starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2013-5634 (published 2013-09-25T10:31Z)

arch/arm/kvm/arm.c in the Linux kernel before 3.10 on the ARM platform, when KVM is used, allows host OS users to cause a denial of service (NULL pointer dereference, OOPS, and host OS crash) or possibly have unspecified other impact by omitting vCPU initialization before a KVM_GET_REG_LIST ioctl call.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:A/AC:H/Au:S/C:N/I:N/A:C)

Weakness information:
cwe_id: CWE-399
cwe_name: Resource Management Errors
description: Weaknesses in this category are related to improper management of system resources.

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Andre Przywara
author_date: 2013-05-09 00:28:06+02:00
msg: ARM: KVM: prevent NULL pointer dereferences with KVM VCPU ioctl

Some ARM KVM VCPU ioctls require the vCPU to be properly initialized
with the KVM_ARM_VCPU_INIT ioctl before being used with further
requests. KVM_RUN checks whether this initialization has been
done, but other ioctls do not.
Namely KVM_GET_REG_LIST will dereference an array with index -1
without initialization and thus leads to a kernel oops.
Fix this by adding checks before executing the ioctl handlers.

 [ Removed superflous comment from static function - Christoffer ]

Changes from v1:
 * moved check into a static function with a meaningful name

Signed-off-by: Andre Przywara <andre.przywara@linaro.org>
Signed-off-by: Christoffer Dall <cdall@cs.columbia.edu>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: arm.c
change_type: ModificationType.MODIFY
diff: @@ -492,6 +492,11 @@ static void vcpu_pause(struct kvm_vcpu *vcpu)
 	wait_event_interruptible(*wq, !vcpu->arch.pause);
 }
 
+static int kvm_vcpu_initialized(struct kvm_vcpu *vcpu)
+{
+	return vcpu->arch.target >= 0;
+}
+
 /**
  * kvm_arch_vcpu_ioctl_run - the main VCPU run function to execute guest code
  * @vcpu:	The VCPU pointer
@@ -508,8 +513,7 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *run)
 	int ret;
 	sigset_t sigsaved;
 
-	/* Make sure they initialize the vcpu with KVM_ARM_VCPU_INIT */
-	if (unlikely(vcpu->arch.target < 0))
+	if (unlikely(!kvm_vcpu_initialized(vcpu)))
 		return -ENOEXEC;
 
 	ret = kvm_vcpu_first_run_init(vcpu);
@@ -710,6 +714,10 @@ long kvm_arch_vcpu_ioctl(struct file *filp,
 	case KVM_SET_ONE_REG:
 	case KVM_GET_ONE_REG: {
 		struct kvm_one_reg reg;
+
+		if (unlikely(!kvm_vcpu_initialized(vcpu)))
+			return -ENOEXEC;
+
 		if (copy_from_user(&reg, argp, sizeof(reg)))
 			return -EFAULT;
 		if (ioctl == KVM_SET_ONE_REG)
@@ -722,6 +730,9 @@ long kvm_arch_vcpu_ioctl(struct file *filp,
 		struct kvm_reg_list reg_list;
 		unsigned n;
 
+		if (unlikely(!kvm_vcpu_initialized(vcpu)))
+			return -ENOEXEC;
+
 		if (copy_from_user(&reg_list, user_list, sizeof(reg_list)))
 			return -EFAULT;
 		n = reg_list.n;

programming_language: C
CVE-2024-34354 (published 2024-05-14T15:38Z)

CMSaaSStarter is a SaaS template/boilerplate built with SvelteKit, Tailwind, and Supabase. Any forks of the CMSaaSStarter template before commit 7904d416d2c72ec75f42fbf51e9e64fa74062ee6 are impacted. The issue is the user JWT Token is not verified on server session. You should take the patch 7904d416d2c72ec75f42fbf51e9e64fa74062ee6 into your fork.\n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/CriticalMoments/CMSaasStarter
commit_details: repo_url: https://github.com/CriticalMoments/CMSaasStarter
author: Steve Cosman
author_date: 2024-05-09 10:29:33-04:00
msg: Merge pull request #65 from CriticalMoments/safe_get_session

Fix a security issue: https://github.com/supabase/supabase/pull/22381
repository: repo_url: https://github.com/CriticalMoments/CMSaasStarter
repo_name: CriticalMoments/CMSaasStarter
description: A modern SaaS template/boilerplate built with SvelteKit, Tailwind, and Supabase. Includes marketing page, blog, subscriptions, auth, user dashboard, user settings, pricing page, and more.
repo_language: Svelte
owner: CriticalMoments
CVE-2019-18408 (published 2019-10-24T14:15Z)

archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0 has a use-after-free in a certain ARCHIVE_FAILED situation, related to Ppmd7_DecodeSymbol.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/libarchive/libarchive
commit_details: repo_url: https://github.com/libarchive/libarchive
author: Martin Matuska
author_date: 2019-05-11 02:36:53+02:00
msg: RAR reader: fix use after free

If read_data_compressed() returns ARCHIVE_FAILED, the caller is allowed
to continue with next archive headers. We need to set rar->start_new_table
after the ppmd7_context got freed, otherwise it won't be allocated again.

