hitoshura25/cvefixes huggingface dataset:
CVE-2011-3346 (C, published 2014-04-01T06:35Z)
Description: value: Buffer overflow in hw/scsi-disk.c in the SCSI subsystem in QEMU before 0.15.2, as used by Xen, might allow local guest users with permission to access the CD-ROM to cause a denial of service (guest crash) via a crafted SAI READ CAPACITY SCSI command.  NOTE: this is only a vulnerability when root has manually modified certain permissions or ACLs.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/bonzini/qemu
Files changed:
hw/scsi-disk.c
Commit message: scsi-disk: lazily allocate bounce buffer

It will not be needed for reads and writes if the HBA provides a sglist.
In addition, this lets scsi-disk refuse commands with an excessive
allocation length, as well as limit memory on usual well-behaved guests.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>


Vulnerable code:
static int scsi_disk_emulate_command(SCSIDiskReq *r, uint8_t *outbuf);
    qemu_vfree(r->iov.iov_base);
    r->iov.iov_len = MIN(r->sector_count * 512, SCSI_DMA_BUF_SIZE);
                ret = scsi_disk_emulate_command(r, r->iov.iov_base);
static int scsi_disk_emulate_command(SCSIDiskReq *r, uint8_t *outbuf)
    uint8_t *outbuf;
    outbuf = (uint8_t *)r->iov.iov_base;
        rc = scsi_disk_emulate_command(r, outbuf);
    SCSIDiskReq *r;
    r = DO_UPCAST(SCSIDiskReq, req, req);
    r->iov.iov_base = qemu_blockalign(s->bs, SCSI_DMA_BUF_SIZE);

Fixed code:
    uint32_t buflen;
static int scsi_disk_emulate_command(SCSIDiskReq *r);
    if (r->iov.iov_base) {
        qemu_vfree(r->iov.iov_base);
    }
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);

    if (!r->iov.iov_base) {
        r->buflen = SCSI_DMA_BUF_SIZE;
        r->iov.iov_base = qemu_blockalign(s->bs, r->buflen);
    }
    r->iov.iov_len = MIN(r->sector_count * 512, r->buflen);
                ret = scsi_disk_emulate_command(r);
static int scsi_disk_emulate_command(SCSIDiskReq *r)
    uint8_t *outbuf;
    if (!r->iov.iov_base) {
        /*
         * FIXME: we shouldn't return anything bigger than 4k, but the code
         * requires the buffer to be as big as req->cmd.xfer in several
         * places.  So, do not allow CDBs with a very large ALLOCATION
         * LENGTH.  The real fix would be to modify scsi_read_data and
         * dma_buf_read, so that they return data beyond the buflen
         * as all zeros.
         */
        if (req->cmd.xfer > 65536) {
            goto illegal_request;
        }
        r->buflen = MAX(4096, req->cmd.xfer);
        r->iov.iov_base = qemu_blockalign(s->bs, r->buflen);
    }

    outbuf = r->iov.iov_base;
        rc = scsi_disk_emulate_command(r);
CVE-2011-3346 (C, published 2014-04-01T06:35Z)
Description: value: Buffer overflow in hw/scsi-disk.c in the SCSI subsystem in QEMU before 0.15.2, as used by Xen, might allow local guest users with permission to access the CD-ROM to cause a denial of service (guest crash) via a crafted SAI READ CAPACITY SCSI command.  NOTE: this is only a vulnerability when root has manually modified certain permissions or ACLs.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/bonzini/qemu
Files changed:
hw/scsi-disk.c
Commit message: scsi-disk: commonize iovec creation between reads and writes

Also, consistently use qiov.size instead of iov.iov_len.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>


