starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2015-20110 (published 2023-10-31T03:15Z)

JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing. This of course drastically reduces the search space to a linear amount of guesses based on the token length times the possible characters.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-307
cwe_name: Improper Restriction of Excessive Authentication Attempts
description: The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/jhipster/generator-jhipster
commit_details: repo_url: https://github.com/jhipster/generator-jhipster
author: Julien Dubois
author_date: 2015-10-16 14:55:19+02:00
msg: Merge pull request #2096 from maklemenz/tokenprovider-timingattack

fixed timing attack vulnerability in TokenProvider
repository: repo_url: https://github.com/jhipster/generator-jhipster
repo_name: jhipster/generator-jhipster
description: JHipster is a development platform to quickly generate, develop, & deploy modern web applications & microservice architectures.
repo_language: TypeScript
owner: jhipster
repo_url: https://github.com/jhipster/generator-jhipster
commit_details: repo_url: https://github.com/jhipster/generator-jhipster
author: Marcel Klemenz
author_date: 2015-10-06 18:06:09+02:00
msg: fixed timing attack vulnerability in TokenProvider #2095
repository: repo_url: https://github.com/jhipster/generator-jhipster
repo_name: jhipster/generator-jhipster
description: JHipster is a development platform to quickly generate, develop, & deploy modern web applications & microservice architectures.
repo_language: TypeScript
owner: jhipster
file_changes: filename: _TokenProvider.java
change_type: ModificationType.MODIFY
diff: @@ -51,6 +51,23 @@ public class TokenProvider {
         long expires = Long.parseLong(parts[1]);
         String signature = parts[2];
         String signatureToMatch = computeSignature(userDetails, expires);
-        return expires >= System.currentTimeMillis() && signature.equals(signatureToMatch);
+        return expires >= System.currentTimeMillis() && constantTimeEquals(signature, signatureToMatch));
     }
+
+    /**
+     * String comparison that doesn't stop at the first character that is different but instead always
+     * iterates the whole string length to prevent timing attacks.
+     */
+    private boolean constantTimeEquals(String a, String b) {
+        if (a.length() != b.length()) {
+            return false;
+        } else {
+            int equal = 0;
+            for (int i = 0; i < a.length(); i++) {
+                equal |= a.charAt(i) ^ b.charAt(i);
+            }
+            return equal == 0;
+        }
+    }
+
 }

programming_language: Java
CVE-2023-28772 (published 2023-03-23T15:15Z)

An issue was discovered in the Linux kernel before 5.13.3. lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow.

CVSS v3 base score: 6.7, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-120
cwe_name: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
extended_description: A buffer overflow condition exists when a product attempts to put more data in a buffer than it can hold, or when it attempts to put data in a memory area outside of the boundaries of a buffer. The simplest type of error, and the most common cause of buffer overflows, is the "classic" case in which the product copies the buffer without restricting how much is copied. Other variants exist, but the existence of a classic overflow strongly suggests that the programmer is not considering even the most basic of security protections.
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Yun Zhou
author_date: 2021-06-26 11:21:55+08:00
msg: seq_buf: Fix overflow in seq_buf_putmem_hex()

There's two variables being increased in that loop (i and j), and i
follows the raw data, and j follows what is being written into the buffer.
We should compare 'i' to MAX_MEMHEX_BYTES or compare 'j' to HEX_CHARS.
Otherwise, if 'j' goes bigger than HEX_CHARS, it will overflow the
destination buffer.

Link: https://lore.kernel.org/lkml/20210625122453.5e2fe304@oasis.local.home/
Link: https://lkml.kernel.org/r/20210626032156.47889-1-yun.zhou@windriver.com

Cc: stable@vger.kernel.org
Fixes: 5e3ca0ec76fce ("ftrace: introduce the "hex" output method")
Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: seq_buf.c
change_type: ModificationType.MODIFY
diff: @@ -229,8 +229,10 @@ int seq_buf_putmem_hex(struct seq_buf *s, const void *mem,
 
 	WARN_ON(s->size == 0);
 
+	BUILD_BUG_ON(MAX_MEMHEX_BYTES * 2 >= HEX_CHARS);
+
 	while (len) {
-		start_len = min(len, HEX_CHARS - 1);
+		start_len = min(len, MAX_MEMHEX_BYTES);
 #ifdef __BIG_ENDIAN
 		for (i = 0, j = 0; i < start_len; i++) {
 #else

programming_language: C
CVE-2022-1934 (published 2022-05-31T03:15Z)

Use After Free in GitHub repository mruby/mruby prior to 3.2.

