starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2018-11590 (published 2018-05-31T16:29Z)

Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file via an integer overflow during syntax parsing. This was addressed by fixing stack size detection on Linux in jsutils.c.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/espruino/Espruino
commit_details: repo_url: https://github.com/espruino/Espruino
author: Gordon Williams
author_date: 2018-05-21 09:54:07+01:00
msg: Fix stack size detection on Linux (fix #1427)
repository: repo_url: https://github.com/espruino/Espruino
repo_name: espruino/Espruino
description: The Espruino JavaScript interpreter - Official Repo
repo_language: C
owner: espruino
file_changes: filename: ChangeLog
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,7 @@
             Increase jslMatch error buffer size to handle "UNFINISHED TEMPLATE LITERAL" string (#1426)
             nRF5x: Make FlashWrite cope with flash writes > 4k
             Increase max size of native strings on platforms that support it - 16 bit to 32 bit (#1432)
+            Fix stack size detection on Linux (fix #1427)
 
      1v98 : Allow Crypto SHA1 without SHA256/512 (for ESP8266 where flash is scarce)
             Add better docs for the form of Wifi callback functions

programming_language: Markdown
filename: jsutils.c
change_type: ModificationType.MODIFY
diff: @@ -844,7 +844,9 @@ size_t jsuGetFreeStack() {
   char ptr; // this is on the stack
   extern void *STACK_BASE;
   uint32_t count =  (uint32_t)((size_t)STACK_BASE - (size_t)&ptr);
-  return 1000000 - count; // give it 1 megabyte of stack
+  const uint32_t max_stack = 1000000; // give it 1 megabyte of stack
+  if (count>max_stack) return 0;
+  return max_stack - count;
 #else
   // stack depth seems pretty platform-specific :( Default to a value that disables it
   return 1000000; // no stack depth check on this platform

programming_language: C++
CVE-2018-20455 (published 2018-12-25T19:29Z)

In radare2 prior to 3.1.1, the parseOperand function inside libr/asm/p/asm_x86_nz.c may allow attackers to cause a denial of service (application crash via a stack-based buffer overflow) by crafting an input file, a related issue to CVE-2018-20456.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/radare/radare2
commit_details: repo_url: https://github.com/radare/radare2
author: radare
author_date: 2018-12-03 01:46:58+01:00
msg: Fix #12372 and #12373 - Crash in x86 assembler (#12380)

0 ,0,[bP-bL-bP-bL-bL-r-bL-bP-bL-bL-
mov ,0,[ax+Bx-ax+Bx-ax+ax+Bx-ax+Bx--
leA ,0,[bP-bL-bL-bP-bL-bP-bL-60@bL-
leA ,0,[bP-bL-r-bP-bL-bP-bL-60@bL-
mov ,0,[ax+Bx-ax+Bx-ax+ax+Bx-ax+Bx--
repository: repo_url: https://github.com/radare/radare2
repo_name: radareorg/radare2
description: UNIX-like reverse engineering framework and command-line toolset
repo_language: C
owner: radare
file_changes: filename: asm_x86_nz.c
change_type: ModificationType.MODIFY
diff: @@ -4575,14 +4575,17 @@ static int parseOperand(RAsm *a, const char *str, Operand *op, bool isrepop) {
 			if (last_type == TT_SPECIAL) {
 				if (str[pos] == '+' || str[pos] == '-' || str[pos] == ']') {
 					if (reg != X86R_UNDEFINED) {
-						op->regs[reg_index] = reg;
-						op->scale[reg_index] = temp;
+						if (reg_index < 2) {
+							op->regs[reg_index] = reg;
+							op->scale[reg_index] = temp;
+						}
 						++reg_index;
 					} else {
 						op->offset += temp;
-						op->regs[reg_index] = X86R_UNDEFINED;
+						if (reg_index < 2) {
+							op->regs[reg_index] = X86R_UNDEFINED;
+						}
 					}
-
 					temp = 1;
 					reg = X86R_UNDEFINED;
 				} else if (str[pos] == '*') {

programming_language: C++
CVE-2017-8825 (published 2017-05-08T16:29Z)

A null dereference vulnerability has been found in the MIME handling component of LibEtPan before 1.8, as used in MailCore and MailCore 2. A crash can occur in low-level/imf/mailimf.c during a failed parse of a Cc header containing multiple e-mail addresses.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/dinhviethoa/libetpan
commit_details: repo_url: https://github.com/dinhviethoa/libetpan
author: Viet Hoa Dinh
author_date: 2017-05-07 15:58:41-07:00
msg: Fixed crash #274
repository: repo_url: https://github.com/dinhviethoa/libetpan
repo_name: dinhvh/libetpan
description: Mail Framework for C Language
repo_language: C
owner: dinhviethoa
file_changes: filename: mailimf.c
change_type: ModificationType.MODIFY
diff: @@ -3083,6 +3083,7 @@ static int mailimf_group_parse(const char * message, size_t length,
   struct mailimf_group * group;
   int r;
   int res;
+  clist * list;
 
   cur_token = * indx;
 
@@ -3110,6 +3111,17 @@ static int mailimf_group_parse(const char * message, size_t length,
       res = r;
       goto free_display_name;
     }
+    list = clist_new();
+    if (list == NULL) {
+      res = MAILIMF_ERROR_MEMORY;
+      goto free_display_name;
+    }
+    mailbox_list = mailimf_mailbox_list_new(list);
+    if (mailbox_list == NULL) {
+      res = MAILIMF_ERROR_MEMORY;
+      clist_free(list);
+      goto free_display_name;
+    }
     break;
   default:
     res = r;

programming_language: C
CVE-2023-40267 (published 2023-08-11T07:15Z)

GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/gitpython-developers/GitPython
commit_details: repo_url: https://github.com/gitpython-developers/GitPython
author: Sebastian Thiel
author_date: 2023-07-10 19:41:35+02:00
msg: Merge pull request #1609 from Beuc/block-insecure-options-clone-non-multi

Block insecure non-multi options in clone/clone_from
repository: repo_url: https://github.com/gitpython-developers/GitPython
repo_name: gitpython-developers/GitPython
description: GitPython is a python library used to interact with Git repositories.
repo_language: Python
owner: gitpython-developers
CVE-2023-38688 (published 2023-08-04T17:15Z)

twitch-tui provides Twitch chat in a terminal. Prior to version 2.4.1, the connection is not using TLS for communication. In the configuration of the irc connection, the software disables TLS, which makes all communication to Twitch IRC servers unencrypted. As a result, communication, including auth tokens, can be sniffed. Version 2.4.1 has a patch for this issue.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-311
cwe_name: Missing Encryption of Sensitive Data
description: The product does not encrypt sensitive or critical information before storage or transmission.
extended_description: The lack of proper data encryption passes up the guarantees of confidentiality, integrity, and accountability that properly implemented encryption conveys.
         

Fix information:
repo_url: https://github.com/Xithrius/twitch-tui
commit_details: repo_url: https://github.com/Xithrius/twitch-tui
author: kosayoda
author_date: 2023-07-29 12:50:55-07:00
msg: Enable SSL for the Twitch IRC connection.
repository: repo_url: https://github.com/Xithrius/twitch-tui
repo_name: Xithrius/twitch-tui
description: Twitch chat in the terminal.
repo_language: Rust
owner: Xithrius
file_changes: filename: connection.rs
change_type: ModificationType.MODIFY
diff: @@ -19,8 +19,8 @@ async fn create_client_stream(config: CompleteConfig) -> Result<(Client, ClientS
         server: Some(config.twitch.server.clone()),
         channels: vec![format!("#{}", config.twitch.channel)],
         password: config.twitch.token.clone(),
-        port: Some(6667),
-        use_tls: Some(false),
+        port: Some(6697),
+        use_tls: Some(true),
         ping_timeout: Some(10),
         ping_time: Some(10),
         ..Default::default()

programming_language: Rust
CVE-2010-2060 (published 2010-06-08T00:30Z)

The put command functionality in beanstalkd 1.4.5 and earlier allows remote attackers to execute arbitrary Beanstalk commands via the body in a job that is too big, which is not properly handled by the dispatch_cmd function in prot.c.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/kr/beanstalkd
commit_details: repo_url: https://github.com/kr/beanstalkd
author: Keith Rarick
author_date: 2010-05-23 00:13:28-07:00
msg: Discard job body bytes if the job is too big.

Previously, a malicious user could craft a job payload and inject
beanstalk commands without the client application knowing. (An
extra-careful client library could check the size of the job body before
sending the put command, but most libraries do not do this, nor should
they have to.)

Reported by Graham Barr.
repository: repo_url: https://github.com/kr/beanstalkd
repo_name: beanstalkd/beanstalkd
description: Beanstalk is a simple, fast work queue.
repo_language: C
owner: kr
file_changes: filename: check-one.sh
change_type: ModificationType.MODIFY
diff: @@ -34,7 +34,7 @@ if [ ! -x ./beanstalkd ]; then
   exit 2
 fi
 
-start_beanstalkd
+start_beanstalkd '' '-z 10'
 
 # Run the test
 fgrep -v "#" $commands | $nc $server $port > "$tmpf"

programming_language: Shell
filename: prot.c
change_type: ModificationType.MODIFY
diff: @@ -1196,7 +1196,8 @@ dispatch_cmd(conn c)
         if (errno) return reply_msg(c, MSG_BAD_FORMAT);
 
         if (body_size > job_data_size_limit) {
-            return reply_msg(c, MSG_JOB_TOO_BIG);
+            /* throw away the job body and respond with JOB_TOO_BIG */
+            return skip(c, body_size + 2, MSG_JOB_TOO_BIG);
         }
 
         /* don't allow trailing garbage */

programming_language: C
filename: too-big.commands
change_type: ModificationType.ADD
diff: @@ -0,0 +1,3 @@
+put 0 0 0 11
+delete 9999
+quit

programming_language: Batchfile
filename: too-big.expected
change_type: ModificationType.ADD
diff: @@ -0,0 +1 @@
+JOB_TOO_BIG

programming_language: Batchfile
CVE-2016-1000004 (published 2020-02-19T13:15Z)

Insufficient type checks were employed prior to casting input data in SimpleXMLElement_exportNode and simplexml_import_dom. This issue affects HHVM versions prior to 3.9.5, all versions between 3.10.0 and 3.12.3 (inclusive), and all versions between 3.13.0 and 3.14.1 (inclusive).

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-345
cwe_name: Insufficient Verification of Data Authenticity
description: The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/facebook/hhvm
commit_details: repo_url: https://github.com/facebook/hhvm
author: Max Wang
author_date: 2016-07-01 09:09:30-07:00
msg: Type safety in simplexml import routines

Reviewed By: Orvid

Differential Revision: D3447275

fbshipit-source-id: d859c97f9d85c520b0e371cef6dcb19bb2ef7dbf
repository: repo_url: https://github.com/facebook/hhvm
repo_name: facebook/hhvm
description: A virtual machine for executing programs written in Hack.
repo_language: Hack
owner: facebook
file_changes: filename: ext_simplexml.cpp
change_type: ModificationType.MODIFY
diff: @@ -374,7 +374,7 @@ static xmlNodePtr php_sxe_get_first_node(SimpleXMLElement* sxe,
 }
 
 xmlNodePtr SimpleXMLElement_exportNode(const Object& sxe) {
-  assert(sxe->instanceof(SimpleXMLElement_classof()));
+  if (!sxe->instanceof(SimpleXMLElement_classof())) return nullptr;
   auto data = Native::data<SimpleXMLElement>(sxe.get());
   return php_sxe_get_first_node(data, data->nodep());
 }
@@ -1166,9 +1166,15 @@ static const Class* class_from_name(const String& class_name,
   return cls;
 }
 
+const StaticString s_DOMNode("DOMNode");
+
 static Variant HHVM_FUNCTION(simplexml_import_dom,
-  const Object& node,
-  const String& class_name /* = "SimpleXMLElement" */) {
+                             const Object& node,
+                             const String& class_name) {
+  if (!node->instanceof(s_DOMNode)) {
+    raise_warning("Invalid Nodetype to import");
+    return init_null();
+  }
   auto domnode = Native::data<DOMNode>(node);
   xmlNodePtr nodep = domnode->nodep();
 

programming_language: C++
filename: simplexml_null.php
change_type: ModificationType.ADD
diff: @@ -0,0 +1,5 @@
+<?php
+
+$date = date_create_immutable();
+var_dump(dom_import_simplexml($date));
+var_dump(simplexml_import_dom($date));

programming_language: PHP
filename: simplexml_null.php.expectf
change_type: ModificationType.ADD
diff: @@ -0,0 +1,5 @@
+Warning: Invalid Nodetype to import in %s/test/slow/ext_domdocument/simplexml_null.php on line 4
+NULL
+
+Warning: Invalid Nodetype to import in %s/test/slow/ext_domdocument/simplexml_null.php on line 5
+NULL

programming_language: Shell
CVE-2013-4118 (published 2016-10-03T21:59Z)

FreeRDP before 1.1.0-beta1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/FreeRDP/FreeRDP
commit_details: repo_url: https://github.com/FreeRDP/FreeRDP
author: Vic Lee
author_date: 2013-03-05 15:08:03+08:00
msg: security: add a NULL pointer check to fix a server crash.
repository: repo_url: https://github.com/FreeRDP/FreeRDP
repo_name: FreeRDP/FreeRDP
description: FreeRDP is a free remote desktop protocol library and clients
repo_language: C
owner: FreeRDP
file_changes: filename: rdp.c
change_type: ModificationType.MODIFY
diff: @@ -717,7 +717,8 @@ BOOL rdp_decrypt(rdpRdp* rdp, STREAM* s, int length, UINT16 securityFlags)
 
 	stream_read(s, wmac, sizeof(wmac));
 	length -= sizeof(wmac);
-	security_decrypt(s->p, length, rdp);
+	if (!security_decrypt(s->p, length, rdp))
+		return FALSE;
 
 	if (securityFlags & SEC_SECURE_CHECKSUM)
 		security_salted_mac_signature(rdp, s->p, length, FALSE, cmac);

programming_language: C
filename: security.c
change_type: ModificationType.MODIFY
diff: @@ -492,6 +492,8 @@ BOOL security_encrypt(BYTE* data, int length, rdpRdp* rdp)
 
 BOOL security_decrypt(BYTE* data, int length, rdpRdp* rdp)
 {
+	if (rdp->rc4_decrypt_key == NULL)
+		return FALSE;
 	if (rdp->decrypt_use_count >= 4096)
 	{
 		security_key_update(rdp->decrypt_key, rdp->decrypt_update_key, rdp->rc4_key_len);

programming_language: C
CVE-2023-0433 (published 2023-01-21T15:15Z)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1225.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-122
cwe_name: Heap-based Buffer Overflow
description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Bram Moolenaar
author_date: 2023-01-21 13:09:19+00:00
msg: patch 9.0.1225: reading past the end of a line when formatting text

Problem:    Reading past the end of a line when formatting text.
Solution:   Check for not going over the end of the line.
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: textformat.c
change_type: ModificationType.MODIFY
diff: @@ -540,6 +540,9 @@ same_leader(
     if (leader1_len == 0)
 	return (leader2_len == 0);
 
+    char_u  *lnum_line = NULL;
+    int	    line_len = 0;
+
     // If first leader has 'f' flag, the lines can be joined only if the
     // second line does not have a leader.
     // If first leader has 'e' flag, the lines can never be joined.
@@ -555,7 +558,12 @@ same_leader(
 		return FALSE;
 	    if (*p == COM_START)
 	    {
-		if (*(ml_get(lnum) + leader1_len) == NUL)
+		if (lnum_line == NULL)
+		{
+		    lnum_line = ml_get(lnum);
+		    line_len = (int)STRLEN(lnum_line);
+		}
+		if (line_len <= leader1_len)
 		    return FALSE;
 		if (leader2_flags == NULL || leader2_len == 0)
 		    return FALSE;

programming_language: C++
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -695,6 +695,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1225,
 /**/
     1224,
 /**/

programming_language: Ruby
CVE-2012-1910 (published 2012-08-06T16:55Z)

Bitcoin-Qt 0.5.0.x before 0.5.0.5; 0.5.1.x, 0.5.2.x, and 0.5.3.x before 0.5.3.1; and 0.6.x before 0.6.0rc4 on Windows does not use MinGW multithread-safe exception handling, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted Bitcoin protocol messages.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/bitcoin/bitcoin
commit_details: repo_url: https://github.com/bitcoin/bitcoin
author: Matt Corallo
author_date: 2012-03-15 22:55:12-04:00
msg: Fix Win32 RPC Crashes.
repository: repo_url: https://github.com/bitcoin/bitcoin
repo_name: bitcoin/bitcoin
description: Bitcoin Core integration/staging tree
repo_language: C++
owner: bitcoin
file_changes: filename: bitcoin-qt.pro
change_type: ModificationType.MODIFY
diff: @@ -291,8 +291,8 @@ isEmpty(BOOST_INCLUDE_PATH) {
     macx:BOOST_INCLUDE_PATH = /opt/local/include
 }
 
-windows:LIBS += -lws2_32 -lshlwapi
-windows:DEFINES += WIN32
+windows:LIBS += -lmingwthrd -lws2_32 -lshlwapi
+windows:DEFINES += _MT WIN32
 windows:RC_FILE = src/qt/res/bitcoin-qt.rc
 
 !windows:!mac {

programming_language: Shell
filename: qt-win32.yml
change_type: ModificationType.MODIFY
diff: @@ -47,6 +47,7 @@ script: |
   cp -a bin $SRCDIR/
   cd $INSTDIR
   find . -name *.prl | xargs -l sed 's|/$||' -i
+  sed 's/QMAKE_LIBS_QT_ENTRY     = -lmingw32 -lqtmain/QMAKE_LIBS_QT_ENTRY     = -lqtmain/' -i mkspecs/unsupported/win32-g++-cross/qmake.conf
   #sed 's|QMAKE_PRL_LIBS.*|QMAKE_PRL_LIBS = -lQtDeclarative -lQtScript -lQtSvg -lQtSql -lQtXmlPatterns -lQtGui -lgdi32 -lcomdlg32 -loleaut32 -limm32 -lwinmm -lwinspool -lmsimg32 -lQtNetwork -lQtCore -lole32 -luuid -lws2_32 -ladvapi32 -lshell32 -luser32 -lkernel32|' -i imports/Qt/labs/particles/qmlparticlesplugin.prl
 
   # as zip stores file timestamps, use faketime to intercept stat calls to set dates for all files to reference date

programming_language: Shell