hitoshura25/cvefixes huggingface dataset:
CVE-2019-20503 (C, published 2020-03-06T20:15Z)
Description: value: usrsctp before 2019-12-20 has out-of-bounds reads in sctp_load_addresses_from_init.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/sctplab/usrsctp
Files changed:
usrsctplib/netinet/sctp_auth.c
usrsctplib/netinet/sctp_pcb.c
Commit message: Improve input validation for some parameters having a too small
reported length.

Thanks to Natalie Silvanovich from Google for finding one of these
issues in the SCTP userland stack and reporting it.


Vulnerable code:
__FBSDID("$FreeBSD: head/sys/netinet/sctp_auth.c 352438 2019-09-17 09:46:42Z tuexen $");
		if ((plen == 0) || (offset + plen > length))
__FBSDID("$FreeBSD: head/sys/netinet/sctp_pcb.c 353477 2019-10-13 16:14:04Z markj $");
		if (plen == 0) {

Fixed code:
__FBSDID("$FreeBSD: head/sys/netinet/sctp_auth.c 355931 2019-12-20 15:25:08Z tuexen $");
		if ((plen < sizeof(struct sctp_paramhdr)) ||
		    (offset + plen > length))
__FBSDID("$FreeBSD: head/sys/netinet/sctp_pcb.c 355931 2019-12-20 15:25:08Z tuexen $");
		if (plen < sizeof(struct sctp_paramhdr)) {
			if (plen < sizeof(struct sctp_asconf_addrv4_param)) {
				return (-101);
			}
CVE-2015-1431 (Unknown, published 2015-02-10T17:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in includes/startup.php in phpBB before 3.0.13 allows remote attackers to inject arbitrary web script or HTML via vectors related to "Relative Path Overwrite."
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phpbb/phpbb
Files changed:
Commit message: Merge pull request #3316 from bantu/ticket/13531

[ticket/13531] Explicitly disallow trailing paths (e.g. PATH_INFO).

Vulnerable code:

Fixed code:
CVE-2015-1432 (PHP, published 2015-02-10T17:59Z)
Description: value: The message_options function in includes/ucp/ucp_pm_options.php in phpBB before 3.0.13 does not properly validate the form key, which allows remote attackers to conduct CSRF attacks and change the full folder setting via unspecified vectors.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/phpbb/phpbb
Files changed:
phpBB/includes/ucp/ucp_pm_options.php
Commit message: [ticket/13526] Correctly validate the ucp_pm_options form key.

PHPBB3-13526


Vulnerable code:
		check_form_key('ucp_pm_options', $config['form_token_lifetime'], $redirect_url);

Fixed code:
		if (!check_form_key('ucp_pm_options'))
		{
			trigger_error('FORM_INVALID');
		}
CVE-2015-3880 (Unknown, published 2017-09-19T15:29Z)
Description: value: Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of Google Chrome to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/phpbb/phpbb
Files changed:
Commit message: Merge remote-tracking branch 'phpbb-security/ticket/security-180' into prep-release-3.0.14

* phpbb-security/ticket/security-180:
  [ticket/security-180] Add tests for redirecting to main URL
  [ticket/security-180] Always fail when redirecting to an insecure URL
  [ticket/security-180] Make sure that redirect goes to full URL plus slash
  [ticket/security-180] Check if redirect URL contains board URL


Vulnerable code:

Fixed code:
CVE-2019-16993 (PHP, published 2019-09-30T12:15Z)
Description: value: In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting them.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/phpbb/phpbb
Files changed:
phpBB/includes/acp/acp_bbcodes.php
Commit message: [ticket/security-188] Check form key in acp_bbcodes

SECURITY-188


Vulnerable code:

