hitoshura25/cvefixes huggingface dataset:
CVE-2017-7407 (Other, published 2017-04-03T20:59Z)
Description: value: The ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from process memory in opportunistic circumstances by reading a workstation screen during use of a --write-out argument ending in a '%' character, which leads to a heap-based buffer over-read.
Severity: LOW (CVSS v3 base score: 2.4)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/curl/curl
Files changed:
src/tool_writeout.c
tests/data/Makefile.inc
tests/data/test1440
tests/data/test1441
Commit message: tool_writeout: fixed a buffer read overrun on --write-out

If a % ended the statement, the string's trailing NUL would be skipped
and memory past the end of the buffer would be accessed and potentially
displayed as part of the --write-out output. Added tests 1440 and 1441
to check for this kind of condition.

Reported-by: Brian Carpenter


Vulnerable code:
    if('%' == *ptr) {
test1436 test1437 test1438 test1439 \

Fixed code:
    if('%' == *ptr && ptr[1]) {
test1436 test1437 test1438 test1439 test1440 test1441 \
<testcase>
<info>
<keywords>
--write-out
</keywords>
</info>
# Server-side
<reply>
</reply>

# Client-side
<client>
<server>
file
</server>

<name>
Check --write-out with trailing %{
</name>
<command>
file://localhost/%PWD/log/ --write-out '%{'
</command>
</client>

# Verify data
<verify>
<stdout nonewline="yes">
%{
</stdout>
</verify>
</testcase>
<testcase>
<info>
<keywords>
--write-out
</keywords>
</info>
# Server-side
<reply>
</reply>

# Client-side
<client>
<server>
file
</server>

<name>
Check --write-out with trailing %
</name>
<command>
file://localhost/%PWD/log/ --write-out '%'
</command>
</client>

# Verify data
<verify>
<stdout nonewline="yes">
%
</stdout>
</verify>
</testcase>
CVE-2018-0500 (C, published 2018-07-11T13:29Z)
Description: value: Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that might be exploitable by an attacker who can control the data that curl transmits over SMTP with certain settings (i.e., use of a nonstandard --limit-rate argument or CURLOPT_BUFFERSIZE value).
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/curl/curl
Files changed:
lib/smtp.c
Commit message: smtp: use the upload buffer size for scratch buffer malloc

... not the read buffer size, as that can be set smaller and thus cause
a buffer overflow! CVE-2018-0500

Reported-by: Peter Wu
Bug: https://curl.haxx.se/docs/adv_2018-70a2.html


Vulnerable code:
    scratch = newscratch = malloc(2 * data->set.buffer_size);

Fixed code:
    scratch = newscratch = malloc(2 * UPLOAD_BUFSIZE);
  DEBUGASSERT(UPLOAD_BUFSIZE >= nread);
CVE-2018-16839 (C, published 2018-10-31T18:29Z)
Description: value: Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/curl/curl
Files changed:
lib/vauth/cleartext.c
Commit message: Curl_auth_create_plain_message: fix too-large-input-check

CVE-2018-16839
Reported-by: Harry Sintonen
Bug: https://curl.haxx.se/docs/CVE-2018-16839.html


Vulnerable code:
  if((ulen > SIZE_T_MAX/2) || (plen > (SIZE_T_MAX/2 - 2)))

Fixed code:
  if((ulen > SIZE_T_MAX/4) || (plen > (SIZE_T_MAX/2 - 2)))
CVE-2018-16840 (C, published 2018-10-31T18:29Z)
Description: value: A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/curl/curl
Files changed:
lib/url.c
Commit message: Curl_close: clear data->multi_easy on free to avoid use-after-free

Regression from b46cfbc068 (7.59.0)
CVE-2018-16840
Reported-by: Brian Carpenter (Geeknik Labs)

Bug: https://curl.haxx.se/docs/CVE-2018-16840.html


Vulnerable code:
  if(data->multi_easy)

