rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid memory copy operation.
Vulnerability ID: CVE-2020-13765
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/qemu/qemu
Published: 2020-06-04
File: hw/core/loader.c
Commit message: hw/core/loader: Fix possible crash in rom_copy()

Both, "rom->addr" and "addr" are derived from the binary image
that can be loaded with the "-kernel" paramer. The code in
rom_copy() then calculates:

    d = dest + (rom->addr - addr);

and uses "d" as destination in a memcpy() some lines later. Now with
bad kernel images, it is possible that rom->addr is smaller than addr,
thus "rom->addr - addr" gets negative and the memcpy() then tries to
copy contents from the image to a bad memory location. This could
maybe be used to inject code from a kernel image into the QEMU binary,
so we better fix it with an additional sanity check here.

Cc: qemu-stable@nongnu.org
Reported-by: Guangming Liu
Buglink: https://bugs.launchpad.net/qemu/+bug/1844635
Message-Id: <20190925130331.27825-1-thuth@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit e423455c4f23a1a828901c78fe6d03b7dde79319)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Commit author: Thomas Huth

Vulnerable version (before fix):
 int rom_copy(uint8_t *dest, hwaddr addr, size_t size)         if (rom->addr + rom->romsize < addr) {             continue;         }         if (rom->addr > end) {             break;         } 

Fixed version (after fix):
 int rom_copy(uint8_t *dest, hwaddr addr, size_t size)         if (rom->addr + rom->romsize < addr) {             continue;         }         if (rom->addr > end || rom->addr < addr) {             break;         } 

Patch:
patch: @@ -1240,7 +1240,7 @@ int rom_copy(uint8_t *dest, hwaddr addr, size_t size)
         if (rom->addr + rom->romsize < addr) {
             continue;
         }
-        if (rom->addr > end) {
+        if (rom->addr > end || rom->addr < addr) {
             break;
         }
path: hw/core/loader.c
Vulnerability: FFmpeg 2.8 and 4.2.3 has a use-after-free via a crafted EXTINF duration in an m3u8 file because parse_playlist in libavformat/hls.c frees a pointer, and later that pointer is accessed in av_probe_input_format3 in libavformat/format.c.
Vulnerability ID: CVE-2020-13904
CWE: CWE-416
Severity score: 2.9
Project: https://github.com/FFmpeg/FFmpeg
Published: 2020-06-07
File: libavformat/hls.c
Commit message: avformat/hls: check segment duration value of EXTINF

fix ticket: 8673
set the default EXTINF duration to 1ms if duration is smaller than 1ms

Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
(cherry picked from commit 9dfb19baeb86a8bb02c53a441682c6e9a6e104cc)
Commit author: Steven Liu

Vulnerable version (before fix):
 static int parse_playlist(HLSContext *c, const char *url,                     ret = AVERROR(ENOMEM);                     goto fail;                 }                 seg->duration = duration;                 seg->key_type = key_type;                 if (has_iv) {                     memcpy(seg->iv, iv, sizeof(iv));                 } else { static int parse_playlist(HLSContext *c, const char *url,                     goto fail;                 }                  dynarray_add(&pls->segments, &pls->n_segments, seg);                 is_segment = 0; 

Fixed version (after fix):
 static int parse_playlist(HLSContext *c, const char *url,                     ret = AVERROR(ENOMEM);                     goto fail;                 }                 if (has_iv) {                     memcpy(seg->iv, iv, sizeof(iv));                 } else { static int parse_playlist(HLSContext *c, const char *url,                     goto fail;                 }                  if (duration < 0.001 * AV_TIME_BASE) {                     duration = 0.001 * AV_TIME_BASE;                 }                 seg->duration = duration;                 seg->key_type = key_type;                 dynarray_add(&pls->segments, &pls->n_segments, seg);                 is_segment = 0; 