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/mruby/mruby
commit_details: repo_url: https://github.com/mruby/mruby
author: Yukihiro "Matz" Matsumoto
author_date: 2022-05-30 01:18:15+09:00
msg: vm.c (hash_new_from_regs): stack may be reallocated.
repository: repo_url: https://github.com/mruby/mruby
repo_name: mruby/mruby
description: Lightweight Ruby
repo_language: C
owner: mruby
file_changes: filename: vm.c
change_type: ModificationType.MODIFY
diff: @@ -1159,18 +1159,20 @@ check_target_class(mrb_state *mrb)
   return target;
 }
 
+#define regs (mrb->c->ci->stack)
+
 static mrb_value
-hash_new_from_values(mrb_state *mrb, mrb_int argc, mrb_value *regs)
+hash_new_from_regs(mrb_state *mrb, mrb_int argc, mrb_int idx)
 {
   mrb_value hash = mrb_hash_new_capa(mrb, argc);
   while (argc--) {
-    mrb_hash_set(mrb, hash, regs[0], regs[1]);
-    regs += 2;
+    mrb_hash_set(mrb, hash, regs[idx+0], regs[idx+1]);
+    idx += 2;
   }
   return hash;
 }
 
-#define ARGUMENT_NORMALIZE(arg_base, arg_info, insn) do { \
+#define ARGUMENT_NORMALIZE(arg_base, arg_info, insn) do {       \
   int n = *(arg_info)&0xf; \
   int nk = (*(arg_info)>>4)&0xf; \
   mrb_int bidx = (arg_base) + mrb_bidx(*(arg_info)); \
@@ -1179,7 +1181,7 @@ hash_new_from_values(mrb_state *mrb, mrb_int argc, mrb_value *regs)
   } \
   else if (nk > 0) {  /* pack keyword arguments */ \
     mrb_int kidx = (arg_base)+(n==CALL_MAXARGS?1:n)+1; \
-    mrb_value kdict = hash_new_from_values(mrb, nk, regs+kidx); \
+    mrb_value kdict = hash_new_from_regs(mrb, nk, kidx); \
     regs[kidx] = kdict; \
     nk = CALL_MAXARGS; \
     *(arg_info) = n | (nk<<4); \
@@ -1242,7 +1244,6 @@ RETRY_TRY_BLOCK:
   mrb->jmp = &c_jmp;
   mrb_vm_ci_proc_set(mrb->c->ci, proc);
 
-#define regs (mrb->c->ci->stack)
   INIT_DISPATCH {
     CASE(OP_NOP, Z) {
       /* do nothing */

programming_language: C
CVE-2019-20016 (published 2019-12-27T02:15Z)

libmysofa before 2019-11-24 does not properly restrict recursive function calls, as demonstrated by reports of stack consumption in readOHDRHeaderMessageDatatype in dataobject.c and directblockRead in fractalhead.c. NOTE: a download of v0.9 after 2019-12-06 should fully remediate this issue.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/hoene/libmysofa
commit_details: repo_url: https://github.com/hoene/libmysofa
author: Christian Hoene
author_date: 2019-11-24 10:42:37+01:00
msg: Fixed recursive function calls
repository: repo_url: https://github.com/hoene/libmysofa
repo_name: hoene/libmysofa
description: Reader for AES SOFA files to get better HRTFs
repo_language: C
owner: hoene
file_changes: filename: fractalhead.c
change_type: ModificationType.MODIFY
diff: @@ -33,12 +33,17 @@ static int directblockRead(struct READER *reader, struct DATAOBJECT *dataobject,
 	UNUSED(block_size);
 	UNUSED(block_offset);
 
+	if(reader->recursive_counter >= 10)
+		return MYSOFA_INVALID_FORMAT;
+	else
+		reader->recursive_counter++;
+
 	/* read signature */
 	if (fread(buf, 1, 4, reader->fhd) != 4 || strncmp(buf, "FHDB", 4)) {
 		log("cannot read signature of fractal heap indirect block\n");
 		return MYSOFA_INVALID_FORMAT;
 	}
-	log("%08" PRIX64 " %.4s\n", (uint64_t )ftell(reader->fhd) - 4, buf);
+	log("%08" PRIX64 " %.4s stack %d\n", (uint64_t )ftell(reader->fhd) - 4, buf, reader->recursive_counter);
 
 	if (fgetc(reader->fhd) != 0) {
 		log("object FHDB must have version 0\n");
@@ -218,6 +223,7 @@ static int directblockRead(struct READER *reader, struct DATAOBJECT *dataobject,
 
 	} while (typeandversion != 0);
 
+	reader->recursive_counter--;
 	return MYSOFA_OK;
 }
 

programming_language: C
filename: reader.h
change_type: ModificationType.MODIFY
diff: @@ -182,6 +182,8 @@ struct READER {
 	struct SUPERBLOCK superblock;
 
 	struct GCOL *gcol;
+
+	int recursive_counter;
 };
 
 int validAddress(struct READER *reader, uint64_t address);

programming_language: C
filename: reader.c
change_type: ModificationType.MODIFY
diff: @@ -244,6 +244,7 @@ MYSOFA_EXPORT struct MYSOFA_HRTF* mysofa_load(const char *filename, int *err) {
 	}
 	reader.gcol = NULL;
 	reader.all = NULL;
+	reader.recursive_counter = 0;
 
 	*err = superblockRead(&reader, &reader.superblock);
 

programming_language: C
CVE-2022-28085 (published 2022-04-27T03:15Z)

A flaw was found in htmldoc commit 31f7804. A heap buffer overflow in the function pdf_write_names in ps-pdf.cxx may lead to arbitrary code execution and Denial of Service (DoS).

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/michaelrsweet/htmldoc
commit_details: repo_url: https://github.com/michaelrsweet/htmldoc
author: Michael R Sweet
author_date: 2022-03-24 16:30:07-04:00
msg: Call check_pages when writing links (Issue #480)
repository: repo_url: https://github.com/michaelrsweet/htmldoc
repo_name: michaelrsweet/htmldoc
description: HTML Conversion Software
repo_language: C++
owner: michaelrsweet
file_changes: filename: ps-pdf.cxx
change_type: ModificationType.MODIFY
diff: @@ -3585,6 +3585,8 @@ pdf_write_names(FILE *out)		/* I - Output file */
     pdf_start_object(out);
     float x, y;
 
+    check_pages(link->page);
+
     x = 0.0f;
     y = link->top + pages[link->page].bottom;
     pspdf_transform_coords(pages + link->page, x, y);

programming_language: C
CVE-2022-47941 (published 2022-12-23T16:15Z)

An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2pdu.c omits a kfree call in certain smb2_handle_negotiate error conditions, aka a memory leak.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-401
cwe_name: Missing Release of Memory after Effective Lifetime
description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
extended_description: This is often triggered by improper handling of malformed data or unexpectedly interrupted sessions.  In some languages, developers are responsible for tracking memory allocation and releasing the memory.  If there are no more pointers or references to the memory, then it can no longer be tracked and identified for release.
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Namjae Jeon
author_date: 2022-07-28 21:56:19+09:00
msg: ksmbd: fix memory leak in smb2_handle_negotiate

The allocated memory didn't free under an error
path in smb2_handle_negotiate().

Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-17815
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: smb2pdu.c
change_type: ModificationType.MODIFY
diff: @@ -1142,12 +1142,16 @@ int smb2_handle_negotiate(struct ksmbd_work *work)
 			       status);
 			rsp->hdr.Status = status;
 			rc = -EINVAL;
+			kfree(conn->preauth_info);
+			conn->preauth_info = NULL;
 			goto err_out;
 		}
 
 		rc = init_smb3_11_server(conn);
 		if (rc < 0) {
 			rsp->hdr.Status = STATUS_INVALID_PARAMETER;
+			kfree(conn->preauth_info);
+			conn->preauth_info = NULL;
 			goto err_out;
 		}
 

programming_language: C
CVE-2021-32435 (published 2022-03-10T17:42Z)

Stack-based buffer overflow in the function get_key in parse.c of abcm2ps v8.14.11 allows remote attackers to cause a Denial of Service (DoS) via unspecified vectors.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/leesavide/abcm2ps
commit_details: repo_url: https://github.com/leesavide/abcm2ps
author: Jean-Francois Moine
author_date: 2021-04-27 16:39:19+02:00
msg: fix: crash when accidental without a note at start of line after K:

Issue #84.
repository: repo_url: https://github.com/leesavide/abcm2ps
repo_name: visit repo url
description: visit repo url
repo_language: visit repo url
owner: leesavide
file_changes: filename: abcparse.c
change_type: ModificationType.MODIFY
diff: @@ -2040,10 +2040,10 @@ static int parse_line(char *p)
 		case CHAR_NOTE:
 			p = parse_note(p - 1, flags);
 			flags &= ABC_F_GRACE;
-			parse.last_sym->u.note.slur_st = slur;
-			slur = 0;
-			if (parse.last_sym->u.note.notes[0].len > 0) /* if not space */
-				curvoice->last_note = parse.last_sym;
+			if (slur && parse.last_sym->u.note.notes[0].len) {
+				parse.last_sym->u.note.slur_st = slur;
+				slur = 0;
+			}
 			break;
 		case CHAR_SLASH:		/* '/' */
 			if (flags & ABC_F_GRACE)
@@ -2078,9 +2078,10 @@ static int parse_line(char *p)
 			if (p[1] != ':') {
 				p = parse_note(p - 1, flags); /* chord */
 				flags &= ABC_F_GRACE;
-				parse.last_sym->u.note.slur_st = slur;
-				slur = 0;
-				curvoice->last_note = parse.last_sym;
+				if (slur && parse.last_sym->u.note.notes[0].len) {
+					parse.last_sym->u.note.slur_st = slur;
+					slur = 0;
+				}
 				break;
 			}
 
@@ -2511,6 +2512,8 @@ add_deco:
 		syntax("Not a note in grace note sequence", p);
 		goto err;
 	}
+	if (s->u.note.notes[0].len > 0) /* if not space */
+		curvoice->last_note = s;
 	return p;
 
 err:

programming_language: C
CVE-2021-37600 (published 2021-07-30T14:15Z)

An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file. NOTE: this is unexploitable in GNU C Library environments, and possibly in all realistic environments.

Severity: LOW
CVSS v2 base score: 1.2 (AV:L/AC:H/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/karelzak/util-linux
commit_details: repo_url: https://github.com/karelzak/util-linux
author: Karel Zak
author_date: 2021-07-27 11:58:31+02:00
msg: sys-utils/ipcutils: be careful when call calloc() for uint64 nmembs

Fix: https://github.com/karelzak/util-linux/issues/1395
Signed-off-by: Karel Zak <kzak@redhat.com>
repository: repo_url: https://github.com/karelzak/util-linux
repo_name: util-linux/util-linux
repo_language: C
owner: karelzak
file_changes: filename: ipcutils.c
change_type: ModificationType.MODIFY
diff: @@ -218,7 +218,7 @@ static void get_sem_elements(struct sem_data *p)
 {
 	size_t i;
 
-	if (!p || !p->sem_nsems || p->sem_perm.id < 0)
+	if (!p || !p->sem_nsems || p->sem_nsems > SIZE_MAX || p->sem_perm.id < 0)
 		return;
 
 	p->elements = xcalloc(p->sem_nsems, sizeof(struct sem_elem));

programming_language: C
CVE-2021-20257 (published 2022-03-16T15:15Z)

An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-835
cwe_name: Loop with Unreachable Exit Condition ('Infinite Loop')
description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
extended_description: If the loop can be influenced by an attacker, this weakness could allow attackers to consume excessive resources such as CPU or memory.
         

Fix information:
repo_url: https://github.com/qemu/qemu
commit_details: repo_url: https://github.com/qemu/qemu
author: Jason Wang
author_date: 2021-02-24 13:45:28+08:00
msg: e1000: fail early for evil descriptor

During procss_tx_desc(), driver can try to chain data descriptor with
legacy descriptor, when will lead underflow for the following
calculation in process_tx_desc() for bytes:

            if (tp->size + bytes > msh)
                bytes = msh - tp->size;

This will lead a infinite loop. So check and fail early if tp->size if
greater or equal to msh.

Reported-by: Alexander Bulekov <alxndr@bu.edu>
Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr>
Reported-by: Ruhr-University Bochum <bugs-syssec@rub.de>
Cc: Prasad J Pandit <ppandit@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Jason Wang <jasowang@redhat.com>
repository: repo_url: https://github.com/qemu/qemu
repo_name: qemu/qemu
description: Official QEMU mirror. Please see https://www.qemu.org/contribute/ for how to submit changes to QEMU. Pull Requests are ignored. Please only use release tarballs from the QEMU website.
repo_language: C
owner: qemu
file_changes: filename: e1000.c
change_type: ModificationType.MODIFY
diff: @@ -670,6 +670,9 @@ process_tx_desc(E1000State *s, struct e1000_tx_desc *dp)
         msh = tp->tso_props.hdr_len + tp->tso_props.mss;
         do {
             bytes = split_size;
+            if (tp->size >= msh) {
+                goto eop;
+            }
             if (tp->size + bytes > msh)
                 bytes = msh - tp->size;
 
@@ -695,6 +698,7 @@ process_tx_desc(E1000State *s, struct e1000_tx_desc *dp)
         tp->size += split_size;
     }
 
+eop:
     if (!(txd_lower & E1000_TXD_CMD_EOP))
         return;
     if (!(tp->cptse && tp->size < tp->tso_props.hdr_len)) {

programming_language: C
CVE-2023-22741 (published 2023-01-19T22:15Z)

Sofia-SIP is an open-source SIP User-Agent library, compliant with the IETF RFC3261 specification. In affected versions Sofia-SIP **lacks both message length and attributes length checks** when it handles STUN packets, leading to controllable heap-over-flow. For example, in stun_parse_attribute(), after we get the attribute's type and length value, the length will be used directly to copy from the heap, regardless of the message's left size. Since network users control the overflowed length, and the data is written to heap chunks later, attackers may achieve remote code execution by heap grooming or other exploitation methods. The bug was introduced 16 years ago in sofia-sip 1.12.4 (plus some patches through 12/21/2006) to in tree libs with git-svn-id: http://svn.freeswitch.org/svn/freeswitch/trunk@3774 d0543943-73ff-0310-b7d9-9358b9ac24b2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-120
cwe_name: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
extended_description: A buffer overflow condition exists when a product attempts to put more data in a buffer than it can hold, or when it attempts to put data in a memory area outside of the boundaries of a buffer. The simplest type of error, and the most common cause of buffer overflows, is the "classic" case in which the product copies the buffer without restricting how much is copied. Other variants exist, but the existence of a classic overflow strongly suggests that the programmer is not considering even the most basic of security protections.
         

Fix information:
repo_url: https://github.com/freeswitch/sofia-sip
commit_details: repo_url: https://github.com/freeswitch/sofia-sip
author: Andrey Volk
author_date: 2022-12-27 22:01:48+03:00
msg: Merge pull request #182 from QiuhaoLi/fix-stun-parser-oob

stun: add checks for STUN messag len and attr len
repository: repo_url: https://github.com/freeswitch/sofia-sip
repo_name: freeswitch/sofia-sip
description: Sofia-SIP is an open-source SIP User-Agent library, compliant with the IETF RFC3261 specification.
repo_language: C
owner: freeswitch