hitoshura25/cvefixes huggingface dataset:
CVE-2019-19275 (C, published 2019-11-26T15:15Z)
Description: value: typed_ast 1.3.0 and 1.3.1 has an ast_for_arguments out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but not necessarily execute it) may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that parses (but does not execute) Python code. (This issue also affected certain Python 3.8.0-alpha prereleases.)
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/python/cpython
Files changed:
Python/ast.c
Commit message: bpo-36495: Fix two out-of-bounds array reads (GH-12641)

Research and fix by @bradlarsen.

Vulnerable code:
                if (TYPE(CHILD(n, i)) == COMMA)
                if (TYPE(CHILD(n, i)) == COMMA)

Fixed code:
                if (i < NCH(n) && TYPE(CHILD(n, i)) == COMMA)
                if (i < NCH(n) && TYPE(CHILD(n, i)) == COMMA)
CVE-2020-27619 (Other, published 2020-10-22T03:16Z)
Description: value: In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/python/cpython
Files changed:
Lib/test/multibytecodec_support.py
Misc/NEWS.d/next/Tests/2020-10-05-17-43-46.bpo-41944.rf1dYb.rst
Commit message: bpo-41944: No longer call eval() on content received via HTTP in the CJK codec tests (GH-22566)



Vulnerable code:
        unichrs = lambda s: ''.join(map(chr, map(eval, s.split('+'))))
                data = line.split('#')[0].strip().split()
                csetval = eval(data[0])
                if csetval <= 0x7F:
                    csetch = bytes([csetval & 0xff])
                elif csetval >= 0x1000000:
                    csetch = bytes([(csetval >> 24), ((csetval >> 16) & 0xff),
                                    ((csetval >> 8) & 0xff), (csetval & 0xff)])
                elif csetval >= 0x10000:
                    csetch = bytes([(csetval >> 16), ((csetval >> 8) & 0xff),
                                    (csetval & 0xff)])
                elif csetval >= 0x100:
                    csetch = bytes([(csetval >> 8), (csetval & 0xff)])
                else:

Fixed code:
        def unichrs(s):
            return ''.join(chr(int(x, 16)) for x in s.split('+'))

                data = line.split('#')[0].split()
                if data[0][:2] != '0x':
                    self.fail(f"Invalid line: {line!r}")
                csetch = bytes.fromhex(data[0][2:])
                if len(csetch) == 1 and 0x80 <= csetch[0]:
Tests for CJK codecs no longer call ``eval()`` on content received via HTTP.
CVE-2024-0450 (Python, published 2024-03-19T16:15Z)
Description: value: An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior.

The zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile module reject zip archives which overlap entries in the archive.


Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/python/cpython
Files changed:
Lib/test/test_zipfile/test_core.py
Commit message: Add @requires_zlib() decorator for gh-109858 tests (GH-113918)



Vulnerable code:

Fixed code:
    @requires_zlib()
    @requires_zlib()
CVE-2024-4030 (C, published 2024-05-07T21:15Z)
Description: value: On Windows a directory returned by tempfile.mkdtemp() would not always have permissions set to restrict reading and writing to the temporary directory by other users, instead usually inheriting the correct permissions from the default location. Alternate configurations or users without a profile directory may not have the intended permissions.

If you’re not using Windows or haven’t changed the temporary directory location then you aren’t affected by this vulnerability. On other platforms the returned directory is consistently readable and writable only by the current user.

This issue was caused by Python not supporting Unix permissions on Windows. The fix adds support for Unix “700” for the mkdir function on Windows which is used by mkdtemp() to ensure the newly created directory has the proper permissions.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/python/cpython
Files changed:
Modules/posixmodule.c
Commit message: gh-118486: Switch mkdir(mode=0o700) on Windows to use OWNER RIGHTS instead of CURRENT_USER (GH-118515)



Vulnerable code:
    data->ea[0].Trustee.TrusteeForm = TRUSTEE_IS_NAME;
    data->ea[0].Trustee.TrusteeType = TRUSTEE_IS_ALIAS;
    data->ea[0].Trustee.ptstrName = L"CURRENT_USER";

