hitoshura25/cvefixes huggingface dataset:
CVE-2015-7294 (JavaScript, published 2017-09-06T21:29Z)
Description: value: ldapauth-fork before 2.3.3 allows remote attackers to perform LDAP injection attacks via a crafted username.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-90 \u2014 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.
Repository: https://github.com/vesse/node-ldapauth-fork
Files changed:
CHANGES.md
lib/ldapauth.js
Commit message: Sanitize user input

Replace the specific special characters with codes as defined in LDAP
specification.

Closes #21


Vulnerable code:
  var searchFilter = self.opts.searchFilter.replace(/{{username}}/g, username);

Fixed code:
## 2.3.3

- [issue #20] Sanitize user input

// https://tools.ietf.org/search/rfc4515#section-3
var sanitizeInput = function (username) {
  return username
    .replace(/\*/g, '\\2a')
    .replace(/\(/g, '\\28')
    .replace(/\)/g, '\\29')
    .replace(/\\/g, '\\5c')
    .replace(/\0/g, '\\00')
    .replace(/\//g, '\\2f');
};

  var searchFilter = self.opts.searchFilter.replace(/{{username}}/g, sanitizeInput(username));
CVE-2020-14093 (C, published 2020-06-15T05:15Z)
Description: value: Mutt before 1.14.3 allows an IMAP fcc/postpone man-in-the-middle attack via a PREAUTH response.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-319 \u2014 Cleartext Transmission of Sensitive Information
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
Repository: https://github.com/muttmua/mutt
Files changed:
imap/imap.c
Commit message: Prevent possible IMAP MITM via PREAUTH response.

This is similar to CVE-2014-2567 and CVE-2020-12398.  STARTTLS is not
allowed in the Authenticated state, so previously Mutt would
implicitly mark the connection as authenticated and skip any
encryption checking/enabling.

No credentials are exposed, but it does allow messages to be sent to
an attacker, via postpone or fcc'ing for instance.

Reuse the $ssl_starttls quadoption "in reverse" to prompt to abort the
connection if it is unencrypted.

Thanks very much to Damian Poddebniak and Fabian Ising from the
Münster University of Applied Sciences for reporting this issue, and
their help in testing the fix.


Vulnerable code:

Fixed code:
#if defined(USE_SSL)
    /* An unencrypted PREAUTH response is most likely a MITM attack.
     * Require a confirmation. */
    if (!idata->conn->ssf)
    {
      if (option(OPTSSLFORCETLS) ||
          (query_quadoption (OPT_SSLSTARTTLS,
                             _("Abort unencrypted PREAUTH connection?")) != MUTT_NO))
      {
        mutt_error _("Encrypted connection unavailable");
        mutt_sleep (1);
        goto err_close_conn;
      }
    }
#endif
CVE-2017-1000198 (C, published 2017-11-17T02:29Z)
Description: value: tcmu-runner daemon version 0.9.0 to 1.2.0 is vulnerable to invalid memory references in the handler_glfs.so handler resulting in denial of service
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/open-iscsi/tcmu-runner
Files changed:
glfs.c
Commit message: glfs: discard glfs_check_config

Signed-off-by: Prasanna Kumar Kalever <prasanna.kalever@redhat.com>


Vulnerable code:

static bool glfs_check_config(const char *cfgstring, char **reason)
{
	char *path;
	glfs_t *fs = NULL;
	glfs_fd_t *gfd = NULL;
	gluster_server *hosts = NULL; /* gluster server defination */
	bool result = true;

	path = strchr(cfgstring, '/');
	if (!path) {
		if (asprintf(reason, "No path found") == -1)
			*reason = NULL;
		result = false;
		goto done;
	}
	path += 1; /* get past '/' */

	fs = tcmu_create_glfs_object(path, &hosts);
	if (!fs) {
		tcmu_err("tcmu_create_glfs_object failed\n");
		goto done;
	}