Fixed code:
		$submit = $request->is_set_post('submit');
		if ($submit && !check_form_key($form_key))
		{
			trigger_error($user->lang['FORM_INVALID'] . adm_back_link($this->u_action), E_USER_WARNING);
		}
CVE-2023-5917 (Unknown, published 2023-11-02T11:15Z)
Description: value: A vulnerability, which was classified as problematic, has been found in phpBB up to 3.3.10. This issue affects the function main of the file phpBB/includes/acp/acp_icons.php of the component Smiley Pack Handler. The manipulation of the argument pak leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 3.3.11 is able to address this issue. The patch is named ccf6e6c255d38692d72fcb613b113e6eaa240aac. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-244307.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phpbb/phpbb
Files changed:
Commit message: Merge pull request #69 from phpbb/ticket/security-279

[ticket/security/279] Escape smilies URL and prevent paths in .pak filename


Vulnerable code:

Fixed code:
CVE-2022-29577 (Java, published 2022-04-21T23:15Z)
Description: value: OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content. NOTE: this issue exists because of an incomplete fix for CVE-2022-28367.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/nahsra/antisamy
Files changed:
src/main/java/org/owasp/validator/html/scan/AntiSamyDOMScanner.java
src/test/java/org/owasp/validator/html/test/AntiSamyTest.java
Commit message: Fix child node removal on style tag processing


Vulnerable code:
            if (ele.getChildNodes().getLength() > 0) {

                for (int i = 1; i < ele.getChildNodes().getLength(); i++) {




Fixed code:
            int childNodesCount = ele.getChildNodes().getLength();
            if (childNodesCount > 0) {
                 * Starting from the end due to list updating on the fly.
                for (int i = childNodesCount - 1; i >= 1; i--) {
        assertThat(as.scan("<select<style/>k<input<</>input/onfocus=alert(1)>", revised, AntiSamy.DOM).getCleanHTML(), not(containsString("input")));
        assertThat(as.scan("<select<style/>k<input<</>input/onfocus=alert(1)>", revised, AntiSamy.SAX).getCleanHTML(), not(containsString("input")));
        assertThat(as.scan("<select<style/>k<input<</>input/onfocus=alert(1)>", revised2, AntiSamy.DOM).getCleanHTML(), not(containsString("input")));
        assertThat(as.scan("<select<style/>k<input<</>input/onfocus=alert(1)>", revised2, AntiSamy.SAX).getCleanHTML(), not(containsString("input")));
CVE-2020-8955 (C, published 2020-02-12T22:15Z)
Description: value: irc_mode_channel_update in plugins/irc/irc-mode.c in WeeChat through 2.7 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a malformed IRC message 324 (channel mode).
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/weechat/weechat
Files changed:
ChangeLog.adoc
src/plugins/irc/irc-mode.c
Commit message: irc: fix crash when receiving a malformed message 324 (channel mode)

Thanks to Stuart Nevans Locke for reporting the issue.


Vulnerable code:
                    chanmode_found = 1;
                    if (set_flag == '+')
                        str_mode[0] = pos[0];
                        str_mode[1] = '\0';
                        strcat (new_modes, str_mode);
                        if (argument)
                            if (new_args[0])
                                strcat (new_args, " ");
                            strcat (new_args, argument);

Fixed code:
  * irc: fix crash when receiving a malformed message 324 (channel mode)
                    if (!chanmode_found)
                        chanmode_found = 1;
                        if (set_flag == '+')
                            str_mode[0] = pos[0];
                            str_mode[1] = '\0';
                            strcat (new_modes, str_mode);
                            if (argument)
                            {
                                if (new_args[0])
                                    strcat (new_args, " ");
                                strcat (new_args, argument);
                            }
CVE-2020-9760 (C, published 2020-03-23T16:15Z)
Description: value: An issue was discovered in WeeChat before 2.7.1 (0.3.4 to 2.7 are affected). When a new IRC message 005 is received with longer nick prefixes, a buffer overflow and possibly a crash can happen when a new mode is set for a nick.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/weechat/weechat
Files changed:
ChangeLog.adoc
src/plugins/irc/irc-nick.c
src/plugins/irc/irc-nick.h
src/plugins/irc/irc-server.c
Commit message: irc: fix crash when a new message 005 is received with longer nick prefixes

Thanks to Stuart Nevans Locke for reporting the issue.


