starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2015-10030 (published 2023-01-08T10:15Z)

A vulnerability has been found in SUKOHI Surpass and classified as critical. This vulnerability affects unknown code of the file src/Sukohi/Surpass/Surpass.php. The manipulation of the argument dir leads to pathname traversal. Upgrading to version 1.0.0 is able to address this issue. The patch is identified as d22337d453a2a14194cdb02bf12cdf9d9f827aa7. It is recommended to upgrade the affected component. VDB-217642 is the identifier assigned to this vulnerability.

CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/SUKOHI/Surpass
commit_details: repo_url: https://github.com/SUKOHI/Surpass
author: sukohi
author_date: 2015-04-09 03:13:28+09:00
msg: Some code added to protect from directory traversal attack.
repository: repo_url: https://github.com/SUKOHI/Surpass
repo_name: SUKOHI/Surpass
description: A PHP package mainly developed for Laravel to manage uploading images using Ajax and displaying thumbnail.
repo_language: PHP
owner: SUKOHI
file_changes: filename: README.md
change_type: ModificationType.MODIFY
diff: @@ -85,6 +85,9 @@ Usage
 		'surpass' => $surpass
 			
 	]);
+	
+	
+*Note: method dir('dir_name') can no longer receive "/" and "." to protect from directory traversal attack.
 
 **Upload  (in View)**
 

programming_language: PHP
filename: Surpass.php
change_type: ModificationType.MODIFY
diff: @@ -50,7 +50,7 @@ class Surpass {
 
     public function dir($dir) {
 
-        $this->_dir = $dir;
+        $this->_dir = str_replace(["\0", '/', '.'], '', $dir);
         $this->_id_hidden_name = self::ID_HIDDEN_NAME .'_'. $dir;
         return $this;
 

programming_language: PHP
CVE-2022-24752 (published 2022-03-15T15:15Z)

SyliusGridBundle is a package of generic data grids for Symfony applications. Prior to versions 1.10.1 and 1.11-rc2, values added at the end of query sorting were passed directly to the database. The maintainers do not know if this could lead to direct SQL injections but took steps to remediate the vulnerability. The issue is fixed in versions 1.10.1 and 1.11-rc2. As a workaround, overwrite the`Sylius\\Component\\Grid\\Sorting\\Sorter.php` class and register it in the container. More information about this workaround is available in the GitHub Security Advisory.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/Sylius/SyliusGridBundle
commit_details: repo_url: https://github.com/Sylius/SyliusGridBundle
author: Łukasz Chruściel
author_date: 2022-03-14 15:40:46+01:00
msg: bug #222 [Security] Dql injection through sorting parameters blocked (TheMilek)

This PR was merged into the 1.10 branch.

Discussion
----------



Commits
-------

b702009975bcf8dd869bb6f5e619ea93c454f48b Dql injection through sorting parameters blocked
repository: repo_url: https://github.com/Sylius/SyliusGridBundle
repo_name: Sylius/SyliusGridBundle
description: Generic data grids for Symfony applications, support Doctrine and custom drivers, sorting, filtering, actions and field types.
repo_language: PHP
owner: Sylius
CVE-2022-41417 (published 2023-01-18T14:15Z)

BlogEngine.NET v3.3.8.0 allows an attacker to create any folder with "files" prefix under ~/App_Data/.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-862
cwe_name: Missing Authorization
description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are not applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/BlogEngine/BlogEngine.NET
commit_details: repo_url: https://github.com/BlogEngine/BlogEngine.NET
author: rxtur
author_date: 2022-05-05 22:09:29-05:00
msg: Merge pull request #247 from 0xLanks/fix-security-issues

Fixed security issues
repository: repo_url: https://github.com/BlogEngine/BlogEngine.NET
repo_name: BlogEngine/BlogEngine.NET
description: Multi-User ASP.NET Blogging Application
repo_language: C#
owner: BlogEngine
CVE-2019-11932 (published 2019-10-03T22:15Z)

A double free vulnerability in the DDGifSlurp function in decoding.c in the android-gif-drawable library before version 1.2.18, as used in WhatsApp for Android before version 2.19.244 and many other Android applications, allows remote attackers to execute arbitrary code or cause a denial of service when the library is used to parse a specially crafted GIF image.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-415
cwe_name: Double Free
description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
extended_description: When a program calls free() twice with the same argument, the program's memory management data structures become corrupted. This corruption can cause the program to crash or, in some circumstances, cause two later calls to malloc() to return the same pointer. If malloc() returns the same value twice and the program later gives the attacker control over the data that is written into this doubly-allocated memory, the program becomes vulnerable to a buffer overflow attack.
         

Fix information:
repo_url: https://github.com/koral--/android-gif-drawable
commit_details: repo_url: https://github.com/koral--/android-gif-drawable
author: Oleg Sukhodolskii
author_date: 2019-08-10 00:03:08-07:00
msg: Do not realloc array if new raster size is 0.

if realloc() is called with 0 size it may return NULL and this will be incorrectly handled
as not enough memory and (also) rasterBits will be freed by realloc but we will not update
it.
repository: repo_url: https://github.com/koral--/android-gif-drawable
repo_name: koral--/android-gif-drawable
description: Views and Drawable for displaying animated GIFs on Android
repo_language: Java
owner: koral--
file_changes: filename: decoding.c
change_type: ModificationType.MODIFY
diff: @@ -56,9 +56,15 @@ void DDGifSlurp(GifInfo *info, bool decode, bool exitAfterFrame) {
 				}
 
 				if (decode) {
-					int_fast32_t widthOverflow = gifFilePtr->Image.Width - info->originalWidth;
-					int_fast32_t heightOverflow = gifFilePtr->Image.Height - info->originalHeight;
 					const uint_fast32_t newRasterSize = gifFilePtr->Image.Width * gifFilePtr->Image.Height;
+					if (newRasterSize == 0) {
+						free(info->rasterBits);
+						info->rasterBits = NULL;
+						info->rasterSize = newRasterSize;
+						return;
+					}
+					const int_fast32_t widthOverflow = gifFilePtr->Image.Width - info->originalWidth;
+					const int_fast32_t heightOverflow = gifFilePtr->Image.Height - info->originalHeight;
 					if (newRasterSize > info->rasterSize || widthOverflow > 0 || heightOverflow > 0) {
 						void *tmpRasterBits = reallocarray(info->rasterBits, newRasterSize, sizeof(GifPixelType));
 						if (tmpRasterBits == NULL) {

programming_language: C
CVE-2020-23932 (published 2021-04-21T18:15Z)

An issue was discovered in gpac before 1.0.1. A NULL pointer dereference exists in the function dump_isom_sdp located in filedump.c. It allows an attacker to cause Denial of Service.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2020-09-01 17:05:02+02:00
msg: fixed #1566
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: filedump.c
change_type: ModificationType.MODIFY
diff: @@ -1624,7 +1624,8 @@ void dump_isom_sdp(GF_ISOFile *file, char *inName, Bool is_final_name)
 	}
 	//get the movie SDP
 	gf_isom_sdp_get(file, &sdp, &size);
-	fprintf(dump, "%s", sdp);
+	if (sdp && size)
+		fprintf(dump, "%s", sdp);
 	fprintf(dump, "\r\n");
 
 	//then tracks

programming_language: C
CVE-2022-39237 (published 2022-10-06T18:16Z)

syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. A patch is available in version >= v2.8.1 of the module. Users are encouraged to upgrade. Users unable to upgrade may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-327
cwe_name: Use of a Broken or Risky Cryptographic Algorithm
description: The product uses a broken or risky cryptographic algorithm or protocol.
extended_description: 
	   Cryptographic algorithms are the methods by which data is scrambled to prevent observation or influence by unauthorized actors. Insecure cryptography can be exploited to expose sensitive information, modify data in unexpected ways, spoof identities of other users or devices, or other impacts.
           It is very difficult to produce a secure algorithm, and even high-profile algorithms by accomplished cryptographic experts have been broken. Well-known techniques exist to break or weaken various kinds of cryptography. Accordingly, there are a small number of well-understood and heavily studied algorithms that should be used by most products. Using a non-standard or known-insecure algorithm is dangerous because a determined adversary may be able to break the algorithm and compromise whatever data has been protected.
           Since the state of cryptography advances so rapidly, it is common for an algorithm to be considered "unsafe" even if it was once thought to be strong. This can happen when new attacks are discovered, or if computing power increases so much that the cryptographic algorithm no longer provides the amount of protection that was originally thought.
	   For a number of reasons, this weakness is even more challenging to manage with hardware deployment of cryptographic algorithms as opposed to software implementation. First, if a flaw is discovered with hardware-implemented cryptography, the flaw cannot be fixed in most cases without a recall of the product, because hardware is not easily replaceable like software. Second, because the hardware product is expected to work for years, the adversary's computing power will only increase over time.
	 
         

Fix information:
repo_url: https://github.com/sylabs/sif
commit_details: repo_url: https://github.com/sylabs/sif
author: Adam Hughes
author_date: 2022-10-06 07:52:14-04:00
msg: Merge pull request from GHSA-m5m3-46gj-wch8

Improve Digital Signature Hash Algorithm Validation
repository: repo_url: https://github.com/sylabs/sif
repo_name: sylabs/sif
description: Singularity Image Format (SIF) reference implementation.
repo_language: Go
owner: sylabs
CVE-2017-12427 (published 2017-08-04T09:29Z)

The ProcessMSLScript function in coders/msl.c in ImageMagick before 6.9.9-5 and 7.x before 7.0.6-5 allows remote attackers to cause a denial of service (memory leak) via a crafted file, related to the WriteMSLImage function.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-772
cwe_name: Missing Release of Resource after Effective Lifetime
description: The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
extended_description: When a resource is not released after use, it can allow attackers to cause a denial of service by causing the allocation of resources without triggering their release. Frequently-affected resources include memory, CPU, disk space, power or battery, etc.
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2017-08-01 07:05:17-04:00
msg: https://github.com/ImageMagick/ImageMagick/issues/636
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: ChangeLog
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,7 @@
+2017-07-01  7.0.6-5 Cristy  <quetzlzacatenango@image...>
+  * Fixed numerous memory leaks (reference
+    https://github.com/ImageMagick/ImageMagick/issues).
+
 2017-07-29  7.0.6-5 Glenn Randers-Pehrson <glennrp@image...>
   * Properly set image->colorspace in the PNG decoder (previously
     it was setting image->gamma, but only setting image->colorspace

programming_language: Markdown
filename: msl.c
change_type: ModificationType.MODIFY
diff: @@ -7899,12 +7899,25 @@ static MagickBooleanType ProcessMSLScript(const ImageInfo *image_info,
   }
   if (msl_info.exception->severity == UndefinedException)
     (void) xmlParseChunk(msl_info.parser," ",1,MagickTrue);
+  /*
+    Free resources.
+  */
   xmlFreeParserCtxt(msl_info.parser);
   (void) LogMagickEvent(CoderEvent,GetMagickModule(),"end SAX");
   msl_info.group_info=(MSLGroupInfo *) RelinquishMagickMemory(
     msl_info.group_info);
   if (*image == (Image *) NULL)
     *image=(*msl_info.image);
+  *msl_info.image_info=DestroyImageInfo(*msl_info.image_info);
+  msl_info.image_info=(ImageInfo **) RelinquishMagickMemory(
+    msl_info.image_info);
+  *msl_info.draw_info=DestroyDrawInfo(*msl_info.draw_info);
+  msl_info.draw_info=(DrawInfo **) RelinquishMagickMemory(msl_info.draw_info);
+  msl_info.image=(Image **) RelinquishMagickMemory(msl_info.image);
+  *msl_info.attributes=DestroyImage(*msl_info.attributes);
+  msl_info.attributes=(Image **) RelinquishMagickMemory(msl_info.attributes);
+  msl_info.group_info=(MSLGroupInfo *) RelinquishMagickMemory(
+    msl_info.group_info);
   if (msl_info.exception->severity != UndefinedException)
     return(MagickFalse);
   return(MagickTrue);

programming_language: C++
CVE-2021-21335 (published 2021-03-08T21:15Z)

In the SPNEGO HTTP Authentication Module for nginx (spnego-http-auth-nginx-module) before version 1.1.1 basic Authentication can be bypassed using a malformed username. This affects users of spnego-http-auth-nginx-module that have enabled basic authentication. This is fixed in version 1.1.1 of spnego-http-auth-nginx-module. As a workaround, one may disable basic authentication.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/stnoonan/spnego-http-auth-nginx-module
commit_details: repo_url: https://github.com/stnoonan/spnego-http-auth-nginx-module
author: Sean Timothy Noonan
author_date: 2021-02-26 10:31:41+00:00
msg: Check basic auth result against != NGX_OK rather than == NGX_DECLINED

This corrects the error handling case when ngx_http_auth_spnego_basic is called with a bad configuration or bad username. These cases return NGX_ERROR, which allowed basic auth to proceed.

Thanks to Prakapovich Pavel aka Flyguy.by for pointing this out.
repository: repo_url: https://github.com/stnoonan/spnego-http-auth-nginx-module
repo_name: stnoonan/spnego-http-auth-nginx-module
description: SPNEGO HTTP Authentication Module for nginx
repo_language: C
owner: stnoonan
file_changes: filename: ngx_http_auth_spnego_module.c
change_type: ModificationType.MODIFY
diff: @@ -1043,7 +1043,7 @@ ngx_http_auth_spnego_handler(
             /* If basic auth is enabled and basic creds are supplied
              * attempt basic auth.  If we attempt basic auth, we do
              * not fall through to real SPNEGO */
-            if (NGX_DECLINED == ngx_http_auth_spnego_basic(r, ctx, alcf)) {
+            if (NGX_OK != ngx_http_auth_spnego_basic(r, ctx, alcf)) {
                 spnego_debug0("Basic auth failed");
                 if (NGX_ERROR == ngx_http_auth_spnego_headers_basic_only(r, ctx, alcf)) {
                     spnego_debug0("Error setting headers");

programming_language: C
CVE-2019-13302 (published 2019-07-05T01:15Z)

ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read in MagickCore/fourier.c in ComplexImages.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2019-06-17 09:13:34-04:00
msg: https://github.com/ImageMagick/ImageMagick/issues/1597
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: fourier.c
change_type: ModificationType.MODIFY
diff: @@ -164,6 +164,9 @@ MagickExport Image *ComplexImages(const Image *images,const ComplexOperator op,
   MagickOffsetType
     progress;
 
+  size_t
+    number_channels;
+
   ssize_t
     y;
 
@@ -216,6 +219,10 @@ MagickExport Image *ComplexImages(const Image *images,const ComplexOperator op,
     }
   Cr_image=complex_images;
   Ci_image=complex_images->next;
+  number_channels=MagickMin(MagickMin(MagickMin(
+    Ar_image->number_channels,Ai_image->number_channels),MagickMin(
+    Br_image->number_channels,Bi_image->number_channels)),MagickMin(
+    Cr_image->number_channels,Ci_image->number_channels));
   Ar_view=AcquireVirtualCacheView(Ar_image,exception);
   Ai_view=AcquireVirtualCacheView(Ai_image,exception);
   Br_view=AcquireVirtualCacheView(Br_image,exception);
@@ -263,7 +270,7 @@ MagickExport Image *ComplexImages(const Image *images,const ComplexOperator op,
       register ssize_t
         i;
 
-      for (i=0; i < (ssize_t) GetPixelChannels(Cr_image); i++)
+      for (i=0; i < (ssize_t) number_channels; i++)
       {
         switch (op)
         {

programming_language: Objective-C