	gfd = glfs_open(fs, hosts->path, ALLOWED_BSOFLAGS);
	if (!gfd) {
		if (asprintf(reason, "glfs_open failed: %m") == -1)
			*reason = NULL;
		result = false;
		goto unref;
	}

	if (glfs_access(fs, hosts->path, R_OK|W_OK) == -1) {
		if (asprintf(reason, "glfs_access file not present, or not writable") == -1)
			*reason = NULL;
		result = false;
		goto unref;
	}

	goto done;

unref:
	gluster_cache_refresh(fs, path);

done:
	if (gfd)
		glfs_close(gfd);
	gluster_free_server(&hosts);

	return result;
}

	.check_config 	= glfs_check_config,


Fixed code:
CVE-2018-12684 (C, published 2018-06-22T19:29Z)
Description: value: Out-of-bounds Read in the send_ssi_file function in civetweb.c in CivetWeb through 1.10 allows attackers to cause a Denial of Service or Information Disclosure via a crafted SSI file.
Severity: MEDIUM (CVSS v3 base score: 7.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/civetweb/civetweb
Files changed:
src/civetweb.c
Commit message: Check length of memcmp


Vulnerable code:
					if (!memcmp(buf + 5, "include", 7)) {
					} else if (!memcmp(buf + 5, "exec", 4)) {

Fixed code:
					if ((len > 12) && !memcmp(buf + 5, "include", 7)) {
					} else if ((len > 9) && !memcmp(buf + 5, "exec", 4)) {
CVE-2018-12684 (C, published 2018-06-22T19:29Z)
Description: value: Out-of-bounds Read in the send_ssi_file function in civetweb.c in CivetWeb through 1.10 allows attackers to cause a Denial of Service or Information Disclosure via a crafted SSI file.
Severity: MEDIUM (CVSS v3 base score: 7.1)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/civetweb/civetweb
Files changed:
src/civetweb.c
Commit message: Check length of memcmp


Vulnerable code:
					if (!memcmp(buf + 5, "include", 7)) {
					} else if (!memcmp(buf + 5, "exec", 4)) {

Fixed code:
					if ((len > 12) && !memcmp(buf + 5, "include", 7)) {
					} else if ((len > 9) && !memcmp(buf + 5, "exec", 4)) {
CVE-2018-18074 (Unknown, published 2018-10-09T17:29Z)
Description: value: The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-522 \u2014 Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Repository: https://github.com/requests/requests
Files changed:
Commit message: Merge pull request #4718 from bmerry/fix-4716

Strip Authorization header whenever root URL changes

Vulnerable code:

Fixed code:
CVE-2018-12420 (PHP, published 2018-06-14T21:29Z)
Description: value: IceHrm before 23.0.1.OS has a risky usage of a hashed password in a request.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-327 \u2014 Use of a Broken or Risky Cryptographic Algorithm
The product uses a broken or risky cryptographic algorithm or protocol.
Repository: https://github.com/gamonoid/icehrm
Files changed:
core/header.php
core/login.php
core/src/Utils/SessionUtils.php
Commit message: Critical security issue - fix password hash


Vulnerable code:
if(empty($user)){
    $actualLink = "http://$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]";
    header("Location:".CLIENT_BASE_URL."login.php?next=".\Base64Url\Base64Url::encode($actualLink));
<?php
?>

if (empty($user)) {
			$_REQUEST['hashedPwd'] = $tempUser->password;
		if (!isset($_REQUEST['hashedPwd'])) {
			$_REQUEST['hashedPwd'] = md5($_REQUEST['password']);

		include 'login.com.inc.php';

				array($_REQUEST['username'],$_REQUEST['username'],$_REQUEST['hashedPwd'])
		if ($suser->password == $_REQUEST['hashedPwd'] || $ssoUserLoaded) {
			    header("Location:" . $loginRedirect);
            "admin_current_profile"

