hitoshura25/cvefixes huggingface dataset:
CVE-2021-39218 (Unknown, published 2021-09-17T21:15Z)
Description: value: Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.26.0 and before version 0.30.0 is affected by a memory unsoundness vulnerability. There was an invalid free and out-of-bounds read and write bug when running Wasm that uses `externref`s in Wasmtime. To trigger this bug, Wasmtime needs to be running Wasm that uses `externref`s, the host creates non-null `externrefs`, Wasmtime performs a garbage collection (GC), and there has to be a Wasm frame on the stack that is at a GC safepoint where there are no live references at this safepoint, and there is a safepoint with live references earlier in this frame's function. Under this scenario, Wasmtime would incorrectly use the GC stack map for the safepoint from earlier in the function instead of the empty safepoint. This would result in Wasmtime treating arbitrary stack slots as `externref`s that needed to be rooted for GC. At the *next* GC, it would be determined that nothing was referencing these bogus `externref`s (because nothing could ever reference them, because they are not really `externref`s) and then Wasmtime would deallocate them and run `<ExternRef as Drop>::drop` on them. This results in a free of memory that is not necessarily on the heap (and shouldn't be freed at this moment even if it was), as well as potential out-of-bounds reads and writes. Even though support for `externref`s (via the reference types proposal) is enabled by default, unless you are creating non-null `externref`s in your host code or explicitly triggering GCs, you cannot be affected by this bug. We have reason to believe that the effective impact of this bug is relatively small because usage of `externref` is currently quite rare. This bug has been patched and users should upgrade to Wasmtime version 0.30.0. If you cannot upgrade Wasmtime at this time, you can avoid this bug by disabling the reference types proposal by passing `false` to `wasmtime::Config::wasm_reference_types`.
Severity: LOW (CVSS v3 base score: 6.3)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/bytecodealliance/wasmtime
Files changed:
Commit message: Merge pull request from GHSA-4873-36h9-wv49

Stop doing fuzzy search for stack maps

Vulnerable code:

Fixed code:
CVE-2021-39219 (Unknown, published 2021-09-17T20:15Z)
Description: value: Wasmtime is an open source runtime for WebAssembly & WASI. Wasmtime before version 0.30.0 is affected by a type confusion vulnerability. As a Rust library the `wasmtime` crate clearly marks which functions are safe and which are `unsafe`, guaranteeing that if consumers never use `unsafe` then it should not be possible to have memory unsafety issues in their embeddings of Wasmtime. An issue was discovered in the safe API of `Linker::func_*` APIs. These APIs were previously not sound when one `Engine` was used to create the `Linker` and then a different `Engine` was used to create a `Store` and then the `Linker` was used to instantiate a module into that `Store`. Cross-`Engine` usage of functions is not supported in Wasmtime and this can result in type confusion of function pointers, resulting in being able to safely call a function with the wrong type. Triggering this bug requires using at least two `Engine` values in an embedding and then additionally using two different values with a `Linker` (one at the creation time of the `Linker` and another when instantiating a module with the `Linker`). It's expected that usage of more-than-one `Engine` in an embedding is relatively rare since an `Engine` is intended to be a globally shared resource, so the expectation is that the impact of this issue is relatively small. The fix implemented is to change this behavior to `panic!()` in Rust instead of silently allowing it. Using different `Engine` instances with a `Linker` is a programmer bug that `wasmtime` catches at runtime. This bug has been patched and users should upgrade to Wasmtime version 0.30.0. If you cannot upgrade Wasmtime and are using more than one `Engine` in your embedding it's recommended to instead use only one `Engine` for the entire program if possible. An `Engine` is designed to be a globally shared resource that is suitable to have only one for the lifetime of an entire process. If using multiple `Engine`s is required then code should be audited to ensure that `Linker` is only used with one `Engine`.
Severity: LOW (CVSS v3 base score: 6.3)
Weakness: CWE-843 \u2014 Access of Resource Using Incompatible Type ('Type Confusion')
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
Repository: https://github.com/bytecodealliance/wasmtime
Files changed:
Commit message: Merge pull request from GHSA-q879-9g95-56mx

