_svn Apache HTTPD server module in Subversion 1.7.11 through 1.7.13 and 1.8.1 through 1.8.4, when built with assertions enabled and SVNAutoversioning is enabled, allows remote attackers to cause a denial of service (assertion failure and Apache process abort) via a non-canonical URL in a request, as demonstrated using a trailing /.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/apache/subversion
Files changed:
subversion/mod_dav_svn/repos.c
Commit message: * subversion/mod_dav_svn/mod_dav_svn.c:
  (get_parent_resource): Use canonical form of path.

Fixes CVE-2013-4558, see our advisory at:
http://subversion.apache.org/security/CVE-2013-4558-advisory.txt


git-svn-id: https://svn.apache.org/repos/asf/subversion/trunk@1542071 13f79535-47bb-0310-9956-ffa450edef68


Vulnerable code:
        svn_stringbuf_create(get_parent_path(resource->info->uri_path->data,
                                             TRUE, resource->pool),
                             resource->pool);

Fixed code:
        svn_stringbuf_create(
               get_parent_path(
                   svn_urlpath__canonicalize(resource->info->uri_path->data,
                                            resource->pool),
                   TRUE, resource->pool),
               resource->pool);
CVE-2018-10017 (C++, published 2018-04-11T05:29Z)
Description: value: soundlib/Snd_fx.cpp in OpenMPT before 1.27.07.00 and libopenmpt before 0.3.8 allows remote attackers to cause a denial of service (out-of-bounds read) via an IT or MO3 file with many nested pattern loops.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/OpenMPT/openmpt
Files changed:
soundlib/Snd_fx.cpp
Commit message: [Fix] Possible out-of-bounds read when computing length of some IT files with pattern loops (OpenMPT: formats that are converted to IT, libopenmpt: IT/ITP/MO3), caught with afl-fuzz.

git-svn-id: https://source.openmpt.org/svn/openmpt/trunk/OpenMPT@10027 56274372-70c3-4bfc-bfc3-4c3a0b034d27


Vulnerable code:
				for(CHANNELINDEX nChn = 0; nChn < GetNumChannels(); nChn++)

Fixed code:
				pChn = playState.Chn;
				for(CHANNELINDEX nChn = 0; nChn < GetNumChannels(); nChn++, pChn++)
CVE-2019-17113 (C, published 2019-10-04T00:15Z)
Description: value: In libopenmpt before 0.3.19 and 0.4.x before 0.4.9, ModPlug_InstrumentName and ModPlug_SampleName in libopenmpt_modplug.c do not restrict the lengths of libmodplug output-buffer strings in the C API, leading to a buffer overflow.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/OpenMPT/openmpt
Files changed:
libopenmpt/libopenmpt_modplug.c
Commit message: [Fix] libmodplug: C API: Limit the length of strings copied to the output buffer of ModPlug_InstrumentName() and ModPlug_SampleName() to 32 bytes (including terminating null) as is done by original libmodplug. This avoids potential buffer overflows in software relying on this limit instead of querying the required buffer size beforehand. libopenmpt can return strings longer than 32 bytes here beacuse the internal limit of 32 bytes applies to strings encoded in arbitrary character encodings but the API returns them converted to UTF-8, which can be longer. (reported by Antonio Morales Maldonado of Semmle Security Research Team)

git-svn-id: https://source.openmpt.org/svn/openmpt/trunk/OpenMPT@12127 56274372-70c3-4bfc-bfc3-4c3a0b034d27


Vulnerable code:
	unsigned int retval;
	size_t tmpretval;
	if(!str){
		if(buff){
			*buff = '\0';
		}
		return 0;
	}
	tmpretval = strlen(str);
	if(tmpretval>=INT_MAX){
		tmpretval = INT_MAX-1;
	retval = (int)tmpretval;
		memcpy(buff,str,retval+1);
		buff[retval] = '\0';
	openmpt_free_string(str);
	return retval;
	unsigned int retval;
	size_t tmpretval;
	if(!str){
		if(buff){
			*buff = '\0';
		}
		return 0;
	}
	tmpretval = strlen(str);
	if(tmpretval>=INT_MAX){
		tmpretval = INT_MAX-1;
	retval = (int)tmpretval;
		memcpy(buff,str,retval+1);
		buff[retval] = '\0';
	openmpt_free_string(str);
	return retval;