Fixed code:
  if(data->multi_easy) {
    data->multi_easy = NULL;
  }
CVE-2018-16842 (C, published 2018-10-31T19:29Z)
Description: value: Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/curl/curl
Files changed:
src/tool_msgs.c
Commit message: voutf: fix bad arethmetic when outputting warnings to stderr

CVE-2018-16842
Reported-by: Brian Carpenter
Bug: https://curl.haxx.se/docs/CVE-2018-16842.html


Vulnerable code:
        len -= cut;

Fixed code:
        len -= cut + 1;
CVE-2021-22897 (C, published 2021-06-11T16:15Z)
Description: value: curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-668 \u2014 Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Repository: https://github.com/curl/curl
Files changed:
lib/vtls/schannel.c
lib/vtls/schannel.h
Commit message: schannel: don't use static to store selected ciphers

CVE-2021-22897

Bug: https://curl.se/docs/CVE-2021-22897.html


Vulnerable code:
set_ssl_ciphers(SCHANNEL_CRED *schannel_cred, char *ciphers)
  static ALG_ID algIds[45]; /*There are 45 listed in the MS headers*/
  while(startCur && (0 != *startCur) && (algCount < 45)) {
      result = set_ssl_ciphers(&schannel_cred, SSL_CONN_CONFIG(cipher_list));

Fixed code:
set_ssl_ciphers(SCHANNEL_CRED *schannel_cred, char *ciphers,
                int *algIds)
  while(startCur && (0 != *startCur) && (algCount < NUMOF_CIPHERS)) {
      result = set_ssl_ciphers(&schannel_cred, SSL_CONN_CONFIG(cipher_list),
                               BACKEND->algIds);
#define NUMOF_CIPHERS 45 /* There are 45 listed in the MS headers */

  ALG_ID algIds[NUMOF_CIPHERS];
CVE-2021-22898 (C, published 2021-06-11T16:15Z)
Description: value: curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.
Severity: LOW (CVSS v3 base score: 3.1)
Weakness: CWE-909 \u2014 Missing Initialization of Resource
The product does not initialize a critical resource.
Repository: https://github.com/curl/curl
Files changed:
lib/telnet.c
Commit message: telnet: check sscanf() for correct number of matches

CVE-2021-22898

Bug: https://curl.se/docs/CVE-2021-22898.html


Vulnerable code:
          if(sscanf(v->data, "%127[^,],%127s", varname, varval)) {

Fixed code:
          if(sscanf(v->data, "%127[^,],%127s", varname, varval) == 2) {
CVE-2021-4162 (Python, published 2021-12-25T12:15Z)
Description: value: archivy is vulnerable to Cross-Site Request Forgery (CSRF)
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/archivy/archivy
Files changed:
archivy/__init__.py
archivy/click_web/resources/cmd_exec.py
archivy/routes.py
archivy/templates/click_web/command_form.html
archivy/templates/dataobjs/show.html
tests/functional/test_routes.py
Commit message: better CSRF protection; change delete route to POST


Vulnerable code:
        field_infos = [
            FieldInfo.factory(key)
            for key in list(request.form.keys()) + list(request.files.keys())
        ]
@app.route("/dataobj/delete/<int:dataobj_id>", methods=["DELETE", "GET"])
          <form action="/dataobj/delete/{{ dataobj['id'] }}" method="delete" onsubmit="return confirm('Delete this item permanently?')" novalidate>
    response = client.get("/dataobj/delete/1")
    response = client.get("/dataobj/delete/1")

Fixed code:
from flask_wtf.csrf import CSRFProtect
csrf = CSRFProtect(app)
        keys = [key for key in list(request.form.keys()) + list(request.files.keys())]
        field_infos = [FieldInfo.factory(key) for key in keys if key != "csrf_token"]
@app.route("/dataobj/delete/<int:dataobj_id>", methods=["POST"])
	<input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
          <form action="/dataobj/delete/{{ dataobj['id'] }}" method="POST" onsubmit="return confirm('Delete this item permanently?')" novalidate>
    response = client.post("/dataobj/delete/1")
    response = client.post("/dataobj/delete/1")
CVE-2022-0697 (Python, published 2022-03-06T23:15Z)
Description: value: Open Redirect in GitHub repository archivy/archivy prior to 1.7.0.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/archivy/archivy
Files changed:
archivy/helpers.py
archivy/routes.py
Commit message: fix open redirect


Vulnerable code:
from flask import current_app, g
from archivy.helpers import get_db, write_config
            return redirect(next_url or "/")

Fixed code:
from flask import current_app, g, request
from urllib.parse import urlparse, urljoin


def is_safe_redirect_url(target):
    host_url = urlparse(request.host_url)
    redirect_url = urlparse(urljoin(request.host_url, target))
    return (
        redirect_url.scheme in ("http", "https")
        and host_url.netloc == redirect_url.netloc
    )
from archivy.helpers import get_db, write_config, is_safe_redirect_url
            if next_url and is_safe_redirect_url(next_url):
                return redirect(next_url)
            else:
                return redirect("/")
CVE-2023-37378 (C, published 2023-07-03T20:15Z)
Description: value: Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/kichik/nsis
Files changed:
Source/exehead/util.c
Commit message: Don't allow everyone to delete the uninstaller directory


git-svn-id: https://svn.code.sf.net/p/nsis/code/NSIS/trunk@7396 212acab6-be3b-0410-9dea-997c60f758d6


Vulnerable code:
  0x00130041, // ACCESS_ALLOWED_ACE:ACCESS_MASK: DELETE|READ_CONTROL|SYNCHRONIZE|FILE_DELETE_CHILD|FILE_LIST_DIRECTORY

Fixed code:
  0x001200c1, // ACCESS_ALLOWED_ACE:ACCESS_MASK: SYNCHRONIZE|READ_CONTROL|FILE_LIST_DIRECTORY|FILE_DELETE_CHILD|FILE_READ_ATTRIBUTES
CVE-2023-37378 (C, published 2023-07-03T20:15Z)
Description: value: Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/kichik/nsis
Files changed:
Source/exehead/Main.c
Commit message: Don't delete old uninstaller if it points somewhere else


git-svn-id: https://svn.code.sf.net/p/nsis/code/NSIS/trunk@7394 212acab6-be3b-0410-9dea-997c60f758d6


Vulnerable code:
          // Delete previous uninstaller
          if (DeleteFile(unexe))
            myDelete(state_temp_dir, DEL_DIR|DEL_RECURSE);

Fixed code:
          // Delete previous uninstaller (if it is safe to do so)
          if (!(GetFileAttributes(unexe) & FILE_ATTRIBUTE_REPARSE_POINT) && DeleteFile(unexe))
            myDelete(state_temp_dir, DEL_DIR);
CVE-2018-1000052 (C++, published 2018-02-09T23:29Z)
Description: value: fmtlib version prior to version 4.1.0 (before commit 0555cea5fc0bf890afe0071a558e44625a34ba85) contains a Memory corruption (SIGSEGV), CWE-134 vulnerability in fmt::print() library function that can result in Denial of Service. This attack appear to be exploitable via Specifying an invalid format specifier in the fmt::print() function results in a SIGSEGV (memory corruption, invalid write). This vulnerability appears to have been fixed in after commit 8cf30aa2be256eba07bb1cefb998c52326e846e7.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-134 \u2014 Use of Externally-Controlled Format String
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
Repository: https://github.com/fmtlib/fmt
Files changed:
fmt/format.h
test/format-test.cc
Commit message: Fix segfault on complex pointer formatting (#642)


Vulnerable code:
    CharPtr result = prepare_int_buffer(
        num_digits, subspec, prefix, prefix_size);
    return result;

Fixed code:
    std::ptrdiff_t offset = get(prepare_int_buffer(
        num_digits, subspec, prefix, prefix_size)) - &buffer_[0];
    return internal::make_ptr(&buffer_[0], buffer_.size()) + offset;

TEST(FormatTest, Regression) {
  fmt::format("...........{:<77777.7p}", "foo");
}
CVE-2021-39193 (Rust, published 2021-09-03T18:15Z)
Description: value: Frontier is Substrate's Ethereum compatibility layer. Prior to commit number 0b962f218f0cdd796dadfe26c3f09e68f7861b26, a bug in `pallet-ethereum` can cause invalid transactions to be included in the Ethereum block state in `pallet-ethereum` due to not validating the input data size. Any invalid transactions included this way have no possibility to alter the internal Ethereum or Substrate state. The transaction will appear to have be included, but is of no effect as it is rejected by the EVM engine. The impact is further limited by Substrate extrinsic size constraints. A patch is available in commit number 0b962f218f0cdd796dadfe26c3f09e68f7861b26. There are no workarounds aside from applying the patch.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-1284 \u2014 Improper Validation of Specified Quantity in Input
The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
Repository: https://github.com/paritytech/frontier
Files changed:
frame/ethereum/src/lib.rs
ts-tests/tests/test-transaction-cost.ts
Commit message: Add transaction cost pre-validation (#465)



Vulnerable code:

Fixed code:
				// We must ensure a transaction can pay the cost of its data bytes.
				// If it can't it should not be included in a block.
				let mut gasometer = evm::gasometer::Gasometer::new(
					transaction.gas_limit.low_u64(),
					<T as pallet_evm::Config>::config(),
				);
				let transaction_cost = match transaction.action {
					TransactionAction::Call(_) => {
						evm::gasometer::call_transaction_cost(&transaction.input)
					}
					TransactionAction::Create => {
						evm::gasometer::create_transaction_cost(&transaction.input)
					}
				};
				if gasometer.record_transaction(transaction_cost).is_err() {
					return InvalidTransaction::Custom(
						TransactionValidationError::InvalidGasLimit as u8,
					)
					.into();
				}

import { expect } from "chai";
import { step } from "mocha-steps";

import { describeWithFrontier, customRequest } from "./util";

describeWithFrontier("Frontier RPC (Transaction cost)", (context) => {

	step("should take transaction cost into account and not submit it to the pool", async function () {
		// Simple transfer with gas limit 0 manually signed to prevent web3 from rejecting client-side.
		const tx = await customRequest(context.web3, "eth_sendRawTransaction", [
			"0xf86180843b9aca00809412cb274aad8251c875c0bf6872b67d9983e53fdd01801ca00e28ba2dd3c5a3fd467\
			d4afd7aefb4a34b373314fff470bb9db743a84d674a0aa06e5994f2d07eafe1c37b4ce5471caecec29011f6f5b\
			f0b1a552c55ea348df35f",
		]);
		let msg =
			"submit transaction to pool failed: Pool(InvalidTransaction(InvalidTransaction::Custom(3)))";
		expect(tx.error).to.include({
			message: msg,
		});
	});
});
CVE-2022-36008 (Rust, published 2022-08-19T21:15Z)
Description: value: Frontier is Substrate's Ethereum compatibility layer. A security issue was discovered affecting parsing of the RPC result of the exit reason in case of EVM reversion. In release build, this would cause the exit reason being incorrectly parsed and returned by RPC. In debug build, this would cause an overflow panic. No action is needed unless you have a bridge node that needs to distinguish different reversion exit reasons and you used RPC for this. There are currently no known workarounds.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/paritytech/frontier
Files changed:
client/rpc/src/eth/execute.rs
Commit message: Fix length checking overflow in EVM revert reason parsing (#820)

* Fix length checking overflow in EVM revert reason parsing

* Remove unused debug_assert

Vulnerable code:
			if data.len() > 68 {
				let message_len = data[36..68].iter().sum::<u8>();
				if data.len() >= 68 + message_len as usize {
					let body: &[u8] = &data[68..68 + message_len as usize];

Fixed code:
	SaturatedConversion,
			const LEN_START: usize = 36;
			const MESSAGE_START: usize = 68;

			if data.len() > MESSAGE_START {
				let message_len =
					U256::from(&data[LEN_START..MESSAGE_START]).saturated_into::<usize>();
				let message_end = MESSAGE_START.saturating_add(message_len);

				if data.len() >= message_end {
					let body: &[u8] = &data[MESSAGE_START..message_end];
CVE-2023-28431 (Rust, published 2023-03-22T21:15Z)
Description: value: Frontier is an Ethereum compatibility layer for Substrate. Frontier's `modexp` precompile uses `num-bigint` crate under the hood. In the implementation prior to pull request 1017, the cases for modulus being even and modulus being odd are treated separately. Odd modulus uses the fast Montgomery multiplication, and even modulus uses the slow plain power algorithm. This gas cost discrepancy was not accounted for in the `modexp` precompile, leading to possible denial of service attacks.

No fixes for `num-bigint` are currently available, and thus this issue is fixed in the short term by raising the gas costs for even modulus, and in the long term fixing it in `num-bigint` or switching to another modexp implementation. The short-term fix for Frontier is deployed at pull request 1017. There are no known workarounds aside from applying the fix.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-682 \u2014 Incorrect Calculation
The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.
Repository: https://github.com/paritytech/frontier
Files changed:
frame/evm/precompile/modexp/src/lib.rs
shell.nix
Commit message: Increase modexp gas cost when mod is even (#1017)

* Increase modexp gas cost when mod is even

* Fix tests

Vulnerable code:
use num::{BigUint, FromPrimitive, One, ToPrimitive, Zero};
			let gas_cost = calculate_gas_cost(base_len as u64, mod_len as u64, &exponent, &exp_buf);
		assert_eq!(handle.gas_used, 7104); // gas used when ran in geth
      rev = "4a07484cf0e49047f82d83fd119acffbad3b235f";

Fixed code:
use num::{BigUint, FromPrimitive, Integer, One, ToPrimitive, Zero};
	mod_is_even: bool,
	.saturating_mul(if mod_is_even { 20 } else { 1 })
			let gas_cost = calculate_gas_cost(
				base_len as u64,
				mod_len as u64,
				&exponent,
				&exp_buf,
				modulus.is_even(),
			);
		assert_eq!(handle.gas_used, 7104 * 20); // gas used when ran in geth (x20)
      rev = "78e723925daf5c9e8d0a1837ec27059e61649cb6";
CVE-2018-20595 (Java, published 2018-12-30T18:29Z)
Description: value: A CSRF issue was discovered in web/authorization/oauth2/controller/OAuth2ClientController.java in hsweb 3.0.4 because the state parameter in the request is not compared with the state parameter in the session after user authentication is successful.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/hs-web/hsweb-framework
Files changed:
hsweb-authorization/hsweb-authorization-oauth2/hsweb-authorization-oauth2-core/src/main/java/org/hswebframework/web/oauth2/core/ErrorType.java
hsweb-system/hsweb-system-oauth2-client/hsweb-system-oauth2-client-web/src/main/java/org/hswebframework/web/authorization/oauth2/controller/OAuth2ClientController.java
Commit message: fix #107 csrf


Vulnerable code:
            //  if (!state.equals(cachedState)) throw new BusinessException("state error");

Fixed code:
    STATE_ERROR(4042), //stat错误

import org.hswebframework.web.BusinessException;
import org.hswebframework.web.oauth2.core.ErrorType;
            if (!state.equals(cachedState)) {
                throw new BusinessException(ErrorType.STATE_ERROR.name());
            }