hitoshura25/cvefixes huggingface dataset:
CVE-2019-14452 (C++, published 2019-07-31T02:15Z)
Description: value: Sigil before 0.9.16 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/Sigil-Ebook/Sigil
Files changed:
src/Misc/Utility.cpp
src/sigil_exception.h
Commit message: harden plugin unzipping to zip-slip attacks


Vulnerable code:

Fixed code:
**  Copyright (C) 2019   Kevin B. Hendricks, Stratford, Ontario Canada

	        // for security reasons against maliciously crafted zip archives
	        // we need the file path to always be inside the target folder 
	        // and not outside, so we will remove all illegal backslashes
	        // and all relative upward paths segments "/../" from the zip's local 
	        // file name/path before prepending the target folder to create 
	        // the final path

	        QString original_path = qfile_name;
	        bool evil_or_corrupt_epub = false;

	        if (qfile_name.contains("\\")) evil_or_corrupt_epub = true; 
	        qfile_name = "/" + qfile_name.replace("\\","");

	        if (qfile_name.contains("/../")) evil_or_corrupt_epub = true;
	        qfile_name = qfile_name.replace("/../","/");

	        while(qfile_name.startsWith("/")) { 
		  qfile_name = qfile_name.remove(0,1);
	        }
                
	        if (cp437_file_name.contains("\\")) evil_or_corrupt_epub = true; 
	        cp437_file_name = "/" + cp437_file_name.replace("\\","");

	        if (cp437_file_name.contains("/../")) evil_or_corrupt_epub = true;
	        cp437_file_name = cp437_file_name.replace("/../","/");

	        while(cp437_file_name.startsWith("/")) { 
		  cp437_file_name = cp437_file_name.remove(0,1);
	        }

	        if (evil_or_corrupt_epub) {
		    unzCloseCurrentFile(zfile);
		    unzClose(zfile);
		    // throw (UNZIPLoadParseError(QString(QObject::tr("Possible evil or corrupt zip file name: %1")).arg(original_path).toStdString()));
                    return false;
	        }

**  Copyright (C) 2019  Kevin B. Hendricks, Stratford, Ontario Canada

/**
 * Thrown for Invalid EPUB errors while loading and parsing content files.
 */
class UNZIPLoadParseError : public std::runtime_error {
public:
    UNZIPLoadParseError(const std::string &msg) : std::runtime_error(msg) { };
};
CVE-2019-14452 (C++, published 2019-07-31T02:15Z)
Description: value: Sigil before 0.9.16 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/Sigil-Ebook/Sigil
Files changed:
src/Importers/ImportEPUB.cpp
Commit message: further harden against malicious epubs and produce error message


Vulnerable code:
	        // for security reasons we need the file path to always be inside the 
                // target folder and not outside, so we will remove all relative upward 
                // paths segments ".." from the file path before prepending the target 
                // folder to create the final target path
	        qfile_name = qfile_name.replace("../","");
                cp437_file_name = cp437_file_name.replace("../","");

Fixed code:
	        // for security reasons against maliciously crafted zip archives
                // we need the file path to always be inside the target folder 
                // and not outside, so we will remove all illegal backslashes
                // and all relative upward paths segments "/../" from the zip's local 
                // file name/path before prepending the target folder to create 
                // the final path

	        QString original_path = qfile_name;
	        bool evil_or_corrupt_epub = false;

                if (qfile_name.contains("\\")) evil_or_corrupt_epub = true; 
	        qfile_name = "/" + qfile_name.replace("\\","");

                if (qfile_name.contains("/../")) evil_or_corrupt_epub = true;
	        qfile_name = qfile_name.replace("/../","/");

                while(qfile_name.startsWith("/")) { 
		    qfile_name = qfile_name.remove(0,1);
		}

                if (cp437_file_name.contains("\\")) evil_or_corrupt_epub = true; 
                cp437_file_name = "/" + cp437_file_name.replace("\\","");

                if (cp437_file_name.contains("/../")) evil_or_corrupt_epub = true;
	        cp437_file_name = cp437_file_name.replace("/../","/");

                while(cp437_file_name.startsWith("/")) { 
		    cp437_file_name = cp437_file_name.remove(0,1);
		}

                if (evil_or_corrupt_epub) {
                    unzCloseCurrentFile(zfile);
                    unzClose(zfile);
                    throw (EPUBLoadParseError(QString(QObject::tr("Possible evil or corrupt epub file name: %1")).arg(original_path).toStdString()));
                }
CVE-2019-14452 (C++, published 2019-07-31T02:15Z)
Description: value: Sigil before 0.9.16 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/Sigil-Ebook/Sigil
Files changed:
src/Importers/ImportEPUB.cpp
Commit message: do not allow zip files to have upward relative path sections