Add an assertion that a `HostFunc`'s `store` agrees on engines

Vulnerable code:

Fixed code:
CVE-2023-27477 (Other, published 2023-03-08T21:15Z)
Description: value: wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's code generation backend, Cranelift, has a bug on x86_64 platforms for the WebAssembly `i8x16.select` instruction which will produce the wrong results when the same operand is provided to the instruction and some of the selected indices are greater than 16. There is an off-by-one error in the calculation of the mask to the `pshufb` instruction which causes incorrect results to be returned if lanes are selected from the second vector. This codegen bug has been fixed in Wasmtiem 6.0.1, 5.0.1, and 4.0.1. Users are recommended to upgrade to these updated versions. If upgrading is not an option for you at this time, you can avoid this miscompilation by disabling the Wasm simd proposal. Additionally the bug is only present on x86_64 hosts. Other platforms such as AArch64 and s390x are not affected.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: CWE-193 \u2014 Off-by-one Error
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
Repository: https://github.com/bytecodealliance/wasmtime
Files changed:
cranelift/codegen/src/isa/x64/lower/isle.rs
cranelift/filetests/filetests/isa/x64/simd-lane-access-compile.clif
cranelift/filetests/filetests/runtests/simd-shuffle.clif
Commit message: Merge pull request from GHSA-xm67-587q-r2vw

This commit fixes an off-by-one error in the subtraction of indices when
shuffling a vector with itself. Lanes 16-and-above are mapped to select
from the first vector since the first and second element are the same,
but the subtraction was with 15 rather than 16 by accident.

Vulnerable code:
            .map(|&b| if b > 15 { b.wrapping_sub(15) } else { b })
;   addb %al, (%rcx, %rax)

Fixed code:
            .map(|&b| if b > 15 { b.wrapping_sub(16) } else { b })
;   addb %al, (%rbx)
;   addl %eax, (%rax)

function %shuffle1(i8x16) -> i8x16 {
block0(v0: i8x16):
    v1 = shuffle v0, v0, [8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23]
    return v1
}
; run: %shuffle1([0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15]) == [8 9 10 11 12 13 14 15 0 1 2 3 4 5 6 7]
CVE-2024-30266 (Rust, published 2024-04-04T16:15Z)
Description: value: wasmtime is a runtime for WebAssembly. The 19.0.0 release of Wasmtime contains a regression introduced during its development which can lead to a guest WebAssembly module causing a panic in the host runtime. A valid WebAssembly module, when executed at runtime, may cause this panic. This vulnerability has been patched in version 19.0.1.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/bytecodealliance/wasmtime
Files changed:
crates/runtime/src/instance.rs
tests/misc_testsuite/externref-table-dropped-segment-issue-8281.wast
Commit message: Fix a panic using tables with the wrong type (#8283)

This commit fixes an accidental issue introduced in #8018 where using an
element segment which had been dropped with an `externref` table would
cause a panic. The panic happened due to an assertion that tables are
being used with the right type of item and that was being mismatched.
The underlying issue was that dropped element segments are modeled as an
empty element segment but the empty element segment was using the
"functions" encoding as opposed to the "expressions" encoding. This
meant that code later assumed that due to the use of functions the table
must be a table-of-functions, but this was not correct for
externref-based tables.

The fix in this commit is to instead model the encoding as an
"expressions" list which means that the table type is dispatched on to
call the appropriate initializer.

There is no memory safety issue with this mistake as the assertion was
specifically targetted at preventing memory safety. This does, however,
enable any WebAssembly module to panic a host.