Vulnerable code:
    int i, length_modes, length_chars;

Fixed code:
  * irc: fix crash when a new message 005 is received with longer nick prefixes
/*
 * Reallocates the "prefixes" string in all nicks of all channels on the server
 * (after 005 has been received).
 */

void
irc_nick_realloc_prefixes (struct t_irc_server *server,
                           int old_length, int new_length)
{
    struct t_irc_channel *ptr_channel;
    struct t_irc_nick *ptr_nick;
    char *new_prefixes;

    for (ptr_channel = server->channels; ptr_channel;
         ptr_channel = ptr_channel->next_channel)
    {
        for (ptr_nick = ptr_channel->nicks; ptr_nick;
             ptr_nick = ptr_nick->next_nick)
        {
            if (ptr_nick->prefixes)
            {
                new_prefixes = realloc (ptr_nick->prefixes, new_length + 1);
                if (new_prefixes)
                {
                    ptr_nick->prefixes = new_prefixes;
                    if (new_length > old_length)
                    {
                        memset (ptr_nick->prefixes + old_length,
                                ' ',
                                new_length - old_length);
                    }
                    ptr_nick->prefixes[new_length] = '\0';
                }
            }
            else
            {
                ptr_nick->prefixes = malloc (new_length + 1);
                if (ptr_nick->prefixes)
                {
                    memset (ptr_nick->prefixes, ' ', new_length);
                    ptr_nick->prefixes[new_length] = '\0';
                }
            }
        }
    }
}

extern void irc_nick_realloc_prefixes (struct t_irc_server *server,
                                       int old_length, int new_length);
    int i, old_length_chars, length_modes, length_chars;
    old_length_chars = (server->prefix_chars) ?
        strlen (server->prefix_chars) : 0;


    length_chars = (server->prefix_chars) ? strlen (server->prefix_chars) : 0;
    if (server->prefix_chars && (length_chars != old_length_chars))
        irc_nick_realloc_prefixes (server, old_length_chars, length_chars);
CVE-2021-36980 (C, published 2021-07-20T07:15Z)
Description: value: Open vSwitch (aka openvswitch) 2.11.0 through 2.15.0 has a use-after-free in decode_NXAST_RAW_ENCAP (called from ofpact_decode and ofpacts_decode) during the decoding of a RAW_ENCAP action.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/openvswitch/ovs
Files changed:
lib/ofp-actions.c
tests/automake.mk
tests/fuzz-regression-list.at
Commit message: ofp-actions: Fix use-after-free while decoding RAW_ENCAP.

While decoding RAW_ENCAP action, decode_ed_prop() might re-allocate
ofpbuf if there is no enough space left.  However, function
'decode_NXAST_RAW_ENCAP' continues to use old pointer to 'encap'
structure leading to write-after-free and incorrect decoding.

  ==3549105==ERROR: AddressSanitizer: heap-use-after-free on address
  0x60600000011a at pc 0x0000005f6cc6 bp 0x7ffc3a2d4410 sp 0x7ffc3a2d4408
  WRITE of size 2 at 0x60600000011a thread T0
    #0 0x5f6cc5 in decode_NXAST_RAW_ENCAP lib/ofp-actions.c:4461:20
    #1 0x5f0551 in ofpact_decode ./lib/ofp-actions.inc2:4777:16
    #2 0x5ed17c in ofpacts_decode lib/ofp-actions.c:7752:21
    #3 0x5eba9a in ofpacts_pull_openflow_actions__ lib/ofp-actions.c:7791:13
    #4 0x5eb9fc in ofpacts_pull_openflow_actions lib/ofp-actions.c:7835:12
    #5 0x64bb8b in ofputil_decode_packet_out lib/ofp-packet.c:1113:17
    #6 0x65b6f4 in ofp_print_packet_out lib/ofp-print.c:148:13
    #7 0x659e3f in ofp_to_string__ lib/ofp-print.c:1029:16
    #8 0x659b24 in ofp_to_string lib/ofp-print.c:1244:21
    #9 0x65a28c in ofp_print lib/ofp-print.c:1288:28
    #10 0x540d11 in ofctl_ofp_parse utilities/ovs-ofctl.c:2814:9
    #11 0x564228 in ovs_cmdl_run_command__ lib/command-line.c:247:17
    #12 0x56408a in ovs_cmdl_run_command lib/command-line.c:278:5
    #13 0x5391ae in main utilities/ovs-ofctl.c:179:9
    #14 0x7f6911ce9081 in __libc_start_main (/lib64/libc.so.6+0x27081)
    #15 0x461fed in _start (utilities/ovs-ofctl+0x461fed)

