starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2024-35234 (published 2024-07-03T19:15Z)

Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch, an attacker can execute arbitrary JavaScript on users’ browsers by posting a specific URL containing maliciously crafted meta tags. This issue only affects sites with Content Security Polic (CSP) disabled. The problem has been patched in version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch. As a workaround, ensure CSP is enabled on the forum.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/discourse/discourse
commit_details: repo_url: https://github.com/discourse/discourse
author: Jan Cernik
author_date: 2024-05-23 20:04:47-03:00
msg: SECURITY: Fix Stored-dom XSS via Facebook Oneboxes
repository: repo_url: https://github.com/discourse/discourse
repo_name: discourse/discourse
description: A platform for community discussion. Free, open, simple.
repo_language: Ruby
owner: discourse
file_changes: filename: facebook_media_onebox.rb
change_type: ModificationType.MODIFY
diff: @@ -6,7 +6,7 @@ module Onebox
       include Engine
       include StandardEmbed
 
-      matches_regexp(%r{^https?://.*\.facebook\.com/(\w+)/(videos|\?).*})
+      matches_regexp(%r{^https?://(?:www\.)?facebook\.com/(\w+)/(videos|\?).*})
       always_https
       requires_iframe_origins "https://www.facebook.com"
 

programming_language: Ruby
filename: facebook_media_onebox_spec.rb
change_type: ModificationType.ADD
diff: @@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+RSpec.describe Onebox::Engine::FacebookMediaOnebox do
+  describe "regex URI match" do
+    it "matches videos with title" do
+      expect(match("https://www.facebook.com/user/videos/title/123456789/")).to eq true
+    end
+
+    it "matches videos without a title" do
+      expect(match("https://facebook.com/user/videos/123456789")).to eq true
+    end
+
+    it "only matches the facebook.com domain" do
+      expect(match("https://somedomain.com/a.facebook.com/a/videos")).to eq false
+    end
+
+    def match(url)
+      Onebox::Engine::FacebookMediaOnebox === URI(url)
+    end
+  end
+end

programming_language: Ruby
CVE-2022-2286 (published 2022-07-02T19:15Z)

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Bram Moolenaar
author_date: 2022-07-01 19:58:30+01:00
msg: patch 9.0.0020: with some completion reading past end of string

Problem:    With some completion reading past end of string.
Solution:   Check the length of the string.
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: insexpand.c
change_type: ModificationType.MODIFY
diff: @@ -2209,11 +2209,21 @@ ins_compl_stop(int c, int prev_mode, int retval)
     // but only do this, if the Popup is still visible
     if (c == Ctrl_E)
     {
+	char_u *p = NULL;
+
 	ins_compl_delete();
 	if (compl_leader != NULL)
-	    ins_bytes(compl_leader + get_compl_len());
+	    p = compl_leader;
 	else if (compl_first_match != NULL)
-	    ins_bytes(compl_orig_text + get_compl_len());
+	    p = compl_orig_text;
+	if (p != NULL)
+	{
+	    int	    compl_len = get_compl_len();
+	    int	    len = (int)STRLEN(p);
+
+	    if (len > compl_len)
+		ins_bytes_len(p + compl_len, len - compl_len);
+	}
 	retval = TRUE;
     }
 

programming_language: C
filename: test_ins_complete.vim
change_type: ModificationType.MODIFY
diff: @@ -2184,4 +2184,12 @@ func Test_complete_smartindent()
   delfunction! FooBarComplete
 endfunc
 
+func Test_complete_overrun()
+  " this was going past the end of the copied text
+  new
+  sil norm si0s0
+  bwipe!
+endfunc
+
+
 " vim: shiftwidth=2 sts=2 expandtab

programming_language: Lua
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -735,6 +735,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    20,
 /**/
     19,
 /**/

programming_language: Ruby
CVE-2021-32685 (published 2021-06-16T01:15Z)