Fixed code:
	char buf[32];
	memset(buf,0,32);
	if(str){
		strncpy(buf,str,31);
		openmpt_free_string(str);
		strncpy(buff,buf,32);
	return (unsigned int)strlen(buf);
	char buf[32];
	memset(buf,0,32);
	if(str){
		strncpy(buf,str,31);
		openmpt_free_string(str);
		strncpy(buff,buf,32);
	return (unsigned int)strlen(buf);
CVE-2024-30252 (JSON, published 2024-04-04T19:15Z)
Description: value: Livemarks is a browser extension that provides RSS feed bookmark folders. Versions of Livemarks prior to 3.7 are vulnerable to cross-site request forgery. A malicious website may be able to coerce the extension to send an authenticated GET request to an arbitrary URL. An authenticated request is a request where the cookies of the browser are sent along with the request. The `subscribe.js` script uses the first parameter from the current URL location as the URL of the RSS feed to subscribe to and checks that the RSS feed is valid XML. `subscribe.js` is accessible by an attacker website due to its use in `subscribe.html`, an HTML page that is declared as a `web_accessible_resource` in `manifest.json`. This issue may lead to `Privilege Escalation`. A CSRF breaks the integrity of servers running on a private network. A user of the browser extension may have a private server with dangerous functionality, which is assumed to be safe due to network segmentation. Upon receiving an authenticated request instantiated from an attacker, this integrity is broken. Version 3.7 fixes this issue by removing subscribe.html from `web_accessible_resources`.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/nt1m/livemarks
Files changed:
manifest.json
Commit message: Remove unnecessary web_accessible_resources

This issue was discovered and reported by GHSL team member @Kwstubbs (Kevin Stubbings).


Vulnerable code:
  "web_accessible_resources": [
    "pages/subscribe/subscribe.html"
  ],

Fixed code:
CVE-2015-6961 (Unknown, published 2017-10-18T20:29Z)
Description: value: Open redirect vulnerability in gluon/tools.py in Web2py 2.9.11 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the _next parameter to user/logout.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/web2py/web2py
Files changed:
Commit message: Merge pull request #1012 from ortgit/master

Security fix: Validate for open redirect everywhere, not just in login()

Vulnerable code:

Fixed code:
CVE-2016-10321 (Python, published 2017-04-10T14:59Z)
Description: value: web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks.
Severity: MEDIUM (CVSS v3 base score: 9.8)
Weakness: CWE-254 \u2014 7PK - Security Features
Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.
Repository: https://github.com/web2py/web2py
Files changed:
applications/admin/controllers/default.py
applications/admin/models/access.py
Commit message: Check if host is denied before verifying password


Vulnerable code:

    elif not success and not request.is_local:

Fixed code:
    elif failed_login_count() >= allowed_number_of_attempts:
        time.sleep(2 ** allowed_number_of_attempts)
        raise HTTP(403)
    elif not success:
def failed_login_count():
    denied_hosts = read_hosts_deny()
    val = denied_hosts.get(request.client, (0, 0))
    return val[0]
CVE-2016-3952 (Python, published 2018-02-06T18:29Z)
Description: value: web2py before 2.14.1, when using the standalone version, allows remote attackers to obtain environment variable values via a direct request to examples/template_examples/beautify.  NOTE: this issue can be leveraged by remote attackers to gain administrative access.
Severity: LOW (CVSS v3 base score: 7.8)
Weakness: CWE-255 \u2014 Credentials Management Errors
Weaknesses in this category are related to the management of credentials.
Repository: https://github.com/web2py/web2py
Files changed:
gluon/globals.py
Commit message: DO NOT LEAK GLOBALS SETTINGS INTO request object


Vulnerable code:
        self.env.update(global_settings)
        self.global_settings = settings.global_settings

Fixed code:
CVE-2022-33146 (Python, published 2022-06-27T01:15Z)
Description: value: Open redirect vulnerability in web2py versions prior to 2.22.5 allows a remote attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/web2py/web2py
Files changed:
applications/admin/controllers/default.py
Commit message: added validation of send attribute in admin