Vulnerable code:
    DPRINTF("Data ready tag=0x%x len=%zd\n", r->req.tag, r->iov.iov_len);
    n = r->iov.iov_len / 512;
    scsi_req_data(&r->req, r->iov.iov_len);
    n = r->sector_count;
    if (n > SCSI_DMA_BUF_SIZE / 512)
        n = SCSI_DMA_BUF_SIZE / 512;

    r->iov.iov_len = n * 512;
    qemu_iovec_init_external(&r->qiov, &r->iov, 1);

    uint32_t len;
    n = r->iov.iov_len / 512;
        len = r->sector_count * 512;
        if (len > SCSI_DMA_BUF_SIZE) {
            len = SCSI_DMA_BUF_SIZE;
        }
        r->iov.iov_len = len;
        DPRINTF("Write complete tag=0x%x more=%d\n", r->req.tag, len);
        scsi_req_data(&r->req, len);
    n = r->iov.iov_len / 512;
        qemu_iovec_init_external(&r->qiov, &r->iov, 1);

                                   scsi_write_complete, r);
        /* Invoke completion routine to fetch data from host.  */

Fixed code:
static uint32_t scsi_init_iovec(SCSIDiskReq *r)
{
    r->iov.iov_len = MIN(r->sector_count * 512, SCSI_DMA_BUF_SIZE);
    qemu_iovec_init_external(&r->qiov, &r->iov, 1);
    return r->qiov.size / 512;
}

    DPRINTF("Data ready tag=0x%x len=%zd\n", r->req.tag, r->qiov.size);
    n = r->qiov.size / 512;
    scsi_req_data(&r->req, r->qiov.size);
    n = scsi_init_iovec(r);
    n = r->qiov.size / 512;
        scsi_init_iovec(r);
        DPRINTF("Write complete tag=0x%x more=%d\n", r->req.tag, r->qiov.size);
        scsi_req_data(&r->req, r->qiov.size);
    n = r->qiov.size / 512;
                                       scsi_write_complete, r);
        /* Called for the first time.  Ask the driver to send us more data.  */
CVE-2021-33880 (Python, published 2021-06-06T15:15Z)
Description: value: The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.
Severity: LOW (CVSS v3 base score: 5.9)
Weakness: CWE-203 \u2014 Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Repository: https://github.com/aaugustin/websockets
Files changed:
docs/changelog.rst
src/websockets/legacy/auth.py
tests/legacy/test_auth.py
Commit message: Use constant-time comparison for passwords.

Backport of c91b4c2a and dfecbd03.


Vulnerable code:

            async def check_credentials(username: str, password: str) -> bool:
                return (username, password) == credentials

            if all(is_credentials(item) for item in credentials_list):
                credentials_dict = dict(credentials_list)

                async def check_credentials(username: str, password: str) -> bool:
                    return credentials_dict.get(username) == password

            else:

        create_protocol, realm=realm, check_credentials=check_credentials
        return password == "iloveyou"
    def test_basic_auth_invalid_credentials(self):

Fixed code:
.. note::

    **Version 9.1 fixes a security issue introduced in version 8.0.**

    Version 8.0 was vulnerable to timing attacks on HTTP Basic Auth passwords.

import hmac
            credentials_list = [cast(Credentials, credentials)]
            if not all(is_credentials(item) for item in credentials_list):
        credentials_dict = dict(credentials_list)

        async def check_credentials(username: str, password: str) -> bool:
            try:
                expected_password = credentials_dict[username]
            except KeyError:
                return False
            return hmac.compare_digest(expected_password, password)

        create_protocol,
        realm=realm,
        check_credentials=check_credentials,
import hmac
        return hmac.compare_digest(password, "iloveyou")
    def test_basic_auth_invalid_username(self):
        with self.assertRaises(InvalidStatusCode) as raised:
            self.start_client(user_info=("goodbye", "iloveyou"))
        self.assertEqual(raised.exception.status_code, 401)