Closes #8281

Vulnerable code:
        let empty = TableSegmentElements::Functions(Box::new([]));

Fixed code:
        // NB: fall back to an expressions-based list of elements which doesn't
        // have static type information (as opposed to `Functions`) since we
        // don't know just yet what type the table has. The type will be be
        // inferred in the next step within `table_init_segment`.
        let empty = TableSegmentElements::Expressions(Box::new([]));

(module
  (table $t 0 0 externref)

  (func (export "f1")
    (i32.const 0)
    (i32.const 0)
    (i32.const 0)
    (table.init $t $declared)
  )

  (func (export "f2")
    (i32.const 0)
    (i32.const 0)
    (i32.const 0)
    (table.init $t $passive)

    (elem.drop $passive)

    (i32.const 0)
    (i32.const 0)
    (i32.const 0)
    (table.init $t $passive)
  )

  (func (export "f3")
    (i32.const 0)
    (i32.const 0)
    (i32.const 0)
    (table.init $t $active)
  )

  (elem $declared declare externref)
  (elem $passive externref)
  (elem $active (i32.const 0) externref)
)

(assert_return (invoke "f1"))
(assert_return (invoke "f2"))
(assert_return (invoke "f3"))
CVE-2021-4296 (Unknown, published 2022-12-29T09:15Z)
Description: value: A vulnerability, which was classified as problematic, has been found in w3c Unicorn. This issue affects the function ValidatorNuMessage of the file src/org/w3c/unicorn/response/impl/ValidatorNuMessage.java. The manipulation of the argument message leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 51f75c31f7fc33859a9a571311c67ae4e95d9c68. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217019.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/w3c/Unicorn
Files changed:
Commit message: Merge pull request #212 from w3c/nu-xss

Escape HTML in messages extracted from Validator NU output

Vulnerable code:

Fixed code:
CVE-2020-24390 (PHP, published 2020-08-27T16:15Z)
Description: value: eonweb in EyesOfNetwork before 5.3-7 does not properly escape the username on the /module/admin_logs page, which might allow pre-authentication stored XSS during login/logout logs recording.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/EyesOfNetworkCommunity/eonweb
Files changed:
include/function.php
Commit message: FIX 2.4 protect login/logout logs recording


Vulnerable code:
	if($user)
	elseif(isset($_COOKIE['user_name']))
		sqlrequest($database_eonweb,"insert into logs values ('','".time()."','".$_COOKIE['user_name']."','$module','$command','".$_SERVER["REMOTE_ADDR"]."');");

Fixed code:
	if($user){
		$user = htmlspecialchars($user);
	}elseif(isset($_COOKIE['user_name'])){
		$user = htmlspecialchars($_COOKIE['user_name']);
		sqlrequest($database_eonweb,"insert into logs values ('','".time()."','".$user."','$module','$command','".$_SERVER["REMOTE_ADDR"]."');");
	}
CVE-2024-24762 (Other, published 2024-02-05T15:15Z)
Description: value: `python-multipart` is a streaming multipart parser for Python. When using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Type` header, including options. An attacker could send a custom-made `Content-Type` option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely (minutes or more) while holding the main event loop. This means that process can't handle any more requests, leading to regular expression denial of service. This vulnerability has been patched in version 0.0.7.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/tiangolo/fastapi
Files changed:
pyproject.toml
requirements-tests.txt
Commit message: Merge pull request from GHSA-qf9m-vfgh-m389



Vulnerable code:
    "python-multipart >=0.0.5",
python-multipart >=0.0.5,<0.0.7

Fixed code:
    "python-multipart >=0.0.7",
python-multipart >=0.0.7,<0.1.0
CVE-2022-1825 (PHP, published 2022-05-23T11:16Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository collectiveaccess/providence prior to 1.8.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/collectiveaccess/providence
Files changed:
app/controllers/system/ErrorController.php
app/lib/ApplicationError.php
app/lib/Controller/Request/RequestHTTP.php
Commit message: Print potential XSS in error message handler


Vulnerable code:
	# -------------------------------------------------------
	
		$this->opn_error_number = $pn_error_number;
			return "Unknown error: ".$this->opn_error_number;
					if(caGetOption('urldecode', $pa_options, true)) {

Fixed code:
		$this->opn_error_number = (int)$pn_error_number;
			return "Unknown error: ".(int)$this->opn_error_number;
		
		$purified = false;
		    $purified = true;
					if(!$purified && caGetOption('urldecode', $pa_options, true)) {
CVE-2021-4258 (Other, published 2022-12-19T14:15Z)
Description: value: A vulnerability was found in whohas. It has been rated as problematic. This issue affects some unknown processing of the component Package Information Handler. The manipulation leads to cleartext transmission of sensitive information. The attack may be initiated remotely. The real existence of this vulnerability is still doubted at the moment. The name of the patch is 667c3e2e9178f15c23d7918b5db25cd0792c8472. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216251. NOTE: Most sources redirect to the encrypted site which limits the possibilities of an attack.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-319 \u2014 Cleartext Transmission of Sensitive Information
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
Repository: https://github.com/whohas/whohas
Files changed:
whohas
Commit message: Use https when checking package information

Prevents network attackers from manipulating the displayed information.

Stick to http for Mandriva and SourceMage,
since they don't appear to support https.


Vulnerable code:
	my $baseurl = "http://dl.fedoraproject.org/pub/fedora/linux/releases/";
	my $baseurl = "http://www.macports.org";
	my $baseurl = "http://pdb.finkproject.org/pdb/";
	my $query = "http://www.freebsd.org/cgi/ports.cgi?query=".$_[0]."&stype=all";
			push @urls,  "http://www.freebsd.org/cgi/ports.cgi?stype=all&query=$names[$now]";
	my $baseurl = 'http://ftp.openbsd.org/pub/OpenBSD/'.$rel.'/packages/'.$arch.'/';
	my $baseurl = "http://www.openbsd.org/".$rel.'_packages/';
	my $baseurl = "http://www.cygwin.com/packages";
	my $gentoobase = "http://gpo.zugaina.org/";
	my $gentoobaseofficial = "http://packages.gentoo.org/package";
	my $slackbase  = "http://packages.slackware.com/";
	&debuntu('http://packages.debian.org','Debian',\@dists,$_[0]);
	&debuntu('http://packages.ubuntu.com','Ubuntu',\@array,$_[0]);
	my $opensusebase = "http://software.opensuse.org";
	my @lines = split /\n|<br\/>/, &fetchdoc("http://pkgsrc.se/search.php?so=".$_[0]);

Fixed code:
	my $baseurl = "https://dl.fedoraproject.org/pub/fedora/linux/releases/";
	my $baseurl = "https://www.macports.org";
	my $baseurl = "https://pdb.finkproject.org/pdb/";
	my $query = "https://www.freebsd.org/cgi/ports.cgi?query=".$_[0]."&stype=all";
			push @urls,  "https://www.freebsd.org/cgi/ports.cgi?stype=all&query=$names[$now]";
	my $baseurl = 'https://ftp.openbsd.org/pub/OpenBSD/'.$rel.'/packages/'.$arch.'/';
	my $baseurl = "https://www.openbsd.org/".$rel.'_packages/';
	my $baseurl = "https://www.cygwin.com/packages";
	my $gentoobase = "https://gpo.zugaina.org/";
	my $gentoobaseofficial = "https://packages.gentoo.org/package";
	my $slackbase  = "https://packages.slackware.com/";
	&debuntu('https://packages.debian.org','Debian',\@dists,$_[0]);
	&debuntu('https://packages.ubuntu.com','Ubuntu',\@array,$_[0]);
	my $opensusebase = "https://software.opensuse.org";
	my @lines = split /\n|<br\/>/, &fetchdoc("https://pkgsrc.se/search.php?so=".$_[0]);
CVE-2013-7137 (PHP, published 2014-01-26T01:55Z)
Description: value: The "remember me" functionality in login.php in Burden before 1.8.1 allows remote attackers to bypass authentication and gain privileges by setting the burden_user_rememberme cookie to 1.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/joshf/Burden
Files changed:
login.php
logout.php
Commit message: Remove remember me until i can think of a better solution. Closes #2


Vulnerable code:
    
//If cookie is set, skip login
if (isset($_COOKIE["burden_user_rememberme"])) {
    $id = $_COOKIE["burden_user_rememberme"];
    $getid = mysql_query("SELECT `id` FROM `Users` WHERE `id` = \"$id\"");
    if (mysql_num_rows($getid) == 0) {
        header("Location: logout.php");
        exit;
    }
    $userinforesult = mysql_fetch_assoc($getid); 
    $_SESSION["burden_user"] = $userinforesult["id"];
}
<div class="control-group">
<div class="controls">
<label class="checkbox">
<input type="checkbox" id="rememberme" name="rememberme"> Remember Me
</label>
</div>
</div>
if (isset($_COOKIE["burden_user_rememberme"])) {
	setcookie("burden_user_rememberme", "", time()-86400);
}


Fixed code:
CVE-2021-41190 (Markdown, published 2021-11-17T20:15Z)
Description: value: The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both “manifests” and “layers” fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. The OCI Distribution Specification has been updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both “manifests” and “layers” fields or “manifests” and “config” fields if they are unable to update to version 1.0.1 of the spec.
Severity: MEDIUM (CVSS v3 base score: 5)
Weakness: CWE-843 \u2014 Access of Resource Using Incompatible Type ('Type Confusion')
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
Repository: https://github.com/opencontainers/distribution-spec
Files changed:
spec.md
Commit message: spec: clarify handling regarding Content-type header

Signed-off-by: Vincent Batts <vbatts@hashbangbash.com>


Vulnerable code:
For more information on the use of `Accept` headers and content negotiation, please see [Content Negotiation](./content-negotiation.md)
<manifest byte stream>

Fixed code:
The `Content-Type` header SHOULD match what the client [pushed as the manifest's `Content-Type`](#pushing-manifests).
If the manifest has a `mediaType` field, clients SHOULD reject unless the `mediaType` field's value matches the type specified by the `Content-Type` header.
For more information on the use of `Accept` headers and content negotiation, please see [Content Negotiation](./content-negotiation.md).

Clients SHOULD set the `Content-Type` header to the type of the manifest being pushed.
All manifests SHOULD include a `mediaType` field declaring the type of the manifest being pushed.
If a manifest includes a `mediaType` field, clients MUST set the `Content-Type` header to the value specified by the `mediaType` field.

Manifest byte stream:
{
  "mediaType": "application/vnd.oci.image.manifest.v1+json",
  ...
}
CVE-2013-4455 (Other, published 2014-05-14T19:55Z)
Description: value: Katello Installer before 0.0.18 uses world-readable permissions for /etc/pki/tls/private/katello-node.key when deploying a child Pulp node, which allows local users to obtain the private key by reading the file.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/Katello/katello-installer
Files changed:
modules/apache/manifests/certs.pp
modules/certs/lib/puppet/provider/katello_ssl_tool.rb
modules/certs/lib/puppet/provider/privkey/katello_ssl_tool.rb
modules/kafo/manifests/foreman_certs.pp
modules/kafo/manifests/foreman_proxy_certs.pp
modules/kafo/manifests/puppet_certs.pp
Commit message: 1021119 - make sure private keys are never world readable

This should prevent similar mistakes in future.


Vulnerable code:
      File.open(resource[:path], "w") { |f| f << expected_content }
      mode => "400"
      mode  => "400"
      mode => "400"

Fixed code:
    } ->
    file { $apache_ssl_key:
      owner => $apache::params::user,
      group => $apache::params::group,
      mode  => '0400';
      File.open(resource[:path], "w", mode) { |f| f << expected_content }
    def mode
      0644
    end

  def mode
    0400
  end

      mode => "0400"
      mode  => "0400"
      mode => "0400"