Reported by: OSS-Fuzz issue 2582
repository: repo_url: https://github.com/libarchive/libarchive
repo_name: libarchive/libarchive
description: Multi-format archive and compression library
repo_language: C
owner: libarchive
file_changes: filename: archive_read_support_format_rar.c
change_type: ModificationType.MODIFY
diff: @@ -1024,8 +1024,10 @@ archive_read_format_rar_read_data(struct archive_read *a, const void **buff,
   case COMPRESS_METHOD_GOOD:
   case COMPRESS_METHOD_BEST:
     ret = read_data_compressed(a, buff, size, offset);
-    if (ret != ARCHIVE_OK && ret != ARCHIVE_WARN)
+    if (ret != ARCHIVE_OK && ret != ARCHIVE_WARN) {
       __archive_ppmd7_functions.Ppmd7_Free(&rar->ppmd7_context);
+      rar->start_new_table = 1;
+    }
     break;
 
   default:

programming_language: C
CVE-2017-9378 (published 2017-06-02T15:29Z)

BigTree CMS through 4.2.18 does not prevent a user from deleting their own account. This could have security relevance because deletion was supposed to be an admin-only action, and the admin may have other tasks (such as data backups) to complete before a user is deleted.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:N/I:P/A:N)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-863
cwe_name: Incorrect Authorization
description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are incorrectly applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/bigtreecms/BigTree-CMS
commit_details: repo_url: https://github.com/bigtreecms/BigTree-CMS
author: Tim Buckingham
author_date: 2017-05-25 16:53:05-04:00
msg: Fixed a user potentially being able to delete themselves if they really really wanted to.
https://github.com/bigtreecms/BigTree-CMS/issues/282
repository: repo_url: https://github.com/bigtreecms/BigTree-CMS
repo_name: bigtreecms/BigTree-CMS
repo_language: PHP
owner: bigtreecms
file_changes: filename: admin.php
change_type: ModificationType.MODIFY
diff: @@ -2303,7 +2303,8 @@
 			$id = sqlescape($id);
 			// If this person has higher access levels than the person trying to update them, fail.
 			$current = static::getUser($id);
-			if ($current["level"] > $this->Level) {
+
+			if ($current["level"] > $this->Level || $id == $this->ID) {
 				return false;
 			}
 

programming_language: PHP
CVE-2024-30268 (published 2024-05-14T15:22Z)

Cacti provides an operational monitoring and fault management framework. A reflected cross-site scripting vulnerability on the 1.3.x DEV branch allows attackers to obtain cookies of administrator and other users and fake their login using obtained cookies. This issue is fixed in commit a38b9046e9772612fda847b46308f9391a49891e.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/Cacti/cacti
commit_details: repo_url: https://github.com/Cacti/cacti
author: Petr Macek
author_date: 2024-02-23 13:56:14+01:00
msg: Merge pull request from GHSA-9m3v-whmr-pc2q
repository: repo_url: https://github.com/Cacti/cacti
repo_name: Cacti/cacti
description: Cacti ™
repo_language: PHP
owner: Cacti
file_changes: filename: settings.php
change_type: ModificationType.MODIFY
diff: @@ -29,6 +29,7 @@ include_once('./lib/poller.php');
 set_default_action();
 
 get_filter_request_var('tab', FILTER_CALLBACK, array('options' => 'sanitize_search_string'));
+get_filter_request_var('filter', FILTER_CALLBACK, array('options' => 'sanitize_search_string'));
 
 global $disable_log_rotation, $local_db_cnn_id;
 
@@ -63,7 +64,7 @@ function display_settings() {
 	print '<tr><td>';
 	print '<table class="filterTable">';
 	print '<td>' . __('Search') . '</td>';
-	print '<td><input type="text" size="25" id="filter" value="' . get_request_var('filter') . '"></td>';
+	print '<td><input type="text" size="25" id="filter" value="' . html_escape_request_var('filter') . '"></td>';
 	print '<td><span><input type="button" id="clear" value="' . __esc('Clear') . '"></span></td>';
 	print '</tr></table>';
 	print '</td></tr>';

programming_language: PHP
CVE-2018-1002203 (published 2018-07-25T17:29Z)

unzipper npm library before 0.8.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/ZJONSSON/node-unzipper
commit_details: repo_url: https://github.com/ZJONSSON/node-unzipper
author: Ziggy Jonsson
author_date: 2018-04-16 09:32:34-04:00
msg: Merge pull request #59 from aviadatsnyk/fix/zip-slip

fix: prevent extracting archived files outside of target path
repository: repo_url: https://github.com/ZJONSSON/node-unzipper
repo_name: ZJONSSON/node-unzipper
description: node.js cross-platform unzip using streams
repo_language: JavaScript
owner: ZJONSSON
CVE-2013-7491 (published 2020-09-11T19:15Z)