    @with_server(create_protocol=create_protocol)
    def test_basic_auth_invalid_password(self):
CVE-2022-31098 (Go, published 2022-06-27T22:15Z)
Description: value: Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. A vulnerability in the logging of Weave GitOps could allow an authenticated remote attacker to view sensitive cluster configurations, aka KubeConfg, of registered Kubernetes clusters, including the service account tokens in plain text from Weave GitOps's pod logs on the management cluster. An unauthorized remote attacker can also view these sensitive configurations from external log storage if enabled by the management cluster. This vulnerability is due to the client factory dumping cluster configurations and their service account tokens when the cluster manager tries to connect to an API server of a registered cluster, and a connection error occurs. An attacker could exploit this vulnerability by either accessing logs of a pod of Weave GitOps, or from external log storage and obtaining all cluster configurations of registered clusters. A successful exploit could allow the attacker to use those cluster configurations to manage the registered Kubernetes clusters. This vulnerability has been fixed by commit 567356f471353fb5c676c77f5abc2a04631d50ca. Users should upgrade to Weave GitOps core version v0.8.1-rc.6 or newer. There is no known workaround for this vulnerability.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-532 \u2014 Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
Repository: https://github.com/weaveworks/weave-gitops
Files changed:
core/clustersmngr/factory.go
Commit message: Fix logging on cluster connection error
Remove the client config from the error log since the wrapped error already contains the cluster name for which the connection couldn't be established.

Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>


Vulnerable code:
		cf.log.Error(err, "failed to create clients for", "clusters", cf.clusters.Get())

Fixed code:
		cf.log.Error(err, "failed to create client")
CVE-2022-24802 (TypeScript, published 2022-04-01T00:15Z)
Description: value: deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. deepmerge-ts is vulnerable to Prototype Pollution via file deepmerge.ts, function defaultMergeRecords(). This issue has been patched in version 4.0.2. There are no known workarounds for this issue.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/RebeccaStevens/deepmerge-ts
Files changed:
src/deepmerge.ts
tests/deepmerge.test.ts
Commit message: fix: protect against prototype pollution


Vulnerable code:
    result[key] = propertyResult;

Fixed code:
    if (key === "__proto__") {
      Object.defineProperty(result, key, {
        value: propertyResult,
        configurable: true,
        enumerable: true,
        writable: true,
      });
    } else {
      result[key] = propertyResult;
    }

test("prototype pollution", (t) => {
  const payload = '{"__proto__":{"a0":true}}';

  const x: any = JSON.parse(payload);
  const y: any = {};

  const merged: any = deepmerge(x, y);

  t.deepEqual(JSON.stringify(merged), payload);

  t.not(({} as any).a0, true, "Safe POJO");
  t.not(x.a0, true, "Safe x input");
  t.not(y.a0, true, "Safe y input");
  t.not(merged.a0, true, "Safe output");
});
CVE-2022-24802 (Unknown, published 2022-04-01T00:15Z)
Description: value: deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. deepmerge-ts is vulnerable to Prototype Pollution via file deepmerge.ts, function defaultMergeRecords(). This issue has been patched in version 4.0.2. There are no known workarounds for this issue.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/RebeccaStevens/deepmerge-ts
Files changed:
Commit message: Merge pull request #86 from RebeccaStevens/security/prototype-pollution



Vulnerable code:

Fixed code:
CVE-2021-33950 (Java, published 2023-02-17T18:15Z)
Description: value: An issue discovered in OpenKM v6.3.10 allows attackers to obtain sensitive information via the XMLTextExtractor function.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-611 \u2014 Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Repository: https://github.com/openkm/document-management-system
Files changed:
src/main/java/com/openkm/extractor/OpenOfficeTextExtractor.java
src/main/java/com/openkm/extractor/XMLTextExtractor.java
Commit message: XXE injection security vulnerability

Fix #287


Vulnerable code:
			xmlReader.setFeature("http://xml.org/sax/features/validation", false);

Fixed code:
			xmlReader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
			xmlReader.setFeature("http://xml.org/sax/features/external-general-entities", false);
			xmlReader.setFeature("http://xml.org/sax/features/validation", false);
			reader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
			reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
			reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
			reader.setFeature("http://xml.org/sax/features/validation", false);
CVE-2022-3969 (Java, published 2022-11-13T08:15Z)
Description: value: A vulnerability was found in OpenKM up to 6.3.11 and classified as problematic. Affected by this issue is the function getFileExtension of the file src/main/java/com/openkm/util/FileUtils.java. The manipulation leads to insecure temporary file. Upgrading to version 6.3.12 is able to address this issue. The name of the patch is c069e4d73ab8864345c25119d8459495f45453e1. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-213548.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-377 \u2014 Insecure Temporary File
Creating and using insecure temporary files can leave application and system data vulnerable to attack.
Repository: https://github.com/openkm/document-management-system
Files changed:
src/main/java/com/openkm/util/FileUtils.java
Commit message: Fix Temporary Directory Hijacking or Information Disclosure Vulnerability

