hitoshura25/cvefixes huggingface dataset:
CVE-2016-9936 (C, published 2017-01-04T20:59Z)
Description: value: The unserialize implementation in ext/standard/var.c in PHP 7.x before 7.0.14 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted serialized data.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6834.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/php/php-src
Files changed:
ext/standard/tests/serialize/bug70172_2.phpt
ext/standard/var.c
Commit message: Complete the fix of bug #70172 for PHP 7


Vulnerable code:
Unfinished merge, needs fix.
      &object(obj2)#%d (1) {
}
	if (!php_var_unserialize_ex(return_value, &p, p + buf_len, &var_hash, class_hash)) {
		zval_ptr_dtor(return_value);
	/* We should keep an reference to return_value to prevent it from being dtor
	   in case nesting calls to unserialize */
	var_push_dtor(&var_hash, return_value);

Fixed code:
      object(obj2)#%d (1) {
}
	zval *retval;
	retval = var_tmp_var(&var_hash);
	if (!php_var_unserialize_ex(retval, &p, p + buf_len, &var_hash, class_hash)) {

	ZVAL_COPY(return_value, retval);
CVE-2017-11142 (Other, published 2017-07-10T14:29Z)
Description: value: In PHP before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a CPU consumption denial of service attack by injecting long form variables, related to main/php_variables.c.
Severity: HIGH (CVSS v3 base score: 7.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/php/php-src
Files changed:
NEWS
main/php_variables.c
Commit message: Fix bug #73807


Vulnerable code:
	char *ksep, *vsep, *val;
	vsep = memchr(var->ptr, '&', var->end - var->ptr);

Fixed code:
- Core:
  . Fixed bug #73807 (Performance problem with processing large post request).
    (Nikita)


	/* Bytes in ptr that have already been scanned for '&' */
	size_t already_scanned;
	char *start, *ksep, *vsep, *val;
	start = var->ptr + var->already_scanned;
	vsep = memchr(start, '&', var->end - start);
			var->already_scanned = var->end - var->ptr;
	var->already_scanned = 0;
CVE-2017-11142 (C, published 2017-07-10T14:29Z)
Description: value: In PHP before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a CPU consumption denial of service attack by injecting long form variables, related to main/php_variables.c.
Severity: HIGH (CVSS v3 base score: 7.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/php/php-src
Files changed:
main/php_variables.c
Commit message: Fix bug #73807


Vulnerable code:
	char *ksep, *vsep, *val;
	vsep = memchr(var->ptr, '&', var->end - var->ptr);
	if (!eof) {

Fixed code:

	/* Bytes in ptr that have already been scanned for '&' */
	size_t already_scanned;
	char *start, *ksep, *vsep, *val;
	start = var->ptr + var->already_scanned;
	vsep = memchr(start, '&', var->end - start);
			var->already_scanned = var->end - var->ptr;
	var->already_scanned = 0;
	if (!eof && vars->str.c != vars->ptr) {
CVE-2017-5340 (C, published 2017-01-11T06:59Z)
Description: value: Zend/zend_hash.c in PHP before 7.0.15 and 7.1.x before 7.1.1 mishandles certain cases that require large array allocations, which allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow, uninitialized memory access, and use of arbitrary destructor function pointers) via crafted serialized data.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/php/php-src
Files changed:
Zend/zend_hash.c
Commit message: Fix #73832 - leave the table in a safe state if the size is too big.


Vulnerable code:
	ht->nTableSize = zend_hash_check_size(nSize);

Fixed code:
	ht->nTableSize = zend_hash_check_size(nSize);
CVE-2018-15132 (C, published 2018-08-07T15:29Z)
Description: value: An issue was discovered in ext/standard/link_win32.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8. The linkinfo function on Windows doesn't implement the open_basedir check. This could be abused to find files on paths outside of the allowed directories.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/php/php-src
Files changed:
ext/standard/link_win32.c
Commit message: Fixed bug #76459 windows linkinfo lacks openbasedir check


Vulnerable code:

Fixed code:
	char *dirname;
	dirname = estrndup(link, link_len);
	php_dirname(dirname, link_len);

	if (php_check_open_basedir(dirname)) {
		efree(dirname);
		RETURN_FALSE;
	}

		efree(dirname);
	efree(dirname);
CVE-2018-17082 (C, published 2018-09-16T15:29Z)
Description: value: The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a "Transfer-Encoding: chunked" request, because the bucket brigade is mishandled in the php_handler function in sapi/apache2handler/sapi_apache2.c.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/php/php-src
Files changed:
sapi/apache2handler/sapi_apache2.c
Commit message: Fix for bug #76582

The brigade seems to end up in a messed up state if something fails
in shutdown, so we clean it up.


Vulnerable code:

Fixed code:
		apr_brigade_cleanup(brigade);
CVE-2018-7584 (C, published 2018-03-01T19:29Z)
Description: value: In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in ext/standard/http_fopen_wrapper.c. This subsequently results in copying a large string.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/php/php-src
Files changed:
ext/standard/http_fopen_wrapper.c
ext/standard/tests/http/bug75981.phpt
Commit message: Fix bug #75981: prevent reading beyond buffer start


Vulnerable code:
			if (tmp_line[tmp_line_len - 1] == '\n') {
				if (tmp_line[tmp_line_len - 1] == '\r') {

Fixed code:
			if (tmp_line_len >= 1 && tmp_line[tmp_line_len - 1] == '\n') {
				if (tmp_line_len >= 1 &&tmp_line[tmp_line_len - 1] == '\r') {
--TEST--
Bug #75981 (stack-buffer-overflow while parsing HTTP response)
--INI--
allow_url_fopen=1
--SKIPIF--
<?php require 'server.inc'; http_server_skipif('tcp://127.0.0.1:12342'); ?>
--FILE--
<?php
require 'server.inc';

$options = [
  'http' => [
    'protocol_version' => '1.1',
    'header' => 'Connection: Close'
  ],
];

$ctx = stream_context_create($options);

$responses = [
	"data://text/plain,000000000100\xA\xA"
];
$pid = http_server('tcp://127.0.0.1:12342', $responses);

echo @file_get_contents('http://127.0.0.1:12342/', false, $ctx);

http_server_kill($pid);

?>
DONE
--EXPECT--
DONE
CVE-2019-6978 (C, published 2019-01-28T08:29Z)
Description: value: The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr() functions in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c. NOTE: PHP is unaffected.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/php/php-src
Files changed:
ext/gd/libgd/gd_gif_out.c
ext/gd/libgd/gd_jpeg.c
ext/gd/libgd/gd_wbmp.c
Commit message: Sync with upstream

Even though libgd/libgd#492 is not a relevant bug fix for PHP, since
the binding doesn't use the `gdImage*Ptr()` functions at all, we're
porting the fix to stay in sync here.


Vulnerable code:
  gdImageGifCtx (im, out);
  rv = gdDPExtractData (out, size);
			return;
	gdImageJpegCtx (im, out, quality);
	rv = gdDPExtractData (out, size);
		return;
		return;
	gdImageWBMPCtx(im, fg, out);
	rv = gdDPExtractData(out, size);

Fixed code:

static int _gdImageGifCtx(gdImagePtr im, gdIOCtxPtr out);

	if (!_gdImageGifCtx(im, out)) {
		rv = gdDPExtractData(out, size);
	} else {
		rv = NULL;
	}
{
	_gdImageGifCtx(im, out);
}

/* returns 0 on success, 1 on failure */
static int _gdImageGifCtx(gdImagePtr im, gdIOCtxPtr out)
			return 1;

    return 0;
static int _gdImageJpegCtx(gdImagePtr im, gdIOCtx *outfile, int quality);
	if (!_gdImageJpegCtx(im, out, quality)) {
		rv = gdDPExtractData(out, size);
	} else {
		rv = NULL;
	}
{
	_gdImageJpegCtx(im, outfile, quality);
}

/* returns 0 on success, 1 on failure */
static int _gdImageJpegCtx(gdImagePtr im, gdIOCtx *outfile, int quality)
		return 1;
	return 0;
static int _gdImageWBMPCtx(gdImagePtr image, int fg, gdIOCtx *out);
{
	_gdImageWBMPCtx(image, fg, out);
}

/* returns 0 on success, 1 on failure */
static int _gdImageWBMPCtx(gdImagePtr image, int fg, gdIOCtx *out)
		return 1;
		freewbmp(wbmp);
		return 1;
	if (!_gdImageWBMPCtx(im, fg, out)) {
		rv = gdDPExtractData(out, size);
	} else {
		rv = NULL;
	}
CVE-2020-7770 (JavaScript, published 2020-11-12T11:15Z)
Description: value: This affects the package json8 before 1.0.3. The function adds in the target object the property specified in the path, however it does not properly check the key being set, leading to a prototype pollution.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/sonnyp/JSON8
Files changed:
packages/merge-patch/README.md
packages/merge-patch/lib/apply.js
packages/merge-patch/test/apply.js
Commit message: json8-merge-patch: Prevent prototype pollution 2 (#116)



Vulnerable code:
 * @param  {Object} doc    - JSON object document
 * @param  {Object} patch  - JSON object patch
 * @return {Object}        - JSON object document
module.exports = function apply(doc, patch) {
    doc = Object.create(null);
  // https://github.com/lodash/lodash/pull/4337
    const patch = { __proto__: { foobar: true } };
    doc = apply(doc, patch);
    assert.deepEqual(doc, {});
  });
  // https://github.com/lodash/lodash/pull/4336
  it("prevents constructor pollution", () => {
    let doc = {};

    const patch = { constructor: { foo: "bar" } };
    doc = apply(doc, patch);
    assert.equal("foo" in Object, false);
    assert.equal(Object.foo, undefined);
    assert.deepEqual(doc, patch);

Fixed code:
### object creation

When needed, `apply` creates objects with `null` prototype, you can choose the prototype to use with `{proto: Object}` as a third argument.

[↑](#json8-merge-patch)

### prototype pollution

`apply` will throw with an error if [prototype pollution](https://github.com/HoLyVieR/prototype-pollution-nsec18) is attempted. You can allow for prototype pollution by passing `{pollute: true}` as a third argument.

[↑](#json8-merge-patch)

 * @param  {Object}  doc                       - JSON object document
 * @param  {Object}  patch                     - JSON object patch
 * @param  {Object}  [options]                 - options
 * @param  {Boolean} [options.pollute=false]   - Allow prototype pollution - throw otherwise
 * @param  {Object}  [options.proto=null]      - Prototype to use for object creation
 * @return {Object}                            - JSON object document
module.exports = function apply(doc, patch, options) {
  options = options || Object.create(null);

    doc = Object.create(options.proto || null);
    if (options.pollute !== true && key === "__proto__") {
      throw new Error("Prototype pollution attempt");
    }
  // https://github.com/sonnyp/JSON8/issues/113
  // https://github.com/HoLyVieR/prototype-pollution-nsec18
    const patch = JSON.parse('{ "__proto__": { "isAdmin": true }}');
    assert.throws(
      () => {
        doc = apply(doc, patch);
      },
      Error,
      "Prototype pollution attempt"
    );
    assert.equal(doc.isAdmin, undefined);
    assert.equal("isAdmin" in doc, false);
CVE-2022-45129 (Unknown, published 2022-11-10T06:15Z)
Description: value: Payara before 2022-11-04, when deployed to the root context, allows attackers to visit META-INF and WEB-INF, a different vulnerability than CVE-2022-37422. This affects Payara Platform Community before 4.1.2.191.38, 5.x before 5.2022.4, and 6.x before 6.2022.1, and Payara Platform Enterprise before 5.45.0.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-552 \u2014 Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.
Repository: https://github.com/payara/Payara
Files changed:
Commit message: Merge pull request #5989 from luiseufrasio/FISH-6603

Fish-6603 New 0-day vulnerability exploit using ROOT context root deployments

Vulnerable code:

Fixed code:
CVE-2023-28627 (Python, published 2023-03-27T21:15Z)
Description: value: pymedusa is an automatic video library manager for TV Shows. In versions prior 1.0.12 an attacker with access to the web interface can update the git executable path in /config/general/ > advanced settings with arbitrary OS commands. An attacker may exploit this vulnerability to take execute arbitrary OS commands as the user running the pymedusa program. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/pymedusa/Medusa
Files changed:
medusa/updater/github_updater.py
Commit message: Ensure that git_path is a valid file (#11138)

* Ensure that git_path is a valid file

* Update github_updater.py

Vulnerable code:

        if app.GIT_PATH:
            main_git = '"' + app.GIT_PATH + '"'
        else:
            main_git = 'git'

Fixed code:
import os
        main_git = app.GIT_PATH or 'git'
        if git_path != 'git' and not os.path.isfile(git_path):
            log.warning(u"Invalid git specified, can't use git commands")
            exit_status = 1
            return output, err, exit_status
CVE-2024-34066 (Go, published 2024-05-03T18:15Z)
Description: value: Pterodactyl wings is the server control plane for Pterodactyl Panel. If the Wings token is leaked either by viewing the node configuration or posting it accidentally somewhere, an attacker can use it to gain arbitrary file write and read access on the node the token is associated to. This issue has been addressed in version 1.11.12 and users are advised to upgrade. Users unable to upgrade may enable the `ignore_panel_config_updates` option as a workaround.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/pterodactyl/wings
Files changed:
config/config.go
Commit message: config: prevent programmatic updates to specific fields


Vulnerable code:
	DisableRemoteDownload bool `json:"disable_remote_download" yaml:"disable_remote_download"`
	RootDirectory string `default:"/var/lib/pterodactyl" yaml:"root_directory"`
	LogDirectory string `default:"/var/log/pterodactyl" yaml:"log_directory"`
	Data string `default:"/var/lib/pterodactyl/volumes" yaml:"data"`
	ArchiveDirectory string `default:"/var/lib/pterodactyl/archives" yaml:"archive_directory"`
	BackupDirectory string `default:"/var/lib/pterodactyl/backups" yaml:"backup_directory"`
	TmpDirectory string `default:"/tmp/pterodactyl" yaml:"tmp_directory"`
	PanelLocation string                   `json:"remote" yaml:"remote"`
var openat2 atomic.Bool
var openat2Set atomic.Bool

Fixed code:
	DisableRemoteDownload bool `json:"-" yaml:"disable_remote_download"`
	RootDirectory string `default:"/var/lib/pterodactyl" json:"-" yaml:"root_directory"`
	LogDirectory string `default:"/var/log/pterodactyl" json:"-" yaml:"log_directory"`
	Data string `default:"/var/lib/pterodactyl/volumes" json:"-" yaml:"data"`
	ArchiveDirectory string `default:"/var/lib/pterodactyl/archives" json:"-" yaml:"archive_directory"`
	BackupDirectory string `default:"/var/lib/pterodactyl/backups" json:"-" yaml:"backup_directory"`
	TmpDirectory string `default:"/tmp/pterodactyl" json:"-" yaml:"tmp_directory"`
	PanelLocation string                   `json:"-" yaml:"remote"`
var (
	openat2    atomic.Bool
	openat2Set atomic.Bool
)
CVE-2020-9395 (JSON, published 2020-07-06T22:15Z)
Description: value: An issue was discovered on Realtek RTL8195AM, RTL8711AM, RTL8711AF, and RTL8710AF devices before 2.0.6. A stack-based buffer overflow exists in the client code that takes care of WPA2's 4-way-handshake via a malformed EAPOL-Key packet with a long keydata buffer.
Severity: MEDIUM (CVSS v3 base score: 8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ambiot/amb1_arduino
Files changed:
Arduino_package/package_realtek.com_ameba1_index.json
Commit message: Title: Update wlan library


Vulnerable code:

Fixed code:
          "version": "2.0.6-v2",
          "category": "Contributed",
          "help": {
            "online": "http://www.amebaiot.com/"
          },
          "url": "https://github.com/ambiot/amb1_arduino/raw/master/Arduino_package/release/ameba_1-2.0.6-v2.tar.gz",
          "archiveFileName": "ameba_1-2.0.6-v2.tar.gz",
          "checksum": "SHA-256:ae23b8a56008edafe70f8db3f304176fab014b7be8a5564ebeedaf0a5b02e3d1",
          "size": "28100307",
          "boards": [
            {"name": "Ameba RTL8195A"},
            {"name": "Ameba RTL8710"},
            {"name": "Ameba RTL8711AM"}
          ],
          "toolsDependencies": [
            {
              "packager": "realtek",
              "name": "ameba_1_arm-none-eabi-gcc",
              "version": "4.8.3-2014q1"
            },
            {
              "packager": "realtek",
              "name": "ameba_1_tools",
              "version": "1.1.1"
            }
          ]
        },
		{
          "name": "Realtek Ameba Boards (32-bits ARM Cortex-M3)",
          "architecture": "Ameba1",
CVE-2022-23538 (Unknown, published 2023-01-17T21:15Z)
Description: value: github.com/sylabs/scs-library-client is the Go client for the Singularity Container Services (SCS) Container Library Service. When the scs-library-client is used to pull a container image, with authentication, the HTTP Authorization header sent by the client to the library service may be incorrectly leaked to an S3 backing storage provider. This occurs in a specific flow, where the library service redirects the client to a backing S3 storage server, to perform a multi-part concurrent download. Depending on site configuration, the S3 service may be provided by a third party. An attacker with access to the S3 service may be able to extract user credentials, allowing them to impersonate the user. The vulnerable multi-part concurrent download flow, with redirect to S3, is only used when communicating with a Singularity Enterprise 1.x installation, or third party server implementing this flow. Interaction with Singularity Enterprise 2.x, and Singularity Container Services (cloud.sylabs.io), does not trigger the vulnerable flow. We encourage all users to update. Users who interact with a Singularity Enterprise 1.x installation, using a 3rd party S3 storage service, are advised to revoke and recreate their authentication tokens within Singularity Enterprise. There is no workaround available at this time.
Severity: nan (CVSS v3 base score: 7.6)
Weakness: CWE-522 \u2014 Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Repository: https://github.com/sylabs/scs-library-client
Files changed:
Commit message: Merge pull request from GHSA-7p8m-22h4-9pj7

Add Authorization header when applicable

Vulnerable code:

Fixed code: