hitoshura25/cvefixes huggingface dataset:
CVE-2020-1911 (C++, published 2020-09-04T03:15Z)
Description: value: A type confusion vulnerability when resolving properties of JavaScript objects with specially-crafted prototype chains in Facebook Hermes prior to commit fe52854cdf6725c2eaa9e125995da76e6ceb27da allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
Severity: MEDIUM (CVSS v3 base score: 9.8)
Weakness: CWE-843 \u2014 Access of Resource Using Incompatible Type ('Type Confusion')
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
Repository: https://github.com/facebook/hermes
Files changed:
API/jsi/jsi/test/testlib.cpp
lib/VM/JSObject.cpp
Commit message: [CVE-2020-1911] Look up HostObject computed properties on the right object in the prototype chain.

Summary:
The change in the hermes repository fixes the security vulnerability
CVE-2020-1911.  This vulnerability only affects applications which
allow evaluation of uncontrolled, untrusted JavaScript code not
shipped with the app, so React Native apps will generally not be affected.

This revision includes a test for the bug.  The test is generic JSI
code, so it is included in the hermes and react-native repositories.

Changelog: [Internal]

Reviewed By: tmikov

Differential Revision: D23322992

fbshipit-source-id: 4e88c974afe1ad33a263f9cac03e9dc98d33649a


Vulnerable code:
    auto propRes = vmcast<HostObject>(selfHandle.get())->get(id);

Fixed code:
TEST_P(JSITest, HostObjectProtoTest) {
  class ProtoHostObject : public HostObject {
    Value get(Runtime& rt, const PropNameID&) override {
      return String::createFromAscii(rt, "phoprop");
    }
  };

  rt.global().setProperty(
      rt,
      "pho",
      Object::createFromHostObject(rt, std::make_shared<ProtoHostObject>()));

  EXPECT_EQ(
      eval("({__proto__: pho})[Symbol.toPrimitive]").getString(rt).utf8(rt),
      "phoprop");
}

    auto propRes = vmcast<HostObject>(propObj.get())->get(id);
CVE-2020-1915 (C++, published 2020-10-26T21:15Z)
Description: value: An out-of-bounds read in the JavaScript Interpreter in Facebook Hermes prior to commit 8cb935cd3b2321c46aa6b7ed8454d95c75a7fca0 allows attackers to cause a denial of service attack or possible further memory corruption via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/facebook/hermes
Files changed:
lib/VM/JSObject.cpp
test/hermes/proxy.js
Commit message: Handle set where internalSetter and Proxy are both true

Summary:
If putComputed is called on a proxy whose target's prototype
is an array with a propname of 'length', then internalSetter will be
true, and the receiver will be a proxy.  In that case, proxy needs to
win; the behavior may assert or be UB otherwise.

Reviewed By: tmikov

Differential Revision: D23916279

fbshipit-source-id: c760356d48a02ece565fb4bc1acdafd7ccad7c68


Vulnerable code:
      } else if (receiverHandle->isHostObject()) {
        return vmcast<HostObject>(receiverHandle.get())->set(id, *valueHandle);
          receiverHandle->isProxyObject() && "descriptor flags are impossible");
      if (*descDefinedRes) {
        dpf.setValue = 1;
      } else {
        dpf = DefinePropertyFlags::getDefaultNewPropertyFlags();
      }
      return JSProxy::defineOwnProperty(
          receiverHandle,
          runtime,
          nameValPrimitiveHandle,
          dpf,
          valueHandle,
          opFlags);

Fixed code:
      // If putComputed is called on a proxy whose target's prototype
      // is an array with a propname of 'length', then internalSetter
      // will be true, and the receiver will be a proxy.  In that case,
      // proxy wins.
      if (receiverHandle->isProxyObject()) {
        if (*descDefinedRes) {
          dpf.setValue = 1;
        } else {
          dpf = DefinePropertyFlags::getDefaultNewPropertyFlags();
        }
        return JSProxy::defineOwnProperty(
            receiverHandle,
            runtime,
            nameValPrimitiveHandle,
            dpf,
            valueHandle,
            opFlags);
      }
          receiverHandle->isHostObject() && "descriptor flags are impossible");
      return vmcast<HostObject>(receiverHandle.get())->set(id, *valueHandle);
// If putComputed is called on a proxy whose target's prototype is an
// array with a propname of 'length', then internalSetter will be
// true, and the receiver will be a proxy.  In that case, proxy needs
// to win; the behavior may assert or be UB otherwise.
var p = new Proxy(Object.create([]), {});
// using String() forces putComputed
p[String('length')] = 0x123;
p[0xABC] = 1111;
CVE-2021-24037 (C++, published 2021-06-15T22:15Z)
Description: value: A use after free in hermes, while emitting certain error messages, prior to commit d86e185e485b6330216dee8e854455c694e3a36e allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/facebook/hermes
Files changed:
include/hermes/VM/StringView.h
lib/VM/Interpreter.cpp
Commit message: Fix a bug in transient object property assignment and getUTF16Ref

Summary:
The returned `UTF16Ref` from `StringView::getUTF16Ref` can be invalidated by
appending more contents to the same allocator.
This case was encountered in `transientObjectPutErrorMessage`, resulting in
using free'd memory.