Vulnerable code:
from gluon.tools import Config
    send = request.vars.send

Fixed code:
from gluon.tools import Config, prevent_open_redirect
    send = prevent_open_redirect(request.vars.send)
CVE-2022-23604 (Python, published 2022-02-15T16:15Z)
Description: value: x26-Cogs is a repository of cogs made by Twentysix for the Red Discord bot. Among these cogs is the Defender cog, a tool for Discord server moderation. A vulnerability in the Defender cog prior to version 1.10.0 allows users with admin privileges to issue commands as other users who share the same server. If a bot owner shares the same server as the attacker, it is possible for the attacker to issue bot-owner restricted commands. The issue has been patched in version 1.10.0. One may unload the Defender cog as a workaround.
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Twentysix26/x26-Cogs
Files changed:
defender/core/warden/rule.py
Commit message: [Defender] WD: Ensure issuer of issue-command can view the channel


Vulnerable code:

Fixed code:
                    if msg_obj.channel.permissions_for(issuer).view_channel is False:
                        raise ExecutionError("Failed to issue command. The issuer has no permissions "
                                             "to view the destination channel.")
CVE-2021-3828 (Python, published 2021-09-27T13:15Z)
Description: value: nltk is vulnerable to Inefficient Regular Expression Complexity
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-697 \u2014 Incorrect Comparison
The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
Repository: https://github.com/nltk/nltk
Files changed:
nltk/corpus/reader/comparative_sents.py
nltk/test/corpus.doctest
Commit message: Resolved ReDoS vulnerability in Corpus Reader (#2816)

* Resolved ReDoS vulnerability in the Corpus Reader for the Comparative Sentence Dataset

* Solidified performance tests

Vulnerable code:
KEYWORD = re.compile(r"\((?!.*\()(.*)\)$")

Fixed code:
KEYWORD = re.compile(r"\(([^\(]*)\)$")

Ensure that KEYWORD from `comparative_sents.py` no longer contains a ReDoS vulnerability.

    >>> import re
    >>> import time
    >>> from nltk.corpus.reader.comparative_sents import KEYWORD
    >>> sizes = {
    ...     "short": 4000,
    ...     "long": 40000
    ... }
    >>> exec_times = {
    ...     "short": [],
    ...     "long": [],
    ... }
    >>> for size_name, size in sizes.items():
    ...     for j in range(9):
    ...         start_t = time.perf_counter()
    ...         payload = "( " + "(" * size
    ...         output = KEYWORD.findall(payload)
    ...         exec_times[size_name].append(time.perf_counter() - start_t)
    ...     exec_times[size_name] = sorted(exec_times[size_name])[4] # Get the mean

Ideally, the execution time of such a regular expression is linear
in the length of the input. As such, we would expect exec_times["long"]
to be roughly 10 times as big as exec_times["short"].
With the ReDoS in place, it took roughly 80 times as long.
For now, we accept values below 30 (times as long), due to the potential
for variance. This ensures that the ReDoS has certainly been reduced,
if not removed.

    >>> exec_times["long"] / exec_times["short"] < 30
    True
CVE-2021-3842 (Python, published 2022-01-04T15:15Z)
Description: value: nltk is vulnerable to Inefficient Regular Expression Complexity
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/nltk/nltk
Files changed:
nltk/parse/malt.py
nltk/sem/glue.py
nltk/tag/brill.py
nltk/tag/brill_trainer.py
nltk/tag/sequential.py
nltk/tbl/demo.py
Commit message: Resolve ReDoS opportunity by fixing incorrectly specified regex (#2906)