Patch:
patch: @@ -806,8 +806,6 @@ static int parse_playlist(HLSContext *c, const char *url,
                     ret = AVERROR(ENOMEM);
                     goto fail;
                 }
-                seg->duration = duration;
-                seg->key_type = key_type;
                 if (has_iv) {
                     memcpy(seg->iv, iv, sizeof(iv));
                 } else {
@@ -837,6 +835,11 @@ static int parse_playlist(HLSContext *c, const char *url,
                     goto fail;
                 }
 
+                if (duration < 0.001 * AV_TIME_BASE) {
+                    duration = 0.001 * AV_TIME_BASE;
+                }
+                seg->duration = duration;
+                seg->key_type = key_type;
                 dynarray_add(&pls->segments, &pls->n_segments, seg);
                 is_segment = 0;
path: libavformat/hls.c
Vulnerability: An issue was discovered in ecma/operations/ecma-container-object.c in JerryScript 2.2.0. Operations with key/value pairs did not consider the case where garbage collection is triggered after the key operation but before the value operation, as demonstrated by improper read access to memory in ecma_gc_set_object_visited in ecma/base/ecma-gc.c.
Vulnerability ID: CVE-2020-14163
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/jerryscript-project/jerryscript
Published: 2020-06-15
File: jerry-core/ecma/operations/ecma-container-object.c
Commit message: Fix adding entries to the internal buffer of a Map object (#3805)

When appending the key/value pair separately, garbage collection could be
triggered before the value is added, which could cause problems during
marking. This patch changes insertion to add both values at the same
time, which prevents partial entries from being present in the internal
buffer.

Fixes #3804.

JerryScript-DCO-1.0-Signed-off-by: Dániel Bátyai dbatyai@inf.u-szeged.hu
Commit author: Dániel Bátyai

Vulnerable version (before fix):
 ecma_op_internal_buffer_append (ecma_collection_t *container_p, /**< internal co {   JERRY_ASSERT (container_p != NULL);    ecma_collection_push_back (container_p, ecma_copy_value_if_not_object (key_arg));    if (lit_id == LIT_MAGIC_STRING_WEAKMAP_UL || lit_id == LIT_MAGIC_STRING_MAP_UL)   {     ecma_collection_push_back (container_p, ecma_copy_value_if_not_object (value_arg));   }    ECMA_CONTAINER_SET_SIZE (container_p, ECMA_CONTAINER_GET_SIZE (container_p) + 1);

Fixed version (after fix):
 ecma_op_internal_buffer_append (ecma_collection_t *container_p, /**< internal co {   JERRY_ASSERT (container_p != NULL);    if (lit_id == LIT_MAGIC_STRING_WEAKMAP_UL || lit_id == LIT_MAGIC_STRING_MAP_UL)   {     ecma_value_t values[] = { ecma_copy_value_if_not_object (key_arg), ecma_copy_value_if_not_object (value_arg) };     ecma_collection_append (container_p, values, 2);   }   else   {     ecma_collection_push_back (container_p, ecma_copy_value_if_not_object (key_arg));   }    ECMA_CONTAINER_SET_SIZE (container_p, ECMA_CONTAINER_GET_SIZE (container_p) + 1);

Patch:
patch: @@ -64,11 +64,14 @@ ecma_op_internal_buffer_append (ecma_collection_t *container_p, /**< internal co
 {
   JERRY_ASSERT (container_p != NULL);
 
-  ecma_collection_push_back (container_p, ecma_copy_value_if_not_object (key_arg));
-
   if (lit_id == LIT_MAGIC_STRING_WEAKMAP_UL || lit_id == LIT_MAGIC_STRING_MAP_UL)
   {
-    ecma_collection_push_back (container_p, ecma_copy_value_if_not_object (value_arg));
+    ecma_value_t values[] = { ecma_copy_value_if_not_object (key_arg), ecma_copy_value_if_not_object (value_arg) };
+    ecma_collection_append (container_p, values, 2);
+  }
+  else
+  {
+    ecma_collection_push_back (container_p, ecma_copy_value_if_not_object (key_arg));
   }
 
   ECMA_CONTAINER_SET_SIZE (container_p, ECMA_CONTAINER_GET_SIZE (container_p) + 1);
path: jerry-core/ecma/operations/ecma-container-object.c
Vulnerability: A possible use-after-free and double-free in c-ares lib version 1.16.0 if ares_destroy() is called prior to ares_getaddrinfo() completing. This flaw possibly allows an attacker to crash the service that uses c-ares lib. The highest threat from this vulnerability is to this service availability.
Vulnerability ID: CVE-2020-14354
CWE: CWE-415
Severity score: 2.9
Project: https://github.com/c-ares/c-ares
Published: 2021-05-13
File: ares_getaddrinfo.c
Commit message: Prevent possible double-free in ares_getaddrinfo() if ares_destroy() is called

In the event that ares_destroy() is called prior to ares_getaddrinfo() completing,
it would result in an invalid read and double-free due to calling end_hquery() twice.

Reported By: Jann Horn @ Google Project Zero
Commit author: Brad House

Vulnerable version (before fix):
 static void host_callback(void *arg, int status, int timeouts,   else if (status == ARES_EDESTRUCTION)     {       end_hquery(hquery, status);     }    if (!hquery->remaining)

Fixed version (after fix):
 static void host_callback(void *arg, int status, int timeouts,   else if (status == ARES_EDESTRUCTION)     {       end_hquery(hquery, status);       return;     }    if (!hquery->remaining)

Patch:
patch: @@ -548,6 +548,7 @@ static void host_callback(void *arg, int status, int timeouts,
   else if (status == ARES_EDESTRUCTION)
     {
       end_hquery(hquery, status);
+      return;
     }
 
   if (!hquery->remaining)
path: ares_getaddrinfo.c
Vulnerability: A possible use-after-free and double-free in c-ares lib version 1.16.0 if ares_destroy() is called prior to ares_getaddrinfo() completing. This flaw possibly allows an attacker to crash the service that uses c-ares lib. The highest threat from this vulnerability is to this service availability.
Vulnerability ID: CVE-2020-14354
CWE: CWE-416
Severity score: 2.9
Project: https://github.com/c-ares/c-ares
Published: 2021-05-13
File: ares_getaddrinfo.c
Commit message: Prevent possible double-free in ares_getaddrinfo() if ares_destroy() is called

In the event that ares_destroy() is called prior to ares_getaddrinfo() completing,
it would result in an invalid read and double-free due to calling end_hquery() twice.

Reported By: Jann Horn @ Google Project Zero
Commit author: Brad House

Vulnerable version (before fix):
 static void host_callback(void *arg, int status, int timeouts,   else if (status == ARES_EDESTRUCTION)     {       end_hquery(hquery, status);     }    if (!hquery->remaining)

Fixed version (after fix):
 static void host_callback(void *arg, int status, int timeouts,   else if (status == ARES_EDESTRUCTION)     {       end_hquery(hquery, status);       return;     }    if (!hquery->remaining)

Patch:
patch: @@ -548,6 +548,7 @@ static void host_callback(void *arg, int status, int timeouts,
   else if (status == ARES_EDESTRUCTION)
     {
       end_hquery(hquery, status);
+      return;
     }
 
   if (!hquery->remaining)
path: ares_getaddrinfo.c
Vulnerability: An issue was discovered in LibVNCServer before 0.9.13. libvncclient/tls_openssl.c has a NULL pointer dereference.
Vulnerability ID: CVE-2020-14396
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/LibVNC/libvncserver
Published: 2020-06-17
File: libvncclient/tls_openssl.c
Commit message: libvncclient/tls_openssl: do not deref a NULL pointer

Happens in anonTLS mode where cred is NULL.

re #347
Commit author: Christian Beier

Vulnerable version (before fix):
 open_ssl_connection (rfbClient *client, int sockfd, rfbBool anonTLS, rfbCredenti   SSL *ssl = NULL;   int n, finished = 0;   X509_VERIFY_PARAM *param;   uint8_t verify_crls = cred->x509Credential.x509CrlVerifyMode;    if (!(ssl_ctx = SSL_CTX_new(SSLv23_client_method())))   { open_ssl_connection (rfbClient *client, int sockfd, rfbBool anonTLS, rfbCredenti   /* Setup verification if not anonymous */   if (!anonTLS)   {     if (cred->x509Credential.x509CACertFile)     {       if (!SSL_CTX_load_verify_locations(ssl_ctx, cred->x509Credential.x509CACertFile, NULL))

Fixed version (after fix):
 open_ssl_connection (rfbClient *client, int sockfd, rfbBool anonTLS, rfbCredenti   SSL *ssl = NULL;   int n, finished = 0;   X509_VERIFY_PARAM *param;   uint8_t verify_crls;    if (!(ssl_ctx = SSL_CTX_new(SSLv23_client_method())))   { open_ssl_connection (rfbClient *client, int sockfd, rfbBool anonTLS, rfbCredenti   /* Setup verification if not anonymous */   if (!anonTLS)   {     verify_crls = cred->x509Credential.x509CrlVerifyMode;     if (cred->x509Credential.x509CACertFile)     {       if (!SSL_CTX_load_verify_locations(ssl_ctx, cred->x509Credential.x509CACertFile, NULL))

Patch:
patch: @@ -268,7 +268,7 @@ open_ssl_connection (rfbClient *client, int sockfd, rfbBool anonTLS, rfbCredenti
   SSL *ssl = NULL;
   int n, finished = 0;
   X509_VERIFY_PARAM *param;
-  uint8_t verify_crls = cred->x509Credential.x509CrlVerifyMode;
+  uint8_t verify_crls;
 
   if (!(ssl_ctx = SSL_CTX_new(SSLv23_client_method())))
   {
@@ -281,6 +281,7 @@ open_ssl_connection (rfbClient *client, int sockfd, rfbBool anonTLS, rfbCredenti
   /* Setup verification if not anonymous */
   if (!anonTLS)
   {
+    verify_crls = cred->x509Credential.x509CrlVerifyMode;
     if (cred->x509Credential.x509CACertFile)
     {
       if (!SSL_CTX_load_verify_locations(ssl_ctx, cred->x509Credential.x509CACertFile, NULL))
path: libvncclient/tls_openssl.c
Vulnerability: An issue was discovered in LibVNCServer before 0.9.13. libvncserver/scale.c has a pixel_value integer overflow.
Vulnerability ID: CVE-2020-14401
CWE: CWE-190
Severity score: 4.9
Project: https://github.com/LibVNC/libvncserver
Published: 2020-06-17
File: libvncserver/scale.c
Commit message: libvncserver: scale: cast to 64 bit before shifting

Since pixel_value is 64 bit the data type of the shift operand should
be 64 bit too to prevent integer overflows.
Commit author: Tobias Junghans

Vulnerable version (before fix):
 void rfbScaledScreenUpdateRect(rfbScreenInfoPtr screen, rfbScreenInfoPtr ptr, in              default:                /* fixme: endianness problem? */                for (z = 0; z < bytesPerPixel; z++)                  pixel_value += (srcptr2[z] << (8 * z));                 break;               }               /*

Fixed version (after fix):
 void rfbScaledScreenUpdateRect(rfbScreenInfoPtr screen, rfbScreenInfoPtr ptr, in              default:                /* fixme: endianness problem? */                for (z = 0; z < bytesPerPixel; z++)                  pixel_value += ((unsigned long)srcptr2[z] << (8 * z));                 break;               }               /*

Patch:
patch: @@ -210,7 +210,7 @@ void rfbScaledScreenUpdateRect(rfbScreenInfoPtr screen, rfbScreenInfoPtr ptr, in
              default:
                /* fixme: endianness problem? */
                for (z = 0; z < bytesPerPixel; z++)
-                 pixel_value += (srcptr2[z] << (8 * z));
+                 pixel_value += ((unsigned long)srcptr2[z] << (8 * z));
                 break;
               }
               /*
path: libvncserver/scale.c
Vulnerability: A reflected cross-site scripting (XSS) vulnerability in Dolibarr 11.0.3 allows remote attackers to inject arbitrary web script or HTML into public/notice.php (related to transphrase and transkey).
Vulnerability ID: CVE-2020-14475
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/Dolibarr/dolibarr
Published: 2020-06-19
File: htdocs/public/notice.php
Commit message: Fix XSS reported by C. Weiler <sak1.s3curity@gmail.com> in notice.php
Commit author: Laurent Destailleur

Vulnerable version (before fix):
 } else {     $langs->load("error");     $langs->load("other");      if (GETPOST('transphrase', 'alphanohtml')) print GETPOST('transphrase', 'alphanohtml');     if (GETPOST('transkey', 'alphanohtml')) print $langs->trans(GETPOST('transkey', 'alphanohtml')); }

Fixed version (after fix):
 } else {     $langs->loadLangs(array("error", "other"));      if (GETPOST('transphrase', 'alphanohtml')) print dol_escape_htmltag(GETPOST('transphrase', 'alphanohtml'));     elseif (GETPOST('transkey', 'alphanohtml')) print dol_escape_htmltag($langs->trans(GETPOST('transkey', 'alphanohtml'))); }

Patch:
patch: @@ -41,9 +41,8 @@
 }
 else
 {
-    $langs->load("error");
-    $langs->load("other");
+    $langs->loadLangs(array("error", "other"));
 
-    if (GETPOST('transphrase', 'alphanohtml')) print GETPOST('transphrase', 'alphanohtml');
-    if (GETPOST('transkey', 'alphanohtml')) print $langs->trans(GETPOST('transkey', 'alphanohtml'));
+    if (GETPOST('transphrase', 'alphanohtml')) print dol_escape_htmltag(GETPOST('transphrase', 'alphanohtml'));
+    elseif (GETPOST('transkey', 'alphanohtml')) print dol_escape_htmltag($langs->trans(GETPOST('transkey', 'alphanohtml')));
 }
path: htdocs/public/notice.php
Vulnerability: OCS Inventory NG 2.7 allows Remote Command Execution via shell metacharacters to require/commandLine/CommandLine.php because mib_file in plugins/main_sections/ms_config/ms_snmp_config.php is mishandled in get_mib_oid.
Vulnerability ID: CVE-2020-14947
CWE: CWE-78
Severity score: 6.4
Project: https://github.com/OCSInventory-NG/OCSInventory-ocsreports
Published: 2020-06-30
File: require/commandLine/CommandLine.php
Commit message: Fix CVE-2020-14947
Commit author: Charlene Auger

Vulnerable version (before fix):
 public function get_mib_oid($file) {         $champs = array('SNMP_MIB_DIRECTORY' => 'SNMP_MIB_DIRECTORY');         $values = look_config_default_values($champs);         $cmd = "snmptranslate -Tz -m ".$values['tvalue']['SNMP_MIB_DIRECTORY']."/".$file;         $result_cmd = shell_exec($cmd);         $result_cmd = preg_split("/\r\n|\n|\r/", $result_cmd);         $result_cmd = str_replace('"', "", $result_cmd); 

Fixed version (after fix):
 public function get_mib_oid($file) {         $champs = array('SNMP_MIB_DIRECTORY' => 'SNMP_MIB_DIRECTORY');         $values = look_config_default_values($champs);         $cmd = "snmptranslate -Tz -m ".$values['tvalue']['SNMP_MIB_DIRECTORY']."/".$file;         $result_cmd = shell_exec(escapeshellcmd($cmd));         $result_cmd = preg_split("/\r\n|\n|\r/", $result_cmd);         $result_cmd = str_replace('"', "", $result_cmd); 

Patch:
patch: @@ -32,7 +32,7 @@ public function get_mib_oid($file) {
         $champs = array('SNMP_MIB_DIRECTORY' => 'SNMP_MIB_DIRECTORY');
         $values = look_config_default_values($champs);
         $cmd = "snmptranslate -Tz -m ".$values['tvalue']['SNMP_MIB_DIRECTORY']."/".$file;
-        $result_cmd = shell_exec($cmd);
+        $result_cmd = shell_exec(escapeshellcmd($cmd));
         $result_cmd = preg_split("/\r\n|\n|\r/", $result_cmd);
         $result_cmd = str_replace('"', "", $result_cmd);
path: require/commandLine/CommandLine.php
Vulnerability: A buffer overflow in the M_LoadDefaults function in m_misc.c in id Tech 1 (aka Doom engine) allows arbitrary code execution via an unsafe usage of fscanf, because it does not limit the number of characters to be read in a format argument.
Vulnerability ID: CVE-2020-15007
CWE: CWE-120
Severity score: 6.4
Project: https://github.com/AXDOOMER/doom-vanille
Published: 2020-06-24
File: m_misc.c
Commit message: Fix buffer overflow in M_LoadDefaults

Too much data will most likely result in a crash or freeze, but you can overwrite the stack which can be used to do an arbitrary code execution. (https://twitter.com/notrevenant/status/1268654123903340544)
Commit author: Alexandre-Xavier Labonté-Lamoureux

Vulnerable version (before fix):
 void M_LoadDefaults (void) 	while (!feof(f)) 	{ 	    isstring = false; 	    if (fscanf (f, "%79s %[^\n]\n", def, strparm) == 2) 	    { 		if (strparm[0] == '"') 		{

Fixed version (after fix):
 void M_LoadDefaults (void) 	while (!feof(f)) 	{ 	    isstring = false; 	    if (fscanf (f, "%79s %99[^\n]\n", def, strparm) == 2) 	    { 		if (strparm[0] == '"') 		{

Patch:
patch: @@ -479,7 +479,7 @@ void M_LoadDefaults (void)
 	while (!feof(f))
 	{
 	    isstring = false;
-	    if (fscanf (f, "%79s %[^\n]\n", def, strparm) == 2)
+	    if (fscanf (f, "%79s %99[^\n]\n", def, strparm) == 2)
 	    {
 		if (strparm[0] == '"')
 		{
path: m_misc.c
Vulnerability: In PrestaShop from version 1.7.0.0 and before version 1.7.6.6, if a target sends a corrupted file, it leads to a reflected XSS. The problem is fixed in 1.7.6.6
Vulnerability ID: CVE-2020-15083
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/PrestaShop/PrestaShop
Published: 2020-07-02
File: admin-dev/themes/default/js/bundle/product/form.js
Commit message: Merge pull request from GHSA-qgh4-95j7-p3vj

Do not append data as html, use text function instead
Commit author: Mathieu Ferment

Vulnerable version (before fix):
 var imagesProduct = (function() {         success: function(file, response) {           //manage error on uploaded file           if (response.error !== 0) {             errorElem.append('<p>' + file.name + ': ' + response.error + '</p>');             this.removeFile(file);             return;           } var imagesProduct = (function() {           }            //append new error           errorElem.append('<p>' + file.name + ': ' + message + '</p>');            //remove uploaded item           this.removeFile(file);

Fixed version (after fix):
 var imagesProduct = (function() {         success: function(file, response) {           //manage error on uploaded file           if (response.error !== 0) {             errorElem.append($('<p></p>').text(file.name + ': ' + response.error));             this.removeFile(file);             return;           } var imagesProduct = (function() {           }            //append new error           errorElem.append($('<p></p>').text(file.name + ': ' + message));            //remove uploaded item           this.removeFile(file);

Patch:
patch: @@ -1339,7 +1339,7 @@ var imagesProduct = (function() {
         success: function(file, response) {
           //manage error on uploaded file
           if (response.error !== 0) {
-            errorElem.append('<p>' + file.name + ': ' + response.error + '</p>');
+            errorElem.append($('<p></p>').text(file.name + ': ' + response.error));
             this.removeFile(file);
             return;
           }
@@ -1368,7 +1368,7 @@ var imagesProduct = (function() {
           }
 
           //append new error
-          errorElem.append('<p>' + file.name + ': ' + message + '</p>');
+          errorElem.append($('<p></p>').text(file.name + ': ' + message));
 
           //remove uploaded item
           this.removeFile(file);
path: admin-dev/themes/default/js/bundle/product/form.js