starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2023-0818 (published 2023-02-13T22:15Z)

Off-by-one Error in GitHub repository gpac/gpac prior to v2.3.0-DEV.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-193
cwe_name: Off-by-one Error
description: A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: Aurelien David
author_date: 2023-02-13 15:42:10+01:00
msg: fix a5efec8 to cover more cases (#2397)
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: load_text.c
change_type: ModificationType.MODIFY
diff: @@ -315,18 +315,24 @@ char *gf_text_get_utf8_line(char *szLine, u32 lineSize, FILE *txt_in, s32 unicod
 			if (!unicode_type && (szLine[i] & 0x80)) {
 				/*non UTF8 (likely some win-CP)*/
 				if ((szLine[i+1] & 0xc0) != 0x80) {
+					if (j >= GF_ARRAY_LENGTH(szLineConv))
+						break;
 					szLineConv[j] = 0xc0 | ( (szLine[i] >> 6) & 0x3 );
 					j++;
 					szLine[i] &= 0xbf;
 				}
 				/*UTF8 2 bytes char*/
 				else if ( (szLine[i] & 0xe0) == 0xc0) {
+					if (j >= GF_ARRAY_LENGTH(szLineConv))
+						break;
 					szLineConv[j] = szLine[i];
 					i++;
 					j++;
 				}
 				/*UTF8 3 bytes char*/
 				else if ( (szLine[i] & 0xf0) == 0xe0) {
+					if (j+1 >= GF_ARRAY_LENGTH(szLineConv))
+						break;
 					szLineConv[j] = szLine[i];
 					i++;
 					j++;
@@ -336,6 +342,8 @@ char *gf_text_get_utf8_line(char *szLine, u32 lineSize, FILE *txt_in, s32 unicod
 				}
 				/*UTF8 4 bytes char*/
 				else if ( (szLine[i] & 0xf8) == 0xf0) {
+					if (j+2 >= GF_ARRAY_LENGTH(szLineConv))
+						break;
 					szLineConv[j] = szLine[i];
 					i++;
 					j++;
@@ -350,14 +358,18 @@ char *gf_text_get_utf8_line(char *szLine, u32 lineSize, FILE *txt_in, s32 unicod
 					continue;
 				}
 			}
+
+			if (j >= GF_ARRAY_LENGTH(szLineConv))
+				break;
+
 			szLineConv[j] = szLine[i];
 			j++;
 
-			if (j >= GF_ARRAY_LENGTH(szLineConv) - 1) {
-				GF_LOG(GF_LOG_DEBUG, GF_LOG_PARSER, ("[TXTIn] Line too long to convert to utf8 (len: %d)\n", len));
-				break;
-			}
 
+		}
+		if ( j >= GF_ARRAY_LENGTH(szLineConv) ) {
+			GF_LOG(GF_LOG_DEBUG, GF_LOG_PARSER, ("[TXTIn] Line too long to convert to utf8 (len: %d)\n", len));
+			j = GF_ARRAY_LENGTH(szLineConv) -1 ;
 		}
 		szLineConv[j] = 0;
 		strcpy(szLine, szLineConv);

programming_language: C
CVE-2020-11558 (published 2020-04-05T20:15Z)

An issue was discovered in libgpac.a in GPAC 0.8.0, as demonstrated by MP4Box. audio_sample_entry_Read in isomedia/box_code_base.c does not properly decide when to make gf_isom_box_del calls. This leads to various use-after-free outcomes involving mdia_Read, gf_isom_delete_movie, and gf_isom_parse_movie_boxes.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: Aurelien David
author_date: 2020-03-26 19:17:07+01:00
msg: fix UAF in audio_sample_entry_Read (#1440)
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: box_code_base.c
change_type: ModificationType.MODIFY
diff: @@ -4069,9 +4069,10 @@ GF_Err audio_sample_entry_Read(GF_Box *s, GF_BitStream *bs)
 	gf_bs_read_data(bs, data, size);
 	for (i=0; i<size-8; i++) {
 		if (GF_4CC((u32)data[i+4], (u8)data[i+5], (u8)data[i+6], (u8)data[i+7]) == GF_ISOM_BOX_TYPE_ESDS) {
+			extern Bool use_dump_mode;
 			GF_BitStream *mybs = gf_bs_new(data + i, size - i, GF_BITSTREAM_READ);
 			if (ptr->esd) {
-				gf_isom_box_del((GF_Box *)ptr->esd);
+				if (!use_dump_mode) gf_isom_box_del((GF_Box *)ptr->esd);
 				ptr->esd=NULL;
 			}
 

programming_language: C
CVE-2024-32984 (published 2024-05-01T11:15Z)

Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. The Rust implementation of the Yamux stream multiplexer uses a vector for pending frames. This vector is not bounded in length. Every time the Yamux protocol requires sending of a new frame, this frame gets appended to this vector. This can be remotely triggered in a number of ways, for example by: 1. Opening a new libp2p Identify stream. This causes the node to send its Identify message. Of course, every other protocol that causes the sending of data also works. The larger the response, the more data is enqueued. 2. Sending a Yamux Ping frame. This causes a Pong frame to be enqueued. Under normal circumstances, this queue of pending frames would be drained once they’re sent out over the network. However, the attacker can use TCP’s receive window mechanism to prevent the victim from sending out any data: By not reading from the TCP connection, the receive window will never be increased, and the victim won’t be able to send out any new data (this is how TCP implements backpressure). Once this happens, Yamux’s queue of pending frames will start growing indefinitely. The queue will only be drained once the underlying TCP connection is closed. An attacker can cause a remote node to run out of memory, which will result in the corresponding process getting terminated by the operating system.\n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/sigp/rust-yamux
commit_details: repo_url: https://github.com/sigp/rust-yamux
author: João Oliveira
author_date: 2024-02-22 14:29:31+00:00
msg: chore: introduce MAX_FRAME_BUFFER
repository: repo_url: https://github.com/sigp/rust-yamux
repo_name: sigp/rust-yamux
description: Multiplexer over reliable, ordered connections.
repo_language: Rust
owner: sigp
file_changes: filename: connection.rs
change_type: ModificationType.MODIFY
diff: @@ -37,6 +37,9 @@ use std::{fmt, sync::Arc, task::Poll};
 
 pub use stream::{Packet, State, Stream};
 
+/// Max queued frames in `Connection`.
+const MAX_FRAME_BUFFER: usize = 2000;
+
 /// How the connection is used.
 #[derive(Copy, Clone, Debug, Hash, PartialEq, Eq)]
 pub enum Mode {
@@ -398,6 +401,11 @@ impl<T: AsyncRead + AsyncWrite + Unpin> Active<T> {
                 }
             }
 
+            // Receiver is not reading.
+            if self.pending_frames.len() == MAX_FRAME_BUFFER {
+                return Poll::Ready(Err(ConnectionError::Closed));
+            }
+
             match self.socket.poll_flush_unpin(cx)? {
                 Poll::Ready(()) => {}
                 Poll::Pending => {}

programming_language: Rust
CVE-2021-4043 (published 2022-02-04T23:15Z)

NULL Pointer Dereference in GitHub repository gpac/gpac prior to 1.1.0.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2022-02-01 15:28:23+01:00
msg: fixed #2092
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: box_code_base.c
change_type: ModificationType.MODIFY
diff: @@ -11083,10 +11083,12 @@ void gitn_box_del(GF_Box *s)
 	u32 i;
 	GroupIdToNameBox *ptr = (GroupIdToNameBox *)s;
 	if (ptr == NULL) return;
-	for (i=0; i<ptr->nb_entries; i++) {
-		if (ptr->entries[i].name) gf_free(ptr->entries[i].name);
+	if (ptr->entries) {
+		for (i=0; i<ptr->nb_entries; i++) {
+			if (ptr->entries[i].name) gf_free(ptr->entries[i].name);
+		}
+		gf_free(ptr->entries);
 	}
-	if (ptr->entries) gf_free(ptr->entries);
 	gf_free(ptr);
 }
 

programming_language: C
CVE-2020-19858 (published 2022-01-21T13:15Z)

