hitoshura25/cvefixes huggingface dataset:
CVE-2019-16346 (C, published 2019-09-16T13:15Z)
Description: value: ngiflib 0.4 has a heap-based buffer overflow in WritePixel() in ngiflib.c when called from DecodeGifImg, because deinterlacing for small pictures is mishandled.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/miniupnp/ngiflib
Files changed:
ngiflib.c
Commit message: fix deinterlacing for small pictures

fixes #12


Vulnerable code:
 * (c) 2004-2017 Thomas Bernard. All rights reserved
			if(context->curY >= p->height) {
				context->pass++;
				context->curY = i->posY + 4;
			}
			if(context->curY >= p->height) {
				context->pass++;
				context->curY = i->posY + 2;
			}
			if(context->curY >= p->height) {
				context->pass++;
				context->curY = i->posY + 1;
			}
				if(context->curY >= p->height) {
					context->pass++;
					context->curY = i->posY + 4;
				}
				if(context->curY >= p->height) {
					context->pass++;
					context->curY = i->posY + 2;
				}
				if(context->curY >= p->height) {
					context->pass++;
					context->curY = i->posY + 1;
				}

Fixed code:
 * (c) 2004-2019 Thomas Bernard. All rights reserved
		while(context->pass > 0 && context->pass < 4 &&
		      context->curY >= p->height) {
			switch(++context->pass) {
			case 2:	/* 2nd pass : every eighth row starting from 4 */
				context->curY = i->posY + 4;
				break;
			case 3:	/* 3rd pass : every fourth row starting from 2 */
				context->curY = i->posY + 2;
				break;
			case 4:	/* 4th pass : every odd row */
				context->curY = i->posY + 1;
				break;
			}
		}
			while(context->pass > 0 && context->pass < 4 &&
			      context->curY >= p->height) {
				switch(++context->pass) {
				case 2:	/* 2nd pass : every eighth row starting from 4 */
					context->curY = i->posY + 4;
					break;
				case 3:	/* 3rd pass : every fourth row starting from 2 */
					context->curY = i->posY + 2;
					break;
				case 4:	/* 4th pass : every odd row */
					context->curY = i->posY + 1;
					break;
				}
			}
CVE-2019-16347 (C, published 2019-09-16T13:15Z)
Description: value: ngiflib 0.4 has a heap-based buffer overflow in WritePixels() in ngiflib.c when called from DecodeGifImg, because deinterlacing for small pictures is mishandled.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-682 \u2014 Incorrect Calculation
The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.
Repository: https://github.com/miniupnp/ngiflib
Files changed:
ngiflib.c
Commit message: fix deinterlacing for small pictures

fixes #12


Vulnerable code:
 * (c) 2004-2017 Thomas Bernard. All rights reserved
			if(context->curY >= p->height) {
				context->pass++;
				context->curY = i->posY + 4;
			}
			if(context->curY >= p->height) {
				context->pass++;
				context->curY = i->posY + 2;
			}
			if(context->curY >= p->height) {
				context->pass++;
				context->curY = i->posY + 1;
			}
				if(context->curY >= p->height) {
					context->pass++;
					context->curY = i->posY + 4;
				}
				if(context->curY >= p->height) {
					context->pass++;
					context->curY = i->posY + 2;
				}
				if(context->curY >= p->height) {
					context->pass++;
					context->curY = i->posY + 1;
				}

Fixed code:
 * (c) 2004-2019 Thomas Bernard. All rights reserved
		while(context->pass > 0 && context->pass < 4 &&
		      context->curY >= p->height) {
			switch(++context->pass) {
			case 2:	/* 2nd pass : every eighth row starting from 4 */
				context->curY = i->posY + 4;
				break;
			case 3:	/* 3rd pass : every fourth row starting from 2 */
				context->curY = i->posY + 2;
				break;
			case 4:	/* 4th pass : every odd row */
				context->curY = i->posY + 1;
				break;
			}
		}
			while(context->pass > 0 && context->pass < 4 &&
			      context->curY >= p->height) {
				switch(++context->pass) {
				case 2:	/* 2nd pass : every eighth row starting from 4 */
					context->curY = i->posY + 4;
					break;
				case 3:	/* 3rd pass : every fourth row starting from 2 */
					context->curY = i->posY + 2;
					break;
				case 4:	/* 4th pass : every odd row */
					context->curY = i->posY + 1;
					break;
				}
			}
CVE-2019-16347 (C, published 2019-09-16T13:15Z)
Description: value: ngiflib 0.4 has a heap-based buffer overflow in WritePixels() in ngiflib.c when called from DecodeGifImg, because deinterlacing for small pictures is mishandled.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/miniupnp/ngiflib
Files changed:
ngiflib.c
Commit message: fix deinterlacing for small pictures

fixes #12


Vulnerable code:
 * (c) 2004-2017 Thomas Bernard. All rights reserved
			if(context->curY >= p->height) {
				context->pass++;
				context->curY = i->posY + 4;
			}
			if(context->curY >= p->height) {
				context->pass++;
				context->curY = i->posY + 2;
			}
			if(context->curY >= p->height) {
				context->pass++;
				context->curY = i->posY + 1;
			}
				if(context->curY >= p->height) {
					context->pass++;
					context->curY = i->posY + 4;
				}
				if(context->curY >= p->height) {
					context->pass++;
					context->curY = i->posY + 2;
				}
				if(context->curY >= p->height) {
					context->pass++;
					context->curY = i->posY + 1;
				}

Fixed code:
 * (c) 2004-2019 Thomas Bernard. All rights reserved
		while(context->pass > 0 && context->pass < 4 &&
		      context->curY >= p->height) {
			switch(++context->pass) {
			case 2:	/* 2nd pass : every eighth row starting from 4 */
				context->curY = i->posY + 4;
				break;
			case 3:	/* 3rd pass : every fourth row starting from 2 */
				context->curY = i->posY + 2;
				break;
			case 4:	/* 4th pass : every odd row */
				context->curY = i->posY + 1;
				break;
			}
		}
			while(context->pass > 0 && context->pass < 4 &&
			      context->curY >= p->height) {
				switch(++context->pass) {
				case 2:	/* 2nd pass : every eighth row starting from 4 */
					context->curY = i->posY + 4;
					break;
				case 3:	/* 3rd pass : every fourth row starting from 2 */
					context->curY = i->posY + 2;
					break;
				case 4:	/* 4th pass : every odd row */
					context->curY = i->posY + 1;
					break;
				}
			}
CVE-2020-25989 (Go, published 2020-11-19T21:15Z)
Description: value: Privilege escalation via arbitrary file write in pritunl electron client 1.0.1116.6 through v1.2.2550.20. Successful exploitation of the issue may allow an attacker to execute code on the effected system with root privileges.
Severity: HIGH (CVSS v3 base score: 7.8)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/pritunl/pritunl-client-electron
Files changed:
service/profile/profile.go
service/utils/utils.go
Commit message: Remove file before io write file


Vulnerable code:
	os.Remove(pth)

Fixed code:
	_ = os.Remove(pth)
	_ = os.Remove(pth)
	_ = os.Remove(pth)
	_ = os.Remove(pth)
	_ = os.Remove(pth)
	_ = os.Remove(pth)
	_ = os.Remove(pth)
	_ = os.Remove(pth)
CVE-2020-27519 (Go, published 2021-04-30T14:15Z)
Description: value: Pritunl Client v1.2.2550.20 contains a local privilege escalation vulnerability in the pritunl-service component. The attack vector is: malicious openvpn config. A local attacker could leverage the log and log-append along with log injection to create or append to privileged script files and execute code as root/SYSTEM.
Severity: HIGH (CVSS v3 base score: 7.8)
Weakness: CWE-269 \u2014 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Repository: https://github.com/pritunl/pritunl-client-electron
Files changed:
service/profile/profile.go
Commit message: Update profile write


Vulnerable code:

Fixed code:
			strings.HasPrefix(trimLine, "log-append ") ||
			strings.HasPrefix(trimLine, "syslog ") ||
			strings.HasPrefix(trimLine, "management ") ||
			strings.HasPrefix(trimLine, "plugin ") ||
CVE-2020-27519 (Go, published 2021-04-30T14:15Z)
Description: value: Pritunl Client v1.2.2550.20 contains a local privilege escalation vulnerability in the pritunl-service component. The attack vector is: malicious openvpn config. A local attacker could leverage the log and log-append along with log injection to create or append to privileged script files and execute code as root/SYSTEM.
Severity: HIGH (CVSS v3 base score: 7.8)
Weakness: CWE-269 \u2014 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Repository: https://github.com/pritunl/pritunl-client-electron
Files changed:
service/profile/profile.go
Commit message: Filter openvpn configuration data


Vulnerable code:
	err = ioutil.WriteFile(pth, []byte(p.Data), os.FileMode(0600))

Fixed code:
	data := ""
	for _, line := range strings.Split(p.Data, "\n") {
		trimLine := strings.TrimSpace(line)
		trimLine = strings.Trim(trimLine, "#")
		trimLine = strings.Trim(trimLine, "-")
		trimLine = strings.Trim(trimLine, "_")
		trimLine = strings.Trim(trimLine, ":")
		trimLine = strings.Trim(trimLine, ";")
		trimLine = strings.Trim(trimLine, "*")
		trimLine = strings.Trim(trimLine, "%")
		trimLine = strings.Trim(trimLine, "$")
		trimLine = strings.Trim(trimLine, "+")
		trimLine = strings.Trim(trimLine, "=")
		trimLine = strings.Trim(trimLine, "~")
		trimLine = strings.Trim(trimLine, "(")
		trimLine = strings.Trim(trimLine, ")")
		trimLine = strings.Trim(trimLine, "[")
		trimLine = strings.Trim(trimLine, "]")
		trimLine = strings.Trim(trimLine, "{")
		trimLine = strings.Trim(trimLine, "}")

		if strings.Contains(trimLine, "script-security") ||
			strings.HasPrefix(trimLine, "log ") ||
			strings.HasPrefix(trimLine, "up ") ||
			strings.HasPrefix(trimLine, "down ") ||
			strings.HasPrefix(trimLine, "route-pre-down ") ||
			strings.HasPrefix(trimLine, "tls-verify ") ||
			strings.HasPrefix(trimLine, "ipchange ") ||
			strings.HasPrefix(trimLine, "route-up ") {

			continue
		}
		data += line + "\n"
	}

	err = ioutil.WriteFile(pth, []byte(data), os.FileMode(0600))
CVE-2022-25372 (Go, published 2022-02-20T20:15Z)
Description: value: Pritunl Client through 1.2.3019.52 on Windows allows local privilege escalation, related to an ACL entry for CREATOR OWNER in platform_windows.go.
Severity: HIGH (CVSS v3 base score: 7.8)
Weakness: CWE-269 \u2014 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Repository: https://github.com/pritunl/pritunl-client-electron
Files changed:
service/platform/platform_windows.go
Commit message: Update acl in service platform windows


Vulnerable code:
		acl.GrantName(windows.GENERIC_ALL, "CREATOR OWNER"),

Fixed code:
CVE-2014-0039 (Other, published 2014-02-08T00:55Z)
Description: value: Untrusted search path vulnerability in fwsnort before 1.6.4, when not running as root, allows local users to execute arbitrary code via a Trojan horse fwsnort.conf in the current working directory.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/mrash/fwsnort
Files changed:
CREDITS
ChangeLog
fwsnort
fwsnort.8
Commit message: Bug fix for CVE-2014-0039

Bug fix for vulnerability CVE-2014-0039 reported by Murray McAllister of
the Red Hat Security Team in which an attacker-controlled fwsnort.conf
file could be read by fwsnort when not running as root.  This was caused
by fwsnort reading './fwsnort.conf' when not running as root and when a
path to the config file was not explicitly set with -c on the command
line.  This behavior has been changed to require the user to specify a
path to fwsnort.conf with -c when not running as root.


Vulnerable code:
        $fwsnort_conf = './fwsnort.conf';
line with the \-\-config option.

Fixed code:

Murray McAllister (Red Hat Security Team)
    - Reported a bug fix for vulnerability CVE-2014-0039 in which an attacker-
      controlled fwsnort.conf file could be read by fwsnort when not running as
      root.  This was caused by fwsnort reading './fwsnort.conf' when not
      running as root and when a path to the config file was not explicitly set
      with -c on the command line.  This behavior has been changed to require
      the user to specify a path to fwsnort.conf with -c when not running as
      root.
fwsnort-1.6.4 (02//2014):
    - Bug fix for vulnerability CVE-2014-0039 reported by Murray McAllister of
      the Red Hat Security Team in which an attacker-controlled fwsnort.conf
      file could be read by fwsnort when not running as root.  This was caused
      by fwsnort reading './fwsnort.conf' when not running as root and when a
      path to the config file was not explicitly set with -c on the command
      line.  This behavior has been changed to require the user to specify a
      path to fwsnort.conf with -c when not running as root.


        die "[*] Must specify a path to readable ",
            "fwsnort.conf file when not running as root.";
line with the \-\-config option.  When fwsnort is not executed as root, then
a path to a readable fwsnort.conf file is required.
CVE-2019-15149 (Python, published 2019-08-18T20:15Z)
Description: value: core.py in Mitogen before 0.2.8 has a typo that drops the unidirectional-routing protection mechanism in the case of a child that is initiated by another child. The Ansible extension is unaffected. NOTE: the vendor disputes this issue because it is exploitable only in conjunction with hypothetical other factors, i.e., an affected use case within a library caller, and a bug in the message receiver policy code that led to reliance on this extra protection mechanism
Severity: MEDIUM (CVSS v3 base score: 9.8)
Weakness: CWE-254 \u2014 7PK - Security Features
Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.
Repository: https://github.com/dw/mitogen
Files changed:
mitogen/core.py
tests/router_test.py
Commit message: [security] core: undirectional routing wasn't respected in some cases

When creating a context using Router.method(via=somechild),
unidirectional mode was set on the new child correctly, however if the
child were to call Router.method(), due to a typing mistake the new
child would start without it.

This doesn't impact the Ansible extension, as only forked tasks are
started directly by children, and they are not responsible for routing
messages.

Add test so it can't happen again.


Vulnerable code:
        self.router.undirectional = self.config['unidirectional']
    def test_siblings_cant_talk(self):
        l1 = self.router.local()
        l2 = self.router.local()
        logs = testlib.LogCapturer()
        logs.start()
        e = self.assertRaises(mitogen.core.CallError,
                              lambda: l2.call(ping_context, l1))
        msg = self.router.unidirectional_msg % (
            l2.context_id,
            l1.context_id,
        )
        self.assertTrue(msg in str(e))
        self.assertTrue('routing mode prevents forward of ' in logs.stop())

Fixed code:
        self.router.unidirectional = self.config['unidirectional']
import sys
import mitogen.core
def test_siblings_cant_talk(router):
    l1 = router.local()
    l2 = router.local()
    logs = testlib.LogCapturer()
    logs.start()

    try:
        l2.call(ping_context, l1)
    except mitogen.core.CallError:
        e = sys.exc_info()[1]

    msg = mitogen.core.Router.unidirectional_msg % (
        l2.context_id,
        l1.context_id,
    )
    assert msg in str(e)
    assert 'routing mode prevents forward of ' in logs.stop()


@mitogen.core.takes_econtext
def test_siblings_cant_talk_remote(econtext):
    mitogen.parent.upgrade_router(econtext)
    test_siblings_cant_talk(econtext.router)


    def test_siblings_cant_talk_master(self):
        test_siblings_cant_talk(self.router)
    def test_siblings_cant_talk_parent(self):
        # ensure 'unidirectional' attribute is respected for contexts started
        # by children.
        self.router.unidirectional = True
        parent = self.router.local()
        parent.call(test_siblings_cant_talk_remote)
CVE-2022-4875 (Unknown, published 2023-01-04T22:15Z)
Description: value: A vulnerability has been found in fossology and classified as problematic. This vulnerability affects unknown code. The manipulation of the argument sql/VarValue leads to cross site scripting. The attack can be initiated remotely. The patch is identified as 8e0eba001662c7eb35f045b70dd458a4643b4553. It is recommended to apply a patch to fix this issue. VDB-217426 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/fossology/fossology
Files changed:
Commit message: Merge pull request #2356 from Orange-OpenSource/fix/orange-opensource/security/fix-reflected-xss

fix(security) fix Reflected XSS vulnerability

Reviewed-by: shaheem.azmal@siemens.com
Tested-by: shaheem.azmal@siemens.com

Vulnerable code:

Fixed code:
CVE-2021-3995 (C, published 2022-08-23T20:15Z)
Description: value: A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE filesystems that belong to certain other users who have a UID that is a prefix of the UID of the attacker in its string form. An attacker may use this flaw to cause a denial of service to applications that use the affected filesystems.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-552 \u2014 Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.
Repository: https://github.com/util-linux/util-linux
Files changed:
libmount/src/context_umount.c
libmount/src/mountP.h
libmount/src/optstr.c
Commit message: libmount: fix UID check for FUSE umount [CVE-2021-3995]

Improper UID check allows an unprivileged user to unmount FUSE
filesystems of users with similar UID.

Signed-off-by: Karel Zak <kzak@redhat.com>


Vulnerable code:
	char *user_id = NULL;
	size_t sz;
	uid_t uid;
	char uidstr[sizeof(stringify_value(ULONG_MAX))];

	if (mnt_optstr_get_option(optstr, "user_id", &user_id, &sz) != 0)
		return 0;

	if (sz == 0 || user_id == NULL)
	snprintf(uidstr, sizeof(uidstr), "%lu", (unsigned long) uid);
	return strncmp(user_id, uidstr, sz) == 0;

Fixed code:
	uid_t uid, entry_uid;
	if (mnt_optstr_get_uid(optstr, "user_id", &entry_uid) != 0)
	return uid == entry_uid;
extern int mnt_optstr_get_uid(const char *optstr, const char *name, uid_t *uid);
/*
 * Converts value from @optstr addressed by @name to uid.
 *
 * Returns: 0 on success, 1 if not found, <0 on error
 */
int mnt_optstr_get_uid(const char *optstr, const char *name, uid_t *uid)
{
	char *value = NULL;
	size_t valsz = 0;
	char buf[sizeof(stringify_value(UINT64_MAX))];
	int rc;
	uint64_t num;

	assert(optstr);
	assert(name);
	assert(uid);

	rc = mnt_optstr_get_option(optstr, name, &value, &valsz);
	if (rc != 0)
		goto fail;

	if (valsz > sizeof(buf) - 1) {
		rc = -ERANGE;
		goto fail;
	}
	mem2strcpy(buf, value, valsz, sizeof(buf));

	rc = ul_strtou64(buf, &num, 10);
	if (rc != 0)
		goto fail;
	if (num > ULONG_MAX || (uid_t) num != num) {
		rc = -ERANGE;
		goto fail;
	}
	*uid = (uid_t) num;

	return 0;
fail:
	DBG(UTILS, ul_debug("failed to convert '%s'= to number [rc=%d]", name, rc));
	return rc;
}
CVE-2021-3996 (C, published 2022-08-23T20:15Z)
Description: value: A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable directory. An attacker may use this flaw to cause a denial of service to applications that use the affected filesystems.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-552 \u2014 Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.
Repository: https://github.com/util-linux/util-linux
Files changed:
libmount/docs/libmount-sections.txt
libmount/src/fs.c
libmount/src/libmount.h.in
libmount/src/libmount.sym
libmount/src/mountP.h
libmount/src/tab_parse.c
misc-utils/findmnt.c
Commit message: libmount: remove support for deleted mount table entries

The "(deleted)" suffix has been originally used by kernel for deleted
mountpoints. Since kernel commit 9d4d65748a5ca26ea8650e50ba521295549bf4e3
(Dec 2014) kernel does not use this suffix for mount stuff in /proc at
all. Let's remove this support from libmount too.

Signed-off-by: Karel Zak <kzak@redhat.com>


Vulnerable code:
mnt_fs_is_deleted
/**
 * mnt_fs_is_deleted:
 * @fs: filesystem
 *
 * Returns: 1 if the filesystem target is a marked as deleted by kernel
 */
int mnt_fs_is_deleted(struct libmnt_fs *fs)
{
	return mnt_fs_get_flags(fs) & MNT_FS_DELETED;
}

extern int mnt_fs_is_deleted(struct libmnt_fs *fs);
	mnt_fs_is_deleted;
#define MNT_FS_DELETED	(1 << 6) /* target path in mountinfo contains "(deleted)" */
	/* remove "\040(deleted)" suffix */
	p = (char *) endswith(fs->target, PATH_DELETED_SUFFIX);
	if (p && *p) {
		*p = '\0';
		fs->flags |= MNT_FS_DELETED;
	}

	COL_DELETED,
	[COL_DELETED]      = { "DELETED",         1, SCOLS_FL_RIGHT, N_("filesystem target marked as deleted") },
	case COL_DELETED:
		str = xstrdup(mnt_fs_is_deleted(fs) ? "1" : "0");
		break;
	if ((flags & FL_DELETED) && !mnt_fs_is_deleted(fs))
		return rc;

	fputs(_("     --deleted          print filesystems with mountpoint marked as deleted\n"), out);
		FINDMNT_OPT_SHADOWED,
		FINDMNT_OPT_DELETED,
		{ "deleted",        no_argument,       NULL, FINDMNT_OPT_DELETED },
		case FINDMNT_OPT_DELETED:
			flags |= FL_DELETED;
			break;
			case COL_DELETED:
				scols_column_set_json_type(cl, SCOLS_JSON_BOOLEAN);
				break;

Fixed code:
		FINDMNT_OPT_SHADOWED