starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2010-5332 (published 2019-07-27T22:15Z)

In the Linux kernel before 2.6.37, an out of bounds array access happened in drivers/net/mlx4/port.c. When searching for a free entry in either mlx4_register_vlan() or mlx4_register_mac(), and there is no free entry, the loop terminates without updating the local variable free thus causing out of array bounds access.

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 5.6, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Eli Cohen
author_date: 2010-10-25 02:56:47+00:00
msg: mlx4_en: Fix out of bounds array access

When searching for a free entry in either mlx4_register_vlan() or
mlx4_register_mac(), and there is no free entry, the loop terminates without
updating the local variable free thus causing out of array bounds access. Fix
this by adding a proper check outside the loop.

Signed-off-by: Eli Cohen <eli@mellanox.co.il>
Signed-off-by: David S. Miller <davem@davemloft.net>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: port.c
change_type: ModificationType.MODIFY
diff: @@ -111,6 +111,12 @@ int mlx4_register_mac(struct mlx4_dev *dev, u8 port, u64 mac, int *index)
 			goto out;
 		}
 	}
+
+	if (free < 0) {
+		err = -ENOMEM;
+		goto out;
+	}
+
 	mlx4_dbg(dev, "Free MAC index is %d\n", free);
 
 	if (table->total == table->max) {
@@ -205,6 +211,11 @@ int mlx4_register_vlan(struct mlx4_dev *dev, u8 port, u16 vlan, int *index)
 		}
 	}
 
+	if (free < 0) {
+		err = -ENOMEM;
+		goto out;
+	}
+
 	if (table->total == table->max) {
 		/* No free vlan entries */
 		err = -ENOSPC;

programming_language: C
CVE-2020-12658 (published 2020-12-31T01:15Z)

gssproxy (aka gss-proxy) before 0.8.3 does not unlock cond_mutex before pthread exit in gp_worker_main() in gp_workers.c. NOTE: An upstream comment states "We are already on a shutdown path when running the code in question, so a DoS there doesn\'t make any sense, and there has been no additional information provided us (as upstream) to indicate why this would be a problem.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-667
cwe_name: Improper Locking
description: The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
extended_description: 
	   Locking is a type of synchronization behavior that ensures that multiple independently-operating processes or threads do not interfere with each other when accessing the same resource. All processes/threads are expected to follow the same steps for locking. If these steps are not followed precisely - or if no locking is done at all - then another process/thread could modify the shared resource in a way that is not visible or predictable to the original process.  This can lead to data or memory corruption, denial of service, etc.
         

Fix information:
repo_url: https://github.com/gssapi/gssproxy
commit_details: repo_url: https://github.com/gssapi/gssproxy
author: Guiyao
author_date: 2020-03-26 06:33:35+00:00
msg: Unlock cond_mutex before pthread exit in gp_worker_main()

Signed-off-by: GuiYao <guiyao@huawei.com>
[rharwood@redhat.com: whitespace, tweak commit message]
Reviewed-by: Robbie Harwood <rharwood@redhat.com>
repository: repo_url: https://github.com/gssapi/gssproxy
repo_name: gssapi/gssproxy
description: A proxy for GSSAPI | Docs at https://github.com/gssapi/gssproxy/tree/main/docs
repo_language: C
owner: gssapi
file_changes: filename: gp_workers.c
change_type: ModificationType.MODIFY
diff: @@ -369,6 +369,7 @@ static void *gp_worker_main(void *pvt)
             /* wait for next query */
             pthread_cond_wait(&t->cond_wakeup, &t->cond_mutex);
             if (t->pool->shutdown) {
+                pthread_mutex_unlock(&t->cond_mutex);
                 pthread_exit(NULL);
             }
         }

programming_language: C
CVE-2023-4255 (published 2023-12-21T16:15Z)

An out-of-bounds write issue has been discovered in the backspace handling of the checkType() function in etc.c within the W3M application. This vulnerability is triggered by supplying a specially crafted HTML file to the w3m binary. Exploitation of this flaw could lead to application crashes, resulting in a denial of service condition.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/tats/w3m
commit_details: repo_url: https://github.com/tats/w3m
author: Rene Kita
author_date: 2023-07-13 07:50:26+02:00
msg: Fix OOB access due to multiple backspaces

Commit 419ca82d57 (Fix m17n backspace handling causes out-of-bounds
write in checkType) introduced an incomplete fix.

In function checkType we store the length of the previous multi-char
character in a buffer plens_buffer with pointer plens pointing to the
current position inside the buffer. When encountering a backspace plens
is set to the previous position without a bounds check. This will lead
to plens being out of bounds if we get more backspaces than we have
processed multi-char characters before.

If we are at the beginning of the buffer do not decrement and set plen
(the current length) to 0.

This also fixes GH Issue #270 [BUG] Out of bound read in Strnew_size ,
Str.c:61

If the above explanation does sound weird it's because I didn't fully
grok that function. :-)
repository: repo_url: https://github.com/tats/w3m
repo_name: tats/w3m
description: Debian's w3m: WWW browsable pager
repo_language: C
owner: tats
file_changes: filename: etc.c
change_type: ModificationType.MODIFY
diff: @@ -393,7 +393,10 @@ checkType(Str s, Lineprop **oprop, Linecolor **ocolor)
 			    if (color)
 				color -= plen;
 #endif
-			    plen = *(--plens);
+			    if (plens == plens_buffer)
+				plen = 0;
+			    else
+				plen = *(--plens);
 			    str += 2;
 			}
 		    }
@@ -419,7 +422,10 @@ checkType(Str s, Lineprop **oprop, Linecolor **ocolor)
 			    if (color)
 				color -= plen;
 #endif
-			    plen = *(--plens);
+			    if (plens == plens_buffer)
+				plen = 0;
+			    else
+				plen = *(--plens);
 			    str++;
 			}
 #else

programming_language: C
CVE-2023-49208 (published 2023-11-23T18:15Z)

scheme/webauthn.c in Glewlwyd SSO server before 2.7.6 has a possible buffer overflow during FIDO2 credentials validation in webauthn registration.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-120
cwe_name: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
extended_description: A buffer overflow condition exists when a product attempts to put more data in a buffer than it can hold, or when it attempts to put data in a memory area outside of the boundaries of a buffer. The simplest type of error, and the most common cause of buffer overflows, is the "classic" case in which the product copies the buffer without restricting how much is copied. Other variants exist, but the existence of a classic overflow strongly suggests that the programmer is not considering even the most basic of security protections.
         

Fix information:
repo_url: https://github.com/babelouest/glewlwyd
commit_details: repo_url: https://github.com/babelouest/glewlwyd
author: Nicolas Mora
author_date: 2023-11-15 14:33:43-05:00
msg: Check key length before parsing it in FIDO2 attestation registration
repository: repo_url: https://github.com/babelouest/glewlwyd
repo_name: babelouest/glewlwyd
description: Experimental Single Sign On server, OAuth2, Openid Connect, multiple factor authentication with, HOTP/TOTP, FIDO2, TLS Certificates, etc. extensible via plugins
repo_language: C
owner: babelouest
file_changes: filename: webauthn.c
change_type: ModificationType.MODIFY
diff: @@ -2299,13 +2299,13 @@ static json_t * register_new_attestation(struct config_module * config, json_t *
         for (i=0; i<cbor_map_size(cbor_cose); i++) {
           cbor_key = cbor_map_handle(cbor_cose)[i].key;
           cbor_value = cbor_map_handle(cbor_cose)[i].value;
-          if (cbor_isa_negint(cbor_key) && cbor_get_int(cbor_key) == 1 && cbor_isa_bytestring(cbor_value)) {
+          if (cbor_isa_negint(cbor_key) && cbor_get_int(cbor_key) == 1 && cbor_isa_bytestring(cbor_value) && cbor_bytestring_length(cbor_value) <= 256) {
             has_x = 1;
             memcpy(cert_x, cbor_bytestring_handle(cbor_value), cbor_bytestring_length(cbor_value));
             cert_x_len = cbor_bytestring_length(cbor_value);
             g_x.data = cert_x;
             g_x.size = (unsigned int)cbor_bytestring_length(cbor_value);
-          } else if (cbor_isa_negint(cbor_key) && cbor_get_int(cbor_key) == 2 && cbor_isa_bytestring(cbor_value)) {
+          } else if (cbor_isa_negint(cbor_key) && cbor_get_int(cbor_key) == 2 && cbor_isa_bytestring(cbor_value) && cbor_bytestring_length(cbor_value) <= 256) {
             has_y = 1;
             memcpy(cert_y, cbor_bytestring_handle(cbor_value), cbor_bytestring_length(cbor_value));
             cert_y_len = cbor_bytestring_length(cbor_value);

programming_language: C
CVE-2023-23456 (published 2023-01-12T19:15Z)