fix #332


Vulnerable code:
		File tmpFile = File.createTempFile("okm", null);

		if (!tmpFile.delete())
			throw new IOException();
		if (!tmpFile.mkdir())
			throw new IOException();
		return tmpFile;
	 * Create "year / month / day" directory structure. 

Fixed code:
import java.nio.file.Files;
		return Files.createTempDirectory("okm").toFile();
	 * Create "year / month / day" directory structure.
CVE-2018-3721 (JavaScript, published 2018-06-07T02:29Z)
Description: value: lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/lodash/lodash
Files changed:
lodash.js
test/test.js
Commit message: Avoid merging properties on to __proto__ objects.


Vulnerable code:
            ? customizer(object[key], srcValue, (key + ''), object, source, stack)
      var objValue = object[key],
          srcValue = source[key],

Fixed code:
  /**
   * Gets the value at `key`, unless `key` is "__proto__".
   *
   * @private
   * @param {Object} object The object to query.
   * @param {string} key The key of the property to get.
   * @returns {*} Returns the property value.
   */
  function safeGet(object, key) {
    return key == '__proto__'
      ? undefined
      : object[key];
  }

            ? customizer(safeGet(object, key), srcValue, (key + ''), object, source, stack)
      var objValue = safeGet(object, key),
          srcValue = safeGet(source, key),

    QUnit.test('should not merge "__proto__" properties', function(assert) {
      assert.expect(1);

      if (JSON) {
        _.merge({}, JSON.parse('{"__proto__":{"a":1}}'));

        var actual = "a" in objectProto;
        delete objectProto.a;

        assert.notOk(actual);
      } else {
        skipAssert(assert);
      }
    });
CVE-2022-29242 (C, published 2022-05-24T15:15Z)
Description: value: GOST engine is a reference implementation of the Russian GOST crypto algorithms for OpenSSL. TLS clients using GOST engine when ciphersuite `TLS_GOSTR341112_256_WITH_KUZNYECHIK_CTR_OMAC` is agreed and the server uses 512 bit GOST secret keys are vulnerable to buffer overflow. GOST engine version 3.0.1 contains a patch for this issue. Disabling ciphersuite `TLS_GOSTR341112_256_WITH_KUZNYECHIK_CTR_OMAC` is a possible workaround.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/gost-engine/engine
Files changed:
gost_ec_keyx.c
Commit message: On unpacking key blob output buffer size should be fixed

Related: CVE-2022-29242


Vulnerable code:
    if (!key) {
        *key_len = 32;
        return 1;
    }
    if (!key) {
        *key_len = 32;
        return 1;
    }
  

Fixed code:
    *key_len = 32;

    *key_len = 32;

    if (key == NULL) {
        *key_len = 32;
        return 1;
    }

    if (key != NULL && *key_len < 32) {
        GOSTerr(GOST_F_PKEY_GOST2018_ENCRYPT, GOST_R_INVALID_BUFFER_SIZE);
        return 0;
    }
CVE-2022-29242 (C, published 2022-05-24T15:15Z)
Description: value: GOST engine is a reference implementation of the Russian GOST crypto algorithms for OpenSSL. TLS clients using GOST engine when ciphersuite `TLS_GOSTR341112_256_WITH_KUZNYECHIK_CTR_OMAC` is agreed and the server uses 512 bit GOST secret keys are vulnerable to buffer overflow. GOST engine version 3.0.1 contains a patch for this issue. Disabling ciphersuite `TLS_GOSTR341112_256_WITH_KUZNYECHIK_CTR_OMAC` is a possible workaround.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/gost-engine/engine
Files changed:
gost_ec_keyx.c
Commit message: Fix buffer overrun in creating key transport blob according to RFC 9189, 4.2.4.2