An issue was discovered in the DBI module before 1.628 for Perl. Stack corruption occurs when a user-defined function requires a non-trivial amount of memory and the Perl stack gets reallocated.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/perl5-dbi/dbi
commit_details: repo_url: https://github.com/perl5-dbi/dbi
author: Tim Bunce
author_date: 2013-06-24 22:39:46+01:00
msg: Fixed stack corruption on callbacks RT#85562 RT#84974 [Aaron Schweiger]
repository: repo_url: https://github.com/perl5-dbi/dbi
repo_name: perl5-dbi/dbi
description: DBI - The Perl 5 Database Interface
repo_language: Perl
owner: perl5-dbi
file_changes: filename: Changes
change_type: ModificationType.MODIFY
diff: @@ -12,6 +12,7 @@ DBI::Changes - List of significant changes to the DBI
 
     Fixed missing fields on partial insert via DBI::DBD::SqlEngine
         engines (DBD::CSV, DBD::DBM etc.) [H.Merijn Brand, Jens Rehsack]
+    Fixed stack corruption on callbacks RT#85562 RT#84974 [Aaron Schweiger]
 
     Added support for finding tables in multiple directories
         via new DBD::File f_dir_search attribute [H.Merijn Brand]

programming_language: Markdown
filename: Driver.xst
change_type: ModificationType.MODIFY
diff: @@ -157,7 +157,9 @@ selectall_arrayref(...)
     }
     /* --- fetchall --- */
     maxrows_svp = DBD_ATTRIB_GET_SVP(attr, "MaxRows", 7);
-    ST(0) = dbdxst_fetchall_arrayref(sth, &PL_sv_undef, (maxrows_svp) ? *maxrows_svp : &PL_sv_undef);
+    SV *tmp = dbdxst_fetchall_arrayref(sth, &PL_sv_undef, (maxrows_svp) ? *maxrows_svp : &PL_sv_undef);
+    SPAGAIN;
+    ST(0) = tmp;
 
 
 void
@@ -660,7 +662,9 @@ fetchall_arrayref(sth, slice=&PL_sv_undef, batch_row_count=&PL_sv_undef)
         ST(0) = tmp;
     }
     else {
-        ST(0) = dbdxst_fetchall_arrayref(sth, slice, batch_row_count);
+        SV *tmp = dbdxst_fetchall_arrayref(sth, slice, batch_row_count);
+        SPAGAIN;
+        ST(0) = tmp;
     }
 
 

programming_language: C++
CVE-2012-4752 (published 2012-09-05T23:55Z)

appconfig.php in ownCloud before 4.0.6 does not properly restrict access, which allows remote authenticated users to edit app configurations via unspecified vectors.  NOTE: this can be leveraged by unauthenticated remote attackers using CVE-2012-4393.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)

Weakness information:
cwe_id: CWE-264
cwe_name: Permissions, Privileges, and Access Controls
description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Fix information:
repo_url: https://github.com/owncloud/core
commit_details: repo_url: https://github.com/owncloud/core
author: Lukas Reschke
author_date: 2012-07-26 00:06:51+02:00
msg: Check for admin user
repository: repo_url: https://github.com/owncloud/core
repo_name: owncloud/core
description: :cloud: ownCloud web server core (Files, DAV, etc.)
repo_language: PHP
owner: owncloud
file_changes: filename: appconfig.php
change_type: ModificationType.MODIFY
diff: @@ -6,6 +6,7 @@
  */
 
 require_once ("../../lib/base.php");
+OC_Util::checkAdminUser();
 OC_JSON::checkLoggedIn();
 $action=isset($_POST['action'])?$_POST['action']:$_GET['action'];
 $result=false;

programming_language: PHP
CVE-2023-25672 (published 2023-03-25T00:15Z)

TensorFlow is an open source platform for machine learning. The function `tf.raw_ops.LookupTableImportV2` cannot handle scalars in the `values` parameter and gives an NPE. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.\n

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Peng Wang
author_date: 2023-01-31 15:02:20-08:00
msg: Fixes shape inference of LookupTableImportV2 to handle scalar values.

