hitoshura25/cvefixes huggingface dataset:
CVE-2022-31031 (C, published 2022-06-09T16:15Z)
Description: value: PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions prior to and including 2.12.1 a stack buffer overflow vulnerability affects PJSIP users that use STUN in their applications, either by: setting a STUN server in their account/media config in PJSUA/PJSUA2 level, or directly using `pjlib-util/stun_simple` API. A patch is available in commit 450baca which should be included in the next release. There are no known workarounds for this issue.
Severity: MEDIUM (CVSS v3 base score: 9.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/pjsip/pjproject
Files changed:
pjlib-util/src/pjlib-util/stun_simple.c
Commit message: Merge pull request from GHSA-26j7-ww69-c4qj



Vulnerable code:
    while (msg_len > 0) {

Fixed code:
    int attr_max_cnt = PJ_ARRAY_SIZE(msg->attr);
    while (msg_len > 0 && msg->attr_count < attr_max_cnt) {
    if (msg->attr_count == attr_max_cnt) {
	PJ_LOG(4, (THIS_FILE, "Warning: max number attribute %d reached.",
		   attr_max_cnt));
    }
CVE-2022-39269 (C, published 2022-10-06T18:16Z)
Description: value: PJSIP is a free and open source multimedia communication library written in C. When processing certain packets, PJSIP may incorrectly switch from using SRTP media transport to using basic RTP upon SRTP restart, causing the media to be sent insecurely. The vulnerability impacts all PJSIP users that use SRTP. The patch is available as commit d2acb9a in the master branch of the project and will be included in version 2.13. Users are advised to manually patch or to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 9.1)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/pjsip/pjproject
Files changed:
pjmedia/src/pjmedia/transport_srtp.c
Commit message: Merge pull request from GHSA-wx5m-cj97-4wwg



Vulnerable code:
	tx = srtp->tx_policy;
	rx = srtp->rx_policy;

Fixed code:
	tx = srtp->tx_policy;
	rx = srtp->rx_policy;
CVE-2023-27585 (C, published 2023-03-14T17:15Z)
Description: value: PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.13 and prior affects applications that use PJSIP DNS resolver. It doesn't affect PJSIP users who do not utilise PJSIP DNS resolver. This vulnerability is related to CVE-2022-24793. The difference is that this issue is in parsing the query record `parse_query()`, while the issue in CVE-2022-24793 is in `parse_rr()`. A patch is available as commit `d1c5e4d` in the `master` branch. A workaround is to disable DNS resolution in PJSIP config (by setting `nameserver_count` to zero) or use an external resolver implementation instead.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/pjsip/pjproject
Files changed:
pjlib-util/src/pjlib-util/dns.c
Commit message: Merge pull request from GHSA-q9cp-8wcq-7pfr

* Prevent heap buffer overflow when parsing DNS packet

* Fixed incorrect check in get_name*()

Vulnerable code:

Fixed code:
    if (start >= max)
        return PJLIB_UTIL_EDNSINNAMEPTR;

    if (start >= max)
        return PJLIB_UTIL_EDNSINNAMEPTR;

        if (p + 4 > max)
            return PJLIB_UTIL_EDNSINSIZE;
        if (p + 16 > max)
            return PJLIB_UTIL_EDNSINSIZE;
        if (p + 6 > max)
            return PJLIB_UTIL_EDNSINSIZE;
CVE-2023-27585 (C, published 2023-03-14T17:15Z)
Description: value: PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.13 and prior affects applications that use PJSIP DNS resolver. It doesn't affect PJSIP users who do not utilise PJSIP DNS resolver. This vulnerability is related to CVE-2022-24793. The difference is that this issue is in parsing the query record `parse_query()`, while the issue in CVE-2022-24793 is in `parse_rr()`. A patch is available as commit `d1c5e4d` in the `master` branch. A workaround is to disable DNS resolution in PJSIP config (by setting `nameserver_count` to zero) or use an external resolver implementation instead.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/pjsip/pjproject
Files changed:
pjlib-util/src/pjlib-util/dns.c
Commit message: Merge pull request from GHSA-q9cp-8wcq-7pfr

