starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2017-20165 (published 2023-01-09T10:15Z)

A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The identifier of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-1333
cwe_name: Inefficient Regular Expression Complexity
description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
extended_description: Some regular expression engines have a feature called "backtracking". If the token cannot match, the engine "backtracks" to a position that may result in a different token that can match.
                Backtracking becomes a weakness if all of these conditions are met:
                
                    The number of possible backtracking attempts are exponential relative to the length of the input.
                    The input can fail to match the regular expression.
                    The input can be long enough.
                
		
		  Attackers can create crafted inputs that
		  intentionally cause the regular expression to use
		  excessive backtracking in a way that causes the CPU
		  consumption to spike.
		
            
            

Fix information:
repo_url: https://github.com/debug-js/debug
commit_details: repo_url: https://github.com/debug-js/debug
author: Ya Zhuang
author_date: 2017-09-22 06:26:33+08:00
msg: remove ReDoS regexp in %o formatter (#504)
repository: repo_url: https://github.com/debug-js/debug
repo_name: debug-js/debug
description: A tiny JavaScript debugging utility modelled after Node.js core's debugging technique. Works in Node.js and web browsers
repo_language: JavaScript
owner: debug-js
file_changes: filename: node.js
change_type: ModificationType.MODIFY
diff: @@ -83,7 +83,9 @@ function useColors() {
 exports.formatters.o = function(v) {
   this.inspectOpts.colors = this.useColors;
   return util.inspect(v, this.inspectOpts)
-    .replace(/\s*\n\s*/g, ' ');
+    .split('\n').map(function(str) {
+      return str.trim()
+    }).join(' ');
 };
 
 /**

programming_language: JavaScript
CVE-2014-10068 (published 2018-05-29T20:29Z)

The inert directory handler in inert node module before 1.1.1 always allows files in hidden directories to be served, even when `showHidden` is false.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/hapijs/inert
commit_details: repo_url: https://github.com/hapijs/inert
author: Eran Hammer
author_date: 2014-12-04 13:13:55-08:00
msg: Merge pull request #15 from kanongil/hide-fix-1.1

Don't allow files in hidden directories to be served
repository: repo_url: https://github.com/hapijs/inert
repo_name: hapijs/inert
description: Static file and directory handlers for hapi.js
repo_language: JavaScript
owner: hapijs
CVE-2019-12111 (published 2019-05-15T23:29Z)

A Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL pointer dereference in copyIPv6IfDifferent in pcpserver.c.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/miniupnp/miniupnp
commit_details: repo_url: https://github.com/miniupnp/miniupnp
author: Thomas Bernard
author_date: 2018-12-18 23:04:14+01:00
msg: pcpserver.c: copyIPv6IfDifferent() check for NULL src argument
repository: repo_url: https://github.com/miniupnp/miniupnp
repo_name: miniupnp/miniupnp
description: UPnP IGD implementation
repo_language: C
owner: miniupnp
file_changes: filename: pcpserver.c
change_type: ModificationType.MODIFY
diff: @@ -177,7 +177,7 @@ static const char * getPCPOpCodeStr(uint8_t opcode)
  * buffers are same */
 static void copyIPv6IfDifferent(void * dest, const void * src)
 {
-	if(dest != src) {
+	if(dest != src && src != NULL) {
 		memcpy(dest, src, sizeof(struct in6_addr));
 	}
 }

programming_language: C
CVE-2021-4259 (published 2022-12-19T14:15Z)

A vulnerability was found in phpRedisAdmin up to 1.16.1. It has been classified as problematic. This affects the function authHttpDigest of the file includes/login.inc.php. The manipulation of the argument response leads to use of wrong operator in string comparison. Upgrading to version 1.16.2 is able to address this issue. The name of the patch is 31aa7661e6db6f4dffbf9a635817832a0a11c7d9. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216267.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-597
cwe_name: Use of Wrong Operator in String Comparison
description: The product uses the wrong operator when comparing a string, such as using "==" when the .equals() method should be used instead.
extended_description: In Java, using == or != to compare two strings for equality actually compares two objects for equality rather than their string values for equality. Chances are good that the two references will never be equal. While this weakness often only affects program correctness, if the equality is used for a security decision, the unintended comparison result could be leveraged to affect program security.
         