Fixed code:
    char sid[64];
    int use_alias = 0;
    DWORD cbSid = sizeof(data->sid);
    if (!CreateWellKnownSid(WinCreatorOwnerRightsSid, NULL, (PSID)data->sid, &cbSid)) {
        use_alias = 1;
    }

    if (use_alias) {
        data->ea[0].Trustee.TrusteeForm = TRUSTEE_IS_NAME;
        data->ea[0].Trustee.TrusteeType = TRUSTEE_IS_ALIAS;
        data->ea[0].Trustee.ptstrName = L"CURRENT_USER";
    } else {
        data->ea[0].Trustee.TrusteeForm = TRUSTEE_IS_SID;
        data->ea[0].Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP;
        data->ea[0].Trustee.ptstrName = (LPWCH)(SID*)data->sid;
    }
CVE-2024-4030 (Other, published 2024-05-07T21:15Z)
Description: value: On Windows a directory returned by tempfile.mkdtemp() would not always have permissions set to restrict reading and writing to the temporary directory by other users, instead usually inheriting the correct permissions from the default location. Alternate configurations or users without a profile directory may not have the intended permissions.

If you’re not using Windows or haven’t changed the temporary directory location then you aren’t affected by this vulnerability. On other platforms the returned directory is consistently readable and writable only by the current user.

This issue was caused by Python not supporting Unix permissions on Windows. The fix adds support for Unix “700” for the mkdir function on Windows which is used by mkdtemp() to ensure the newly created directory has the proper permissions.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/python/cpython
Files changed:
Doc/whatsnew/3.13.rst
Misc/NEWS.d/next/Security/2024-05-01-20-57-09.gh-issue-118486.K44KJG.rst
Commit message: gh-118486: Update docs for CVE-2024-4030 reference (GH-118737)



Vulnerable code:

Fixed code:
* :func:`os.mkdir` and :func:`os.makedirs` on Windows now support passing a
  *mode* value of ``0o700`` to apply access control to the new directory. This
  implicitly affects :func:`tempfile.mkdtemp` and is a mitigation for
  :cve:`2024-4030`. Other values for *mode* continue to be ignored.
  (Contributed by Steve Dower in :gh:`118486`.)

tempfile
--------

* On Windows, the default mode ``0o700`` used by :func:`tempfile.mkdtemp` now
  limits access to the new directory due to changes to :func:`os.mkdir`. This
  is a mitigation for :cve:`2024-4030`.
  (Contributed by Steve Dower in :gh:`118486`.)

:func:`os.mkdir` on Windows now accepts *mode* of ``0o700`` to restrict
the new directory to the current user. This fixes :cve:`2024-4030`
affecting :func:`tempfile.mkdtemp` in scenarios where the base temporary
directory is more permissive than the default.
CVE-2024-4030 (C, published 2024-05-07T21:15Z)
Description: value: On Windows a directory returned by tempfile.mkdtemp() would not always have permissions set to restrict reading and writing to the temporary directory by other users, instead usually inheriting the correct permissions from the default location. Alternate configurations or users without a profile directory may not have the intended permissions.

If you’re not using Windows or haven’t changed the temporary directory location then you aren’t affected by this vulnerability. On other platforms the returned directory is consistently readable and writable only by the current user.

This issue was caused by Python not supporting Unix permissions on Windows. The fix adds support for Unix “700” for the mkdir function on Windows which is used by mkdtemp() to ensure the newly created directory has the proper permissions.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/python/cpython
Files changed:
Lib/test/test_os.py
Modules/posixmodule.c
Commit message: gh-118486: Simplify test_win32_mkdir_700 to check the exact ACL (GH-119056)



Vulnerable code:
        path1 = os.path.join(os_helper.TESTFN, 'dir1')
        path2 = os.path.join(os_helper.TESTFN, 'dir2')
        # mode=0o700 is special-cased to override ACLs on Windows
        # There's no way to know exactly how the ACLs will look, so we'll
        # check that they are different from a regularly created directory.
        os.mkdir(path1, mode=0o700)
        os.mkdir(path2, mode=0o777)

        out1 = subprocess.check_output(["icacls.exe", path1], encoding="oem")
        out2 = subprocess.check_output(["icacls.exe", path2], encoding="oem")
        os.rmdir(path1)
        os.rmdir(path2)
        out1 = out1.replace(path1, "<PATH>")
        out2 = out2.replace(path2, "<PATH>")
        self.assertNotEqual(out1, out2)
        // Set a discreationary ACL (D) that is protected (P) and includes

Fixed code:
        path = os.path.abspath(os.path.join(os_helper.TESTFN, 'dir'))
        os.mkdir(path, mode=0o700)
        out = subprocess.check_output(["cacls.exe", path, "/s"], encoding="oem")
        os.rmdir(path)
        self.assertEqual(
            out.strip(),
            f'{path} "D:P(A;OICI;FA;;;SY)(A;OICI;FA;;;BA)(A;OICI;FA;;;OW)"',
        )
        // Set a discretionary ACL (D) that is protected (P) and includes
CVE-2024-21520 (Python, published 2024-06-26T05:15Z)
Description: value: Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improper input sanitization before splitting and joining with <br> tags.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/encode/django-rest-framework
Files changed:
rest_framework/templatetags/rest_framework.py
Commit message: Fix potential XSS vulnerability in break_long_headers template filter (#9435)

The header input is now properly escaped before splitting and joining with <br> tags. This prevents potential XSS attacks if the header contains unsanitized user input.

Vulnerable code:
        header = mark_safe('<br> ' + ', <br>'.join(header.split(',')))

Fixed code:
        header = mark_safe('<br> ' + ', <br>'.join(escape(header).split(',')))
CVE-2016-15023 (Other, published 2023-01-31T20:15Z)
Description: value: A vulnerability, which was classified as problematic, was found in SiteFusion Application Server up to 6.6.6. This affects an unknown part of the file getextension.php of the component Extension Handler. The manipulation leads to path traversal. Upgrading to version 6.6.7 is able to address this issue. The identifier of the patch is 49fff155c303d6cd06ce8f97bba56c9084bf08ac. It is recommended to upgrade the affected component. The identifier VDB-219765 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/sitefusion/server
Files changed:
VERSION
www/getextension.php
Commit message: Fixed vulnerability in getextension.php that allowed reading files outside of the extension directory.


Vulnerable code:
6.6.6
if( strpos($extension,'/') || strpos($extension,"\\") or !file_exists($path = $WEBCONFIG['sitefusionPath'].'/extensions/'.$extension) ) {

Fixed code:
6.6.7
$allowedRoot = realpath($WEBCONFIG['sitefusionPath'].'/extensions');
$path = realpath($allowedRoot.'/'.$extension);

if (!(substr($path, 0, strlen($allowedRoot)) == $allowedRoot && file_exists($path))) {
CVE-2016-10524 (JavaScript, published 2018-05-31T20:29Z)
Description: value: i18n-node-angular is a module used to interact between i18n and angular without using additional resources. A REST API endpoint that is used for development in i18n-node-angular before 1.4.0 was not disabled in production environments a malicious user could fill up the server causing a Denial of Service or content injection.
Severity: MEDIUM (CVSS v3 base score: 8.2)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/oliversalzburg/i18n-node-angular
Files changed:
i18n-node-routes.js
Commit message: [FIX] Only register translate route during development


Vulnerable code:
	app.get( "/i18n/:locale/:phrase", i18nRoutes.translate );

Fixed code:

	if( process.env.NODE_ENV === "development" ) {
		app.get( "/i18n/:locale/:phrase", i18nRoutes.translate );
	}
CVE-2021-42917 (C++, published 2021-11-01T19:15Z)
Description: value: Buffer overflow vulnerability in Kodi xbmc up to 19.0, allows attackers to cause a denial of service due to improper length of values passed to istream.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/fuzzard/xbmc
Files changed:
xbmc/playlists/PlayListPLS.cpp
Commit message: [Playlist] dont use istream directly to a tinyxml structure

Turn istream into a std::string to handle large buffers (#20305)


Vulnerable code:
    stream >> xmlDoc;

