starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2022-0226 (published 2022-01-14T19:15Z)

livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/livehelperchat/livehelperchat
commit_details: repo_url: https://github.com/livehelperchat/livehelperchat
author: Remigijus Kiminas
author_date: 2022-01-13 14:04:29-05:00
msg: Missing csfr check
repository: repo_url: https://github.com/livehelperchat/livehelperchat
repo_name: LiveHelperChat/livehelperchat
description: Live Helper Chat - live support for your website. Featuring web and mobile apps, Voice & Video & ScreenShare. Supports Telegram, