starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2023-1605 (published 2023-03-23T19:15Z)

Denial of Service in GitHub repository radareorg/radare2 prior to 5.8.6.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-400
cwe_name: Uncontrolled Resource Consumption
description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
extended_description: 
            Limited resources include memory, file system storage, database connection pool entries, and CPU. If an attacker can trigger the allocation of these limited resources, but the number or size of the resources is not controlled, then the attacker could cause a denial of service that consumes all available resources. This would prevent valid users from accessing the product, and it could potentially have an impact on the surrounding environment. For example, a memory exhaustion attack against an application could slow down the application as well as its host operating system.
            There are at least three distinct scenarios which can commonly lead to resource exhaustion:
               
                  Lack of throttling for the number of allocated resources
                  Losing all references to a resource before reaching the shutdown stage
                  Not closing/returning a resource after processing
               
            Resource exhaustion problems are often result due to an incorrect implementation of the following situations:
               
                  Error conditions and other exceptional circumstances.
                  Confusion over which part of the program is responsible for releasing the resource.
               
         
         

Fix information:
repo_url: https://github.com/radareorg/radare2
commit_details: repo_url: https://github.com/radareorg/radare2
author: echel0n
author_date: 2023-03-21 20:52:41+03:00
msg: fix segfault when bin->symbols is NULL #21503
repository: repo_url: https://github.com/radareorg/radare2
repo_name: radareorg/radare2
description: UNIX-like reverse engineering framework and command-line toolset
repo_language: C
owner: radareorg
file_changes: filename: bin_coff.c
change_type: ModificationType.MODIFY
diff: @@ -505,11 +505,13 @@ static RList *patch_relocs(RBin *b) {
 
 	size_t nimports = 0;
 	int i;
-	for (i = 0; i < bin->hdr.f_nsyms; i++) {
-		if (is_imported_symbol (&bin->symbols[i])) {
-			nimports++;
+	if (bin->symbols) {
+		for (i = 0; i < bin->hdr.f_nsyms; i++) {
+			if (is_imported_symbol (&bin->symbols[i])) {
+				nimports++;
+			}
+			i += bin->symbols[i].n_numaux;
 		}
-		i += bin->symbols[i].n_numaux;
 	}
 	ut64 m_vaddr = UT64_MAX;
 	if (nimports) {

programming_language: C
CVE-2022-36109 (published 2022-09-09T18:15Z)

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. This bug is fixed in Moby (Docker Engine) 20.10.18. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade, this problem can be worked around by not using the `"USER $USERNAME"` Dockerfile instruction. Instead by calling `ENTRYPOINT ["su", "-", "user"]` the supplementary groups will be set up properly.

CVSS v3 base score: 6.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/moby/moby
commit_details: repo_url: https://github.com/moby/moby
author: Sebastiaan van Stijn
author_date: 2022-09-08 21:29:35+02:00
msg: Merge pull request from GHSA-rc4r-wh2q-q6c4

AdditionalGids must include effective group ID
repository: repo_url: https://github.com/moby/moby
repo_name: moby/moby
description: The Moby Project - a collaborative project for the container ecosystem to assemble container-based systems
repo_language: Go
owner: moby
CVE-2021-25992 (published 2022-02-10T10:15Z)

In Ifme, versions 1.0.0 to v.7.33.2 don’t properly invalidate a user’s session even after the user initiated logout. It makes it possible for an attacker to reuse the admin cookies either via local/network access or by other hypothetical attacks.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-613
cwe_name: Insufficient Session Expiration
description: According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/ifmeorg/ifme
commit_details: repo_url: https://github.com/ifmeorg/ifme
author: Julia Nguyen
author_date: 2022-02-03 23:13:53-08:00
msg: Call invalidate_all_sessions in prepend_before_action
repository: repo_url: https://github.com/ifmeorg/ifme
repo_name: ifmeorg/ifme
description: Free, open source mental health communication web app to share experiences with loved ones
repo_language: Ruby
owner: ifmeorg
file_changes: filename: sessions_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -3,6 +3,7 @@
 class SessionsController < Devise::SessionsController
   prepend_before_action :check_recaptcha, only: [:create]
   before_action :set_recaptcha, only: [:new]
+  prepend_before_action :invalidate_all_sessions, only: [:destroy]
 
   def new
     super
@@ -14,7 +15,6 @@ class SessionsController < Devise::SessionsController
   end
 
   def destroy
-    current_user.invalidate_all_sessions!
     super
   end
 
@@ -57,4 +57,8 @@ class SessionsController < Devise::SessionsController
 
     RecaptchaService.new(user).recaptcha_required_for_login?
   end
+
+  def invalidate_all_sessions
+    current_user.invalidate_all_sessions!
+  end
 end

programming_language: Ruby
CVE-2021-43821 (published 2021-12-14T20:15Z)