Fix that by getting a new pointer before using.

Credit to OSS-Fuzz.

Fuzzer regression test will fail only with AddressSanitizer enabled.

Reported-at: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27851
Fixes: f839892a206a ("OF support and translation of generic encap and decap")
Acked-by: William Tu <u9012063@gmail.com>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>


Vulnerable code:
	tests/fuzz-regression/ofp_print_fuzzer-6502620041576448

Fixed code:
    const size_t encap_ofs = out->size;
    encap = ofpbuf_at_assert(out, encap_ofs, sizeof *encap);
	tests/fuzz-regression/ofp_print_fuzzer-6502620041576448 \
	tests/fuzz-regression/ofp_print_fuzzer-6540965472632832
TEST_FUZZ_REGRESSION([ofp_print_fuzzer-6540965472632832])
CVE-2021-3905 (C, published 2022-08-23T16:15Z)
Description: value: A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-401 \u2014 Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
Repository: https://github.com/openvswitch/ovs
Files changed:
lib/ipf.c
Commit message: ipf: release unhandled packets from the batch

Since 640d4db788ed ("ipf: Fix a use-after-free error, ...") the ipf
framework unconditionally allocates a new dp_packet to track
individual fragments.  This prevents a use-after-free.  However, an
additional issue was present - even when the packet buffer is cloned,
if the ip fragment handling code keeps it, the original buffer is
leaked during the refill loop.  Even in the original processing code,
the hardcoded dnsteal branches would always leak a packet buffer from
the refill loop.

This can be confirmed with valgrind:

==717566== 16,672 (4,480 direct, 12,192 indirect) bytes in 8 blocks are definitely lost in loss record 390 of 390
==717566==    at 0x484086F: malloc (vg_replace_malloc.c:380)
==717566==    by 0x537BFD: xmalloc__ (util.c:137)
==717566==    by 0x537BFD: xmalloc (util.c:172)
==717566==    by 0x46DDD4: dp_packet_new (dp-packet.c:153)
==717566==    by 0x46DDD4: dp_packet_new_with_headroom (dp-packet.c:163)
==717566==    by 0x550AA6: netdev_linux_batch_rxq_recv_sock.constprop.0 (netdev-linux.c:1262)
==717566==    by 0x5512AF: netdev_linux_rxq_recv (netdev-linux.c:1511)
==717566==    by 0x4AB7E0: netdev_rxq_recv (netdev.c:727)
==717566==    by 0x47F00D: dp_netdev_process_rxq_port (dpif-netdev.c:4699)
==717566==    by 0x47FD13: dpif_netdev_run (dpif-netdev.c:5957)
==717566==    by 0x4331D2: type_run (ofproto-dpif.c:370)
==717566==    by 0x41DFD8: ofproto_type_run (ofproto.c:1768)
==717566==    by 0x40A7FB: bridge_run__ (bridge.c:3245)
==717566==    by 0x411269: bridge_run (bridge.c:3310)
==717566==    by 0x406E6C: main (ovs-vswitchd.c:127)

The fix is to delete the original packet when it isn't able to be
reinserted into the packet batch.  Subsequent valgrind runs show that
the packets are not leaked from the batch any longer.