tEnvoy contains the PGP, NaCl, and PBKDF2 in node.js and the browser (hashing, random, encryption, decryption, signatures, conversions), used by TogaTech.org. In versions prior to 7.0.3, the `verifyWithMessage` method of `tEnvoyNaClSigningKey` always returns `true` for any signature that has a SHA-512 hash matching the SHA-512 hash of the message even if the signature was invalid. This issue is patched in version 7.0.3. As a workaround: In `tenvoy.js` under the `verifyWithMessage` method definition within the `tEnvoyNaClSigningKey` class, ensure that the return statement call to `this.verify` ends in `.verified`.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-347
cwe_name: Improper Verification of Cryptographic Signature
description: The product does not verify, or incorrectly verifies, the cryptographic signature for data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/TogaTech/tEnvoy
commit_details: repo_url: https://github.com/TogaTech/tEnvoy
author: CMEONE
author_date: 2021-06-15 10:16:16-07:00
msg: Critical security fix in verifyWithMessage
repository: repo_url: https://github.com/TogaTech/tEnvoy
repo_name: TogaTech/tEnvoy
description: PGP, NaCl, and PBKDF2 in node.js and the browser (hashing, random, encryption, decryption, signatures, conversions), used by TogaTech.org
repo_language: JavaScript
owner: TogaTech
file_changes: filename: tenvoy.js
change_type: ModificationType.MODIFY
diff: @@ -2166,7 +2166,7 @@ function tEnvoyNaClSigningKey(key, type = "secret", password = null, passwordPro
 			throw "tEnvoyNaClSigningKey Fatal Error: Invalid signature.";
 		}
 		let hash = _tEnvoy.util.hexToBytes(signed.split("::")[0]);
-		return this.verify(signed, password) && _tEnvoy.util.bytesToHex(_nacl.hash(_tEnvoy.util.pack(message))) == _tEnvoy.util.bytesToHex(hash);
+		return this.verify(signed, password).verified && _tEnvoy.util.bytesToHex(_nacl.hash(_tEnvoy.util.pack(message))) == _tEnvoy.util.bytesToHex(hash);
 	}
 	
 	this.toPublic = (password = null) => {

programming_language: TeX
filename: tenvoy.js
change_type: ModificationType.MODIFY
diff: @@ -48183,7 +48183,7 @@ function tEnvoyNaClSigningKey(key, type = "secret", password = null, passwordPro
 			throw "tEnvoyNaClSigningKey Fatal Error: Invalid signature.";
 		}
 		let hash = _tEnvoy.util.hexToBytes(signed.split("::")[0]);
-		return this.verify(signed, password) && _tEnvoy.util.bytesToHex(_nacl.hash(_tEnvoy.util.pack(message))) == _tEnvoy.util.bytesToHex(hash);
+		return this.verify(signed, password).verified && _tEnvoy.util.bytesToHex(_nacl.hash(_tEnvoy.util.pack(message))) == _tEnvoy.util.bytesToHex(hash);
 	}
 	
 	this.toPublic = (password = null) => {

programming_language: JavaScript
CVE-2024-32977 (published 2024-05-14T16:17Z)

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.0 contain a vulnerability that allows an unauthenticated attacker to completely bypass the authentication if the `autologinLocal` option is enabled within `config.yaml`, even if they come from networks that are not configured as `localNetworks`, spoofing their IP via the `X-Forwarded-For` header. If autologin is not enabled, this vulnerability does not have any impact. The vulnerability has been patched in version 1.10.1. Until the patch has been applied, OctoPrint administrators who have autologin enabled on their instances should disable it and/or to make the instance inaccessible from potentially hostile networks like the internet.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/OctoPrint/OctoPrint
commit_details: repo_url: https://github.com/OctoPrint/OctoPrint
author: Gina Häußge
author_date: 2024-05-13 15:26:34+02:00
msg: Merge branch 'regressionfix/xff-issue' into staging/bugfix
repository: repo_url: https://github.com/OctoPrint/OctoPrint
repo_name: OctoPrint/OctoPrint
description: OctoPrint is the snappy web interface for your 3D printer!
repo_language: Python
owner: OctoPrint
CVE-2017-9499 (published 2017-06-07T14:29Z)

In ImageMagick 7.0.5-7 Q16, an assertion failure was found in the function SetPixelChannelAttributes, which allows attackers to cause a denial of service via a crafted file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-617
cwe_name: Reachable Assertion
description: The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
extended_description: 
            While assertion is good for catching logic errors and reducing the chances of reaching more serious vulnerability conditions, it can still lead to a denial of service.
            For example, if a server handles multiple simultaneous connections, and an assert() occurs in one single connection that causes all other connections to be dropped, this is a reachable assertion that leads to a denial of service.
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Dirk Lemstra
author_date: 2017-05-15 21:43:29+02:00
msg: Added check for incorrect number of meta channels report in #492.
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: mpc.c
change_type: ModificationType.MODIFY
diff: @@ -568,6 +568,9 @@ static Image *ReadMPCImage(const ImageInfo *image_info,ExceptionInfo *exception)
                 if (LocaleCompare(keyword,"number-meta-channels") == 0)
                   {
                     image->number_meta_channels=StringToUnsignedLong(options);
+                    if (image->number_meta_channels > MaxPixelChannels)
+                      ThrowReaderException(CorruptImageError,
+                        "ImproperImageHeader");
                     break;
                   }
                 break;

programming_language: Objective-C
CVE-2018-6197 (published 2018-01-25T03:29Z)

w3m through 0.5.3 is prone to a NULL pointer dereference flaw in formUpdateBuffer in form.c.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/tats/w3m
commit_details: repo_url: https://github.com/tats/w3m
author: Tatsuya Kinoshita
author_date: 2017-12-27 06:43:52+09:00
msg: Prevent invalid columnPos() call in formUpdateBuffer()

Bug-Debian: https://github.com/tats/w3m/issues/89
repository: repo_url: https://github.com/tats/w3m
repo_name: tats/w3m
description: Debian's w3m: WWW browsable pager
repo_language: C
owner: tats
file_changes: filename: form.c
change_type: ModificationType.MODIFY
diff: @@ -482,6 +482,8 @@ formUpdateBuffer(Anchor *a, Buffer *buf, FormItemList *form)
 	rows = form->rows ? form->rows : 1;
 	col = COLPOS(l, a->start.pos);
 	for (c_rows = 0; c_rows < rows; c_rows++, l = l->next) {
+	    if (l == NULL)
+		break;
 	    if (rows > 1) {
 		pos = columnPos(l, col);
 		a = retrieveAnchor(buf->formitem, l->linenumber, pos);

programming_language: C
CVE-2024-38355 (published 2024-06-19T20:15Z)

Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `socket.io@4.6.2` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the "error" event to catch these errors.\n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/socketio/socket.io
commit_details: repo_url: https://github.com/socketio/socket.io
author: Damien Arrachequesne
author_date: 2023-05-24 10:30:20+02:00
msg: refactor: add a noop handler for the error event

We should reduce the scope of the "event" error in the next major
version, as it is overloaded today:

- it can be sent by the client (`socket.emit("error")`, which is a perfectly valid event name)
- it can be emitted when the connection encounters an error (an invalid packet for example)
- it can be emitted when a packet is rejected in a middleware (`socket.use()`)

Related: https://github.com/socketio/socket.io/issues/2047
repository: repo_url: https://github.com/socketio/socket.io
repo_name: socketio/socket.io
description: Realtime application framework (Node.JS server)
repo_language: TypeScript
owner: socketio
file_changes: filename: socket.ts
change_type: ModificationType.MODIFY
diff: @@ -280,6 +280,9 @@ export class Socket<
       }
     }
     this.handshake = this.buildHandshake(auth);
+
+    // prevents crash when the socket receives an "error" event without listener
+    this.on("error", noop);
   }
 
   /**
@@ -720,12 +723,11 @@ export class Socket<
    * @private
    */
   _onerror(err: Error): void {
-    if (this.listeners("error").length) {
-      this.emitReserved("error", err);
-    } else {
-      console.error("Missing error handler on `socket`.");
-      console.error(err.stack);
-    }
+    // FIXME the meaning of the "error" event is overloaded:
+    //  - it can be sent by the client (`socket.emit("error")`)
+    //  - it can be emitted when the connection encounters an error (an invalid packet for example)
+    //  - it can be emitted when a packet is rejected in a middleware (`socket.use()`)
+    this.emitReserved("error", err);
   }
 
   /**

programming_language: TypeScript
CVE-2022-24769 (published 2022-03-24T20:15Z)

Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby (Docker Engine) prior to version 20.10.14 where containers were incorrectly started with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during `execve(2)`. Normally, when executable programs have specified permitted file capabilities, otherwise unprivileged users and processes can execute those programs and gain the specified file capabilities up to the bounding set. Due to this bug, containers which included executable programs with inheritable file capabilities allowed otherwise unprivileged users and processes to additionally gain these inheritable file capabilities up to the container's bounding set. Containers which use Linux users and groups to perform privilege separation inside the container are most directly impacted. This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set. This bug has been fixed in Moby (Docker Engine) 20.10.14. Running containers should be stopped, deleted, and recreated for the inheritable capabilities to be reset. This fix changes Moby (Docker Engine) behavior such that containers are started with a more typical Linux environment. As a workaround, the entry point of a container can be modified to use a utility like `capsh(1)` to drop inheritable capabilities prior to the primary process starting.

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 5.9, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Weakness information:
cwe_id: CWE-732
cwe_name: Incorrect Permission Assignment for Critical Resource
description: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
extended_description: When a resource is given a permission setting that provides access to a wider range of actors than required, it could lead to the exposure of sensitive information, or the modification of that resource by unintended parties. This is especially dangerous when the resource is related to program configuration, execution, or sensitive user data. For example, consider a misconfigured storage account for the cloud that can be read or written by a public or anonymous user.
         

Fix information:
repo_url: https://github.com/moby/moby
commit_details: repo_url: https://github.com/moby/moby
author: Sebastiaan van Stijn
author_date: 2022-03-23 22:10:17+01:00
msg: Merge pull request from GHSA-2mm7-x5h6-5pvq

oci: inheritable capability set should be empty
repository: repo_url: https://github.com/moby/moby
repo_name: moby/moby
description: The Moby Project - a collaborative project for the container ecosystem to assemble container-based systems
repo_language: Go
owner: moby
CVE-2016-2085 (published 2016-04-27T17:59Z)

The evm_verify_hmac function in security/integrity/evm/evm_main.c in the Linux kernel before 4.5 does not properly copy data, which makes it easier for local users to forge MAC values via a timing side-channel attack.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-19
cwe_name: Data Processing Errors
description: Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Ryan Ware
author_date: 2016-02-11 15:58:44-08:00
msg: EVM: Use crypto_memneq() for digest comparisons

This patch fixes vulnerability CVE-2016-2085.  The problem exists
because the vm_verify_hmac() function includes a use of memcmp().
Unfortunately, this allows timing side channel attacks; specifically
a MAC forgery complexity drop from 2^128 to 2^12.  This patch changes
the memcmp() to the cryptographically safe crypto_memneq().

Reported-by: Xiaofei Rex Guo <xiaofei.rex.guo@intel.com>
Signed-off-by: Ryan Ware <ware@linux.intel.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: evm_main.c
change_type: ModificationType.MODIFY
diff: @@ -23,6 +23,7 @@
 #include <linux/integrity.h>
 #include <linux/evm.h>
 #include <crypto/hash.h>
+#include <crypto/algapi.h>
 #include "evm.h"
 
 int evm_initialized;
@@ -148,7 +149,7 @@ static enum integrity_status evm_verify_hmac(struct dentry *dentry,
 				   xattr_value_len, calc.digest);
 		if (rc)
 			break;
-		rc = memcmp(xattr_data->digest, calc.digest,
+		rc = crypto_memneq(xattr_data->digest, calc.digest,
 			    sizeof(calc.digest));
 		if (rc)
 			rc = -EINVAL;

programming_language: C
CVE-2022-27470 (published 2022-05-04T03:15Z)

SDL_ttf v2.0.18 and below was discovered to contain an arbitrary memory write via the function TTF_RenderText_Solid(). This vulnerability is triggered via a crafted TTF file.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/libsdl-org/SDL_ttf
commit_details: repo_url: https://github.com/libsdl-org/SDL_ttf
author: Sylvain
author_date: 2022-03-19 20:40:28+01:00
msg: More integer overflow (see bug #187)
Make sure that 'width + alignment' doesn't overflow, otherwise
it could create a SDL_Surface of 'width' but with wrong 'pitch'
repository: repo_url: https://github.com/libsdl-org/SDL_ttf
repo_name: libsdl-org/SDL_ttf
description: Support for TrueType (.ttf) font files with Simple Directmedia Layer.
repo_language: C
owner: libsdl-org
file_changes: filename: SDL_ttf.c
change_type: ModificationType.MODIFY
diff: @@ -1257,7 +1257,7 @@ static SDL_Surface* Create_Surface_Solid(int width, int height, SDL_Color fg, Ui
      */
     void *pixels, *ptr;
     /* Worse case at the end of line pulling 'alignment' extra blank pixels */
-    Sint64 pitch = width + alignment;
+    Sint64 pitch = (Sint64)width + (Sint64)alignment;
     pitch += alignment;
     pitch &= ~alignment;
     size = height * pitch + sizeof (void *) + alignment;
@@ -1321,7 +1321,7 @@ static SDL_Surface* Create_Surface_Shaded(int width, int height, SDL_Color fg, S
      */
     void *pixels, *ptr;
     /* Worse case at the end of line pulling 'alignment' extra blank pixels */
-    Sint64 pitch = width + alignment;
+    Sint64 pitch = (Sint64)width + (Sint64)alignment;
     pitch += alignment;
     pitch &= ~alignment;
     size = height * pitch + sizeof (void *) + alignment;
@@ -1418,7 +1418,7 @@ static SDL_Surface *Create_Surface_Blended(int width, int height, SDL_Color fg,
         Sint64 size;
         void *pixels, *ptr;
         /* Worse case at the end of line pulling 'alignment' extra blank pixels */
-        Sint64 pitch = (width + alignment) * 4;
+        Sint64 pitch = ((Sint64)width + (Sint64)alignment) * 4;
         pitch += alignment;
         pitch &= ~alignment;
         size = height * pitch + sizeof (void *) + alignment;

programming_language: C