Vulnerable code:
            (r"^-?[0-9]+(.[0-9]+)?$", "CD"),  # cardinal numbers
                (r"^-?[0-9]+(.[0-9]+)?$", "CD"),  # cardinal numbers
                "final: {finalerrors:5d} {finalacc:.4f} ".format(**train_stats)
        """
        ... (r'^-?[0-9]+(.[0-9]+)?$', 'CD'),   # cardinal numbers
        0.2450142...
            Found 845 useful rules.
          47  63  16 161  | NN->IN if Pos:NNS@[-1]
        [1775, 1269, [132, 85, 69, 51, 47, 33, 26, 24, 22, 17]]
        TRAIN (   2417 tokens) initial  1775 0.2656 final:  1269 0.4750
        0.43996...
        [1855, 1376, [100, 85, 67, 58, 27, 36, 27, 16, 31, 32]]
            Found 845 useful rules.
        0.44159544...
        ...     print("({}, {}), ".format(tok, tag))
    """
        ...     [(r'^-?[0-9]+(.[0-9]+)?$', 'CD'),   # cardinal numbers
        >>> regexp_tagger.tag(test_sent)
NN_CD_TAGGER = RegexpTagger([(r"^-?[0-9]+(.[0-9]+)?$", "CD"), (r".*", "NN")])
        (r"^-?[0-9]+(.[0-9]+)?$", "CD"),  # cardinal numbers

Fixed code:
            (r"^-?[0-9]+(\.[0-9]+)?$", "CD"),  # cardinal numbers
                (r"^-?[0-9]+(\.[0-9]+)?$", "CD"),  # cardinal numbers
                "final: {finalerrors:5d} {finalacc:.4f}".format(**train_stats)
        r"""
        ... (r'^-?[0-9]+(\.[0-9]+)?$', 'CD'),  # cardinal numbers
        0.2433862...
            Found 847 useful rules.
          47  63  16 162  | NN->IN if Pos:NNS@[-1]
        [1776, 1270, [132, 85, 69, 51, 47, 33, 26, 24, 22, 17]]
        TRAIN (   2417 tokens) initial  1776 0.2652 final:  1270 0.4746
        0.43833...
        [1859, 1380, [100, 85, 67, 58, 27, 36, 27, 16, 31, 32]]
            Found 847 useful rules.
        0.43996743...
        ...     print("({}, {}), ".format(tok, tag)) # doctest: +NORMALIZE_WHITESPACE
    r"""
        ...     [(r'^-?[0-9]+(\.[0-9]+)?$', 'CD'),  # cardinal numbers
        >>> regexp_tagger.tag(test_sent) # doctest: +NORMALIZE_WHITESPACE
NN_CD_TAGGER = RegexpTagger([(r"^-?[0-9]+(\.[0-9]+)?$", "CD"), (r".*", "NN")])
        (r"^-?[0-9]+(\.[0-9]+)?$", "CD"),  # cardinal numbers
CVE-2017-16932 (Other, published 2017-11-23T21:29Z)
Description: value: parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-835 \u2014 Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Repository: https://github.com/GNOME/libxml2
Files changed:
parser.c
result/errors/759579.xml.err
result/errors/759579.xml.str
test/errors/759579.xml
Commit message: Detect infinite recursion in parameter entities

When expanding a parameter entity in a DTD, infinite recursion could
lead to an infinite loop or memory exhaustion.

Thanks to Wei Lei for the first of many reports.

Fixes bug 759579.


Vulnerable code:
	    if (xmlPushInput(ctxt, input) < 0)

Fixed code:
    if (((ctxt->inputNr > 40) && ((ctxt->options & XML_PARSE_HUGE) == 0)) ||
        (ctxt->inputNr > 1024)) {
        xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL);
        while (ctxt->inputNr > 1)
            xmlFreeInputStream(inputPop(ctxt));
	return(-1);
    }
	    if (xmlPushInput(ctxt, input) < 0) {
                xmlFreeInputStream(input);
            }
Entity: line 2: parser error : Detected an entity reference loop
        %z; %z; %z; %z; %z;
           ^
Entity: line 2: 
        %z; %z; %z; %z; %z;
           ^
Entity: line 2: parser error : Detected an entity reference loop
        %z; %z; %z; %z; %z;
           ^
Entity: line 2: 
        %z; %z; %z; %z; %z;
           ^
./test/errors/759579.xml : failed to parse
<!DOCTYPE doc [
    <!ENTITY % z '
        &#37;z; &#37;z; &#37;z; &#37;z; &#37;z;
        &#37;z; &#37;z; &#37;z; &#37;z; &#37;z;
        &#37;z; &#37;z; &#37;z; &#37;z; &#37;z;
        &#37;z; &#37;z; &#37;z; &#37;z; &#37;z;
        &#37;z; &#37;z; &#37;z; &#37;z; &#37;z;
    '>
    %z;
]>
<doc/>