Platinum Upnp SDK through 1.2.0 has a directory traversal vulnerability. The attack could remote attack victim by sending http://ip:port/../privacy.avi URL to compromise a victim's privacy.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/plutinosoft/Platinum
commit_details: repo_url: https://github.com/plutinosoft/Platinum
author: Sylvain Rebaud
author_date: 2019-07-22 23:07:31-07:00
msg: Fix vulnerability around urls crafter as http://host/../secret.foo (#24)
repository: repo_url: https://github.com/plutinosoft/Platinum
repo_name: plutinosoft/Platinum
description: UPnP SDK
repo_language: C++
owner: plutinosoft
file_changes: filename: PltHttpServer.cpp
change_type: ModificationType.MODIFY
diff: @@ -190,7 +190,7 @@ PLT_HttpServer::ServeFile(const NPT_HttpRequest&        request,
     NPT_FileInfo             file_info;
     
     // prevent hackers from accessing files outside of our root
-    if ((file_path.Find("/..") >= 0) || (file_path.Find("\\..") >= 0) ||
+    if ((file_path.Find("../") >= 0) || (file_path.Find("..\\") >= 0) ||
         NPT_FAILED(NPT_File::GetInfo(file_path, &file_info))) {
         return NPT_ERROR_NO_SUCH_ITEM;
     }

programming_language: C++
CVE-2021-24666 (published 2021-09-27T16:15Z)

The Podlove Podcast Publisher WordPress plugin before 3.5.6 contains a 'Social & Donations' module (not activated by default), which adds the rest route '/services/contributor/(?P<id>[\\d]+), takes an 'id' and 'category' parameters as arguments. Both parameters can be used for the SQLi.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/podlove/podlove-publisher
commit_details: repo_url: https://github.com/podlove/podlove-publisher
author: Eric Teubert
author_date: 2021-08-22 11:31:50+02:00
msg: fix(security): sql injection in "Social & Donations" module
repository: repo_url: https://github.com/podlove/podlove-publisher
repo_name: podlove/podlove-publisher
description: Podlove Podcast Publisher for WordPress
repo_language: PHP
owner: podlove
file_changes: filename: contributor_service.php
change_type: ModificationType.MODIFY
diff: @@ -51,6 +51,9 @@ class ContributorService extends Base
 
     public static function find_by_contributor_id_and_category($contributor_id, $category = 'social')
     {
+        $contributor_id = (int) $contributor_id;
+        $category = $category == 'social' ? 'social' : 'donation';
+
         return self::all('WHERE service_id IN (SELECT id FROM '.Service::table_name()." WHERE `category` = '".$category."' ) AND `contributor_id` = ".$contributor_id);
     }
 }

programming_language: PHP
filename: show_service.php
change_type: ModificationType.MODIFY
diff: @@ -32,6 +32,8 @@ class ShowService extends Base
 
     public static function find_by_category($category = 'social')
     {
+        $category = $category == 'social' ? 'social' : 'donation';
+
         return self::all('WHERE service_id IN (SELECT id FROM '.Service::table_name()." WHERE `category` = '".$category."' ) ORDER BY position ASC");
     }
 }

programming_language: PHP
filename: readme.txt
change_type: ModificationType.MODIFY
diff: @@ -106,6 +106,10 @@ This product includes GeoLite2 data created by MaxMind, available from http://ww
 
 == Changelog ==
 
+= 2021-08-22 =
+
+* fix(security): sql injection in "Social & Donations" module
+
 = 2021-05-02 =
 
 * fix: transcript API returns list again

programming_language: Markdown
CVE-2020-4062 (published 2020-06-22T16:15Z)

In Conjur OSS Helm Chart before 2.0.0, a recently identified critical vulnerability resulted in the installation of the Conjur Postgres database with an open port. This allows an attacker to gain full read & write access to the Conjur Postgres database, including escalating the attacker\'s privileges to assume full control. A malicious actor who knows the IP address and port number of the Postgres database and has access into the Kubernetes cluster where Conjur runs can gain full read & write access to the Postgres database. This enables the attacker to write a policy that allows full access to retrieve any secret. This Helm chart is a method to install Conjur OSS into a Kubernetes environment. Hence, the systems impacted are only Conjur OSS systems that were deployed using this chart. Other deployments including Docker and the CyberArk Dynamic Access Provider (DAP) are not affected. To remediate this vulnerability, clone the latest Helm Chart and follow the upgrade instructions. If you are not able to fully remediate this vulnerability immediately, you can mitigate some of the risk by making sure Conjur OSS is deployed on an isolated Kubernetes cluster or namespace. The term "isolated" refers to: - No other workloads besides Conjur OSS and its backend database are running in that Kubernetes cluster/namespace. - Kubernetes and helm access to the cluster/namespace is limited to security administrators via Role-Based Access Control (RBAC).

Severity: HIGH
CVSS v2 base score: 7.7 (AV:A/AC:L/Au:S/C:C/I:C/A:C)
CVSS v3 base score: 9.0, CRITICAL (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/cyberark/conjur-oss-helm-chart
commit_details: repo_url: https://github.com/cyberark/conjur-oss-helm-chart
author: Matthew Brace
author_date: 2020-06-18 12:59:55-05:00
msg: Merge pull request from GHSA-mg2m-623j-wpxw

Adds postgres password configuration
repository: repo_url: https://github.com/cyberark/conjur-oss-helm-chart
repo_name: cyberark/conjur-oss-helm-chart
description: Helm chart for deploying Conjur OSS to Kubernetes
repo_language: Shell
owner: cyberark
CVE-2017-18255 (published 2018-03-31T17:29Z)

The perf_cpu_time_max_percent_handler function in kernel/events/core.c in the Linux kernel before 4.11 allows local users to cause a denial of service (integer overflow) or possibly have unspecified other impact via a large value, as demonstrated by an incorrect sample-rate calculation.

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Tan Xiaojun
author_date: 2017-02-23 14:04:39+08:00
msg: perf/core: Fix the perf_cpu_time_max_percent check

Use "proc_dointvec_minmax" instead of "proc_dointvec" to check the input
value from user-space.

If not, we can set a big value and some vars will overflow like
"sysctl_perf_event_sample_rate" which will cause a lot of unexpected
problems.

Signed-off-by: Tan Xiaojun <tanxiaojun@huawei.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: <acme@kernel.org>
Cc: <alexander.shishkin@linux.intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vince Weaver <vincent.weaver@maine.edu>
Link: http://lkml.kernel.org/r/1487829879-56237-1-git-send-email-tanxiaojun@huawei.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: core.c
change_type: ModificationType.MODIFY
diff: @@ -455,7 +455,7 @@ int perf_cpu_time_max_percent_handler(struct ctl_table *table, int write,
 				void __user *buffer, size_t *lenp,
 				loff_t *ppos)
 {
-	int ret = proc_dointvec(table, write, buffer, lenp, ppos);
+	int ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
 
 	if (ret || !write)
 		return ret;

programming_language: C
CVE-2019-18812 (published 2019-11-07T16:15Z)

A memory leak in the sof_dfsentry_write() function in sound/soc/sof/debug.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-c0a333d842ef.

Severity: HIGH
CVSS v2 base score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-401
cwe_name: Missing Release of Memory after Effective Lifetime
description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
extended_description: This is often triggered by improper handling of malformed data or unexpectedly interrupted sessions.  In some languages, developers are responsible for tracking memory allocation and releasing the memory.  If there are no more pointers or references to the memory, then it can no longer be tracked and identified for release.
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Navid Emamdoost
author_date: 2019-10-27 14:48:47-05:00
msg: ASoC: SOF: Fix memory leak in sof_dfsentry_write

In the implementation of sof_dfsentry_write() memory allocated for
string is leaked in case of an error. Go to error handling path if the
d_name.name is not valid.

Fixes: 091c12e1f50c ("ASoC: SOF: debug: add new debugfs entries for IPC flood test")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Link: https://lore.kernel.org/r/20191027194856.4056-1-navid.emamdoost@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: debug.c
change_type: ModificationType.MODIFY
diff: @@ -152,8 +152,10 @@ static ssize_t sof_dfsentry_write(struct file *file, const char __user *buffer,
 	 */
 	dentry = file->f_path.dentry;
 	if (strcmp(dentry->d_name.name, "ipc_flood_count") &&
-	    strcmp(dentry->d_name.name, "ipc_flood_duration_ms"))
-		return -EINVAL;
+	    strcmp(dentry->d_name.name, "ipc_flood_duration_ms")) {
+		ret = -EINVAL;
+		goto out;
+	}
 
 	if (!strcmp(dentry->d_name.name, "ipc_flood_duration_ms"))
 		flood_duration_test = true;

programming_language: C