starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2021-29574 (published 2021-05-14T20:15Z)

TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.MaxPool3DGradGrad` exhibits undefined behavior by dereferencing null pointers backing attacker-supplied empty tensors. The implementation(https://github.com/tensorflow/tensorflow/blob/72fe792967e7fd25234342068806707bbc116618/tensorflow/core/kernels/pooling_ops_3d.cc#L679-L703) fails to validate that the 3 tensor inputs are not empty. If any of them is empty, then accessing the elements in the tensor results in dereferencing a null pointer. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Mihai Maruseac
author_date: 2021-05-05 15:20:14-07:00
msg: Add missing validation to pooling_ops_3d

PiperOrigin-RevId: 372218727
Change-Id: I6b9ed4266aa7286c02f1f230d7bea922c1be547e
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: pooling_ops_3d.cc
change_type: ModificationType.MODIFY
diff: @@ -698,6 +698,19 @@ class MaxPooling3dGradGradOp : public OpKernel {
     OP_REQUIRES_OK(context, context->forward_input_or_allocate_output(
                                 {2}, 0, tensor_out.shape(), &output));
 
+    // Given access patterns in LaunchMaxPooling3dGradGradOp, these tensors must
+    // have elements.
+    OP_REQUIRES(context, tensor_in.NumElements() > 0,
+                errors::InvalidArgument("received empty tensor tensor_in: ",
+                                        tensor_in.DebugString()));
+    OP_REQUIRES(context, tensor_out.NumElements() > 0,
+                errors::InvalidArgument("received empty tensor tensor_out: ",
+                                        tensor_out.DebugString()));
+    OP_REQUIRES(
+        context, out_grad_backprop.NumElements() > 0,
+        errors::InvalidArgument("received empty tensor out_grad_backprop: ",
+                                out_grad_backprop.DebugString()));
+
     LaunchMaxPooling3dGradGradOp<Device, T>::launch(
         context, params, tensor_in, tensor_out, out_grad_backprop, output);
   }

programming_language: C++
CVE-2022-1452 (published 2022-04-24T21:15Z)

Out-of-bounds Read in r_bin_java_bootstrap_methods_attr_new function in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end 2f the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash. More details see [CWE-125: Out-of-bounds read](https://cwe.mitre.org/data/definitions/125.html).

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 7.1, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/radareorg/radare2
commit_details: repo_url: https://github.com/radareorg/radare2
author: pancake
author_date: 2022-04-24 21:15:25+02:00
msg: Fix oobread in java parser ##crash

* Reported by @bet4it via @huntrdev
* BountyID c8f4c2de-7d96-4ad4-857a-c099effca2d6
* Reproducer: bootstrap.class
repository: repo_url: https://github.com/radareorg/radare2
repo_name: radareorg/radare2
description: UNIX-like reverse engineering framework and command-line toolset
repo_language: C
owner: radareorg
file_changes: filename: class.c
change_type: ModificationType.MODIFY
diff: @@ -6933,6 +6933,10 @@ R_API RBinJavaAttrInfo *r_bin_java_bootstrap_methods_attr_new(RBinJavaObj *bin,
 	offset += 6;
 	if (attr) {
 		attr->type = R_BIN_JAVA_ATTR_TYPE_BOOTSTRAP_METHODS_ATTR;
+		if (offset + 8 > sz)  {
+			free (attr);
+			return NULL;
+		}
 		attr->info.bootstrap_methods_attr.num_bootstrap_methods = R_BIN_JAVA_USHORT (buffer, offset);
 		offset += 2;
 		attr->info.bootstrap_methods_attr.bootstrap_methods = r_list_newf (r_bin_java_bootstrap_method_free);

programming_language: C++
CVE-2024-3761 (published 2024-05-20T09:15Z)

In lunary-ai/lunary version 1.2.2, the DELETE endpoint located at `packages/backend/src/api/v1/datasets` is vulnerable to unauthorized dataset deletion due to missing authorization and authentication mechanisms. This vulnerability allows any user, even those without a valid token, to delete a dataset by sending a DELETE request to the endpoint. The issue was fixed in version 1.2.8. The impact of this vulnerability is significant as it permits unauthorized users to delete datasets, potentially leading to data loss or disruption of service.


Weakness information:
cwe_id: CWE-862
cwe_name: Missing Authorization
description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are not applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/lunary-ai/lunary
commit_details: repo_url: https://github.com/lunary-ai/lunary
author: Hugues Chocart
author_date: 2024-04-13 16:27:58-03:00
msg: fix: authorization delete dataset (#204)
repository: repo_url: https://github.com/lunary-ai/lunary
repo_name: lunary-ai/lunary
description: The production toolkit for LLMs. Observability, prompt management and evaluations. 
repo_language: TypeScript
owner: lunary-ai
file_changes: filename: index.ts
change_type: ModificationType.MODIFY
diff: @@ -120,13 +120,18 @@ datasets.patch(
   },
 )
 
-datasets.delete("/:id", async (ctx: Context) => {
-  const { id } = ctx.params
+datasets.delete(
+  "/:id",
+  checkAccess("datasets", "delete"),
+  async (ctx: Context) => {
+    const { id } = ctx.params
+    const { projectId } = ctx.state
 
-  await sql`delete from dataset where id = ${id}`
+    await sql`delete from dataset where id = ${id} and projectId = ${projectId}`
 
-  ctx.status = 200
-})
+    ctx.status = 200
+  },
+)
 
 // Create prompt
 datasets.post(

programming_language: TypeScript
CVE-2020-36633 (published 2022-12-27T13:15Z)

A vulnerability was found in moodle-block_sitenews 1.0. It has been classified as problematic. This affects the function get_content of the file block_sitenews.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 1.1 is able to address this issue. The name of the patch is cd18d8b1afe464ae6626832496f4e070bac4c58f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216879.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/eberhardt/moodle-block_sitenews
commit_details: repo_url: https://github.com/eberhardt/moodle-block_sitenews
author: Martin Gauk
author_date: 2020-01-10 12:52:53+00:00
msg: Add CSRF protection to item number setting
repository: repo_url: https://github.com/eberhardt/moodle-block_sitenews
repo_name: eberhardt/moodle-block_sitenews
description: Display site news in full scale at my startpage. You may find it useful to make it sticky above or below the course overview.
repo_language: PHP
owner: eberhardt
file_changes: filename: block_sitenews.php
change_type: ModificationType.MODIFY
diff: @@ -64,7 +64,7 @@ class block_sitenews extends block_base {
 
         $updatemynumber = optional_param("mynewsitems", -1, PARAM_INT);
         $displaysetting = block_sitenews_get_itemsnumber();
-        if ($updatemynumber >= 0 && $updatemynumber < 11) {
+        if ($updatemynumber >= 0 && $updatemynumber < 11 && confirm_sesskey()) {
             block_sitenews_update_itemsnumber($updatemynumber);
             $displaysetting = $items = $updatemynumber;
         }

programming_language: PHP
filename: renderer.php
change_type: ModificationType.MODIFY
diff: @@ -58,6 +58,7 @@ class block_sitenews_renderer extends plugin_renderer_base {
         $options = range(0,10);
         $options[0] = get_string("preset", "block_sitenews");
         $select = new single_select($url, "mynewsitems", $options, $selected, array());
+        $select->method = 'post';
         $select->set_label(get_string("newsitemsnumber") . ":");
         $output .= $this->output->render($select);
 

programming_language: PHP
CVE-2012-0038 (published 2012-05-17T11:00Z)

Integer overflow in the xfs_acl_from_disk function in fs/xfs/xfs_acl.c in the Linux kernel before 3.1.9 allows local users to cause a denial of service (panic) via a filesystem with a malformed ACL, leading to a heap-based buffer overflow.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Christoph Hellwig
author_date: 2011-11-20 15:35:32+00:00
msg: xfs: validate acl count

This prevents in-memory corruption and possible panics if the on-disk
ACL is badly corrupted.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Ben Myers <bpm@sgi.com>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: xfs_acl.c
change_type: ModificationType.MODIFY
diff: @@ -42,6 +42,8 @@ xfs_acl_from_disk(struct xfs_acl *aclp)
 	int count, i;
 
 	count = be32_to_cpu(aclp->acl_cnt);
+	if (count > XFS_ACL_MAX_ENTRIES)
+		return ERR_PTR(-EFSCORRUPTED);
 
 	acl = posix_acl_alloc(count, GFP_KERNEL);
 	if (!acl)

programming_language: C
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Xi Wang
author_date: 2011-12-12 21:55:52+00:00
msg: xfs: fix acl count validation in xfs_acl_from_disk()

Commit fa8b18ed didn't prevent the integer overflow and possible
memory corruption.  "count" can go negative and bypass the check.

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Ben Myers <bpm@sgi.com>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: xfs_acl.c
change_type: ModificationType.MODIFY
diff: @@ -39,7 +39,7 @@ xfs_acl_from_disk(struct xfs_acl *aclp)
 	struct posix_acl_entry *acl_e;
 	struct posix_acl *acl;
 	struct xfs_acl_entry *ace;
-	int count, i;
+	unsigned int count, i;
 
 	count = be32_to_cpu(aclp->acl_cnt);
 	if (count > XFS_ACL_MAX_ENTRIES)

programming_language: C
CVE-2024-22209 (published 2024-01-13T08:15Z)

Open edX Platform is a service-oriented platform for authoring and delivering online learning. A user with a JWT and more limited scopes could call endpoints exceeding their access. This vulnerability has been patched in commit 019888f.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-284
cwe_name: Improper Access Control
description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
extended_description: 
            Access control involves the use of several protection mechanisms such as:
            
               Authentication (proving the identity of an actor)
               Authorization (ensuring that a given actor can access a resource), and
               Accountability (tracking of activities that were performed)
            
            When any mechanism is not applied or otherwise fails, attackers can compromise the security of the product by gaining privileges, reading sensitive information, executing commands, evading detection, etc.
            There are two distinct behaviors that can introduce access control weaknesses:
               
                  Specification: incorrect privileges, permissions, ownership, etc. are explicitly specified for either the user or the resource (for example, setting a password file to be world-writable, or giving administrator capabilities to a guest user). This action could be performed by the program or the administrator.
                  Enforcement: the mechanism contains errors that prevent it from properly enforcing the specified access control requirements (e.g., allowing the user to specify their own privileges, or allowing a syntactically-incorrect ACL to produce insecure settings). This problem occurs within the program itself, in that it does not actually enforce the intended security policy that the administrator specifies.
               
         
		 

Fix information:
repo_url: https://github.com/openedx/edx-platform
commit_details: repo_url: https://github.com/openedx/edx-platform
author: Feanil Patel
author_date: 2024-01-12 11:26:28-05:00
msg: Merge pull request from GHSA-qx8m-mqx3-j9fm

fix: add `JwtRestrictedApplication` check to XBlock callback
repository: repo_url: https://github.com/openedx/edx-platform
repo_name: openedx/edx-platform
description: The Open edX LMS & Studio, powering education sites around the world!
repo_language: Python
owner: openedx
CVE-2016-7534 (published 2017-04-20T18:59Z)

The generic decoder in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2016-02-07 15:13:08-05:00
msg: https://github.com/ImageMagick/ImageMagick/issues/126
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: quantum-import.c
change_type: ModificationType.MODIFY
diff: @@ -1421,7 +1421,7 @@ static void ImportCbYCrYQuantum(const Image *image,QuantumInfo *quantum_info,
 
           n=0;
           quantum=0;
-          for (x=0; x < (ssize_t) number_pixels; x+=2)
+          for (x=0; x < (ssize_t) number_pixels; x+=4)
           {
             for (i=0; i < 4; i++)
             {

programming_language: C
filename: quantum.c
change_type: ModificationType.MODIFY
diff: @@ -321,6 +321,9 @@ MagickExport size_t GetQuantumExtent(const Image *image,
     case BGRAQuantum: packet_size=4; break;
     case CMYKQuantum: packet_size=4; break;
     case CMYKAQuantum: packet_size=5; break;
+    case CbYCrAQuantum: packet_size=4; break;
+    case CbYCrQuantum: packet_size=3; break;
+    case CbYCrYQuantum: packet_size=4; break;
     default: break;
   }
   extent=MagickMax(image->columns,image->rows);
@@ -872,7 +875,6 @@ MagickExport void SetQuantumPack(QuantumInfo *quantum_info,
   quantum_info->pack=pack;
 }
 
-
 /*
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 %                                                                             %

programming_language: Objective-C
CVE-2020-26285 (published 2021-01-21T14:15Z)

OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to import/export data and to create widget instances was able to inject an executable file on the server. The latest OpenMage Versions up from 19.4.9 and 20.0.5 have this Issue solved

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 7.2, HIGH (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/OpenMage/magento-lts
commit_details: repo_url: https://github.com/OpenMage/magento-lts
author: Mark Lewis
author_date: 2021-01-19 10:19:01-05:00
msg: Merge pull request from GHSA-hj6w-xrv3-wjj9

Security fix for GHSA-hj6w-xrv3-wjj9
repository: repo_url: https://github.com/OpenMage/magento-lts
repo_name: OpenMage/magento-lts
description: Official OpenMage LTS codebase | Migrate easily from Magento Community Edition in minutes! Download the source code for free or contribute to OpenMage LTS | Security vulnerability patches, bug fixes, performance improvements and more.
repo_language: PHP
owner: OpenMage
CVE-2019-20915 (published 2020-07-16T18:15Z)

An issue was discovered in GNU LibreDWG through 0.9.3. Crafted input will lead to a heap-based buffer over-read in bit_write_TF in bits.c.

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 8.1, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/LibreDWG/libredwg
commit_details: repo_url: https://github.com/LibreDWG/libredwg
author: Reini Urban
author_date: 2019-12-31 08:49:07+01:00
msg: encode: protect from stack under-flow

From GH #178 fuzzing
repository: repo_url: https://github.com/LibreDWG/libredwg
repo_name: LibreDWG/libredwg
description: Official mirror of libredwg. With CI hooks and nightly releases. PR's ok
repo_language: C
owner: LibreDWG
file_changes: filename: bits.c
change_type: ModificationType.MODIFY
diff: @@ -883,7 +883,7 @@ bit_write_MC (Bit_Chain *dat, BITCODE_MC val)
     if (byte[i] & 0x7f)
       break;
 
-  if (byte[i] & 0x40)
+  if (byte[i] & 0x40 && i > 0)
     i--;
   byte[i] &= 0x7f;
   if (negative)
@@ -953,7 +953,7 @@ bit_write_UMC (Bit_Chain *dat, BITCODE_UMC val)
     if (byte[i] & 0x7f)
       break;
 
-  if (byte[i] & 0x40)
+  if (byte[i] & 0x40 && i > 0)
     i--;
   byte[i] &= 0x7f;
   for (j = 4; j >= i; j--)

programming_language: C