Reviewed By: tmikov

Differential Revision: D23034855

fbshipit-source-id: 4c25a5369934bf3bdfc5582385503f4b87de3792


Vulnerable code:
  /// Note: \p allocator does not need to be empty when passed in. We always
  /// append.
  SmallU16String<32> tmp;
      baseTypeAsString.getUTF16Ref(tmp) + " '" +
      valueAsStringPrintable.getUTF16Ref(tmp) + "'");

Fixed code:
  /// \pre allocator must be empty when passed in.
    assert(allocator.empty() && "Shouldn't use a non-empty allocator");
  SmallU16String<32> tmp1;
  SmallU16String<32> tmp2;
      baseTypeAsString.getUTF16Ref(tmp1) + " '" +
      valueAsStringPrintable.getUTF16Ref(tmp2) + "'");
CVE-2021-24045 (C++, published 2021-12-13T21:15Z)
Description: value: A type confusion vulnerability could be triggered when resolving the "typeof" unary operator in Facebook Hermes prior to v0.10.0. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
Severity: MEDIUM (CVSS v3 base score: 9.8)
Weakness: CWE-843 \u2014 Access of Resource Using Incompatible Type ('Type Confusion')
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
Repository: https://github.com/facebook/hermes
Files changed:
lib/IR/IREval.cpp
test/hermes/tdz-check.js
Commit message: Handle typeof applied to empty in InstSimplify

Summary:
Do not simplify `typeof` if it is applied to an invalid type. This
handles a case like the one in the added test, where `typeof` is called
on a literal empty in unreachable code.

Reviewed By: kodafb

Differential Revision: D31000173

fbshipit-source-id: 2d7f69cbcc9c1bb0a916585c07171089444c85dc


Vulnerable code:
          llvm_unreachable("Invalid literal kind.");

Fixed code:
          break;

test(() => {
    const foo = print(foo, typeof foo)
});
//CHECK-NEXT: caught ReferenceError: accessing an uninitialized variable
CVE-2022-35289 (C++, published 2022-10-11T02:15Z)
Description: value: A write-what-where condition in hermes caused by an integer overflow, prior to commit 5b6255ae049fa4641791e47fad994e8e8c4da374 allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/facebook/hermes
Files changed:
lib/VM/detail/IdentifierHashTable.cpp
Commit message: Re-sync with internal repository (#791)

Co-authored-by: Facebook Community Bot <6422482+facebook-github-bot@users.noreply.github.com>

Vulnerable code:

Fixed code:
  // Guard against potential overflow in the calculation of new capacity.
  if (LLVM_UNLIKELY(newCapacity <= capacity())) {
    hermes_fatal("too many identifiers created");
  }
CVE-2016-9132 (Unknown, published 2017-01-30T22:59Z)
Description: value: In Botan 1.8.0 through 1.11.33, when decoding BER data an integer overflow could occur, which would cause an incorrect length field to be computed. Some API callers may use the returned (incorrect and attacker controlled) length field in a way which later causes memory corruption or other failure.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/randombit/botan
Files changed:
Commit message: Fix BER decoder integer overflow


Vulnerable code:

Fixed code:
CVE-2024-34702 (Unknown, published 2024-07-08T17:15Z)
Description: value: Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters.  Prior to 3.5.0 and 2.19.5, checking name constraints in X.509 certificates is quadratic in the number of names and name constraints. An attacker who presented a certificate chain which contained a very large number of names in the SubjectAlternativeName, signed by a CA certificate which contained a large number of name constraints, could cause a denial of service. The problem has been addressed in Botan 3.5.0 and a partial backport has also been applied and is included in Botan 2.19.5.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/randombit/botan
Files changed:
Commit message: Merge pull request #4045 from randombit/jack/x509-path-sigs-first

During X509 path validation, return immediately if a signature is invalid

Vulnerable code:

Fixed code:
CVE-2024-34702 (Unknown, published 2024-07-08T17:15Z)
Description: value: Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters.  Prior to 3.5.0 and 2.19.5, checking name constraints in X.509 certificates is quadratic in the number of names and name constraints. An attacker who presented a certificate chain which contained a very large number of names in the SubjectAlternativeName, signed by a CA certificate which contained a large number of name constraints, could cause a denial of service. The problem has been addressed in Botan 3.5.0 and a partial backport has also been applied and is included in Botan 2.19.5.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/randombit/botan
Files changed:
Commit message: Merge pull request #4034 from randombit/jack/refactor-alt-name

Refactor AlternativeName internals

Vulnerable code:

Fixed code:
CVE-2024-34702 (Unknown, published 2024-07-08T17:15Z)
Description: value: Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters.  Prior to 3.5.0 and 2.19.5, checking name constraints in X.509 certificates is quadratic in the number of names and name constraints. An attacker who presented a certificate chain which contained a very large number of names in the SubjectAlternativeName, signed by a CA certificate which contained a large number of name constraints, could cause a denial of service. The problem has been addressed in Botan 3.5.0 and a partial backport has also been applied and is included in Botan 2.19.5.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/randombit/botan
Files changed:
Commit message: Merge pull request #4047 from randombit/jack/opt-name-constraints

Optimize name constraint matching

Vulnerable code:

Fixed code:
CVE-2024-34702 (Unknown, published 2024-07-08T17:15Z)
Description: value: Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters.  Prior to 3.5.0 and 2.19.5, checking name constraints in X.509 certificates is quadratic in the number of names and name constraints. An attacker who presented a certificate chain which contained a very large number of names in the SubjectAlternativeName, signed by a CA certificate which contained a large number of name constraints, could cause a denial of service. The problem has been addressed in Botan 3.5.0 and a partial backport has also been applied and is included in Botan 2.19.5.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/randombit/botan
Files changed:
Commit message: Merge pull request #4186 from randombit/jack/fix-nc-dos

Address denial of service in name constraints processing

Vulnerable code:

Fixed code:
CVE-2024-34703 (Unknown, published 2024-06-30T21:15Z)
Description: value: Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. Prior to versions 3.3.0 and 2.19.4, an attacker could present an ECDSA X.509 certificate using explicit encoding where the parameters are very large. The proof of concept used a 16Kbit prime for this purpose. When parsing, the parameter is checked to be prime, causing excessive computation. This was patched in 2.19.4 and 3.3.0 to allow the prime parameter of the elliptic curve to be at most 521 bits. No known workarounds are available. Note that support for explicit encoding of elliptic curve parameters is deprecated in Botan.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/randombit/botan
Files changed:
Commit message: Merge pull request #3913 from randombit/jack/limit-ecc-curve-size

When decoding an arbitrary elliptic curve, set an upper bound on length

Vulnerable code:

Fixed code:
CVE-2021-45926 (Other, published 2022-01-01T01:15Z)
Description: value: MDB Tools (aka mdbtools) 0.9.2 has a stack-based buffer overflow (at 0x7ffd0c689be0) in mdb_numeric_to_string (called from mdb_xfer_bound_data and _mdb_attempt_bind).
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/mdbtools/mdbtools
Files changed:
NEWS
configure.ac
Commit message: Version 0.9.3, final


Vulnerable code:
Version 0.9.3, Beta 4
=============

libmdb:
* Fix build failure with emscripten #299

Version 0.9.3, Beta 3
=============

libmdb / libmdbsql:
* Fix build when _XOPEN_SOURCE was already defined on the platform #298

Version 0.9.3, Beta 2
=============

libmdb:
* Migrate to g_memdup2 #287 #288

libmdbsql:
* Allow double quoted (") database names #291
* Allow spaces in database names #292 #293

Docs:
* Add JET version for access 2013/2016/2019 to docs #286

Version 0.9.3, Beta 1
* Comparison operators behaved incorrectly when the constant was on the left #283 #285
AC_INIT([mdbtools],[0.9.3-beta4],[https://github.com/mdbtools/mdbtools/issues],[],[https://github.com/mdbtools/mdbtools])

Fixed code:
Version 0.9.3
* Migrate to `g_memdup2` #287 #288
* Fix build when `_XOPEN_SOURCE` was already defined on the platform #298
* Fix build failure with emscripten #299
* Comparison operators behaved incorrectly when the constant was on the left #283 #285
* Allow double quoted (") database names #291
* Allow spaces in database names #292 #293
Docs:
* Add JET version for access 2013/2016/2019 to docs #286

AC_INIT([mdbtools],[0.9.3],[https://github.com/mdbtools/mdbtools/issues],[],[https://github.com/mdbtools/mdbtools])
CVE-2021-45927 (Other, published 2022-01-01T01:15Z)
Description: value: MDB Tools (aka mdbtools) 0.9.2 has a stack-based buffer overflow (at 0x7ffd6e029ee0) in mdb_numeric_to_string (called from mdb_xfer_bound_data and _mdb_attempt_bind).
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/mdbtools/mdbtools
Files changed:
NEWS
configure.ac
Commit message: Version 0.9.3, final


Vulnerable code:
Version 0.9.3, Beta 4
=============

libmdb:
* Fix build failure with emscripten #299

Version 0.9.3, Beta 3
=============

libmdb / libmdbsql:
* Fix build when _XOPEN_SOURCE was already defined on the platform #298

Version 0.9.3, Beta 2
=============

libmdb:
* Migrate to g_memdup2 #287 #288

libmdbsql:
* Allow double quoted (") database names #291
* Allow spaces in database names #292 #293

Docs:
* Add JET version for access 2013/2016/2019 to docs #286

Version 0.9.3, Beta 1
* Comparison operators behaved incorrectly when the constant was on the left #283 #285
AC_INIT([mdbtools],[0.9.3-beta4],[https://github.com/mdbtools/mdbtools/issues],[],[https://github.com/mdbtools/mdbtools])

Fixed code:
Version 0.9.3
* Migrate to `g_memdup2` #287 #288
* Fix build when `_XOPEN_SOURCE` was already defined on the platform #298
* Fix build failure with emscripten #299
* Comparison operators behaved incorrectly when the constant was on the left #283 #285
* Allow double quoted (") database names #291
* Allow spaces in database names #292 #293
Docs:
* Add JET version for access 2013/2016/2019 to docs #286

AC_INIT([mdbtools],[0.9.3],[https://github.com/mdbtools/mdbtools/issues],[],[https://github.com/mdbtools/mdbtools])
CVE-2022-29245 (C#, published 2022-05-31T17:15Z)
Description: value: SSH.NET is a Secure Shell (SSH) library for .NET. In versions 2020.0.0 and 2020.0.1, during an `X25519` key exchange, the client’s private key is generated with `System.Random`. `System.Random` is not a cryptographically secure random number generator, it must therefore not be used for cryptographic purposes. When establishing an SSH connection to a remote host, during the X25519 key exchange, the private key is generated with a weak random number generator whose seed can be brute forced. This allows an attacker who is able to eavesdrop on the communications to decrypt them. Version 2020.0.2 contains a patch for this issue. As a workaround, one may disable support for `curve25519-sha256` and `curve25519-sha256@libssh.org` key exchange algorithms.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-338 \u2014 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
Repository: https://github.com/sshnet/SSH.NET
Files changed:
src/Renci.SshNet/Security/KeyExchangeECCurve25519.cs
Commit message: Use cryptographically secure random number generator.
Fixes CVE-2022-29245.


Vulnerable code:
            var rnd = new Random();
            _privateKey = new byte[MontgomeryCurve25519.PrivateKeySizeInBytes];
            rnd.NextBytes(_privateKey);

Fixed code:
            _privateKey = CryptoAbstraction.GenerateRandom(MontgomeryCurve25519.PrivateKeySizeInBytes);
CVE-2022-21667 (Unknown, published 2022-01-10T14:12Z)
Description: value: soketi is an open-source WebSockets server. There is an unhandled case when reading POST requests which results in the server crashing if it could not read the body of a request. In the event that a POST request is sent to any endpoint of the server with an empty body, even unauthenticated with the Pusher Protocol, it will crash the server. All users that run the server are affected by this vulnerability and it's highly recommended to upgrade to the latest patch. There are no workarounds for this issue.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-755 \u2014 Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
Repository: https://github.com/soketi/soketi
Files changed:
Commit message: Merge pull request #246 from soketi/fix/crash-on-empty-post

[fix] Do not close the connection on empty POST payload

Vulnerable code:

Fixed code:
CVE-2022-2061 (C, published 2022-06-13T12:15Z)
Description: value: Heap-based Buffer Overflow in GitHub repository hpjansson/chafa prior to 1.12.0.
Severity: LOW (CVSS v3 base score: 3.3)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/hpjansson/chafa
Files changed:
libnsgif/lzw.c
Commit message: libnsgif: fix oob in lzw_decode


Vulnerable code:

Fixed code:
	} else if (code_new >= 1 << LZW_CODE_MAX) {
		/* Don't access out of bound */
		return LZW_BAD_CODE;