Resolves: CVE-2022-29242


Vulnerable code:
    if ((*out_len = i2d_GOST_KEY_TRANSPORT(gkt, out ? &out : NULL)) > 0)

Fixed code:
    int res_len = 0;

    res_len = i2d_GOST_KEY_TRANSPORT(gkt, NULL);
    if (res_len <= 0) {
        GOSTerr(GOST_F_PKEY_GOST_ECCP_ENCRYPT, ERR_R_ASN1_LIB);
        goto err;
    }

    if (out == NULL) {
        *out_len = res_len;
    } else {
        if ((size_t)res_len > *out_len) {
            GOSTerr(GOST_F_PKEY_GOST_ECCP_ENCRYPT, GOST_R_INVALID_BUFFER_SIZE);
            goto err;
        }
        if ((*out_len = i2d_GOST_KEY_TRANSPORT(gkt, &out)) > 0)
            ret = 1;
        else
            GOSTerr(GOST_F_PKEY_GOST_ECCP_ENCRYPT, ERR_R_ASN1_LIB);
    }
CVE-2022-29242 (C, published 2022-05-24T15:15Z)
Description: value: GOST engine is a reference implementation of the Russian GOST crypto algorithms for OpenSSL. TLS clients using GOST engine when ciphersuite `TLS_GOSTR341112_256_WITH_KUZNYECHIK_CTR_OMAC` is agreed and the server uses 512 bit GOST secret keys are vulnerable to buffer overflow. GOST engine version 3.0.1 contains a patch for this issue. Disabling ciphersuite `TLS_GOSTR341112_256_WITH_KUZNYECHIK_CTR_OMAC` is a possible workaround.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/gost-engine/engine
Files changed:
e_gost_err.c
e_gost_err.h
gost_ec_keyx.c
Commit message: Fix buffer overrun in creating key transport blob according to RFC 9189, 4.2.4.1

Resolves: CVE-2022-29242


Vulnerable code:
    if ((*out_len = i2d_PSKeyTransport_gost(pst, out ? &out : NULL)) > 0)

Fixed code:
    {ERR_PACK(0, 0, GOST_R_INVALID_BUFFER_SIZE), "invalid buffer size"},
# define GOST_R_INVALID_BUFFER_SIZE                       140
    int res_len = 0;
    res_len = i2d_PSKeyTransport_gost(pst, NULL);
    if (res_len <= 0) {
        GOSTerr(GOST_F_PKEY_GOST2018_ENCRYPT, ERR_R_ASN1_LIB);
        goto err;
    }

    if (out == NULL) {
        *out_len = res_len;
    } else {
        if ((size_t)res_len > *out_len) {
            GOSTerr(GOST_F_PKEY_GOST2018_ENCRYPT, GOST_R_INVALID_BUFFER_SIZE);
            goto err;
        }
        if ((*out_len = i2d_PSKeyTransport_gost(pst, &out)) > 0)
            ret = 1;
        else
            GOSTerr(GOST_F_PKEY_GOST2018_ENCRYPT, ERR_R_ASN1_LIB);
    }
CVE-2014-3980 (C, published 2014-06-11T14:55Z)
Description: value: libfep 0.0.5 before 0.1.0 does not properly use UNIX domain sockets in the abstract namespace, which allows local users to gain privileges via unspecified vectors.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/ueno/libfep
Files changed:
fep/control.c
libfep/client.c
Commit message: Don't use abstract Unix domain sockets


Vulnerable code:
#ifdef __linux__
  sun.sun_path[0] = '\0';
  memcpy (sun.sun_path + 1, path, strlen (path));
  sun_len = offsetof (struct sockaddr_un, sun_path) + strlen (path) + 1;
  remove_control_socket (path);
#else
#endif
#ifdef __linux__
  sun.sun_path[0] = '\0';
  memcpy (sun.sun_path + 1, address, strlen (address));
  sun_len = offsetof (struct sockaddr_un, sun_path) + strlen (address) + 1;
#else
#endif

Fixed code: