starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2017-6419 (published 2017-08-07T03:29Z)

mspack/lzxd.c in libmspack 0.5alpha, as used in ClamAV 0.99.2, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted CHM file.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/vrtadmin/clamav-devel
commit_details: repo_url: https://github.com/vrtadmin/clamav-devel
author: Mickey Sola
author_date: 2017-03-29 14:55:26-04:00
msg: fixing potential OOB window write when unpacking chm files
repository: repo_url: https://github.com/vrtadmin/clamav-devel
repo_name: Cisco-Talos/clamav
description: ClamAV - Documentation is here: https://docs.clamav.net
repo_language: C
owner: vrtadmin
file_changes: filename: lzxd.c
change_type: ModificationType.MODIFY
diff: @@ -766,8 +766,13 @@ int lzxd_decompress(struct lzxd_stream *lzx, off_t out_bytes) {
       case LZX_BLOCKTYPE_UNCOMPRESSED:
 	/* as this_run is limited not to wrap a frame, this also means it
 	 * won't wrap the window (as the window is a multiple of 32k) */
+        if (window_posn + this_run > lzx->window_size) {
+                D(("match ran over window boundary"))
+                return lzx->error = MSPACK_ERR_DECRUNCH;
+        }
 	rundest = &window[window_posn];
 	window_posn += this_run;
+
 	while (this_run > 0) {
 	  if ((i = i_end - i_ptr) == 0) {
 	    READ_IF_NEEDED;
@@ -888,8 +893,10 @@ void lzxd_free(struct lzxd_stream *lzx) {
   struct mspack_system *sys;
   if (lzx) {
     sys = lzx->sys;
-    sys->free(lzx->inbuf);
-    sys->free(lzx->window);
+    if(lzx->inbuf)
+        sys->free(lzx->inbuf);
+    if(lzx->window)
+        sys->free(lzx->window);
     sys->free(lzx);
   }
 }

programming_language: C
filename: libmspack.c
change_type: ModificationType.MODIFY
diff: @@ -264,7 +264,11 @@ static void *mspack_fmap_alloc(struct mspack_system *self, size_t num)
 
 static void mspack_fmap_free(void *mem)
 {
-	free(mem);
+    if(mem) {
+        free(mem);
+        mem = NULL;
+    }
+    return;
 }
 
 static void mspack_fmap_copy(void *src, void *dst, size_t num)

programming_language: C
CVE-2021-32438 (published 2021-08-11T20:15Z)

The gf_media_export_filters function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2021-04-30 10:50:38+02:00
msg: fixed #1769 (fuzz)
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: media_export.c
change_type: ModificationType.MODIFY
diff: @@ -1108,7 +1108,7 @@ static GF_Err gf_media_export_filters(GF_MediaExporter *dumper)
 		}
 		esd = gf_media_map_esd(dumper->file, track_num, 0);
 		sample_count = gf_isom_get_sample_count(dumper->file, dumper->trackID);
-		if (esd) {
+		if (esd && esd->decoderConfig) {
 			if (esd->decoderConfig->objectTypeIndication<GF_CODECID_LAST_MPEG4_MAPPING) {
 				codec_id = gf_codecid_from_oti(esd->decoderConfig->streamType, esd->decoderConfig->objectTypeIndication);
 #ifndef GPAC_DISABLE_AV_PARSERS

programming_language: C
CVE-2022-23630 (published 2022-02-10T20:15Z)

Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, Gradle may skip that verification and accept a dependency that would otherwise fail the build as an untrusted external artifact. This occurs when dependency verification is disabled on one or more configurations and those configurations have common dependencies with other configurations that have dependency verification enabled. If the configuration that has dependency verification disabled is resolved first, Gradle does not verify the common dependencies for the configuration that has dependency verification enabled. Gradle 7.4 fixes that issue by validating artifacts at least once if they are present in a resolved configuration that has dependency verification active. For users who cannot update either do not use `ResolutionStrategy.disableDependencyVerification()` and do not use plugins that use that method to disable dependency verification for a single configuration or make sure resolution of configuration that disable that feature do not happen in builds that resolve configuration where the feature is enabled.

Severity: MEDIUM
CVSS v2 base score: 6.0 (AV:N/AC:M/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-829
cwe_name: Inclusion of Functionality from Untrusted Control Sphere
description: The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
extended_description: 
            When including third-party functionality, such as a web widget, library, or other source of functionality, the product must effectively trust that functionality. Without sufficient protection mechanisms, the functionality could be malicious in nature (either by coming from an untrusted source, being spoofed, or being modified in transit from a trusted source). The functionality might also contain its own weaknesses, or grant access to additional functionality and state information that should be kept private to the base system, such as system state information, sensitive application data, or the DOM of a web application.
            This might lead to many different consequences depending on the included functionality, but some examples include injection of malware, information exposure by granting excessive privileges or permissions to the untrusted functionality, DOM-based XSS vulnerabilities, stealing user's cookies, or open redirect to malware (CWE-601).
         
         

Fix information:
repo_url: https://github.com/gradle/gradle
commit_details: repo_url: https://github.com/gradle/gradle
author: bot-gradle
author_date: 2022-02-02 10:08:54+01:00
msg: Merge pull request #19798 Do not share resolvable artifacts between verified and non-verified resolve contexts
repository: repo_url: https://github.com/gradle/gradle
repo_name: gradle/gradle
description: Adaptable, fast automation for all
repo_language: Groovy
owner: gradle
CVE-2022-35923 (published 2022-08-02T20:15Z)

v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in the `lowercase()` and `uppercase()` regex which could lead to a denial of service attack. In testing of the `lowercase()` function a payload of 'a' + 'a'.repeat(i) + 'A' with 32 leading characters took 29443 ms to execute. The same issue happens with uppercase(). Users are advised to upgrade. There are no known workarounds for this issue.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-1333
cwe_name: Inefficient Regular Expression Complexity
description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
extended_description: Some regular expression engines have a feature called "backtracking". If the token cannot match, the engine "backtracks" to a position that may result in a different token that can match.
                Backtracking becomes a weakness if all of these conditions are met:
                
                    The number of possible backtracking attempts are exponential relative to the length of the input.
                    The input can fail to match the regular expression.
                    The input can be long enough.
                
		
		  Attackers can create crafted inputs that
		  intentionally cause the regular expression to use
		  excessive backtracking in a way that causes the CPU
		  consumption to spike.
		
            
            

Fix information:
repo_url: https://github.com/imbrn/v8n
commit_details: repo_url: https://github.com/imbrn/v8n
author: imbrn
author_date: 2022-06-30 23:06:27-03:00
msg: fix inefficient regular expressions on lowercase and uppercase rules
repository: repo_url: https://github.com/imbrn/v8n
repo_name: imbrn/v8n
description: ☑️ JavaScript fluent validation library
repo_language: JavaScript
owner: imbrn
file_changes: filename: v8n.js
change_type: ModificationType.MODIFY
diff: @@ -189,9 +189,15 @@ const availableRules = {
 
   pattern: expected => value => expected.test(value),
 
-  lowercase: () => value => /^([a-z]+\s*)+$/.test(value),
+  lowercase: () => value => {
+    return (
+      typeof value === 'boolean' ||
+      (value === value.toLowerCase() && value.trim() !== '')
+    );
+  },
 
-  uppercase: () => value => /^([A-Z]+\s*)+$/.test(value),
+  uppercase: () => value =>
+    value === value.toUpperCase() && value.trim() !== '',
 
   vowel: () => value => /^[aeiou]+$/i.test(value),
 

programming_language: TypeScript
CVE-2019-11937 (published 2019-12-04T16:15Z)

In Mcrouter prior to v0.41.0, a large struct input provided to the Carbon protocol reader could result in stack exhaustion and denial of service.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-674
cwe_name: Uncontrolled Recursion
description: The product does not properly control the amount of recursion that takes place,  consuming excessive resources, such as allocated memory or the program stack.
extended_description: 
        
      
      

Fix information:
repo_url: https://github.com/facebook/mcrouter
commit_details: repo_url: https://github.com/facebook/mcrouter
author: Ted Reed
author_date: 2019-11-04 07:02:54-08:00
msg: Attempt to make CarbonProtocolReader::skip tail recursive

Reviewed By: edenzik

Differential Revision: D17967570

fbshipit-source-id: fdc32e190a521349c7c8f4d6081902fa18eb0284
repository: repo_url: https://github.com/facebook/mcrouter
repo_name: facebook/mcrouter
description: Mcrouter is a memcached protocol router for scaling memcached deployments.
repo_language: C++
owner: facebook
file_changes: filename: CarbonProtocolReader.cpp
change_type: ModificationType.MODIFY
diff: @@ -78,13 +78,11 @@ void CarbonProtocolReader::skip(const FieldType ft) {
     }
     case FieldType::Struct: {
       readStructBegin();
-      while (true) {
-        const auto fieldType = readFieldHeader().first;
-        if (fieldType == FieldType::Stop) {
-          break;
-        }
-        skip(fieldType);
-      }
+      const auto next = readFieldHeader().first;
+      skip(next);
+      break;
+    }
+    case FieldType::Stop: {
       readStructEnd();
       break;
     }
@@ -96,8 +94,10 @@ void CarbonProtocolReader::skip(const FieldType ft) {
       skipKVContainer();
       break;
     }
-    default: { break; }
+    default: {
+      break;
+    }
   }
 }
 
-} // carbon
+} // namespace carbon

programming_language: C++
filename: CarbonProtocolReader.h
change_type: ModificationType.MODIFY
diff: @@ -245,8 +245,10 @@ class CarbonProtocolReader {
   }
 
   void readStructEnd() {
-    lastFieldId_ = nestedStructFieldIds_.back();
-    nestedStructFieldIds_.pop_back();
+    if (!nestedStructFieldIds_.empty()) {
+      lastFieldId_ = nestedStructFieldIds_.back();
+      nestedStructFieldIds_.pop_back();
+    }
   }
 
   std::pair<std::pair<FieldType, FieldType>, uint32_t>

programming_language: C++
CVE-2016-2186 (published 2016-05-02T10:59Z)

The powermate_probe function in drivers/input/misc/powermate.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 4.6, MEDIUM (CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Josh Boyer
author_date: 2016-03-14 09:33:40-07:00
msg: Input: powermate - fix oops with malicious USB descriptors

The powermate driver expects at least one valid USB endpoint in its
probe function.  If given malicious descriptors that specify 0 for
the number of endpoints, it will crash.  Validate the number of
endpoints on the interface before using them.

The full report for this issue can be found here:
http://seclists.org/bugtraq/2016/Mar/85

Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: powermate.c
change_type: ModificationType.MODIFY
diff: @@ -307,6 +307,9 @@ static int powermate_probe(struct usb_interface *intf, const struct usb_device_i
 	int error = -ENOMEM;
 
 	interface = intf->cur_altsetting;
+	if (interface->desc.bNumEndpoints < 1)
+		return -EINVAL;
+
 	endpoint = &interface->endpoint[0].desc;
 	if (!usb_endpoint_is_int_in(endpoint))
 		return -EIO;

programming_language: C
CVE-2022-0669 (published 2022-08-29T15:15Z)

A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected number of fds as ancillary data to VHOST_USER_GET_INFLIGHT_FD / VHOST_USER_SET_INFLIGHT_FD messages that are not closed by the vhost-user slave. By sending such messages continuously, the vhost-user master exhausts available fd in the vhost-user slave process, leading to a denial of service.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/DPDK/dpdk
commit_details: repo_url: https://github.com/DPDK/dpdk
author: David Marchand
author_date: 2022-01-18 15:53:30+01:00
msg: vhost: fix FD leak with inflight messages

Even if unlikely, a buggy vhost-user master might attach fds to inflight
messages. Add checks like for other types of vhost-user messages.

Fixes: d87f1a1cb7b6 ("vhost: support inflight info sharing")
Cc: stable@dpdk.org

Signed-off-by: David Marchand <david.marchand@redhat.com>
Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>
repository: repo_url: https://github.com/DPDK/dpdk
repo_name: DPDK/dpdk
description: Data Plane Development Kit
repo_language: C
owner: DPDK
file_changes: filename: vhost_user.c
change_type: ModificationType.MODIFY
diff: @@ -1602,6 +1602,9 @@ vhost_user_get_inflight_fd(struct virtio_net **pdev,
 	int numa_node = SOCKET_ID_ANY;
 	void *addr;
 
+	if (validate_msg_fds(dev, ctx, 0) != 0)
+		return RTE_VHOST_MSG_RESULT_ERR;
+
 	if (ctx->msg.size != sizeof(ctx->msg.payload.inflight)) {
 		VHOST_LOG_CONFIG(ERR, "(%s) invalid get_inflight_fd message size is %d\n",
 			dev->ifname, ctx->msg.size);
@@ -1699,6 +1702,9 @@ vhost_user_set_inflight_fd(struct virtio_net **pdev,
 	int fd, i;
 	int numa_node = SOCKET_ID_ANY;
 
+	if (validate_msg_fds(dev, ctx, 1) != 0)
+		return RTE_VHOST_MSG_RESULT_ERR;
+
 	fd = ctx->fds[0];
 	if (ctx->msg.size != sizeof(ctx->msg.payload.inflight) || fd < 0) {
 		VHOST_LOG_CONFIG(ERR, "(%s) invalid set_inflight_fd message size is %d,fd is %d\n",

programming_language: C
CVE-2016-7568 (published 2016-09-28T20:59Z)

Integer overflow in the gdImageWebpCtx function in gd_webp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP through 7.0.11, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted imagewebp and imagedestroy calls.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/libgd/libgd
commit_details: repo_url: https://github.com/libgd/libgd
author: Christoph M. Becker
author_date: 2016-09-16 10:54:34+02:00
msg: Merge branch 'pull-request/296'
repository: repo_url: https://github.com/libgd/libgd
repo_name: libgd/libgd
description: GD Graphics Library
repo_language: C
owner: libgd
repo_url: https://github.com/php/php-src
commit_details: repo_url: https://github.com/php/php-src
author: Christoph M. Becker
author_date: 2016-09-16 11:40:36+02:00
msg: Merge branch 'PHP-5.6' into PHP-7.0
repository: repo_url: https://github.com/php/php-src
repo_name: php/php-src
description: The PHP Interpreter
repo_language: C
owner: php
CVE-2017-8890 (published 2017-05-10T16:29Z)

The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the Linux kernel through 4.10.15 allows attackers to cause a denial of service (double free) or possibly have unspecified other impact by leveraging use of the accept system call.

Severity: HIGH
CVSS v2 base score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-415
cwe_name: Double Free
description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
extended_description: When a program calls free() twice with the same argument, the program's memory management data structures become corrupted. This corruption can cause the program to crash or, in some circumstances, cause two later calls to malloc() to return the same pointer. If malloc() returns the same value twice and the program later gives the attacker control over the data that is written into this doubly-allocated memory, the program becomes vulnerable to a buffer overflow attack.
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Eric Dumazet
author_date: 2017-05-09 06:29:19-07:00
msg: dccp/tcp: do not inherit mc_list from parent

syzkaller found a way to trigger double frees from ip_mc_drop_socket()

It turns out that leave a copy of parent mc_list at accept() time,
which is very bad.

Very similar to commit 8b485ce69876 ("tcp: do not inherit
fastopen_req from parent")

Initial report from Pray3r, completed by Andrey one.
Thanks a lot to them !

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Pray3r <pray3r.z@gmail.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: inet_connection_sock.c
change_type: ModificationType.MODIFY
diff: @@ -794,6 +794,8 @@ struct sock *inet_csk_clone_lock(const struct sock *sk,
 		/* listeners have SOCK_RCU_FREE, not the children */
 		sock_reset_flag(newsk, SOCK_RCU_FREE);
 
+		inet_sk(newsk)->mc_list = NULL;
+
 		newsk->sk_mark = inet_rsk(req)->ir_mark;
 		atomic64_set(&newsk->sk_cookie,
 			     atomic64_read(&inet_rsk(req)->ir_cookie));

programming_language: C
CVE-2022-2927 (published 2022-08-22T09:15Z)

Weak Password Requirements in GitHub repository notrinos/notrinoserp prior to 0.7.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-521
cwe_name: Weak Password Requirements
description: The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.
extended_description: Authentication mechanisms often rely on a memorized secret (also known as a password) to provide an assertion of identity for a user of a system. It is therefore important that this password be of sufficient complexity and impractical for an adversary to guess. The specific requirements around how complex a password needs to be depends on the type of system being protected. Selecting the correct password requirements and enforcing them through implementation are critical to the overall success of the authentication mechanism.
         

Fix information:
repo_url: https://github.com/notrinos/notrinoserp
commit_details: repo_url: https://github.com/notrinos/notrinoserp
author: notrinos
author_date: 2022-08-22 14:46:05+07:00
msg: added password validation for adding new user.
repository: repo_url: https://github.com/notrinos/notrinoserp
repo_name: notrinos/NotrinosERP
description: A web-based erp, accounting system that written in PHP and MySql includes Sales, Purchasing, Warehousing, Manufacturing, Human Resource... It supports multi user, multi currencies, multi languages.
repo_language: PHP
owner: notrinos
file_changes: filename: users.php
change_type: ModificationType.MODIFY
diff: @@ -31,7 +31,7 @@ function can_process($new) {
 		set_focus('user_id');
 		return false;
 	}
-	if (!$new && ($_POST['password'] != '')) {
+	if ($new || (!$new && ($_POST['password'] != ''))) {
 		if (strlen($_POST['password']) < 4) {
 			display_error( _('The password entered must be at least 4 characters long.'));
 			set_focus('password');

programming_language: PHP