Opencast is an Open Source Lecture Capture & Video Management for Education. Opencast before version 9.10 or 10.6 allows references to local file URLs in ingested media packages, allowing attackers to include local files from Opencast's host machines and making them available via the web interface. Before Opencast 9.10 and 10.6, Opencast would open and include local files during ingests. Attackers could exploit this to include most local files the process has read access to, extracting secrets from the host machine. An attacker would need to have the privileges required to add new media to exploit this. But these are often widely given. The issue has been fixed in Opencast 10.6 and 11.0. You can mitigate this issue by narrowing down the read access Opencast has to files on the file system using UNIX permissions or mandatory access control systems like SELinux. This cannot prevent access to files Opencast needs to read though and we highly recommend updating.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)
CVSS v3 base score: 7.7, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-552
cwe_name: Files or Directories Accessible to External Parties
description: The product makes files or directories accessible to unauthorized actors, even though they should not be.
extended_description: 
	   Web servers, FTP servers, and similar servers may store a set of files underneath a "root" directory that is accessible to the server's users.  Applications may store sensitive files underneath this root without also using access control to limit which users may request those files, if any.  Alternately, an application might package multiple files or directories into an archive file (e.g., ZIP or tar), but the application might not exclude sensitive files that are underneath those directories.
	   In cloud technologies and containers, this weakness might present itself in the form of misconfigured storage accounts that can be read or written by a public or anonymous user.
	 
         

Fix information:
repo_url: https://github.com/opencast/opencast
commit_details: repo_url: https://github.com/opencast/opencast
author: Greg Logan
author_date: 2021-12-13 14:04:01-06:00
msg: Merge pull request from GHSA-59g4-hpg3-3gcp

Ensure local files are not addable
repository: repo_url: https://github.com/opencast/opencast
repo_name: opencast/opencast
description: The free and open source solution for automated video capture and distribution at scale.
repo_language: Java
owner: opencast
CVE-2023-49062 (published 2023-11-28T16:15Z)

Katran could disclose non-initialized kernel memory as part of an IP header. The issue was present for IPv4 encapsulation and ICMP (v4) Too Big packet generation. After a bpf_xdp_adjust_head call, Katran code didn’t initialize the Identification field for the IPv4 header, resulting in writing content of kernel memory in that field of IP header. The issue affected all Katran versions prior to commit 6a03106ac1eab39d0303662963589ecb2374c97f

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-665
cwe_name: Improper Initialization
description: The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
extended_description: This can have security implications when the associated resource is expected to have certain properties or values, such as a variable that determines whether a user has been authenticated or not.
         

Fix information:
repo_url: https://github.com/facebookincubator/katran
commit_details: repo_url: https://github.com/facebookincubator/katran
author: Fei Chen
author_date: 2023-11-15 14:43:42-08:00
msg: initialize all iphdr/icmphdr fields when generating iphdr/icmphdr

Summary: as per title

Reviewed By: avasylev

Differential Revision: D51366550

fbshipit-source-id: 3a5ccf0ba21c2f53c4f336cd6df72c64d62b9cc7
repository: repo_url: https://github.com/facebookincubator/katran
repo_name: facebookincubator/katran
description: A high performance layer 4 load balancer
repo_language: C
owner: facebookincubator
file_changes: filename: encap_helpers.h
change_type: ModificationType.MODIFY
diff: @@ -48,6 +48,7 @@ __attribute__((__always_inline__)) static inline void create_v4_hdr(
   iph->tos = DEFAULT_TOS;
 #endif
   iph->tot_len = bpf_htons(pkt_bytes + sizeof(struct iphdr));
+  iph->id = 0;
   iph->daddr = daddr;
   iph->saddr = saddr;
   iph->ttl = DEFAULT_TTL;

programming_language: C
filename: handle_icmp.h
change_type: ModificationType.MODIFY
diff: @@ -145,6 +145,7 @@ __attribute__((__always_inline__)) static inline int send_icmp4_too_big(
   icmp_hdr->type = ICMP_DEST_UNREACH;
   icmp_hdr->code = ICMP_FRAG_NEEDED;
   icmp_hdr->un.frag.mtu = bpf_htons(MAX_PCKT_SIZE - sizeof(struct ethhdr));
+  icmp_hdr->un.frag.__unused = 0;
   icmp_hdr->checksum = 0;
   ipv4_csum(icmp_hdr, ICMP_TOOBIG_PAYLOAD_SIZE, &csum);
   icmp_hdr->checksum = csum;
@@ -157,6 +158,7 @@ __attribute__((__always_inline__)) static inline int send_icmp4_too_big(
   iph->protocol = IPPROTO_ICMP;
   iph->tos = 0;
   iph->tot_len = bpf_htons(ICMP_TOOBIG_SIZE + headroom - sizeof(struct ethhdr));
+  iph->id = 0;
   iph->check = 0;
   csum = 0;
   ipv4_csum(iph, sizeof(struct iphdr), &csum);

programming_language: C
CVE-2022-42895 (published 2022-11-23T15:15Z)

There is an infoleak vulnerability in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_parse_conf_req function which can be used to leak kernel pointers remotely.\nWe recommend upgrading past commit\xa0 https://github.com/torvalds/linux/commit/b1a2cd50c0357f243b7435a732b4e62ba3157a2e https://www.google.com/url \n\n

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-824
cwe_name: Access of Uninitialized Pointer
description: The product accesses or uses a pointer that has not been initialized.
extended_description: 
            If the pointer contains an uninitialized value, then the value might not point to a valid memory location. This could cause the product to read from or write to unexpected memory locations, leading to a denial of service. If the uninitialized pointer is used as a function call, then arbitrary functions could be invoked. If an attacker can influence the portion of uninitialized memory that is contained in the pointer, this weakness could be leveraged to execute code or perform other attacks.
            Depending on memory layout, associated memory management behaviors, and product operation, the attacker might be able to influence the contents of the uninitialized pointer, thus gaining more fine-grained control of the memory location to be accessed.
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Luiz Augusto von Dentz
author_date: 2022-10-31 16:10:52-07:00
msg: Bluetooth: L2CAP: Fix attempting to access uninitialized memory

On l2cap_parse_conf_req the variable efs is only initialized if
remote_efs has been set.

CVE: CVE-2022-42895
CC: stable@vger.kernel.org
Reported-by: Tamás Koczka <poprdi@google.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Reviewed-by: Tedd Ho-Jeong An <tedd.an@intel.com>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: l2cap_core.c
change_type: ModificationType.MODIFY
diff: @@ -3764,7 +3764,8 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data
 			l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
 					   sizeof(rfc), (unsigned long) &rfc, endptr - ptr);
 
-			if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
+			if (remote_efs &&
+			    test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
 				chan->remote_id = efs.id;
 				chan->remote_stype = efs.stype;
 				chan->remote_msdu = le16_to_cpu(efs.msdu);

programming_language: C
CVE-2021-29529 (published 2021-05-14T20:15Z)

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a heap buffer overflow in `tf.raw_ops.QuantizedResizeBilinear` by manipulating input values so that float rounding results in off-by-one error in accessing image elements. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/44b7f486c0143f68b56c34e2d01e146ee445134a/tensorflow/core/kernels/quantized_resize_bilinear_op.cc#L62-L66) computes two integers (representing the upper and lower bounds for interpolation) by ceiling and flooring a floating point value. For some values of `in`, `interpolation->upper[i]` might be smaller than `interpolation->lower[i]`. This is an issue if `interpolation->upper[i]` is capped at `in_size-1` as it means that `interpolation->lower[i]` points outside of the image. Then, in the interpolation code(https://github.com/tensorflow/tensorflow/blob/44b7f486c0143f68b56c34e2d01e146ee445134a/tensorflow/core/kernels/quantized_resize_bilinear_op.cc#L245-L264), this would result in heap buffer overflow. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-193
cwe_name: Off-by-one Error
description: A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Mihai Maruseac
author_date: 2021-04-21 16:20:48-07:00
msg: Fix heap buffer overflow caused by rounding.

This was hard to fix. Due to the way we compute the pixels that influence an output pixel in resized images, for certain input configuration we might have issued a read to a pixel that is outside of boundary of the original image. This is because of floating errors that affected truncation results.

PiperOrigin-RevId: 369757871
Change-Id: If89425fff930983829a2168203c11858883eebc9
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: quantized_resize_bilinear_op.cc
change_type: ModificationType.MODIFY
diff: @@ -64,6 +64,8 @@ inline void ComputeInterpolationWeights(
         std::max(static_cast<int64>(in_f), static_cast<int64>(0));
     interpolation->upper[i] =
         std::min(static_cast<int64>(std::ceil(in)), in_size - 1);
+    interpolation->lower[i] =
+        std::min(interpolation->lower[i], interpolation->upper[i]);
     interpolation->lerp[i] = in - in_f;
     interpolation->ilerp[i] =
         static_cast<T_SCALE>((in - in_f) * (1 << resolution));

programming_language: C++
CVE-2017-8067 (published 2017-04-23T05:59Z)

drivers/char/virtio_console.c in the Linux kernel 4.9.x and 4.10.x before 4.10.12 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.

Severity: HIGH
CVSS v2 base score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Omar Sandoval
author_date: 2017-02-01 00:02:27-08:00
msg: virtio-console: avoid DMA from stack

put_chars() stuffs the buffer it gets into an sg, but that buffer may be
on the stack. This breaks with CONFIG_VMAP_STACK=y (for me, it
manifested as printks getting turned into NUL bytes).

Signed-off-by: Omar Sandoval <osandov@fb.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Amit Shah <amit.shah@redhat.com>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: virtio_console.c
change_type: ModificationType.MODIFY
diff: @@ -1136,6 +1136,8 @@ static int put_chars(u32 vtermno, const char *buf, int count)
 {
 	struct port *port;
 	struct scatterlist sg[1];
+	void *data;
+	int ret;
 
 	if (unlikely(early_put_chars))
 		return early_put_chars(vtermno, buf, count);
@@ -1144,8 +1146,14 @@ static int put_chars(u32 vtermno, const char *buf, int count)
 	if (!port)
 		return -EPIPE;
 
-	sg_init_one(sg, buf, count);
-	return __send_to_port(port, sg, 1, count, (void *)buf, false);
+	data = kmemdup(buf, count, GFP_ATOMIC);
+	if (!data)
+		return -ENOMEM;
+
+	sg_init_one(sg, data, count);
+	ret = __send_to_port(port, sg, 1, count, data, false);
+	kfree(data);
+	return ret;
 }
 
 /*

programming_language: C
CVE-2021-3778 (published 2021-09-15T08:15Z)

vim is vulnerable to Heap-based Buffer Overflow

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-122
cwe_name: Heap-based Buffer Overflow
description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Bram Moolenaar
author_date: 2021-09-07 19:26:53+02:00
msg: patch 8.2.3409: reading beyond end of line with invalid utf-8 character

Problem:    Reading beyond end of line with invalid utf-8 character.
Solution:   Check for NUL when advancing.
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: regexp_nfa.c
change_type: ModificationType.MODIFY
diff: @@ -5664,7 +5664,8 @@ find_match_text(colnr_T startcol, int regstart, char_u *match_text)
 		match = FALSE;
 		break;
 	    }
-	    len2 += MB_CHAR2LEN(c2);
+	    len2 += enc_utf8 ? utf_ptr2len(rex.line + col + len2)
+							     : MB_CHAR2LEN(c2);
 	}
 	if (match
 		// check that no composing char follows

programming_language: C
filename: test_regexp_utf8.vim
change_type: ModificationType.MODIFY
diff: @@ -558,4 +558,12 @@ func Test_match_char_class_upper()
   bwipe!
 endfunc
 
+func Test_match_invalid_byte()
+  call writefile(0z630a.765d30aa0a.2e0a.790a.4030, 'Xinvalid')
+  new
+  source Xinvalid
+  bwipe!
+  call delete('Xinvalid')
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab

programming_language: Lua
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -755,6 +755,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    3409,
 /**/
     3408,
 /**/

programming_language: Ruby