hitoshura25/cvefixes huggingface dataset:
CVE-2023-46733 (PHP, published 2023-11-10T18:15Z)
Description: value: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 5.4.21 and 6.2.7 and prior to versions 5.4.31 and 6.3.8, `SessionStrategyListener` does not migrate the session after every successful login. It does so only in case the logged in user changes by means of checking the user identifier. In some use cases, the user identifier doesn't change between the verification phase and the successful login, while the token itself changes from one type (partially-authenticated) to another (fully-authenticated). When this happens, the session id should be regenerated to prevent possible session fixations, which is not the case at the moment. As of versions 5.4.31 and 6.3.8, Symfony now checks the type of the token in addition to the user identifier before deciding whether the session id should be regenerated.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-384 \u2014 Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
Repository: https://github.com/symfony/symfony
Files changed:
src/Symfony/Component/Security/Http/EventListener/SessionStrategyListener.php
src/Symfony/Component/Security/Http/Tests/EventListener/SessionStrategyListenerTest.php
Commit message: [Security] Fix possible session fixation when only the *token* changes


Vulnerable code:
            if ('' !== ($user ?? '') && $user === $previousUser) {

Fixed code:
            if ('' !== ($user ?? '') && $user === $previousUser && \get_class($token) === \get_class($previousToken)) {
use Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken;
    public function testRequestWithSamePreviousUserButDifferentTokenType()
    {
        $this->configurePreviousSession();

        $token = $this->createMock(NullToken::class);
        $token->expects($this->once())
            ->method('getUserIdentifier')
            ->willReturn('test');
        $previousToken = $this->createMock(UsernamePasswordToken::class);
        $previousToken->expects($this->once())
            ->method('getUserIdentifier')
            ->willReturn('test');

        $this->sessionAuthenticationStrategy->expects($this->once())->method('onAuthentication')->with($this->request, $token);

        $event = new LoginSuccessEvent($this->createMock(AuthenticatorInterface::class), new SelfValidatingPassport(new UserBadge('test', function () {})), $token, $this->request, null, 'main_firewall', $previousToken);

        $this->listener->onSuccessfulLogin($event);
    }
CVE-2023-46734 (Unknown, published 2023-11-10T18:15Z)
Description: value: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 2.0.0, 5.0.0, and 6.0.0 and prior to versions 4.4.51, 5.4.31, and 6.3.8, some Twig filters in CodeExtension use `is_safe=html` but don't actually ensure their input is safe. As of versions 4.4.51, 5.4.31, and 6.3.8, Symfony now escapes the output of the affected filters.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/symfony/symfony
Files changed:
Commit message: security #cve-2023-46734 [TwigBridge] Ensure CodeExtension's filters properly escape their input (nicolas-grekas, GromNaN)

This PR was merged into the 4.4 branch.


Vulnerable code:

Fixed code:
CVE-2023-46735 (PHP, published 2023-11-10T18:15Z)
Description: value: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in version 6.0.0 and prior to version 6.3.8, the error message in `WebhookController` returns unescaped user-submitted input. As of version 6.3.8, `WebhookController` now doesn't return any user-submitted input in its response.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/symfony/symfony
Files changed:
src/Symfony/Component/Webhook/Controller/WebhookController.php
Commit message: [Webhook] Remove user-submitted type from HTTP response


Vulnerable code:
            return new Response(sprintf('No parser found for webhook of type "%s".', $type), 404);

Fixed code:
            return new Response('No webhook parser found for the type given in the URL.', 404, ['Content-Type' => 'text/plain']);
CVE-2023-34094 (Python, published 2023-06-02T16:15Z)
Description: value: ChuanhuChatGPT is a graphical user interface for ChatGPT and many large language models. A vulnerability in versions 20230526 and prior allows unauthorized access to the config.json file of the privately deployed ChuanghuChatGPT project, when authentication is not configured. The attacker can exploit this vulnerability to steal the API keys in the configuration file. The vulnerability has been fixed in commit bfac445. As a workaround, setting up access authentication can help mitigate the vulnerability.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-306 \u2014 Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Repository: https://github.com/GaiZhenbiao/ChuanhuChatGPT
Files changed:
ChuanhuChatbot.py
Commit message: 增加 blocked path


Vulnerable code:

Fixed code:
        blocked_paths=["config.json"],
CVE-2016-9840 (C, published 2017-05-23T04:29Z)
Description: value: inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/madler/zlib
Files changed:
inftrees.c
Commit message: Remove offset pointer optimization in inftrees.c.

inftrees.c was subtracting an offset from a pointer to an array,
in order to provide a pointer that allowed indexing starting at
the offset. This is not compliant with the C standard, for which
the behavior of a pointer decremented before its allocated memory
is undefined. Per the recommendation of a security audit of the
zlib code by Trail of Bits and TrustInSoft, in support of the
Mozilla Foundation, this tiny optimization was removed, in order
to avoid the possibility of undefined behavior.


Vulnerable code:
    int end;                    /* use base and extra for symbol > end */
        end = 19;
        base -= 257;
        extra -= 257;
        end = 256;
        end = -1;
        if ((int)(work[sym]) < end) {
        else if ((int)(work[sym]) > end) {
            here.op = (unsigned char)(extra[work[sym]]);
            here.val = base[work[sym]];

Fixed code:
    unsigned match;             /* use base and extra for symbol >= match */
        match = 20;
        match = 257;
        match = 0;
        if (work[sym] + 1 < match) {
        else if (work[sym] >= match) {
            here.op = (unsigned char)(extra[work[sym] - match]);
            here.val = base[work[sym] - match];
CVE-2016-9842 (C, published 2017-05-23T04:29Z)
Description: value: The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/madler/zlib
Files changed:
inflate.c
Commit message: Avoid shifts of negative values inflateMark().

The C standard says that bit shifts of negative integers is
undefined.  This casts to unsigned values to assure a known
result.


Vulnerable code:
    if (strm == Z_NULL || strm->state == Z_NULL) return -1L << 16;
    return ((long)(state->back) << 16) +

Fixed code:
    if (strm == Z_NULL || strm->state == Z_NULL)
        return (long)(((unsigned long)0 - 1) << 16);
    return (long)(((unsigned long)((long)state->back)) << 16) +
CVE-2016-9843 (C, published 2017-05-23T04:29Z)
Description: value: The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/madler/zlib
Files changed:
crc32.c
Commit message: Avoid pre-decrement of pointer in big-endian CRC calculation.

There was a small optimization for PowerPCs to pre-increment a
pointer when accessing a word, instead of post-incrementing. This
required prefacing the loop with a decrement of the pointer,
possibly pointing before the object passed. This is not compliant
with the C standard, for which decrementing a pointer before its
allocated memory is undefined. When tested on a modern PowerPC
with a modern compiler, the optimization no longer has any effect.
Due to all that, and per the recommendation of a security audit of
the zlib code by Trail of Bits and TrustInSoft, in support of the
Mozilla Foundation, this "optimization" was removed, in order to
avoid the possibility of undefined behavior.


Vulnerable code:
#define DOBIG4 c ^= *++buf4; \
    buf4--;
    buf4++;

Fixed code:
#define DOBIG4 c ^= *buf4++; \
CVE-2022-37434 (C, published 2022-08-05T07:15Z)
Description: value: zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/madler/zlib
Files changed:
inflate.c
Commit message: Fix a bug when getting a gzip header extra field with inflate().

If the extra field was larger than the space the user provided with
inflateGetHeader(), and if multiple calls of inflate() delivered
the extra header data, then there could be a buffer overflow of the
provided space. This commit assures that provided space is not
exceeded.


Vulnerable code:
                        state->head->extra != Z_NULL) {
                        len = state->head->extra_len - state->length;

Fixed code:
                    len = state->head->extra_len - state->length;
                        state->head->extra != Z_NULL &&
                        len < state->head->extra_max) {
CVE-2021-31660 (Unknown, published 2021-06-18T22:15Z)
Description: value: RIOT-OS 2021.01 before commit 85da504d2dc30188b89f44c3276fc5a25b31251f contains a buffer overflow which could allow attackers to obtain sensitive information.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/RIOT-OS/RIOT
Files changed:
Commit message: Merge pull request #15947 from nmeum/pr/clif_get_attr_empty

clif: Don't access any data if input is empty

Vulnerable code:

Fixed code:
CVE-2021-31661 (Unknown, published 2021-06-18T22:15Z)
Description: value: RIOT-OS 2021.01 before commit 609c9ada34da5546cffb632a98b7ba157c112658 contains a buffer overflow that could allow attackers to obtain sensitive information.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/RIOT-OS/RIOT
Files changed:
Commit message: Merge pull request #15945 from nmeum/pr/clif_get_attr_bounds

clif: After incrementing pos, make sure it is still in bounds

Vulnerable code:

Fixed code:
CVE-2021-31662 (Unknown, published 2021-06-18T22:15Z)
Description: value: RIOT-OS 2021.01 before commit 07f1254d8537497552e7dce80364aaead9266bbe contains a buffer overflow which could allow attackers to obtain sensitive information.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/RIOT-OS/RIOT
Files changed:
Commit message: Merge pull request #15930 from nmeum/pr/uri_parser_scheme

uri_parser: check if uri is long enough to even contain a ://

Vulnerable code:

Fixed code:
CVE-2021-31663 (Unknown, published 2021-06-18T22:15Z)
Description: value: RIOT-OS 2021.01 before commit bc59d60be60dfc0a05def57d74985371e4f22d79 contains a buffer overflow which could allow attackers to obtain sensitive information.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/RIOT-OS/RIOT
Files changed:
Commit message: Merge pull request #15929 from cgundogan/pr/uriparser

uri_parser: fix out-of-bounds and additional enhancements

Vulnerable code:

Fixed code:
CVE-2021-31664 (Unknown, published 2021-06-18T22:15Z)
Description: value: RIOT-OS 2021.01 before commit 44741ff99f7a71df45420635b238b9c22093647a contains a buffer overflow which could allow attackers to obtain sensitive information.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/RIOT-OS/RIOT
Files changed:
Commit message: Merge pull request #15345 from nmeum/pr/sock_dns_overflow

sock_dns: Fix incorrect buffer bounds check

Vulnerable code:

Fixed code:
CVE-2023-24817 (Unknown, published 2023-05-30T16:15Z)
Description: value: RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send a crafted frame to the device resulting in an integer underflow and out of bounds access in the packet buffer. Triggering the access at the right time will corrupt other packets or the allocator metadata. Corrupting a pointer will lead to denial of service. This issue is fixed in version 2023.04. As a workaround, disable SRH in the network stack.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-191 \u2014 Integer Underflow (Wrap or Wraparound)
The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
Repository: https://github.com/RIOT-OS/RIOT
Files changed:
Commit message: Merge pull request from GHSA-xjgw-7638-29g5

gnrc_rpl_srh: check header fields consistency before substraction

Vulnerable code:

Fixed code:
CVE-2023-24817 (Unknown, published 2023-05-30T16:15Z)
Description: value: RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send a crafted frame to the device resulting in an integer underflow and out of bounds access in the packet buffer. Triggering the access at the right time will corrupt other packets or the allocator metadata. Corrupting a pointer will lead to denial of service. This issue is fixed in version 2023.04. As a workaround, disable SRH in the network stack.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/RIOT-OS/RIOT
Files changed:
Commit message: Merge pull request from GHSA-xjgw-7638-29g5

gnrc_rpl_srh: check header fields consistency before substraction

Vulnerable code:

Fixed code:
CVE-2023-24825 (Unknown, published 2023-05-30T16:15Z)
Description: value: RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send a crafted frame to the device to trigger a NULL pointer dereference leading to denial of service. This issue is fixed in version 2023.04. There are no known workarounds.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-252 \u2014 Unchecked Return Value
The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
Repository: https://github.com/RIOT-OS/RIOT
Files changed:
Commit message: Merge pull request from GHSA-xqm8-xj74-fjw2

gnrc_sixlowpan_iphc: check IPHC dispatch for truncation

Vulnerable code:

Fixed code:
CVE-2023-24825 (Unknown, published 2023-05-30T16:15Z)
Description: value: RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send a crafted frame to the device to trigger a NULL pointer dereference leading to denial of service. This issue is fixed in version 2023.04. There are no known workarounds.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/RIOT-OS/RIOT
Files changed:
Commit message: Merge pull request from GHSA-xqm8-xj74-fjw2

gnrc_sixlowpan_iphc: check IPHC dispatch for truncation

Vulnerable code:

Fixed code:
CVE-2023-24826 (Unknown, published 2023-05-30T17:15Z)
Description: value: RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send crafted frames to the device to trigger the usage of an uninitialized object leading to denial of service. This issue is fixed in version 2023.04. As a workaround, disable fragment forwarding or SFR.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-824 \u2014 Access of Uninitialized Pointer
The product accesses or uses a pointer that has not been initialized.
Repository: https://github.com/RIOT-OS/RIOT
Files changed:
Commit message: Merge pull request from GHSA-xfj4-9g7w-f4gh

fixes for CVE-2023-24826

Vulnerable code:

Fixed code:
CVE-2023-33973 (C, published 2023-05-30T17:15Z)
Description: value: RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. In versions 2023.01 and prior, an attacker can send a crafted frame which is forwarded by the device. During encoding of the packet a NULL pointer dereference occurs. This crashes the device leading to denial of service. A patch is available at pull request 19678. There are no known workarounds.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/RIOT-OS/RIOT
Files changed:
sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c
Commit message: gnrc_sixlowpan_iphc: fix NULL pointer dereference


Vulnerable code:
    ipv6_hdr_t *ipv6_hdr = pkt->next->data;

Fixed code:
    ipv6_hdr_t *ipv6_hdr;
    if (pkt->next == NULL) {
        DEBUG("6lo iphc: packet missing header\n");
        return 0;
    }
    ipv6_hdr = pkt->next->data;

        if (IS_USED(MODULE_GNRC_SIXLOWPAN_FRAG_MINFWD)) {
            gnrc_sixlowpan_frag_fb_t *fb = ctx;

            if (fb->pkt == pkt) {
                /* free provided fragmentation buffer */
                fb->pkt = NULL;
            }
        }
CVE-2023-33974 (C, published 2023-05-30T17:15Z)
Description: value: RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. In versions 2023.01 and prior, an attacker can send multiple crafted frames to the device to trigger a race condition. The race condition invalidates assumptions about the program state and leads to an invalid memory access resulting in denial of service. This issue is patched in pull request 19679. There are no known workarounds.
Severity: nan (CVSS v3 base score: 5.9)
Weakness: CWE-362 \u2014 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
Repository: https://github.com/RIOT-OS/RIOT
Files changed:
sys/net/gnrc/network_layer/sixlowpan/frag/sfr/gnrc_sixlowpan_frag_sfr.c
Commit message: gnrc_sixlowpan_frag_sfr: fix ARQ scheduler race-condition


Vulnerable code:
    fbuf->sfr.arq_timeout_event.msg.content.ptr = NULL;
    fbuf->sfr.arq_timeout_event.event.next = NULL;
    if (fbuf->sfr.arq_timeout_event.msg.content.ptr != NULL) {
            fbuf->sfr.arq_timeout_event.msg.content.ptr = NULL;

Fixed code:
static inline bool _arq_scheduled(gnrc_sixlowpan_frag_fb_t *fbuf)
{
    evtimer_event_t *ptr = _arq_timer.events;
    evtimer_event_t *event = &fbuf->sfr.arq_timeout_event.event;
    while (ptr) {
        if (ptr == event) {
            return true;
        }
        ptr = ptr->next;
    }
    return false;
}

    if (_arq_scheduled(fbuf)) {