* Prevent heap buffer overflow when parsing DNS packet

* Fixed incorrect check in get_name*()

Vulnerable code:

Fixed code:
    if (start >= max)
        return PJLIB_UTIL_EDNSINNAMEPTR;

    if (start >= max)
        return PJLIB_UTIL_EDNSINNAMEPTR;

        if (p + 4 > max)
            return PJLIB_UTIL_EDNSINSIZE;
        if (p + 16 > max)
            return PJLIB_UTIL_EDNSINSIZE;
        if (p + 6 > max)
            return PJLIB_UTIL_EDNSINSIZE;
CVE-2023-30627 (Unknown, published 2023-04-24T21:15Z)
Description: value: jellyfin-web is the web client for Jellyfin, a free-software media system. Starting in version 10.1.0 and prior to version 10.8.10, a stored cross-site scripting vulnerability in device.js can be used to make arbitrary calls to the `REST` endpoints with admin privileges. When combined with CVE-2023-30626, this results in remote code execution on the Jellyfin instance in the context of the user who's running it. This issue is patched in version 10.8.10. There are no known workarounds.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/jellyfin/jellyfin-web
Files changed:
Commit message: Merge pull request from GHSA-89hp-h43h-r5pq

Escape device id in raw HTML

Vulnerable code:

Fixed code:
CVE-2017-8825 (C, published 2017-05-08T16:29Z)
Description: value: A null dereference vulnerability has been found in the MIME handling component of LibEtPan before 1.8, as used in MailCore and MailCore 2. A crash can occur in low-level/imf/mailimf.c during a failed parse of a Cc header containing multiple e-mail addresses.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/dinhviethoa/libetpan
Files changed:
src/low-level/imf/mailimf.c
Commit message: Fixed crash #274


Vulnerable code:

Fixed code:
  clist * list;
    list = clist_new();
    if (list == NULL) {
      res = MAILIMF_ERROR_MEMORY;
      goto free_display_name;
    }
    mailbox_list = mailimf_mailbox_list_new(list);
    if (mailbox_list == NULL) {
      res = MAILIMF_ERROR_MEMORY;
      clist_free(list);
      goto free_display_name;
    }
CVE-2021-30145 (C, published 2021-05-18T14:15Z)
Description: value: A format string vulnerability in mpv through 0.33.0 allows user-assisted remote attackers to achieve code execution via a crafted m3u playlist file.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-134 \u2014 Use of Externally-Controlled Format String
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
Repository: https://github.com/mpv-player/mpv
Files changed:
demux/demux_mf.c
Commit message: demux_mf: improve format string processing

Before this commit, the user could specify a printf format string
which wasn't verified, and could result in:
- Undefined behavior due to missing or non-matching arguments.
- Buffer overflow due to untested result length.

The offending code was added at commit 103a9609 (2002, mplayer svn):
git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@4566 b3059339-0415-0410-9bf9-f77b7e298cf2

It moved around but was not modified meaningfully until now.

Now we reject all conversion specifiers at the format except %%
and a simple subset of the valid specifiers. Also, we now use
snprintf to avoid buffer overflow.

The format string is provided by the user as part of mf:// URI.

Report and initial patch by Stefan Schiller.
Patch reviewed by @jeeb, @sfan5, Stefan Schiller.


Vulnerable code:
    char *fname = talloc_size(mf, strlen(filename) + 32);
        sprintf(fname, filename, count++);

Fixed code:
    size_t fname_avail = strlen(filename) + 32;
    char *fname = talloc_size(mf, fname_avail);
    // We're using arbitrary user input as printf format with 1 int argument.
    // Any format which uses exactly 1 int argument would be valid, but for
    // simplicity we reject all conversion specifiers except %% and simple
    // integer specifier: %[.][NUM]d where NUM is 1-3 digits (%.d is valid)
    const char *f = filename;
    int MAXDIGS = 3, nspec = 0, bad_spec = 0, c;

    while (nspec < 2 && (c = *f++)) {
        if (c != '%')
            continue;
        if (*f != '%') {
            nspec++;  // conversion specifier which isn't %%
            if (*f == '.')
                f++;
            for (int ndig = 0; mp_isdigit(*f) && ndig < MAXDIGS; ndig++, f++)
                /* no-op */;
            if (*f != 'd') {
                bad_spec++;  // not int, or beyond our validation capacity
                break;
            }
        }
        // *f is '%' or 'd'
        f++;
    }

