starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2020-28705 (published 2021-03-10T14:15Z)

FUEL CMS 1.4.13 contains a cross-site request forgery (CSRF) vulnerability that can delete a page via a post ID to /pages/delete/3.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/daylightstudio/FUEL-CMS
commit_details: repo_url: https://github.com/daylightstudio/FUEL-CMS
author: David McReynolds
author_date: 2020-11-04 20:35:31-08:00
msg: fix: issue #576 with expanded ability to delete pages
repository: repo_url: https://github.com/daylightstudio/FUEL-CMS
repo_name: daylightstudio/FUEL-CMS
description: A CodeIgniter Content Management System
repo_language: PHP
owner: daylightstudio
file_changes: filename: Module.php
change_type: ModificationType.MODIFY
diff: @@ -1621,9 +1621,16 @@ class Module extends Fuel_base_controller {
 
 		$inline = $this->fuel->admin->is_inline();
 
-		if ( ! empty($_POST['id']))
+		if (! empty($_POST['id']))
 		{
-			$posted = explode('|', $this->input->post('id', TRUE));
+			if (!empty($id))
+			{
+				$posted = array($id);
+			}
+			else
+			{
+				$posted = explode('|', $this->input->post('id', TRUE));
+			}
 
 			// run before_delete hook
 			$this->_run_hook('before_delete', $posted);

programming_language: PHP
CVE-2021-41211 (published 2021-11-05T21:15Z)

TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for `QuantizeV2` can trigger a read outside of bounds of heap allocated array. This occurs whenever `axis` is a negative value less than `-1`. In this case, we are accessing data before the start of a heap buffer. The code allows `axis` to be an optional argument (`s` would contain an `error::NOT_FOUND` error code). Otherwise, it assumes that `axis` is a valid index into the dimensions of the `input` tensor. If `axis` is less than `-1` then this results in a heap OOB read. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, as this version is the only one that is also affected.

Severity: LOW
CVSS v2 base score: 3.6 (AV:L/AC:L/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 7.1, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Yu-Cheng Ling
author_date: 2021-10-01 15:52:56-07:00
msg: Prevent OOB access in QuantizeV2 shape inference

PiperOrigin-RevId: 400309614
Change-Id: I31412c71b05b4f21b677f7fa715a61499cbee39d
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: common_shape_fns.cc
change_type: ModificationType.MODIFY
diff: @@ -2559,6 +2559,9 @@ Status QuantizeV2Shape(InferenceContext* c) {
   if (!s.ok() && s.code() != error::NOT_FOUND) {
     return s;
   }
+  if (axis < -1) {
+    return errors::InvalidArgument("axis should be at least -1, got ", axis);
+  }
   const int minmax_rank = (axis == -1) ? 0 : 1;
   TF_RETURN_IF_ERROR(shape_inference::UnchangedShape(c));
   ShapeHandle minmax;

programming_language: C++
CVE-2022-47516 (published 2022-12-18T05:15Z)

An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.20. It allows remote attackers to cause a denial of service (daemon crash) via a crafted UDP message that leads to a failure of the libsofia-sip-ua/tport/tport.c self assertion.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-617
cwe_name: Reachable Assertion
description: The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
extended_description: 
            While assertion is good for catching logic errors and reducing the chances of reaching more serious vulnerability conditions, it can still lead to a denial of service.
            For example, if a server handles multiple simultaneous connections, and an assert() occurs in one single connection that causes all other connections to be dropped, this is a reachable assertion that leads to a denial of service.
         
         

Fix information:
repo_url: https://github.com/davehorton/sofia-sip
commit_details: repo_url: https://github.com/davehorton/sofia-sip
author: Dave Horton
author_date: 2022-11-28 14:44:30-05:00
msg: remove assert that can reasonably be expected to happen
repository: repo_url: https://github.com/davehorton/sofia-sip
repo_name: davehorton/sofia-sip
description: Sofia sip stack (forked from gitorious 1/1/2014)
repo_language: C
owner: davehorton
file_changes: filename: tport.c
change_type: ModificationType.MODIFY
diff: @@ -3310,8 +3310,6 @@ tport_t *tport_tsend(tport_t *self,
   tp_name_t tpn[1];
   struct sigcomp_compartment *cc;
 
-  assert(self);
-
   if (!self || !msg || !_tpn) {
     msg_set_errno(msg, EINVAL);
     return NULL;

programming_language: C
CVE-2022-25309 (published 2022-09-06T18:15Z)