A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack() in p_tmt.cpp file. The flow allows an attacker to cause a denial of service (abort) via a crafted file.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/upx/upx
commit_details: repo_url: https://github.com/upx/upx
author: John Reiser
author_date: 2022-11-24 10:28:03-08:00
msg: p_tmt: more sanity of input, cleanup MemBuffer usage

https://github.com/upx/upx/issues/632
	modified:   src/p_tmt.cpp
repository: repo_url: https://github.com/upx/upx
repo_name: upx/upx
description: UPX - the Ultimate Packer for eXecutables
repo_language: C++
owner: upx
file_changes: filename: p_tmt.cpp
change_type: ModificationType.MODIFY
diff: @@ -139,7 +139,8 @@ int PackTmt::readFileHeader() {
     unsigned const imagesize = ih.imagesize;
     unsigned const entry = ih.entry;
     unsigned const relocsize = ih.relocsize;
-    if (!imagesize || file_size <= imagesize || file_size <= entry || file_size <= relocsize) {
+    if (imagesize < sizeof(ih) || entry < sizeof(ih) || file_size <= imagesize ||
+        file_size <= entry || file_size <= relocsize) {
         printWarn(getName(), "bad header; imagesize=%#x  entry=%#x  relocsize=%#x", imagesize,
                   entry, relocsize);
         return 0;
@@ -172,7 +173,7 @@ void PackTmt::pack(OutputFile *fo) {
     obuf.allocForCompression(usize + rsize + 128);
 
     MemBuffer mb_wrkmem;
-    mb_wrkmem.alloc(rsize + EXTRA_INFO); // relocations
+    mb_wrkmem.alloc(rsize + EXTRA_INFO + 4); // relocations + original entry point + relocsize
     SPAN_S_VAR(upx_byte, wrkmem, mb_wrkmem);
 
     fi->seek(adam_offset + sizeof(ih), SEEK_SET);
@@ -180,7 +181,7 @@ void PackTmt::pack(OutputFile *fo) {
     fi->readx(wrkmem + 4, rsize);
     const unsigned overlay = file_size - fi->tell();
 
-    if (find_le32(ibuf, 128, get_le32("UPX ")) >= 0)
+    if (find_le32(ibuf, UPX_MIN(128u, usize), get_le32("UPX ")) >= 0)
         throwAlreadyPacked();
     if (rsize == 0)
         throwCantPack("file is already compressed with another packer");

programming_language: C++
CVE-2024-32980 (published 2024-05-08T15:15Z)

Spin is the developer tool for building and running serverless applications powered by WebAssembly. Prior to 2.4.3, some specifically configured Spin applications that use `self` requests without a specified URL authority can be induced to make requests to arbitrary hosts via the `Host` HTTP header. The following conditions need to be met for an application to be vulnerable: 1. The environment Spin is deployed in routes requests to the Spin runtime based on the request URL instead of the `Host` header, and leaves the `Host` header set to its original value; 2. The Spin application\'s component handling the incoming request is configured with an `allow_outbound_hosts` list containing `"self"`; and 3. In reaction to an incoming request, the component makes an outbound request whose URL doesn\'t include the hostname/port. Spin 2.4.3 has been released to fix this issue.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/fermyon/spin
commit_details: repo_url: https://github.com/fermyon/spin
author: Lann
author_date: 2024-05-08 10:05:15-04:00
msg: Merge pull request from GHSA-f3h7-gpjj-wcvh

Stop using untrusted user input for determining outbound request permissions
repository: repo_url: https://github.com/fermyon/spin
repo_name: fermyon/spin
description: Spin is the open source developer tool for building and running serverless applications powered by WebAssembly.
repo_language: Rust
owner: fermyon
CVE-2016-9122 (published 2017-03-28T02:59Z)

go-jose before 1.0.4 suffers from multiple signatures exploitation. The go-jose library supports messages with multiple signatures. However, when validating a signed message the API did not indicate which signature was valid, which could potentially lead to confusion. For example, users of the library might mistakenly read protected header values from an attached signature that was different from the one originally validated.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-284
cwe_name: Improper Access Control
description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
extended_description: 
            Access control involves the use of several protection mechanisms such as:
            
               Authentication (proving the identity of an actor)
               Authorization (ensuring that a given actor can access a resource), and
               Accountability (tracking of activities that were performed)
            
            When any mechanism is not applied or otherwise fails, attackers can compromise the security of the product by gaining privileges, reading sensitive information, executing commands, evading detection, etc.
            There are two distinct behaviors that can introduce access control weaknesses:
               
                  Specification: incorrect privileges, permissions, ownership, etc. are explicitly specified for either the user or the resource (for example, setting a password file to be world-writable, or giving administrator capabilities to a guest user). This action could be performed by the program or the administrator.
                  Enforcement: the mechanism contains errors that prevent it from properly enforcing the specified access control requirements (e.g., allowing the user to specify their own privileges, or allowing a syntactically-incorrect ACL to produce insecure settings). This problem occurs within the program itself, in that it does not actually enforce the intended security policy that the administrator specifies.
               
         
		 

Fix information:
repo_url: https://github.com/square/go-jose
commit_details: repo_url: https://github.com/square/go-jose
author: Cedric Staub
author_date: 2016-09-22 16:24:13-07:00
msg: Merge pull request #111 from square/cs/better-multi

Improve multi-recipient/multi-sig handling
repository: repo_url: https://github.com/square/go-jose
repo_name: square/go-jose
description: An implementation of JOSE standards (JWE, JWS, JWT) in Go
owner: square
CVE-2022-39222 (published 2022-10-06T18:16Z)

Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex instances with public clients (and by extension, clients accepting tokens issued by those Dex instances) are affected by this vulnerability if they are running a version prior to 2.35.0. An attacker can exploit this vulnerability by making a victim navigate to a malicious website and guiding them through the OIDC flow, stealing the OAuth authorization code in the process. The authorization code then can be exchanged by the attacker for a token, gaining access to applications accepting that token. Version 2.35.0 has introduced a fix for this issue. Users are advised to upgrade. There are no known workarounds for this issue.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-862
cwe_name: Missing Authorization
description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are not applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/dexidp/dex
commit_details: repo_url: https://github.com/dexidp/dex
author: Márk Sági-Kazár
author_date: 2022-09-28 16:10:11+02:00
msg: Merge pull request from GHSA-vh7g-p26c-j2cw

Add HMAC protection on /approval endpoint
repository: repo_url: https://github.com/dexidp/dex
repo_name: dexidp/dex
description: OpenID Connect (OIDC) identity and OAuth 2.0 provider with pluggable connectors
repo_language: Go
owner: dexidp
CVE-2023-5686 (published 2023-10-20T17:15Z)

Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/radareorg/radare2
commit_details: repo_url: https://github.com/radareorg/radare2
author: pancake
author_date: 2023-10-19 17:43:43+02:00
msg: Fix oobread in the java disassembler ##asan

* Causes UB when performing analysis, not exploitable
* https://huntr.com/bounties/bbfe1f76-8fa1-4a8c-909d-65b16e970be0/
* Reported by @gandalf4a
repository: repo_url: https://github.com/radareorg/radare2
repo_name: radareorg/radare2
description: UNIX-like reverse engineering framework and command-line toolset
repo_language: C
owner: radareorg
file_changes: filename: code.c
change_type: ModificationType.MODIFY
diff: @@ -206,9 +206,9 @@ R_API int java_print_opcode(RBinJavaObj *obj, ut64 addr, int idx, const ut8 *byt
 	case 0xa6: // if_acmpne
 	case 0xa7: // goto
 	case 0xa8: // jsr
-		if (len > 1) {
-			snprintf (output, outlen, "%s 0x%04"PFMT64x, JAVA_OPS[idx].name,
-					(addr + (short)USHORT (bytes, 1)));
+		if (len > 3) {
+			const short delta = USHORT (bytes, 1);
+			snprintf (output, outlen, "%s 0x%04"PFMT64x, JAVA_OPS[idx].name, addr + delta);
 			output[outlen - 1] = 0;
 			return update_bytes_consumed (JAVA_OPS[idx].size);
 		}

programming_language: C
CVE-2022-1212 (published 2022-04-05T04:15Z)

Use-After-Free in str_escape in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/mruby/mruby
commit_details: repo_url: https://github.com/mruby/mruby
author: Yukihiro "Matz" Matsumoto
author_date: 2022-04-04 12:26:52+09:00
msg: vm.c: create break object before clearing GC arena.

Otherwise it possibly cause use-after-free.
repository: repo_url: https://github.com/mruby/mruby
repo_name: mruby/mruby
description: Lightweight Ruby
repo_language: C
owner: mruby
file_changes: filename: vm.c
change_type: ModificationType.MODIFY
diff: @@ -2268,9 +2268,9 @@ RETRY_TRY_BLOCK:
           }
           if (ci->cci > CINFO_NONE) {
             ci = cipop(mrb);
+            mrb->exc = (struct RObject*)break_new(mrb, RBREAK_TAG_BREAK, proc, v);
             mrb_gc_arena_restore(mrb, ai);
             mrb->c->vmexec = FALSE;
-            mrb->exc = (struct RObject*)break_new(mrb, RBREAK_TAG_BREAK, proc, v);
             mrb->jmp = prev_jmp;
             MRB_THROW(prev_jmp);
           }

programming_language: C