Fixed code:
if(empty($user) || empty($user->email)){
    $actualLinkArray = explode('/',$_SERVER['REQUEST_URI']);
    header("Location:".CLIENT_BASE_URL."login.php?next=".\Base64Url\Base64Url::encode($actualLinkArray[count($actualLinkArray) - 1]));
$hashedPwd = null;
if (empty($user) || empty($user->email)) {
			$hashedPwd = $tempUser->password;
            $cookieLogin = true;
		if (!isset($hashedPwd)) {
			$hashedPwd = md5($_REQUEST['password']);
				array($_REQUEST['username'], $_REQUEST['username'], $hashedPwd)
		if (empty($suser->username) || empty($suser->email)) {
            $next = !empty($_REQUEST['next'])?'&next='.$_REQUEST['next']:'';
            header("Location:".CLIENT_BASE_URL."login.php?f=1".$next);
            exit();
        }

        $loginCsrf = \Utils\SessionUtils::getSessionObject('csrf-login');

        if (!$cookieLogin && ($_REQUEST['csrf'] != $loginCsrf || empty($_REQUEST['csrf']))) {
            $next = !empty($_REQUEST['next'])?'&next='.$_REQUEST['next']:'';
            header("Location:".CLIENT_BASE_URL."login.php?f=1".$next);
            exit();
        }

		if ($suser->password === $hashedPwd || $ssoUserLoaded) {
			    header("Location:" . CLIENT_BASE_URL.$loginRedirect);
                        <input type="hidden" id="csrf" name="csrf" value="<?=$csrfToken?>"/>
            "admin_current_profile",
            "csrf-login"
CVE-2021-3644 (Unknown, published 2022-08-26T16:15Z)
Description: value: A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressions, a user who was granted access to the management interface can potentially access a vault expression they should not be able to access and possibly retrieve the item which was stored in the vault. The highest threat from this vulnerability is data confidentiality and integrity.
Severity: nan (CVSS v3 base score: 3.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/wildfly/wildfly-core
Files changed:
Commit message: Merge pull request #4668 from darranl/WFCORE-5511/main

[WFCORE-5511] wildfly-core: Invalid Sensitivity Classification of Vault Expression

Vulnerable code:

Fixed code:
CVE-2018-6003 (Other, published 2018-01-22T20:29Z)
Description: value: An issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1 before 4.13. Unlimited recursion in the BER decoder leads to stack exhaustion and DoS.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-674 \u2014 Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place,  consuming excessive resources, such as allocated memory or the program stack.
Repository: https://gitlab.com/gnutls/libtasn1
Files changed:
NEWS
lib/libtasn1.h
Commit message: released 4.13

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>


Vulnerable code:
* Noteworthy changes in release 4.13 (unreleased) [stable]
#define ASN1_VERSION "4.12"

Fixed code:
* Noteworthy changes in release 4.13 (released 2018-01-16) [stable]
#define ASN1_VERSION "4.13"
CVE-2022-4963 (Java, published 2024-03-21T02:44Z)
Description: value: A vulnerability was found in Folio Spring Module Core up to 1.1.5. It has been rated as critical. Affected by this issue is the function dropSchema of the file tenant/src/main/java/org/folio/spring/tenant/hibernate/HibernateSchemaService.java of the component Schema Name Handler. The manipulation leads to sql injection. Upgrading to version 2.0.0 is able to address this issue. The name of the patch is d374a5f77e6b58e36f0e0e4419be18b95edcd7ff. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-257516.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/folio-org/spring-module-core
Files changed:
tenant/src/main/java/org/folio/spring/tenant/hibernate/HibernateSchemaService.java
tenant/src/main/java/org/folio/spring/tenant/service/SchemaService.java
Commit message: FOLIO-3645: schema name SQL injection

SELECT EXISTS now uses a prepared statement.

PostgreSQL doesn't support a prepared statement for CREATE SCHEMA and DROP SCHEMA.
Instead we validate the schema name before use to mitigate any SQL injection attack.


Vulnerable code:
import static org.hibernate.cfg.AvailableSettings.*;

    try (Statement statement = connection.createStatement()) {
      String queryTemplate = "SELECT EXISTS(SELECT 1 FROM information_schema.schemata WHERE schema_name = '%s');";
      ResultSet resultSet = statement.executeQuery(String.format(queryTemplate, schema));
    return String.format("%s_%s", tenant, buildInfoProperties.getArtifact()).replace("-", "_");

Fixed code:
import java.sql.PreparedStatement;
    String sql = "SELECT EXISTS(SELECT 1 FROM information_schema.schemata WHERE schema_name = ?)";
    try (PreparedStatement statement = connection.prepareStatement(sql)) {
      statement.setString(1, schema);
      ResultSet resultSet = statement.executeQuery();
import java.util.regex.Pattern;
  private static final Pattern SCHEMA_REGEXP = Pattern.compile("[a-zA-Z0-9_]+");

    var schema = String.format("%s_%s", tenant, buildInfoProperties.getArtifact()).replace("-", "_");
    if (! SCHEMA_REGEXP.matcher(schema).matches()) {
      throw new IllegalArgumentException("Illegal character in schema name: " + schema);
    }
    return schema;
CVE-2023-50708 (PHP, published 2023-12-22T19:15Z)
Description: value: yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth1/2 `state` and OpenID Connect `nonce` is vulnerable for a `timing attack` since it is compared via regular string comparison (instead of `Yii::$app->getSecurity()->compareString()`). Version 2.2.15 contains a patch for the issue. No known workarounds are available.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/yiisoft/yii2-authclient
Files changed:
CHANGELOG.md
src/OAuth1.php
src/OAuth2.php
src/OpenIdConnect.php
Commit message: Merge pull request from GHSA-w8vh-p74j-x9xp

* Fixed Oauth1/2 and OpenID Connect state/noce check

* Updated changelog for ghsa-w8vh-p74j-x9xp

---------

Co-authored-by: Alexander Makarov <sam@rmcreative.ru>

Vulnerable code:
        if (strcmp($requestToken->getToken(), $oauthToken) !== 0) {
            if (!isset($incomingState) || empty($authState) || strcmp($incomingState, $authState) !== 0) {
                if (!isset($jwsData['nonce']) || empty($authNonce) || strcmp($jwsData['nonce'], $authNonce) !== 0) {

Fixed code:
- Enh GHSA-w8vh-p74j-x9xp: Improved security for OAuth1, OAuth2 and OpenID Connect clients by using timing attack safe string comparsion (rhertogh)
        if (!Yii::$app->getSecurity()->compareString($requestToken->getToken(), $oauthToken)) {
            if (
                !isset($incomingState)
                || empty($authState)
                || !Yii::$app->getSecurity()->compareString($incomingState, $authState)
            ) {
                if (
                    !isset($jwsData['nonce'])
                    || empty($authNonce)
                    || !Yii::$app->getSecurity()->compareString($jwsData['nonce'], $authNonce)
                ) {
CVE-2023-50714 (Markdown, published 2023-12-22T19:15Z)
Description: value: yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth2 PKCE implementation is vulnerable in 2 ways. First, the `authCodeVerifier` should be removed after usage (similar to `authState`). Second, there is a risk for a `downgrade attack` if PKCE is being relied on for CSRF protection. Version 2.2.15 contains a patch for the issue. No known workarounds are available.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/yiisoft/yii2-authclient
Files changed:
CHANGELOG.md
src/OAuth2.php
Commit message: Merge pull request from GHSA-rw54-6826-c8j5

* Oauth2 replay attack mitigation for PKCE

* Oauth2 PKCE downgrate attack mitigation

* Updated changelog for GHSA-rw54-6826-c8j5

Vulnerable code:
- Enh: #367: Throw more specific `ClientErrorResponseException` when the response code in `BaseOAuth::sendRequest()` is a 4xx (rhertogh)  
            $defaultParams['code_verifier'] = $this->getState('authCodeVerifier');