A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidi_cap_rtl_to_unicode() function of the fribidi-char-sets-cap-rtl.c file. This flaw allows an attacker to pass a specially crafted file to the Fribidi application with the '--caprtl' option, leading to a crash and causing a denial of service.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-122
cwe_name: Heap-based Buffer Overflow
description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/fribidi/fribidi
commit_details: repo_url: https://github.com/fribidi/fribidi
author: Dov Grobgeld
author_date: 2022-03-25 09:09:49+03:00
msg: Protected against garbage in the CapRTL encoder
repository: repo_url: https://github.com/fribidi/fribidi
repo_name: fribidi/fribidi
description: GNU FriBidi
repo_language: C
owner: fribidi
file_changes: filename: fribidi-char-sets-cap-rtl.c
change_type: ModificationType.MODIFY
diff: @@ -232,7 +232,12 @@ fribidi_cap_rtl_to_unicode (
 	    }
 	}
       else
-	us[j++] = caprtl_to_unicode[(int) s[i]];
+      {
+        if ((int)s[i] < 0)
+          us[j++] = '?';
+        else
+          us[j++] = caprtl_to_unicode[(int) s[i]];
+      }
     }
 
   return j;

programming_language: C
CVE-2024-0241 (published 2024-01-04T21:15Z)

encoded_id-rails versions before 1.0.0.beta2 are affected by an uncontrolled resource consumption vulnerability. A remote and unauthenticated attacker might cause a denial of service condition by sending an HTTP request with an extremely long "id" parameter.\n\n

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-770
cwe_name: Allocation of Resources Without Limits or Throttling
description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
extended_description: Code frequently has to work with limited resources, so programmers must be careful to ensure that resources are not consumed too quickly, or too easily.  Without use of quotas, resource limits, or other protection mechanisms, it can be easy for an attacker to consume many resources by rapidly making many requests, or causing larger resources to be used than is needed. When too many resources are allocated, or if a single resource is too large, then it can prevent the code from working correctly, possibly leading to a denial of service.
         

Fix information:
repo_url: https://github.com/stevegeek/encoded_id-rails
commit_details: repo_url: https://github.com/stevegeek/encoded_id-rails
author: Stephen Ierodiaconou
author_date: 2023-10-23 08:14:04+03:00
msg: Update encoded_id dependency to address GHSA-3px7-jm2p-6h2c
repository: repo_url: https://github.com/stevegeek/encoded_id-rails
repo_name: stevegeek/encoded_id-rails
description: Use `encoded_id` with Rails ActiveRecord models
repo_language: Ruby
owner: stevegeek
file_changes: filename: encoded_id-rails.gemspec
change_type: ModificationType.MODIFY
diff: @@ -32,7 +32,7 @@ Gem::Specification.new do |spec|
   # Uncomment to register a new dependency of your gem
   spec.add_dependency "activesupport", ">= 6.0", "< 8.0"
   spec.add_dependency "activerecord", ">= 6.0", "< 8.0"
-  spec.add_dependency "encoded_id", "~> 1.0.0.rc2"
+  spec.add_dependency "encoded_id", "~> 1.0.0.rc3"
 
   # For more information and examples about making a new gem, check out our
   # guide at: https://bundler.io/guides/creating_gem.html

programming_language: Ruby
CVE-2017-6418 (published 2017-08-07T03:29Z)

libclamav/message.c in ClamAV 0.99.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted e-mail message.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/vrtadmin/clamav-devel
commit_details: repo_url: https://github.com/vrtadmin/clamav-devel
author: Steven Morgan
author_date: 2017-03-02 14:41:20-05:00
msg: bb11797 - fix invalid read in fuzzed mail file.
repository: repo_url: https://github.com/vrtadmin/clamav-devel
repo_name: Cisco-Talos/clamav
description: ClamAV - Documentation is here: https://docs.clamav.net
repo_language: C
owner: vrtadmin
file_changes: filename: message.c
change_type: ModificationType.MODIFY
diff: @@ -445,8 +445,12 @@ messageAddArgument(message *m, const char *arg)
 			 * FIXME: Bounce message handling is corrupting the in
 			 * core copies of headers
 			 */
-			cli_dbgmsg("Possible data corruption fixed\n");
-			p[8] = '=';
+                        if (strlen(p) > 8) {
+                            cli_dbgmsg("Possible data corruption fixed\n");
+                            p[8] = '=';
+                        } else {
+                            cli_dbgmsg("Possible data corruption not fixed\n");
+                        }
 		} else {
 			if(*p)
 				cli_dbgmsg("messageAddArgument, '%s' contains no '='\n", p);
@@ -682,7 +686,7 @@ messageFindArgument(const message *m, const char *variable)
 				cli_dbgmsg("messageFindArgument: no '=' sign found in MIME header '%s' (%s)\n", variable, messageGetArgument(m, i));
 				return NULL;
 			}
-			if((*++ptr == '"') && (strchr(&ptr[1], '"') != NULL)) {
+			if((strlen(ptr) > 2) && (*++ptr == '"') && (strchr(&ptr[1], '"') != NULL)) {
 				/* Remove any quote characters */
 				char *ret = cli_strdup(++ptr);
 				char *p;

programming_language: C
CVE-2011-2765 (published 2018-08-20T13:29Z)

pyro before 3.15 unsafely handles pid files in temporary directory locations and opening the pid file as root. An attacker can use this flaw to overwrite arbitrary files via symlinks.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-59
cwe_name: Improper Link Resolution Before File Access ('Link Following')
description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/irmen/Pyro3
commit_details: repo_url: https://github.com/irmen/Pyro3
author: irmen
author_date: 2011-09-01 13:32:40+00:00
msg: changed pidfile location because of security vulnerability, debian bug #631912
repository: repo_url: https://github.com/irmen/Pyro3
repo_name: irmen/Pyro3
description: Pyro 3.x (old version - unmaintained - use Pyro4 instead)
repo_language: Python
owner: irmen
file_changes: filename: daemonizer.py
change_type: ModificationType.MODIFY
diff: @@ -47,7 +47,9 @@ class Daemonizer:
     """
     def __init__(self, pidfile=None):
         if not pidfile:
-            self.pidfile = "/tmp/%s.pid" % self.__class__.__name__.lower()
+            # PID file moved out of /tmp to avoid security vulnerability
+            # changed by Debian maintainer per Debian bug #631912
+            self.pidfile = "/var/run/pyro-%s.pid" % self.__class__.__name__.lower()
         else:
             self.pidfile = pidfile
 
@@ -121,12 +123,16 @@ class Daemonizer:
 
     def process_command_line(self, argv, verbose=1):
         usage = "usage:  %s  start | stop | restart | status | debug " \
+                "[--pidfile=...] " \
                 "(run as non-daemon)" % os.path.basename(argv[0])
         if len(argv) < 2:
             print usage
             raise SystemExit
         else:
             operation = argv[1]
+            if len(argv) > 2 and argv[2].startswith('--pidfile=') and \
+                len(argv[2]) > len('--pidfile='):
+                self.pidfile = argv[2][len('--pidfile='):]
         pid = self.get_pid()
         if operation == 'status':
             if self.is_process_running():

programming_language: Python
CVE-2023-30847 (published 2023-04-27T15:15Z)

H2O is an HTTP server. In versions 2.3.0-beta2 and prior, when the reverse proxy handler tries to processes a certain type of invalid HTTP request, it tries to build an upstream URL by reading from uninitialized pointer. This behavior can lead to crashes or leak of information to back end HTTP servers. Pull request  number 3229 fixes the issue. The pull request has been merged to the `master` branch in commit f010336. Users should upgrade to commit f010336 or later.

CVSS v3 base score: 8.2, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)

Weakness information:
cwe_id: CWE-824
cwe_name: Access of Uninitialized Pointer
description: The product accesses or uses a pointer that has not been initialized.
extended_description: 
            If the pointer contains an uninitialized value, then the value might not point to a valid memory location. This could cause the product to read from or write to unexpected memory locations, leading to a denial of service. If the uninitialized pointer is used as a function call, then arbitrary functions could be invoked. If an attacker can influence the portion of uninitialized memory that is contained in the pointer, this weakness could be leveraged to execute code or perform other attacks.
            Depending on memory layout, associated memory management behaviors, and product operation, the attacker might be able to influence the contents of the uninitialized pointer, thus gaining more fine-grained control of the memory location to be accessed.
         
         

Fix information:
repo_url: https://github.com/h2o/h2o
commit_details: repo_url: https://github.com/h2o/h2o
author: Kazuho Oku
author_date: 2023-04-27 22:14:41+09:00
msg: Merge pull request #3229 from h2o/kazuho/reverse-proxy-invalid-read

[reverse proxy] invalid memory read
repository: repo_url: https://github.com/h2o/h2o
repo_name: h2o/h2o
description: H2O - the optimized HTTP/1, HTTP/2, HTTP/3 server
repo_language: C
owner: h2o
CVE-2019-3557 (published 2019-01-15T22:29Z)

The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. This behavior caused some stream functions, such as stream_get_line, to trigger an out-of-bounds read when operating on such malformed streams. The implementations were updated to return valid values consistently. This affects all supported versions of HHVM (3.30 and 3.27.4 and below).

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/facebook/hhvm
commit_details: repo_url: https://github.com/facebook/hhvm
author: Joseph Griego
author_date: 2019-01-14 12:18:21-08:00
msg: CVE-2019-3557: Fix OOB read in readRecord on BZ2Files/OutputFiles

Summary:
These File subclasses return -1 on read errors which is not what is
expected for readImpl--this made File::readRecord behave unusually if the read
fails, causing it to read (size_t)(-1) bytes from its stream buffer; which,
unsurprisingly produces a out-of-bounds heap read.