Fix information:
repo_url: https://github.com/erikdubbelboer/phpRedisAdmin
commit_details: repo_url: https://github.com/erikdubbelboer/phpRedisAdmin
author: Erik Dubbelboer
author_date: 2021-10-05 18:45:52+00:00
msg: Fix magic hash attack
repository: repo_url: https://github.com/erikdubbelboer/phpRedisAdmin
repo_name: erikdubbelboer/phpRedisAdmin
description: Simple web interface to manage Redis databases.
repo_language: PHP
owner: erikdubbelboer
file_changes: filename: login.inc.php
change_type: ModificationType.MODIFY
diff: @@ -56,7 +56,7 @@ function authHttpDigest()
 
     $response = md5($password.':'.$data['nonce'].':'.$data['nc'].':'.$data['cnonce'].':'.$data['qop'].':'.md5($_SERVER['REQUEST_METHOD'].':'.$data['uri']));
 
-    if ($data['response'] != $response) {
+    if ($data['response'] !== $response) {
       header('HTTP/1.1 401 Unauthorized');
       header('WWW-Authenticate: Digest realm="'.$realm.'",qop="auth",nonce="'.uniqid().'",opaque="'.$opaque.'"');
       die('Invalid username and/or password combination.');

programming_language: PHP
CVE-2023-48707 (published 2023-11-24T18:15Z)

CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. The `secretKey` value is an important key for HMAC SHA256 authentication and in affected versions was stored in the database in cleartext form. If a malicious person somehow had access to the data in the database, they could use the key and secretKey for HMAC SHA256 authentication to send requests impersonating that corresponding user. This issue has been addressed in version 1.0.0-beta.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-312
cwe_name: Cleartext Storage of Sensitive Information
description: The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
extended_description: 
	 Because the information is stored in cleartext (i.e., unencrypted), attackers could potentially read it. Even if the information is encoded in a way that is not human-readable, certain techniques could determine which encoding is being used, then decode the information.
	 When organizations adopt cloud services, it can be easier for attackers to access the data from anywhere on the Internet.
	 In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.
       
         

Fix information:
repo_url: https://github.com/codeigniter4/shield
commit_details: repo_url: https://github.com/codeigniter4/shield
author: kenjis
author_date: 2023-11-23 08:22:00+09:00
msg: Merge pull request from GHSA-v427-c49j-8w6x

fix: Cleartext Storage of Sensitive Information in HMAC SHA256 Authentication
repository: repo_url: https://github.com/codeigniter4/shield
repo_name: codeigniter4/shield
description: Authentication and Authorization for CodeIgniter 4
repo_language: PHP
owner: codeigniter4
CVE-2017-9841 (published 2017-06-27T17:29Z)

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-94
cwe_name: Improper Control of Generation of Code ('Code Injection')
description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
extended_description: 
            When a product allows a user's input to contain code syntax, it might be possible for an attacker to craft the code in such a way that it will alter the intended control flow of the product. Such an alteration could lead to arbitrary code execution.
            Injection problems encompass a wide variety of issues -- all mitigated in very different ways. For this reason, the most effective way to discuss these weaknesses is to note the distinct features which classify them as injection weaknesses. The most important issue to note is that all injection problems share one thing in common -- i.e., they allow for the injection of control plane data into the user-controlled data plane. This means that the execution of the process may be altered by sending code in through legitimate data channels, using no other mechanism. While buffer overflows, and many other flaws, involve the use of some further issue to gain execution, injection problems need only for the data to be parsed. The most classic instantiations of this category of weakness are SQL injection and format string vulnerabilities.
         
         

Fix information:
repo_url: https://github.com/sebastianbergmann/phpunit
commit_details: repo_url: https://github.com/sebastianbergmann/phpunit
author: Bob Weinand
author_date: 2016-11-13 18:52:50+01:00
msg: Correct fix for #1956
repository: repo_url: https://github.com/sebastianbergmann/phpunit
repo_name: sebastianbergmann/phpunit
description: The PHP Unit Testing framework.
repo_language: PHP
owner: sebastianbergmann
file_changes: filename: TestCaseMethod.tpl.dist
change_type: ModificationType.MODIFY
diff: @@ -55,7 +55,7 @@ function __phpunit_run_isolated_test()
         $output = $test->getActualOutput();
     }
 
-    rewind(STDOUT);
+    @rewind(STDOUT); /* @ as not every STDOUT target stream is rewindable */
     if ($stdout = stream_get_contents(STDOUT)) {
         $output = $stdout . $output;
     }

programming_language: PHP
filename: eval-stdin.php
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,3 @@
 <?php
 
-eval('?>' . file_get_contents('php://input'));
+eval('?>' . file_get_contents('php://stdin'));

programming_language: PHP
CVE-2021-46022 (published 2022-01-14T20:15Z)

An Use-After-Free vulnerability in rec_mset_elem_destroy() at rec-mset.c of GNU Recutils v1.8.90 can lead to a segmentation fault or application crash.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/gnu-mirror-unofficial/recutils
commit_details: repo_url: https://github.com/gnu-mirror-unofficial/recutils
author: Jose E. Marchesi
author_date: 2022-04-16 17:11:56+02:00
msg: parser: avoid character 0xff being interpreted as (int) -1

This fixes the following CVEs:
- CVE-2021-46019
- CVE-2021-46022
- CVE-2021-46022

2022-04-16  Jose E. Marchesi  <jemarch@gnu.org>

	CVE-2021-46019
	CVE-2021-46022
	CVE-2021-46022
	* src/rec-parser.c (rec_parse_comment): Avoid 0xff being
	interpreted as (int) -1.
repository: repo_url: https://github.com/gnu-mirror-unofficial/recutils
repo_name: gnu-mirror-unofficial/recutils
description: GNU recutils - Official repo link below. Please read this organisation's pinned readme for info.
repo_language: C
owner: gnu-mirror-unofficial
file_changes: filename: ChangeLog
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,11 @@
+2022-04-16  Jose E. Marchesi  <jemarch@gnu.org>
+
+	CVE-2021-46019
+	CVE-2021-46022
+	CVE-2021-46022
+	* src/rec-parser.c (rec_parse_comment): Avoid 0xff being
+	interpreted as (int) -1.
+
 2022-04-16  Jose E. Marchesi  <jemarch@gnu.org>
 
 	* configure.ac: Remove algol68 bindings support.

programming_language: Markdown
filename: rec-parser.c
change_type: ModificationType.MODIFY
diff: @@ -432,7 +432,7 @@ rec_parse_comment (rec_parser_t parser, rec_comment_t *comment)
                 c = '\n';
             }
 
-          if (rec_buf_putc (c, buf) == EOF)
+          if (rec_buf_putc (ci, buf) == EOF)
             {
               /* Out of memory */
               parser->error = REC_PARSER_ENOMEM;

programming_language: C
CVE-2020-15101 (published 2020-07-14T22:15Z)

In freewvs before 0.1.1, a directory structure of more than 1000 nested directories can interrupt a freewvs scan due to Python's recursion limit and os.walk(). This can be problematic in a case where an administrator scans the dirs of potentially untrusted users. This has been patched in 0.1.1.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v3 base score: 3.3, LOW (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)

Weakness information:
cwe_id: CWE-674
cwe_name: Uncontrolled Recursion
description: The product does not properly control the amount of recursion that takes place,  consuming excessive resources, such as allocated memory or the program stack.
extended_description: 
        
      
      

Fix information:
repo_url: https://github.com/schokokeksorg/freewvs
commit_details: repo_url: https://github.com/schokokeksorg/freewvs
author: Hanno Böck
author_date: 2020-06-09 19:12:59+02:00
msg: protect against deep recursion of directories
repository: repo_url: https://github.com/schokokeksorg/freewvs
repo_name: schokokeksorg/freewvs
description: A local scanner for vulnerable web applications
repo_language: Python
owner: schokokeksorg
file_changes: filename: freewvs
change_type: ModificationType.MODIFY
diff: @@ -109,7 +109,11 @@ if opts.xml:
 # start the search
 
 for fdir in opts.dirs:
-    for root, _, files in os.walk(fdir):
+    for root, dirs, files in os.walk(fdir):
+        # this protects us against nested directories causing
+        # an exception
+        if root.count(os.sep) > 500:
+            del dirs[:]
         for filename in scanfiles.intersection(files):
             for item in jconfig:
                 if not opts.thirdparty and 'thirdparty' in item:

programming_language: Python
CVE-2018-6927 (published 2018-02-12T19:29Z)

The futex_requeue function in kernel/futex.c in the Linux kernel before 4.14.15 might allow attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact by triggering a negative wake or requeue value.

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Li Jinyue
author_date: 2017-12-14 17:04:54+08:00
msg: futex: Prevent overflow by strengthen input validation

UBSAN reports signed integer overflow in kernel/futex.c:

 UBSAN: Undefined behaviour in kernel/futex.c:2041:18
 signed integer overflow:
 0 - -2147483648 cannot be represented in type 'int'

Add a sanity check to catch negative values of nr_wake and nr_requeue.

Signed-off-by: Li Jinyue <lijinyue@huawei.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: peterz@infradead.org
Cc: dvhart@infradead.org
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/1513242294-31786-1-git-send-email-lijinyue@huawei.com
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: futex.c
change_type: ModificationType.MODIFY
diff: @@ -1878,6 +1878,9 @@ static int futex_requeue(u32 __user *uaddr1, unsigned int flags,
 	struct futex_q *this, *next;
 	DEFINE_WAKE_Q(wake_q);
 
+	if (nr_wake < 0 || nr_requeue < 0)
+		return -EINVAL;
+
 	/*
 	 * When PI not supported: return -ENOSYS if requeue_pi is true,
 	 * consequently the compiler knows requeue_pi is always false past

programming_language: C
CVE-2022-21711 (published 2022-01-24T20:15Z)

elfspirit is an ELF static analysis and injection framework that parses, manipulates, and camouflages ELF files. When analyzing the ELF file format in versions prior to 1.1, there is an out-of-bounds read bug, which can lead to application crashes or information leakage. By constructing a special format ELF file, the information of any address can be leaked. elfspirit version 1.1 contains a patch for this issue.

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 7.1, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/liyansong2018/elfspirit
commit_details: repo_url: https://github.com/liyansong2018/elfspirit
author: liyansong2018
author_date: 2022-01-23 21:17:42+08:00
msg: Fix #1 about out-of-bounds
repository: repo_url: https://github.com/liyansong2018/elfspirit
repo_name: liyansong2018/elfspirit
description: ELF static analysis and injection framework that parse, manipulate, patch and camouflage ELF files.
repo_language: C
owner: liyansong2018
file_changes: filename: parse.c
change_type: ModificationType.MODIFY
diff: @@ -73,6 +73,17 @@ int flag2str_sh(int flag, char *flag_str) {
     return 0;
 }
 
+/**
+ * @description: Judge whether the memory address is legal
+ * @param {uint32_t} addr
+ * @param {uint32_t} start
+ * @param {uint32_t} end
+ * @return {*}
+ */
+int validated_offset(uint32_t addr, uint32_t start, uint32_t end){
+    return addr <= end && addr >= start? 0:-1;
+}
+
 int parse(char *elf) {
     int fd;
     struct stat st;
@@ -256,6 +267,10 @@ int parse(char *elf) {
         PRINT_SECTION_TITLE("Nr", "Name", "Type", "Addr", "Off", "Size", "Es", "Flg", "Lk", "Inf", "Al");
         for (int i = 0; i < ehdr->e_shnum; i++) {
             name = elf_map + shstrtab.sh_offset + shdr[i].sh_name;
+            if (validated_offset(name, elf_map, elf_map + st.st_size)) {
+                ERROR("Corrupt file format\n");
+                return -1;
+            }
 
             switch (shdr[i].sh_type) {
                 case SHT_NULL:
@@ -902,6 +917,10 @@ int parse(char *elf) {
         PRINT_SECTION_TITLE("Nr", "Name", "Type", "Addr", "Off", "Size", "Es", "Flg", "Lk", "Inf", "Al");
         for (int i = 0; i < ehdr->e_shnum; i++) {
             name = elf_map + shstrtab.sh_offset + shdr[i].sh_name;
+            if (validated_offset(name, elf_map, elf_map + st.st_size)) {
+                ERROR("Corrupt file format\n");
+                return -1;
+            }
 
             switch (shdr[i].sh_type) {
                 case SHT_NULL:

programming_language: C++