Vulnerable code:

Fixed code:

	        // for security reasons we need the file path to always be inside the 
                // target folder and not outside, so we will remove all relative upward 
                // paths segments ".." from the file path before prepending the target 
                // folder to create the final target path
	        qfile_name = qfile_name.replace("../","");
                cp437_file_name = cp437_file_name.replace("../","");
CVE-2023-3532 (JSON, published 2023-07-07T03:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository outline/outline prior to 0.70.1.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/outline/outline
Files changed:
package.json
Commit message: 0.70.1


Vulnerable code:
  "version": "0.70.0"

Fixed code:
  "version": "0.70.1"
CVE-2019-20909 (C, published 2020-07-16T18:15Z)
Description: value: An issue was discovered in GNU LibreDWG through 0.9.3. There is a NULL pointer dereference in the function dwg_encode_LWPOLYLINE in dwg.spec.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/LibreDWG/libredwg
Files changed:
src/encode.c
Commit message: encode: fix empty FIELD_2DD_VECTOR

Fixes GH #178 null_pointer1 case


Vulnerable code:
  FIELD_2RD (nam[0], dxf);                                                    \

Fixed code:
  if (_obj->size)                                                             \
    FIELD_2RD (nam[0], dxf);                                                  \
CVE-2019-20913 (Other, published 2020-07-16T18:15Z)
Description: value: An issue was discovered in GNU LibreDWG through 0.9.3. Crafted input will lead to a heap-based buffer over-read in dwg_encode_entity in common_entity_data.spec.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/LibreDWG/libredwg
Files changed:
src/classes.inc
src/dec_macros.h
Commit message: add DEBUGGING_CLASS_CPP

and use it for TABLECONTENT.
This is more stable than CLASS_DXF in cases when
TABLE is mixed up with TABLECONTENT. See e.g.
GH #178, where it fixes the heap_overflow2 case.


Vulnerable code:
      return DEBUGGING_DXF(action, name) DWG_FUNC_N(action,_name)(dat, obj); \
        /*obj->fixedtype = DWG_TYPE_##_name; */ \
      /* return dwg_##action_##_name(dat, obj); */ \
        /*obj->fixedtype = DWG_TYPE_##_name; */ \
      /* return dwg_##action_##name(dat, obj); */ \
  STABLE_CLASS    (ACTION, LAYOUT)
  STABLE_CLASS    (ACTION, MLEADERSTYLE)
  DEBUGGING_CLASS     (ACTION, ARC_DIMENSION) //ent
  DEBUGGING_CLASS     (ACTION, TABLECONTENT) //wrong values
      error                                                                   \
          = dwg_decode_##token##_private (&obj_dat, &hdl_dat, &str_dat, obj); \

Fixed code:
# define DEBUGGING_CLASS_CPP(action, name, _cppname) UNSTABLE_CLASS_CPP(action, name, _cppname)
# define DEBUGGING_CLASS_CPP(action, name, _cppname) UNHANDLED_CLASS_CPP(action, name, _cppname)
      return DEBUGGING_DXF(action, name) DWG_FUNC_N(action,_name) (dat, obj); \
      return DWG_ERR_UNHANDLEDCLASS; \
    }
#define UNHANDLED_CLASS_CPP(action, _name, _cppname) \
  if (klass->cppname && strEQc (klass->cppname, #_cppname)) \
    { \
      WARN_UNHANDLED_CLASS; \
      if (strEQc (_STR(action), "decode") || !memcmp (_STR(action), "in", 2)) { \
        obj->name = (char*) #_name; \
        obj->dxfname = (char*) #_name; \
      } \
  STABLE_CLASS    (ACTION, LAYOUT) // TODO bottom_margin nan
  STABLE_CLASS    (ACTION, MLEADERSTYLE) // TODO block_rotation nan
  DEBUGGING_CLASS     (ACTION, ARC_DIMENSION)     /*ent */
  DEBUGGING_CLASS_CPP (ACTION, TABLECONTENT, AcDbTableContent)
      error = dwg_decode_##token##_private (&obj_dat, &hdl_dat, &str_dat,     \
                                            obj);                             \
CVE-2019-20915 (C, published 2020-07-16T18:15Z)
Description: value: An issue was discovered in GNU LibreDWG through 0.9.3. Crafted input will lead to a heap-based buffer over-read in bit_write_TF in bits.c.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/LibreDWG/libredwg
Files changed:
src/bits.c
Commit message: encode: protect from stack under-flow

From GH #178 fuzzing


Vulnerable code:
  if (byte[i] & 0x40)
  if (byte[i] & 0x40)

Fixed code:
  if (byte[i] & 0x40 && i > 0)
  if (byte[i] & 0x40 && i > 0)
CVE-2021-36080 (C, published 2021-07-01T03:15Z)
Description: value: GNU LibreDWG 0.12.3.4163 through 0.12.3.4191 has a double-free in bit_chain_free (called from dwg_encode_MTEXT and dwg_encode_add_object).
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/LibreDWG/libredwg
Files changed:
src/encode.c
Commit message: encode: avoid hdl_dat double-free

In case of an handle overflow, such as num_reactors.
Fixes oss-fuzz issue 31724.


Vulnerable code:
    Bit_Chain *str_dat = dat; /* a ref */                                     \
        if (hdl_dat != dat)                                                   \
    if (error & DWG_ERR_VALUEOUTOFBOUNDS && hdl_dat != dat)                   \
      bit_chain_free (hdl_dat);                                               \
        Bit_Chain *dat, Bit_Chain *hdl_dat, Bit_Chain *str_dat,               \
        Dwg_Object *restrict obj)                                             \
    Dwg_Entity_##token *_obj = _ent->tio.token;                               \
    if (hdl_dat != dat)                                                       \
    if (error & DWG_ERR_VALUEOUTOFBOUNDS && hdl_dat != dat)                   \
    if (hdl_dat != dat)                                                       \

Fixed code:
        *hdl_dat = *dat;                                                      \
    Bit_Chain *str_dat = dat;       /* a ref */                               \
        LOG_HANDLE ("Early DWG_ENTITY exit\n");                               \
        if (hdl_dat != dat && hdl_dat->chain != dat->chain)                   \
    if (error & DWG_ERR_VALUEOUTOFBOUNDS && hdl_dat != dat                    \
        && hdl_dat->chain != dat->chain)                                      \
      {                                                                       \
        LOG_HANDLE ("VALUEOUTOFBOUNDS bypassed DWG_ENTITY_END\n");            \
        /*bit_chain_free (hdl_dat);*/                                         \
      }                                                                       \
      Bit_Chain *dat, Bit_Chain *hdl_dat, Bit_Chain *str_dat,                 \
      Dwg_Object *restrict obj)                                               \
    Dwg_Entity_##token *_obj = _ent->tio.token;
    if (hdl_dat != dat && hdl_dat->chain != dat->chain)                       \
    if (error & DWG_ERR_VALUEOUTOFBOUNDS && hdl_dat != dat                    \
        && hdl_dat->chain != dat->chain)                                      \
    if (hdl_dat != dat && hdl_dat->chain != dat->chain)                       \
CVE-2023-26157 (C, published 2024-01-02T05:15Z)
Description: value: Versions of the package libredwg before 0.12.5.6384 are vulnerable to Denial of Service (DoS) due to an out-of-bounds read involving section->num_pages in decode_r2007.c.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/LibreDWG/libredwg
Files changed:
src/decode_r2007.c
Commit message: decode_r2007: fix fuzzing out-of-bounds

reset invalid section->num_pages.
Fixes GH #850


Vulnerable code:
      if (section->num_pages <= 0)
        continue;
      if (section->num_pages > 0xf0000)

Fixed code:
      if (!section_page)
        {
          free (decomp);
          LOG_ERROR ("Failed to find section page %d", (int)i)
          return DWG_ERR_PAGENOTFOUND;
        }
      if (section->num_pages <= 0 || section->num_pages > 0xf0000)
          section->num_pages = 0;
CVE-2016-10746 (C, published 2019-04-18T16:29Z)
Description: value: libvirt-domain.c in libvirt before 1.3.1 supports virDomainGetTime API calls by guest agents with an RO connection, even though an RW connection was supposed to be required, a different vulnerability than CVE-2019-3886.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-254 \u2014 7PK - Security Features
Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.
Repository: https://github.com/libvirt/libvirt
Files changed:
src/libvirt-domain.c
Commit message: virDomainGetTime: Deny on RO connections

We have a policy that if API may end up talking to a guest agent
it should require RW connection. We don't obey the rule in
virDomainGetTime().

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>


Vulnerable code:

Fixed code:
    virCheckReadOnlyGoto(dom->conn->flags, error);
CVE-2021-3975 (C, published 2022-08-23T20:15Z)
Description: value: A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function in qemuProcessHandleMonitorEOF is called using multiple threads without being adequately protected by a monitor lock. This flaw could be triggered by the virConnectGetAllDomainStats API when the guest is shutting down. An unprivileged client with a read-only connection could use this flaw to perform a denial of service attack by causing the libvirt daemon to crash.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/libvirt/libvirt
Files changed:
src/qemu/qemu_process.c
Commit message: qemu: Add missing lock in qemuProcessHandleMonitorEOF

qemuMonitorUnregister will be called in multiple threads (e.g. threads
in rpc worker pool and the vm event thread).  In some cases, it isn't
protected by the monitor lock, which may lead to call g_source_unref
more than one time and a use-after-free problem eventually.

Add the missing lock in qemuProcessHandleMonitorEOF (which is the only
position missing lock of monitor I found).

Suggested-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Peng Liang <liangpeng10@huawei.com>
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>


Vulnerable code:

Fixed code:
    virObjectLock(mon);
    virObjectUnlock(mon);
CVE-2012-2139 (Ruby, published 2012-07-18T18:55Z)
Description: value: Directory traversal vulnerability in lib/mail/network/delivery_methods/file_delivery.rb in the Mail gem before 2.4.4 for Ruby allows remote attackers to read arbitrary files via a .. (dot dot) in the to parameter.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/mikel/mail
Files changed:
lib/mail/network/delivery_methods/file_delivery.rb
spec/mail/network/delivery_methods/file_delivery_spec.rb
Commit message: Preventing file system traversal in file_delivery method


Vulnerable code:
  # "fred@test", "bob@test" and "joe@anothertest"
        ::File.open(::File.join(settings[:location], to), 'a') { |f| "#{f.write(mail.encoded)}\r\n\r\n" }

Fixed code:
  # by their message id
        ::File.open(::File.join(settings[:location], File.basename(to.to_s)), 'a') { |f| "#{f.write(mail.encoded)}\r\n\r\n" }
    it "should use the base name of the file name to prevent file system traversal" do
      Mail.defaults do
        delivery_method :file, :location => tmpdir
      end
      
      Mail.deliver do
        from    'roger@moore.com'
        to      '../../../../../../../../../../../tmp/pwn'
        subject 'evil hacker'
      end

      delivery = File.join(Mail.delivery_method.settings[:location], 'pwn')
      File.exists?(delivery).should be_true
    end
CVE-2012-2140 (Ruby, published 2012-07-18T18:55Z)
Description: value: The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/mikel/mail
Files changed:
lib/mail/network/delivery_methods/sendmail.rb
spec/mail/network/delivery_methods/sendmail_spec.rb
Commit message: Making sure that destinations are also properly escaped in all version of ruby


Vulnerable code:
      self.class.call(settings[:location], arguments, mail.destinations.collect(&:shellescape).join(" "), mail)
      to      'marcel@test.lindsaar.net'
                                              'marcel@test.lindsaar.net', 

Fixed code:
      self.class.call(settings[:location], arguments, mail.destinations.collect(&:escape_for_shell).join(" "), mail)
      to      '"foo\";touch /tmp/PWNED;\""@blah.com'
                                              "\\\"foo\\\\\\\"\\;touch /tmp/PWNED\\;\\\\\\\"\\\"@blah.com",