Reviewed By: leikahing, jjgriego

Differential Revision: D13659395

fbshipit-source-id: 359ed6e3ff9f9cf49b752b666f51c4e0b3ce4b8a
repository: repo_url: https://github.com/facebook/hhvm
repo_name: facebook/hhvm
description: A virtual machine for executing programs written in Hack.
repo_language: Hack
owner: facebook
file_changes: filename: output-file.cpp
change_type: ModificationType.MODIFY
diff: @@ -66,7 +66,7 @@ bool OutputFile::closeImpl() {
 
 int64_t OutputFile::readImpl(char* /*buffer*/, int64_t /*length*/) {
   raise_warning("cannot read from a php://output stream");
-  return -1;
+  return 0;
 }
 
 int OutputFile::getc() {

programming_language: C++
filename: bz2-file.cpp
change_type: ModificationType.MODIFY
diff: @@ -95,7 +95,7 @@ int64_t BZ2File::readImpl(char * buf, int64_t length) {
   if (len <= 0) {
     setEof(true);
     if (len < 0) {
-      return -1;
+      return 0;
     }
   }
   return len;

programming_language: C++
filename: oob_read_file.php
change_type: ModificationType.ADD
diff: @@ -0,0 +1,12 @@
+<?hh
+
+<<__EntryPoint>>
+function main() {
+    $a = bzopen("/dev/null", "w");
+    $tmp = stream_get_line($a, 1, "1");
+    var_dump($tmp);
+
+    $a = fopen("php://output", "w");
+    $tmp = stream_get_line($a, 1, "1");
+    var_dump($tmp);
+}

programming_language: PHP
filename: oob_read_file.php.expectf
change_type: ModificationType.ADD
diff: @@ -0,0 +1,4 @@
+string(0) ""
+
+Warning: cannot read from a php://output stream in %s on line %d
+string(0) ""

programming_language: Batchfile
CVE-2024-21668 (published 2024-01-09T19:15Z)

react-native-mmkv is a library that allows easy use of MMKV inside React Native applications. Before version 2.11.0, the react-native-mmkv logged the optional encryption key for the MMKV database into the Android system log. The key can be obtained by anyone with access to the Android Debugging Bridge (ADB) if it is enabled in the phone settings. This bug is not present on iOS devices. By logging the encryption secret to the system logs, attackers can trivially recover the secret by enabling ADB and undermining an app's thread model. This issue has been patched in version 2.11.0.

CVSS v3 base score: 4.9, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-532
cwe_name: Insertion of Sensitive Information into Log File
description: Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
extended_description: 
            While logging all information may be helpful during development stages, it is important that logging levels be set appropriately before a product ships so that sensitive user data and system information are not accidentally exposed to potential attackers.
            Different log files may be produced and stored for:
            
               Server log files (e.g. server.log).  This can give information on whatever application left the file. Usually this can give full path names and system information, and sometimes usernames and passwords.
               log files that are used for debugging
            
         
         

Fix information:
repo_url: https://github.com/mrousavy/react-native-mmkv
commit_details: repo_url: https://github.com/mrousavy/react-native-mmkv
author: Marc Rousavy
author_date: 2023-09-30 13:11:25+02:00
msg: fix: Don't leak encryption key in logs
repository: repo_url: https://github.com/mrousavy/react-native-mmkv
repo_name: mrousavy/react-native-mmkv
description: ⚡️ The fastest key/value storage for React Native. ~30x faster than AsyncStorage!
repo_language: C++
owner: mrousavy
file_changes: filename: MmkvHostObject.cpp
change_type: ModificationType.MODIFY
diff: @@ -15,9 +15,10 @@
 
 MmkvHostObject::MmkvHostObject(const std::string& instanceId, std::string path,
                                std::string cryptKey) {
+  bool hasEncryptionKey = cryptKey.size() > 0;
   __android_log_print(ANDROID_LOG_INFO, "RNMMKV",
-                      "Creating MMKV instance \"%s\"... (Path: %s, Encryption-Key: %s)",
-                      instanceId.c_str(), path.c_str(), cryptKey.c_str());
+                      "Creating MMKV instance \"%s\"... (Path: %s, Encrypted: %b)",
+                      instanceId.c_str(), path.c_str(), hasEncryptionKey);
   std::string* pathPtr = path.size() > 0 ? &path : nullptr;
   std::string* cryptKeyPtr = cryptKey.size() > 0 ? &cryptKey : nullptr;
   instance = MMKV::mmkvWithID(instanceId, mmkv::DEFAULT_MMAP_SIZE, MMKV_SINGLE_PROCESS, cryptKeyPtr,

programming_language: C++