Fixed code:
- Enh #367: Throw more specific `ClientErrorResponseException` when the response code in `BaseOAuth::sendRequest()` is a 4xx (rhertogh)
- Enh GHSA-rw54-6826-c8j5: Improved security for OAuth2 client by requiring an `authCodeVerifier` if PKCE is enabled and clearing it after usage (rhertogh)
            $authCodeVerifier = $this->getState('authCodeVerifier');
            if (empty($authCodeVerifier)) {
                // Prevent PKCE Downgrade Attack
                // https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics#name-pkce-downgrade-attack
                throw new HttpException(409, 'Invalid auth code verifier.');
            }
            $defaultParams['code_verifier'] = $authCodeVerifier;
            $this->removeState('authCodeVerifier');
CVE-2022-22851 (Markdown, published 2022-01-26T16:15Z)
Description: value: A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodtester Hospital's Patient Records Management System 1.0 via the specialization parameter in doctors.php
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Sant268/CVE-2022-22851
Files changed:
CVE-2022-22851.md
Commit message: Create CVE-2022-22851.md


Vulnerable code:

Fixed code:
# CVE-2022-22851
# Exploit Title: HPRMS - 'doctors' Stored XSS
# Exploit Author: (Sant268)
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15116/hospitals-patient-records-management-system-php-free-source-code.html
# Version: HPRMS 1.0
# Tested on: Ubuntu 20, Apache
# CVE: CVE-2022-22851

- Description:
A XSS issue in HPRMS v.1.0 allows remote attackers to inject JavaScript via /articles in the description parameter.

- Payload used:
<img src =q onerror=prompt(8)>

- Steps to reproduce:
1- Go to http://victim.com/admin/?page=doctors
2- Add a Doctor, paste the payload in specialisation
3- Alert will pop whenever the page is accessed.
CVE-2022-31001 (Unknown, published 2022-05-31T20:15Z)
Description: value: Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, an attacker can send a message with evil sdp to FreeSWITCH, which may cause crash. This type of crash may be caused by `#define MATCH(s, m) (strncmp(s, m, n = sizeof(m) - 1) == 0)`, which will make `n` bigger and trigger out-of-bound access when `IS_NON_WS(s[n])`. Version 1.13.8 contains a patch for this issue.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/freeswitch/sofia-sip
Files changed:
Commit message: Merge pull request from GHSA-79jq-hh82-cv9g

Fix Out-of-bound read in sip_method_d

Vulnerable code:

Fixed code:
CVE-2022-31002 (Unknown, published 2022-05-31T19:15Z)
Description: value: Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, an attacker can send a message with evil sdp to FreeSWITCH, which may cause a crash. This type of crash may be caused by a URL ending with `%`. Version 1.13.8 contains a patch for this issue.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/freeswitch/sofia-sip
Files changed:
Commit message: Merge pull request from GHSA-g3x6-p824-x6hm

Fix Out-of-bound read in url_canonize2 and url_canonize3

Vulnerable code:

Fixed code:
CVE-2022-31003 (Unknown, published 2022-05-31T20:15Z)
Description: value: Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, when parsing each line of a sdp message, `rest = record + 2` will access the memory behind `\0` and cause an out-of-bounds write. An attacker can send a message with evil sdp to FreeSWITCH, causing a crash or more serious consequence, such as remote code execution. Version 1.13.8 contains a patch for this issue.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/freeswitch/sofia-sip
Files changed:
Commit message: Merge pull request from GHSA-8w5j-6g2j-pxcp

Fix Heap-buffer-overflow in parse_descs and parse_message

Vulnerable code:

Fixed code:
CVE-2022-31003 (Unknown, published 2022-05-31T20:15Z)
Description: value: Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, when parsing each line of a sdp message, `rest = record + 2` will access the memory behind `\0` and cause an out-of-bounds write. An attacker can send a message with evil sdp to FreeSWITCH, causing a crash or more serious consequence, such as remote code execution. Version 1.13.8 contains a patch for this issue.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/freeswitch/sofia-sip
Files changed:
Commit message: Merge pull request from GHSA-8w5j-6g2j-pxcp

Fix Heap-buffer-overflow in parse_descs and parse_message

Vulnerable code:

Fixed code: