hitoshura25/cvefixes huggingface dataset:
CVE-2016-9888 (Other, published 2016-12-08T08:59Z)
Description: value: An error within the "tar_directory_for_file()" function (gsf-infile-tar.c) in GNOME Structured File Library before 1.14.41 can be exploited to trigger a Null pointer dereference and subsequently cause a crash via a crafted TAR file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/GNOME/libgsf
Files changed:
ChangeLog
NEWS
gsf/gsf-infile-tar.c
Commit message: tar: fix crash on broken tar file.


Vulnerable code:
				dir = GSF_INFILE_TAR (subdir);

Fixed code:
2016-11-30  Morten Welinder  <terra@gnome.org>

	* gsf/gsf-infile-tar.c (tar_directory_for_file): Handle the case
	where what we expected to be a directory is a file.  (That implies
	a corrupted tar file.)  Thanks to Behzad Najjarpour Jabbari,
	Secunia Research at Flexera Software for discovering this.

Morten:
	* Fix corrupted-tar-file crash.

				dir = GSF_IS_INFILE_TAR (subdir)
					? GSF_INFILE_TAR (subdir)
					: dir;
CVE-2021-32740 (Markdown, published 2021-07-06T15:15Z)
Description: value: Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical usage, templates would not normally be read from untrusted user input, but nonetheless, no previous security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected. The vulnerability is patched in version 2.8.0. As a workaround, only create Template objects from trusted sources that have been validated not to produce catastrophic backtracking.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/sporkmonger/addressable
Files changed:
CHANGELOG.md
Commit message: Adding note about ReDoS vulnerability


Vulnerable code:

Fixed code:
- fixes ReDoS vulnerability in Addressable::Template#match
CVE-2020-15261 (C++, published 2020-10-19T22:15Z)
Description: value: On Windows the Veyon Service before version 4.4.2 contains an unquoted service path vulnerability, allowing locally authenticated users with administrative privileges to run malicious executables with LocalSystem privileges. Since Veyon users (both students and teachers) usually don't have administrative privileges, this vulnerability is only dangerous in anyway unsafe setups. The problem has been fixed in version 4.4.2. As a workaround, the exploitation of the vulnerability can be prevented by revoking administrative privileges from all potentially untrustworthy users.
Severity: HIGH (CVSS v3 base score: 6.7)
Weakness: CWE-428 \u2014 Unquoted Search Path or Element
The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.
Repository: https://github.com/veyon/veyon
Files changed:
plugins/platform/windows/WindowsServiceControl.cpp
Commit message: WindowsServiceControl: quote service binary path

Fix unquoted service path vulnerability.

Closes #657.


Vulnerable code:
				WindowsCoreFunctions::toConstWCharArray( filePath ),		// service's binary

Fixed code:
	const auto binaryPath = QStringLiteral("\"%1\"").arg( QString( filePath ).replace( QLatin1Char('"'), QString() ) );

				WindowsCoreFunctions::toConstWCharArray( binaryPath ),		// service's binary
CVE-2023-42374 (Rust, published 2024-02-13T01:15Z)
Description: value: An issue in mystenlabs Sui Blockchain before v.1.6.3 allow a remote attacker to execute arbitrary code and cause a denial of service via a crafted compressed script to the Sui node component.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/MystenLabs/sui
Files changed:
crates/mysten-network/src/codec.rs
crates/sui-node/src/lib.rs
narwhal/primary/src/primary.rs
narwhal/worker/src/worker.rs
Commit message: Reduce anemo message limit to 1G (#13231)



Vulnerable code:
            let mut snappy_decoder = snap::read::FrameDecoder::new(buf.reader());
            // Set the max_frame_size to be 2 GB to work around the issue of there being too many
            anemo_config.max_frame_size = Some(2 << 30);
            // Set the max_frame_size to be 2 GB to work around the issue of there being too many
            config.max_frame_size = Some(2 << 30);
            // Set the max_frame_size to be 2 GB to work around the issue of there being too many
            config.max_frame_size = Some(2 << 30);

Fixed code:
            let mut snappy_decoder = snap::read::FrameDecoder::new(buf.reader()).take(1 << 30);
            // Set the max_frame_size to be 1 GB to work around the issue of there being too many
            anemo_config.max_frame_size = Some(1 << 30);
            // Set the max_frame_size to be 1 GB to work around the issue of there being too many
            config.max_frame_size = Some(1 << 30);
            // Set the max_frame_size to be 1 GB to work around the issue of there being too many
            config.max_frame_size = Some(1 << 30);
CVE-2018-1999024 (JavaScript, published 2018-07-23T16:29Z)
Description: value: MathJax version prior to version 2.7.4 contains a Cross Site Scripting (XSS) vulnerability in the \unicode{} macro that can result in Potentially untrusted Javascript running within a web browser. This attack appear to be exploitable via The victim must view a page where untrusted content is processed using Mathjax. This vulnerability appears to have been fixed in 2.7.4 and later.
Severity: MEDIUM (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/mathjax/MathJax
Files changed:
unpacked/extensions/TeX/unicode.js
unpacked/extensions/toMathML.js
Commit message: Fix parsing and output for \class{} and \unicode{}


Vulnerable code:
      var n = this.trimSpaces(this.GetArgument(name)),
          N = parseInt(n.match(/^x/) ? "0"+n : n);
          if (variant.match(/bold/))   {def.fontweight = "bold"}
      if (CLASS.length) {attr.unshift('class="'+CLASS.join(" ")+'"')}
        data.push(space+'    <annotation encoding="'+annotation+'">'+xmlEscapedTex+"</annotation>");
    toMathML: function (space) {return (space||"") + "&"+this.data[0]+";<!-- "+this.toString()+" -->"}

Fixed code:
      var n = this.trimSpaces(this.GetArgument(name)).replace(/^0x/,"x");
      if (!n.match(/^(x[0-9A-Fa-f]+|[0-9]+)$/)) {
        TEX.Error(["BadUnicode","Argument to \\unicode must be a number"]);
      }
      var N = parseInt(n.match(/^x/) ? "0"+n : n);
          if (variant.match(/bold/)) {def.fontweight = "bold"}
      if (CLASS.length) {attr.unshift('class="'+this.toMathMLquote(CLASS.join(" "))+'"')}
        data.push(space+'    <annotation encoding="'+this.toMathMLquote(annotation)+'">'+xmlEscapedTex+"</annotation>");
    toMathML: function (space) {return (space||"") + "&"+this.toMathMLquote(this.data[0])+";<!-- "+this.toString()+" -->"}
CVE-2017-5592 (C, published 2017-02-09T20:59Z)
Description: value: An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for profanity (0.4.7 - 0.5.0).
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/boothj5/profanity
Files changed:
src/xmpp/message.c
tests/functionaltests/test_carbons.c
Commit message: Add carbons from check


Vulnerable code:
    Jid *my_jid = jid_create(connection_get_fulljid());
        "<message type='chat' to='stabber@localhost/profanity' from='buddy1@localhost'>"

Fixed code:
    Jid *my_jid = jid_create(connection_get_fulljid());
    const char *const stanza_from = xmpp_stanza_get_from(stanza);
    Jid *msg_jid = jid_create(stanza_from);
    if (g_strcmp0(my_jid->barejid, msg_jid->barejid) != 0) {
        log_warning("Invalid carbon received, from: %s", stanza_from);
        return TRUE;
    }

        "<message type='chat' to='stabber@localhost/profanity' from='stabber@localhost'>"
CVE-2017-5592 (C, published 2017-02-09T20:59Z)
Description: value: An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for profanity (0.4.7 - 0.5.0).
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-346 \u2014 Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
Repository: https://github.com/boothj5/profanity
Files changed:
src/xmpp/message.c
tests/functionaltests/test_carbons.c
Commit message: Add carbons from check


Vulnerable code:
    Jid *my_jid = jid_create(connection_get_fulljid());
        "<message type='chat' to='stabber@localhost/profanity' from='buddy1@localhost'>"

Fixed code:
    Jid *my_jid = jid_create(connection_get_fulljid());
    const char *const stanza_from = xmpp_stanza_get_from(stanza);
    Jid *msg_jid = jid_create(stanza_from);
    if (g_strcmp0(my_jid->barejid, msg_jid->barejid) != 0) {
        log_warning("Invalid carbon received, from: %s", stanza_from);
        return TRUE;
    }

        "<message type='chat' to='stabber@localhost/profanity' from='stabber@localhost'>"
CVE-2023-26153 (Markdown, published 2023-10-06T05:15Z)
Description: value: Versions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geo_location' cookie. This issue can be exploited remotely via a malicious cookie value.**Note:** An attacker can use this vulnerability to execute commands on the host system.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/geokit/geokit-rails
Files changed:
CHANGELOG.md
Commit message: Re-enabled and fixed up tests and removed YAML support.


Vulnerable code:

Fixed code:
## 2.5.0

* Fixed dangerous YAML loading vulnerability
* Rebuilt integration tests
CVE-2023-26153 (Unknown, published 2023-10-06T05:15Z)
Description: value: Versions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geo_location' cookie. This issue can be exploited remotely via a malicious cookie value.**Note:** An attacker can use this vulnerability to execute commands on the host system.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/geokit/geokit-rails
Files changed:
Commit message: Merge pull request #159 from geokit/tests2023

Tests 2023

Vulnerable code:

Fixed code:
CVE-2017-1000215 (C++, published 2017-11-17T20:29Z)
Description: value: ROOT xrootd version 4.6.0 and below is vulnerable to an unauthenticated shell command injection resulting in remote code execution
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/xrootd/xrootd
Files changed:
packaging/rhel/xrootd.spec.in
src/XrdCl/XrdClDefaultEnv.cc
src/XrdSecgsi.cmake
src/XrdSecgsi/XrdSecgsiGMAPFunLDAP.cc
src/XrdVersionPlugin.hh
Commit message: secgsi: do not build/package libXrdSecgsiGMAPLDAP-4.so

The way the LDAP query is implemented may represent a security threat.
Any related building and packaging reference is removed.
The code is left in place (for the time being) to remind its functionality
in the case a sanitized version is required.


Vulnerable code:
%{_libdir}/libXrdSecgsiGMAPLDAP.so*
      "libXrdSecgsiGMAPLDAP.so",
set( LIB_XRD_SEC_GSI_GMAPLDAP XrdSecgsiGMAPLDAP-${PLUGIN_VERSION} )
#-------------------------------------------------------------------------------
# The XrdSecgsiGMAPLDAP module
#-------------------------------------------------------------------------------
add_library(
  ${LIB_XRD_SEC_GSI_GMAPLDAP}
  MODULE
  XrdSecgsi/XrdSecgsiGMAPFunLDAP.cc )

set_target_properties(
  ${LIB_XRD_SEC_GSI_GMAPLDAP}
  PROPERTIES
  INTERFACE_LINK_LIBRARIES ""
  LINK_INTERFACE_LIBRARIES "" )

  ${LIB_XRD_SEC_GSI_GMAPLDAP}
         "libXrdSecgsiGMAPLDAP.so",  \

Fixed code:
/* Warning: this plug-in is not build any longer because the external         */
/* LDAP query via the popen() represents a potential security threat          */
/* and it is believed that functionality provided is not actually used.       */
/* If this believe happens to be uncorrect please report at                   */
/*                                                                            */
/*                   https://github.com/xrootd                                */
/*                                                                            */
/* a sanitized version of the plug-in can be provided using a proper library. */
/*                                                                            */
CVE-2017-6903 (C++, published 2017-03-14T22:59Z)
Description: value: In ioquake3 before 2017-03-14, the auto-downloading feature has insufficient content restrictions. This also affects Quake III Arena, OpenArena, OpenJK, iortcw, and other id Tech 3 (aka Quake 3 engine) forks. A malicious auto-downloaded file can trigger loading of crafted auto-downloaded files as native code DLLs. A malicious auto-downloaded file can contain configuration defaults that override the user's. Executable bytecode in a malicious auto-downloaded file can set configuration variables to values that will result in unwanted native code DLLs being loaded, resulting in sandbox escape.
Severity: HIGH (CVSS v3 base score: 7.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/JACoders/OpenJK
Files changed:
code/client/cl_main.cpp
code/qcommon/files.cpp
codemp/client/cl_main.cpp
codemp/qcommon/files.cpp
shared/sys/sys_main.cpp
Commit message: Shared: Merge ioquake/ioq3@376267d534476a875d8b9228149c4ee18b74a4fd

Don't load .pk3s as .dlls, and don't load user config files from .pk3s.

Vulnerable code:
    cl_renderer = Cvar_Get( "cl_renderer", DEFAULT_RENDER_LIBRARY, CVAR_ARCHIVE|CVAR_LATCH );
	cl_renderer = Cvar_Get( "cl_renderer", DEFAULT_RENDER_LIBRARY, CVAR_ARCHIVE|CVAR_LATCH, "Which renderer library to use" );

Fixed code:
    cl_renderer = Cvar_Get( "cl_renderer", DEFAULT_RENDER_LIBRARY, CVAR_ARCHIVE|CVAR_LATCH|CVAR_PROTECTED );
	bool			isUserConfig = false;
	isUserConfig = !Q_stricmp( filename, "autoexec_sp.cfg" ) || !Q_stricmp( filename, Q3CONFIG_NAME );

				// autoexec_sp.cfg and openjk_sp.cfg can only be loaded outside of pk3 files.
				if ( isUserConfig ) {
					continue;
				}

	cl_renderer = Cvar_Get( "cl_renderer", DEFAULT_RENDER_LIBRARY, CVAR_ARCHIVE|CVAR_LATCH|CVAR_PROTECTED, "Which renderer library to use" );
	bool			isUserConfig = false;
	isUserConfig = !Q_stricmp( filename, "autoexec.cfg" ) || !Q_stricmp( filename, Q3CONFIG_CFG );

				// autoexec.cfg and openjk.cfg can only be loaded outside of pk3 files.
				if ( isUserConfig ) {
					continue;
				}

	// Don't load any DLLs that end with the pk3 extension
	if ( COM_CompareExtension( name, ".pk3" ) )
	{
		Com_Printf( S_COLOR_YELLOW "WARNING: Rejecting DLL named \"%s\"", name );
		return NULL;
	}
CVE-2018-12018 (Go, published 2018-07-05T02:29Z)
Description: value: The GetBlockHeadersMsg handler in the LES protocol implementation in Go Ethereum (aka geth) before 1.8.11 may lead to an access violation because of an integer signedness error for the array index, which allows attackers to launch a Denial of Service attack by sending a packet with a -1 query.Skip value. The vulnerable remote node would be crashed by such an attack immediately, aka the EPoD (Ethereum Packet of Death) issue.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-129 \u2014 Improper Validation of Array Index
The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
Repository: https://github.com/ethereum/go-ethereum
Files changed:
les/handler.go
Commit message: les: add Skip overflow check to GetBlockHeadersMsg handler (#16891)



Vulnerable code:
			case query.Origin.Hash != (common.Hash{}) && query.Reverse:
			case query.Origin.Hash != (common.Hash{}) && !query.Reverse:
				if header := pm.blockchain.GetHeaderByNumber(origin.Number.Uint64() + query.Skip + 1); header != nil {
					if pm.blockchain.GetBlockHashesFromHash(header.Hash(), query.Skip+1)[query.Skip] == query.Origin.Hash {
						query.Origin.Hash = header.Hash()
				} else {
					unknown = true

Fixed code:
	"encoding/json"
			case hashMode && query.Reverse:
			case hashMode && !query.Reverse:
				var (
					current = origin.Number.Uint64()
					next    = current + query.Skip + 1
				)
				if next <= current {
					infos, _ := json.MarshalIndent(p.Peer.Info(), "", "  ")
					p.Log().Warn("GetBlockHeaders skip overflow attack", "current", current, "skip", query.Skip, "next", next, "attacker", infos)
					unknown = true
				} else {
					if header := pm.blockchain.GetHeaderByNumber(next); header != nil {
						if pm.blockchain.GetBlockHashesFromHash(header.Hash(), query.Skip+1)[query.Skip] == query.Origin.Hash {
							query.Origin.Hash = header.Hash()
						} else {
							unknown = true
						}
CVE-2018-16733 (Go, published 2018-09-08T15:29Z)
Description: value: In Go Ethereum (aka geth) before 1.8.14, TraceChain in eth/api_tracer.go does not verify that the end block is after the start block.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/ethereum/go-ethereum
Files changed:
eth/api_tracer.go
Commit message: eth: ensure from<to when tracing chain (credits Chen Nan via bugbounty)


Vulnerable code:

Fixed code:
	if from.Number().Cmp(to.Number()) >= 0 {
		return nil, fmt.Errorf("end block (#%d) needs to come after start block (#%d)", end, start)
	}
CVE-2020-26240 (Go, published 2020-11-25T02:15Z)
Description: value: Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. An ethash mining DAG generation flaw in Geth before version 1.9.24 could cause miners to erroneously calculate PoW in an upcoming epoch (estimated early January, 2021). This happened on the ETC chain on 2020-11-06. This issue is relevant only for miners, non-mining nodes are unaffected. This issue is fixed as of 1.9.24
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-682 \u2014 Incorrect Calculation
The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.
Repository: https://github.com/ethereum/go-ethereum
Files changed:
consensus/ethash/algorithm.go
Commit message: consensus/ethash: use 64bit indexes for the DAG generation (#21793)

* Bit boundary fix for the DAG generation routine

* Fix unnecessary conversion warnings

Co-authored-by: Sergey Pavlov <spavlov@gmail.com>

Vulnerable code:
			batch := uint32((size + hashBytes*uint64(threads) - 1) / (hashBytes * uint64(threads)))
			first := uint32(id) * batch
			if limit > uint32(size/hashBytes) {
				limit = uint32(size / hashBytes)
				item := generateDatasetItem(cache, index, keccak512)

Fixed code:
			batch := (size + hashBytes*uint64(threads) - 1) / (hashBytes * uint64(threads))
			first := uint64(id) * batch
			if limit > size/hashBytes {
				limit = size / hashBytes
				item := generateDatasetItem(cache, uint32(index), keccak512)
CVE-2020-26264 (Go, published 2020-12-11T17:15Z)
Description: value: Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. In Geth before version 1.9.25 a denial-of-service vulnerability can make a LES server crash via malicious GetProofsV2 request from a connected LES client. This vulnerability only concerns users explicitly enabling les server; disabling les prevents the exploit. The vulnerability was patched in version 1.9.25.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/ethereum/go-ethereum
Files changed:
les/server_handler.go
Commit message: les: fix GetProofsV2 bug (#21896)



Vulnerable code:
					var (
						header *types.Header
						trie   state.Trie
					)

Fixed code:
			header    *types.Header
					var trie state.Trie