PiperOrigin-RevId: 506126405
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: lookup_ops.cc
change_type: ModificationType.MODIFY
diff: @@ -309,9 +309,10 @@ REGISTER_OP("LookupTableImportV2")
 
       ShapeHandle keys;
       TF_RETURN_IF_ERROR(c->WithRank(c->input(1), 1, &keys));
+      ShapeHandle values;
+      TF_RETURN_IF_ERROR(c->WithRankAtLeast(c->input(2), 1, &values));
       DimensionHandle unused;
-      TF_RETURN_IF_ERROR(
-          c->Merge(c->Dim(keys, 0), c->Dim(c->input(2), 0), &unused));
+      TF_RETURN_IF_ERROR(c->Merge(c->Dim(keys, 0), c->Dim(values, 0), &unused));
       return OkStatus();
     });
 

programming_language: C++
filename: lookup_ops_test.py
change_type: ModificationType.MODIFY
diff: @@ -41,6 +41,7 @@ from tensorflow.python.framework import test_ops
 from tensorflow.python.framework import test_util
 from tensorflow.python.ops import array_ops
 from tensorflow.python.ops import control_flow_ops
+from tensorflow.python.ops import gen_lookup_ops
 from tensorflow.python.ops import lookup_ops
 from tensorflow.python.ops import map_fn
 from tensorflow.python.ops import variables
@@ -573,6 +574,20 @@ class StaticHashTableTest(BaseLookupTableTest, parameterized.TestCase):
     self.evaluate(lookup_ops.tables_initializer())
     self.assertAllEqual(grad, -10.)
 
+  def testImportShapeInference(self, is_anonymous):
+    v = variables.Variable(1)
+
+    @def_function.function(jit_compile=True)
+    def foo():
+      return gen_lookup_ops.lookup_table_import_v2(
+          table_handle=v.handle, keys=[1.1, 2.2], values=1
+      )
+
+    with self.assertRaisesRegex(
+        ValueError, r"Shape must be at least rank 1 but is rank 0"
+    ):
+      foo()
+
   def testExportShapeInference(self, is_anonymous):
     table = self.getHashTable()(
         lookup_ops.KeyValueTensorInitializer(

programming_language: Python
CVE-2017-9520 (published 2017-06-08T14:29Z)

The r_config_set function in libr/config/config.c in radare2 1.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted DEX file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/radare/radare2
commit_details: repo_url: https://github.com/radare/radare2
author: pancake
author_date: 2017-06-07 23:50:59+02:00
msg: Fix #7698 - UAF in r_config_set when loading a dex
repository: repo_url: https://github.com/radare/radare2
repo_name: radareorg/radare2
description: UNIX-like reverse engineering framework and command-line toolset
repo_language: C
owner: radare
file_changes: filename: config.c
change_type: ModificationType.MODIFY
diff: @@ -388,8 +388,9 @@ R_API RConfigNode* r_config_set(RConfig *cfg, const char *name, const char *valu
 				if (node->value == value) {
 					goto beach;
 				}
-				free (node->value);
+				char *tmp = node->value;
 				node->value = strdup (value);
+				free (tmp);
 				if (IS_DIGIT (*value)) {
 					if (strchr (value, '/')) {
 						node->i_value = r_num_get (cfg->num, value);

programming_language: C
filename: cbin.c
change_type: ModificationType.MODIFY
diff: @@ -96,7 +96,8 @@ R_API int r_core_bin_set_env(RCore *r, RBinFile *binfile) {
 	RBinInfo *info = binobj ? binobj->info: NULL;
 	if (info) {
 		int va = info->has_va;
-		const char * arch = info->arch;
+		char * arch = strdup(info->arch);
+		char * cpu = info->cpu? strdup(info->cpu): NULL;
 		ut16 bits = info->bits;
 		ut64 baseaddr = r_bin_get_baddr (r->bin);
 		/* Hack to make baddr work on some corner */
@@ -106,14 +107,16 @@ R_API int r_core_bin_set_env(RCore *r, RBinFile *binfile) {
 		r_config_set (r->config, "asm.arch", arch);
 		r_config_set_i (r->config, "asm.bits", bits);
 		r_config_set (r->config, "anal.arch", arch);
-		if (info->cpu && *info->cpu) {
-			r_config_set (r->config, "anal.cpu", info->cpu);
+		if (cpu && *cpu) {
+			r_config_set (r->config, "anal.cpu", cpu);
 		} else {
 			r_config_set (r->config, "anal.cpu", arch);
 		}
 		r_asm_use (r->assembler, arch);
 		r_core_bin_info (r, R_CORE_BIN_ACC_ALL, R_CORE_BIN_SET, va, NULL, NULL);
 		r_core_bin_set_cur (r, binfile);
+		free (cpu);
+		free (arch);
 		return true;
 	}
 	return false;

programming_language: C