Fixes: 640d4db788ed ("ipf: Fix a use-after-free error, and remove the 'do_not_steal' flag.")
Fixes: 4ea96698f667 ("Userspace datapath: Add fragmentation handling.")
Reported-by: Wan Junjie <wanjunjie@bytedance.com>
Reported-at: https://github.com/openvswitch/ovs-issues/issues/226
Signed-off-by: Aaron Conole <aconole@redhat.com>
Reviewed-by: David Marchand <david.marchand@redhat.com>
Tested-by: Wan Junjie <wanjunjie@bytedance.com>
Signed-off-by: Alin-Gabriel Serdean <aserdean@ovn.org>


Vulnerable code:

Fixed code:
            } else {
                dp_packet_delete(pkt);
CVE-2020-36628 (Other, published 2022-12-25T11:15Z)
Description: value: A vulnerability classified as critical has been found in Calsign APDE. This affects the function handleExtract of the file APDE/src/main/java/com/calsignlabs/apde/build/dag/CopyBuildTask.java of the component ZIP File Handler. The manipulation leads to path traversal. Upgrading to version 0.5.2-pre2-alpha is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216747.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/Calsign/APDE
Files changed:
APDE/src/main/java/com/calsignlabs/apde/build/dag/CopyBuildTask.java
build.gradle
Commit message: fix zip path traversal vulnerability


Vulnerable code:
        classpath 'com.android.tools.build:gradle:3.6.2'

Fixed code:
				if (file.getCanonicalPath().startsWith(folder.getCanonicalPath())) {
					System.err.println("Aborted zip! Attempted zip path traversal attack extracting to: " + folder.getAbsolutePath());
					return false;
				}
        classpath 'com.android.tools.build:gradle:3.6.3'
CVE-2022-48682 (C, published 2024-04-26T01:15Z)
Description: value: In deletefiles in FDUPES before 2.2.0, a TOCTOU race condition allows arbitrary file deletion via a symlink.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/adrianlopezroche/fdupes
Files changed:
Makefile.am
fdupes.c
ncurses-commands.c
removeifnotchanged.c
removeifnotchanged.h
Commit message: Call stat() before deleting any file to ensure it's still the same file.


Vulnerable code:
      if (remove(dupelist[x]->d_name) == 0) {
        printf("-- unable to delete file!\n");
    if (remove(to_delete->d_name) == 0) {
      printf("-- unable to delete file!\n");
          if (ismatch && remove(groups[g].files[f].file->d_name) == 0)

Fixed code:
 removeifnotchanged.c\
 removeifnotchanged.h\
 removeifnotchanged.c\
 removeifnotchanged.h\
#include "removeifnotchanged.h"
  char *errorstring;
      if (removeifnotchanged(dupelist[x], &errorstring) == 0) {
        printf("-- unable to delete file: %s!\n", errorstring);
  char *errorstring;
    if (removeifnotchanged(to_delete, &errorstring) == 0) {
      printf("-- unable to delete file: %s!\n", errorstring);
#include "removeifnotchanged.h"
          if (ismatch && removeifnotchanged(groups[g].files[f].file, 0) == 0)
#include "removeifnotchanged.h"
#include <errno.h>
#include <string.h>
#include <stdio.h>

int removeifnotchanged(const file_t *file, char **errorstring)
{
  int result;
  struct stat st;

  static char *filechanged = "File contents changed during processing";
  static char *unknownerror = "Unknown error";

  stat(file->d_name, &st);

  if (file->device != st.st_dev ||
      file->inode != st.st_ino ||
      file->ctime != st.st_ctime ||
      file->mtime != st.st_mtime ||
      file->size != st.st_size)
  {
    if (errorstring != 0)
        *errorstring = filechanged;

    return -2;
  }
  else
  {
    result = remove(file->d_name);

    if (result != 0 && errorstring != 0)
    {
      *errorstring = strerror(errno);

      if (*errorstring == 0)
        *errorstring = unknownerror;
    }

    return result;
  }
}
#ifndef REMOVEIFNOTCHANGED_H
#define REMOVEIFNOTCHANGED_H

#include "fdupes.h"

int removeifnotchanged(const file_t *file, char **errorstring);

#endif