Fixed code:
    std::string asxstream(std::istreambuf_iterator<char>(stream), {});
    xmlDoc.Parse(asxstream, TIXML_DEFAULT_ENCODING);
    if (!pRootElement)
      return false;
CVE-2017-9250 (JavaScript, published 2017-05-28T20:29Z)
Description: value: The lexer_process_char_literal function in jerry-core/parser/js/js-lexer.c in JerryScript 1.0 does not skip memory allocation for empty strings, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via malformed JavaScript source code, related to the jmem_heap_free_block function.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/jerryscript-project/jerryscript
Files changed:
jerry-core/parser/js/js-lexer.c
tests/jerry/regression-test-issue-1833.js
Commit message: Do not allocate memory for zero length strings. (#1844)

Fixes #1821.

JerryScript-DCO-1.0-Signed-off-by: Zoltan Herczeg zherczeg.u-szeged@partner.samsung.com

Vulnerable code:

Fixed code:
  if (length == 0)
  {
    has_escape = false;
  }

// Copyright JS Foundation and other contributors, http://js.foundation
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

'\
'
CVE-2020-13649 (C, published 2020-05-28T15:15Z)
Description: value: parser/js/js-scanner.c in JerryScript 2.2.0 mishandles errors during certain out-of-memory conditions, as demonstrated by a scanner_reverse_info_list NULL pointer dereference and a scanner_scan_all assertion failure.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/jerryscript-project/jerryscript
Files changed:
jerry-core/parser/js/js-scanner.c
Commit message: Fix error handling in scanner when in case of OOM (#3793)

This patch fixes #3786 and fixes #3788.

JerryScript-DCO-1.0-Signed-off-by: Robert Fancsik frobert@inf.u-szeged.hu

Vulnerable code:
    /* Ignore the errors thrown by the lexer. */
    if (context_p->error != PARSER_ERR_OUT_OF_MEMORY)
    {
      context_p->error = PARSER_ERR_NO_ERROR;
    }

    /* The following code may allocate memory, so it is enclosed in a try/catch. */
    PARSER_TRY (context_p->try_buffer)
#if ENABLED (JERRY_ES2015)
      if (scanner_context.status_flags & SCANNER_CONTEXT_THROW_ERR_ASYNC_FUNCTION)
        JERRY_ASSERT (scanner_context.async_source_p != NULL);
        scanner_info_t *info_p;
        info_p = scanner_insert_info (context_p, scanner_context.async_source_p, sizeof (scanner_info_t));
        info_p->type = SCANNER_TYPE_ERR_ASYNC_FUNCTION;
      }
#endif /* ENABLED (JERRY_ES2015) */
      while (scanner_context.active_literal_pool_p != NULL)
        scanner_pop_literal_pool (context_p, &scanner_context);
    PARSER_CATCH
    {
      JERRY_ASSERT (context_p->error == PARSER_ERR_NO_ERROR);
    }
    PARSER_TRY_END
#if ENABLED (JERRY_ES2015)
    context_p->status_flags &= (uint32_t) ~PARSER_IS_GENERATOR_FUNCTION;
#endif /* ENABLED (JERRY_ES2015) */

Fixed code:
    if (JERRY_UNLIKELY (context_p->error != PARSER_ERR_OUT_OF_MEMORY))
      /* Ignore the errors thrown by the lexer. */
      context_p->error = PARSER_ERR_NO_ERROR;

      /* The following code may allocate memory, so it is enclosed in a try/catch. */
      PARSER_TRY (context_p->try_buffer)
  #if ENABLED (JERRY_ES2015)
        if (scanner_context.status_flags & SCANNER_CONTEXT_THROW_ERR_ASYNC_FUNCTION)
        {
          JERRY_ASSERT (scanner_context.async_source_p != NULL);
          scanner_info_t *info_p;
          info_p = scanner_insert_info (context_p, scanner_context.async_source_p, sizeof (scanner_info_t));
          info_p->type = SCANNER_TYPE_ERR_ASYNC_FUNCTION;
        }
  #endif /* ENABLED (JERRY_ES2015) */
        while (scanner_context.active_literal_pool_p != NULL)
        {
          scanner_pop_literal_pool (context_p, &scanner_context);
        }
      }
      PARSER_CATCH
        JERRY_ASSERT (context_p->error == PARSER_ERR_OUT_OF_MEMORY);
      PARSER_TRY_END
    JERRY_ASSERT (context_p->error == PARSER_ERR_NO_ERROR || context_p->error == PARSER_ERR_OUT_OF_MEMORY);

    if (context_p->error == PARSER_ERR_OUT_OF_MEMORY)
    {
      parser_stack_free (context_p);
      return;
    }
CVE-2020-13649 (C, published 2020-05-28T15:15Z)
Description: value: parser/js/js-scanner.c in JerryScript 2.2.0 mishandles errors during certain out-of-memory conditions, as demonstrated by a scanner_reverse_info_list NULL pointer dereference and a scanner_scan_all assertion failure.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-617 \u2014 Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Repository: https://github.com/jerryscript-project/jerryscript
Files changed:
jerry-core/parser/js/js-scanner.c
Commit message: Fix error handling in scanner when in case of OOM (#3793)

This patch fixes #3786 and fixes #3788.

JerryScript-DCO-1.0-Signed-off-by: Robert Fancsik frobert@inf.u-szeged.hu

Vulnerable code:
    /* Ignore the errors thrown by the lexer. */
    if (context_p->error != PARSER_ERR_OUT_OF_MEMORY)
    {
      context_p->error = PARSER_ERR_NO_ERROR;
    }

    /* The following code may allocate memory, so it is enclosed in a try/catch. */
    PARSER_TRY (context_p->try_buffer)
#if ENABLED (JERRY_ES2015)
      if (scanner_context.status_flags & SCANNER_CONTEXT_THROW_ERR_ASYNC_FUNCTION)
        JERRY_ASSERT (scanner_context.async_source_p != NULL);
        scanner_info_t *info_p;
        info_p = scanner_insert_info (context_p, scanner_context.async_source_p, sizeof (scanner_info_t));
        info_p->type = SCANNER_TYPE_ERR_ASYNC_FUNCTION;
      }
#endif /* ENABLED (JERRY_ES2015) */
      while (scanner_context.active_literal_pool_p != NULL)
        scanner_pop_literal_pool (context_p, &scanner_context);
    PARSER_CATCH
    {
      JERRY_ASSERT (context_p->error == PARSER_ERR_NO_ERROR);
    }
    PARSER_TRY_END
#if ENABLED (JERRY_ES2015)
    context_p->status_flags &= (uint32_t) ~PARSER_IS_GENERATOR_FUNCTION;
#endif /* ENABLED (JERRY_ES2015) */

Fixed code:
    if (JERRY_UNLIKELY (context_p->error != PARSER_ERR_OUT_OF_MEMORY))
      /* Ignore the errors thrown by the lexer. */
      context_p->error = PARSER_ERR_NO_ERROR;

      /* The following code may allocate memory, so it is enclosed in a try/catch. */
      PARSER_TRY (context_p->try_buffer)
  #if ENABLED (JERRY_ES2015)
        if (scanner_context.status_flags & SCANNER_CONTEXT_THROW_ERR_ASYNC_FUNCTION)
        {
          JERRY_ASSERT (scanner_context.async_source_p != NULL);
          scanner_info_t *info_p;
          info_p = scanner_insert_info (context_p, scanner_context.async_source_p, sizeof (scanner_info_t));
          info_p->type = SCANNER_TYPE_ERR_ASYNC_FUNCTION;
        }
  #endif /* ENABLED (JERRY_ES2015) */
        while (scanner_context.active_literal_pool_p != NULL)
        {
          scanner_pop_literal_pool (context_p, &scanner_context);
        }
      }
      PARSER_CATCH
        JERRY_ASSERT (context_p->error == PARSER_ERR_OUT_OF_MEMORY);
      PARSER_TRY_END
    JERRY_ASSERT (context_p->error == PARSER_ERR_NO_ERROR || context_p->error == PARSER_ERR_OUT_OF_MEMORY);

    if (context_p->error == PARSER_ERR_OUT_OF_MEMORY)
    {
      parser_stack_free (context_p);
      return;
    }