    // nspec==0 (zero specifiers) is rejected because fname wouldn't advance.
    if (bad_spec || nspec != 1) {
        mp_err(log, "unsupported expr format: '%s'\n", filename);
        goto exit_mf;
    }

        if (snprintf(fname, fname_avail, filename, count++) >= fname_avail) {
            mp_err(log, "format result too long: '%s'\n", filename);
            goto exit_mf;
        }
CVE-2022-1253 (C++, published 2022-04-06T12:15Z)
Description: value: Heap-based Buffer Overflow in GitHub repository strukturag/libde265 prior to and including 1.0.8. The fix is established in commit 8e89fe0e175d2870c39486fdd09250b230ec10b8 but does not yet belong to an official release.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/strukturag/libde265
Files changed:
libde265/sps.cc
libde265/vui.cc
Commit message: error on out-of-range cpb_cnt_minus1 (oss-fuzz issue 27590)


Vulnerable code:
    vui.read(errqueue, br, this);

Fixed code:
    de265_error err = vui.read(errqueue, br, this);
    if (err) {
      return err;
    }
      if (cpb_cnt_minus1[i] > 31) {
	return DE265_ERROR_CODED_PARAMETER_OUT_OF_RANGE;
      }
      if (err) {
	return err;
      }
CVE-2023-43887 (C++, published 2023-11-22T18:15Z)
Description: value: Libde265 v1.0.12 was discovered to contain multiple buffer overflows via the num_tile_columns and num_tile_row parameters in the function pic_parameter_set::dump.
Severity: nan (CVSS v3 base score: 8.1)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/strukturag/libde265
Files changed:
libde265/decctx.cc
Commit message: fix #418


Vulnerable code:
  if (success) {
    pps[ (int)new_pps->pic_parameter_set_id ] = new_pps;
  }
  return success ? DE265_OK : DE265_WARNING_PPS_HEADER_INVALID;

Fixed code:
  if (!success) {
    return DE265_WARNING_PPS_HEADER_INVALID;
  }
  pps[ (int)new_pps->pic_parameter_set_id ] = new_pps;
  return DE265_OK;
CVE-2023-47471 (C++, published 2023-11-16T04:15Z)
Description: value: Buffer Overflow vulnerability in strukturag libde265 v1.10.12 allows a local attacker to cause a denial of service via the slice_segment_header function in the slice.cc component.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/strukturag/libde265
Files changed:
libde265/slice.cc
Commit message: null-pointer check in debug output (fixes #426)


Vulnerable code:
  LOG0("----------------- SLICE -----------------\n");

Fixed code:
  LOG0("----------------- SLICE -----------------\n");

  if (!pps) {
    LOG0("invalid PPS referenced\n");
    return;
  }
  if (!sps) {
    LOG0("invalid SPS referenced\n");
    return;
  }
CVE-2020-8910 (JavaScript, published 2020-03-26T12:15Z)
Description: value: A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to be parsed by the library and return the wrong authority. Mitigation: update your library to version v20200315.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/google/closure-library
Files changed:
closure/goog/uri/utils.js
closure/goog/uri/utils_test.js
Commit message: Fix authority parsing in Closure URI parser.
RELNOTES: Fix authority parsing in Closure URI parser.

PiperOrigin-RevId: 300815722


Vulnerable code:
    '^' +
    '(?:([^/?#]*)@)?' +  // userInfo
    '([^/#?]*?)' +       // domain
    '(?::([0-9]+))?' +   // port
    '(?=[/\\\\#?]|$)' +  // authority-terminating character
    '(?:#([\\s\\S]*))?' +  // fragment

Fixed code:
 *
 * TODO(user): separate out the authority terminating characters once this
 * file is moved to ES6.
    '^' +  // Anchor against the entire string.
    '(?:([^\\\\/?#]*)@)?' +  // userInfo
    '([^\\\\/?#]*?)' +       // domain
    '(?::([0-9]+))?' +       // port
    '(?=[\\\\/?#]|$)' +      // authority-terminating character.
    '(?:#([\\s\\S]*))?' +  // fragment. Can't use '.*' with 's' flag as Firefox
                           // doesn't support the flag, and can't use an
                           // "everything set" ([^]) as IE10 doesn't match any
                           // characters with it.
  testSplitMaliciousUriUsername() {
    const uri = 'https://malicious.com\\@test.google.com';
    assertEquals('https', utils.getScheme(uri));
    assertEquals('malicious.com', utils.getDomain(uri));
    assertEquals('malicious.com', utils.getDomainEncoded(uri));
    assertNull(utils.getPort(uri));
    assertEquals('\\@test.google.com', utils.getPathEncoded(uri));
    assertEquals('\\@test.google.com', utils.getPath(uri));
    assertNull(utils.getQueryData(uri));
    assertNull(utils.getFragmentEncoded(uri));
    assertNull(utils.getFragment(uri));
  },
CVE-2015-3010 (Unknown, published 2015-06-16T16:59Z)
Description: value: ceph-deploy before 1.5.23 uses weak permissions (644) for ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/ceph/ceph-deploy
Files changed:
Commit message: Merge pull request #272 from trhoden/wip_key_perms

Fix: keyring permissions where world readable

Vulnerable code:

Fixed code:
CVE-2018-11647 (Unknown, published 2018-06-17T16:29Z)
Description: value: index.js in oauth2orize-fprm before 0.2.1 has XSS via a crafted URL.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/jaredhanson/oauth2orize-fprm
Files changed:
Commit message: Merge pull request #4 from MarcinHoppe/fix-number-encoding

Correctly encoding values that are not strings

Vulnerable code:

Fixed code:
CVE-2012-10007 (PHP, published 2023-02-19T16:15Z)
Description: value: A vulnerability was found in madgicweb BuddyStream Plugin up to 3.2.7 on WordPress. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file ShareBox.php. The manipulation of the argument content/link/shares leads to cross site scripting. The attack can be launched remotely. Upgrading to version 3.2.8 is able to address this issue. The patch is named 7d5b9a89a27711aad76fd55ab4cc4185b545a1d0. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-221479.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/madgicweb/buddystream
Files changed:
buddystream.php
extensions/default/templates/ShareBox.php
readme.txt
Commit message: fixed vulnerability

git-svn-id: https://plugins.svn.wordpress.org/buddystream/trunk@634128 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
Version: 2.6.2
    define('BP_BUDDYSTREAM_VERSION', '2.6.2');
    <h4><i>"<?php echo $_GET['content']; ?>"</i></h4>
$content   = $_GET['content'];
$link      = $_GET['link'];
$arrShares = explode(',', $_GET['shares']);
        echo '<script src="http://platform.linkedin.com/in.js" type="text/javascript"></script><script type="IN/Share" data-url="'.$link.'"></script> ';
Tested up to: WP 3.4.1, BuddyPress 1.6.1
Stable tag: 2.6.2

Fixed code:
Version: 2.6.3
    define('BP_BUDDYSTREAM_VERSION', '2.6.3');
    <h4><i>"<?php echo esc_attr($_GET['content']); ?>"</i></h4>
$content   = esc_attr($_GET['content']);
$link      = esc_attr($_GET['link']);
$arrShares = explode(',', esc_attr($_GET['shares']));
        echo '<script src="http://platform.linkedin.com/in.js" type="text/javascript"></script><script type="IN/Share" data-url="'.urlencode($link).'"></script> ';
Tested up to: WP 3.4.2, BuddyPress 1.6.1
Stable tag: 2.6.3
= 2.6.3 =
* Fixed vulnerability in the ShareBox
CVE-2012-2385 (C++, published 2012-06-29T19:55Z)
Description: value: The terminal dispatcher in mosh before 1.2.1 allows remote authenticated users to cause a denial of service (long loop and CPU consumption) via an escape sequence with a large repeat count value.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-399 \u2014 Resource Management Errors
Weaknesses in this category are related to improper management of system resources.
Repository: https://github.com/keithw/mosh
Files changed:
src/terminal/terminaldispatcher.cc
src/terminal/terminaldispatcher.h
Commit message: Cap escape sequence parameters to prevent long loops.

Fixes #271 github issue.


Vulnerable code:

Fixed code:

  if ( ret > PARAM_MAX ) {
    ret = defaultval;
  }

    static const int PARAM_MAX = 65535;
    /* prevent evil escape sequences from causing long loops */
CVE-2019-10761 (JavaScript, published 2022-07-13T09:15Z)
Description: value: This affects the package vm2 before 3.6.11. It is possible to trigger a RangeError exception from the host rather than the "sandboxed" context by reaching the stack call limit with an infinite recursion. The returned object is then used to reference the mainModule property of the host code running the script allowing it to spawn a child_process and execute arbitrary code.
Severity: nan (CVSS v3 base score: 8.3)
Weakness: CWE-674 \u2014 Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place,  consuming excessive resources, such as allocated memory or the program stack.
Repository: https://github.com/patriksimek/vm2
Files changed:
lib/contextify.js
Commit message: Fixes sandbox escape (#197)


Vulnerable code:
	if (Contextified.has(value)) {
		// Contextified object has returned back from vm
		return Contextified.get(value);
	} else if (Decontextify.proxies.has(value)) {
		// Decontextified proxy already exists, reuse
		return Decontextify.proxies.get(value);
	}

	if (Decontextified.has(value)) {
		// Decontextified object has returned back to vm
		return Decontextified.get(value);
	} else if (Contextify.proxies.has(value)) {
		// Contextified proxy already exists, reuse
		return Contextify.proxies.get(value);
	}


Fixed code:
		if (Contextified.has(value)) {
			// Contextified object has returned back from vm
			return Contextified.get(value);
		} else if (Decontextify.proxies.has(value)) {
			// Decontextified proxy already exists, reuse
			return Decontextify.proxies.get(value);
		}

		if (Decontextified.has(value)) {
			// Decontextified object has returned back to vm
			return Decontextified.get(value);
		} else if (Contextify.proxies.has(value)) {
			// Contextified proxy already exists, reuse
			return Contextify.proxies.get(value);
		}
CVE-2021-23555 (Unknown, published 2022-02-11T20:15Z)
Description: value: The package vm2 before 3.9.6 are vulnerable to Sandbox Bypass via direct access to host error objects generated by node internals during generation of a stacktraces, which can lead to execution of arbitrary code on the host machine.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/patriksimek/vm2
Files changed:
Commit message: Merge pull request #395 from XmiliaH/security-fixes

Internal restructuring and security improvements

Vulnerable code:

Fixed code:
CVE-2022-36067 (JavaScript, published 2022-09-06T22:15Z)
Description: value: vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.11 of vm2. There are no known workarounds.
Severity: nan (CVSS v3 base score: 10)
Weakness: CWE-913 \u2014 Improper Control of Dynamically-Managed Code Resources
The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
Repository: https://github.com/patriksimek/vm2
Files changed:
lib/setup-sandbox.js
test/vm.js
Commit message: Fix 467


Vulnerable code:
	root: {value: global, writable: true, configurable: true}

Fixed code:
	root: {value: global, writable: true, configurable: true},
	Error: {value: LocalError}
		assert.throws(()=>vm2.run(`(()=>{
			const OldError = Error;
			global.Error = {prepareStackTrace: (_, c) => c.map(c => c.getThis()).find(a => a && a.process)};
			const { stack } = new OldError();
			global.Error = OldError;
			return stack.process.mainModule;
		})()`));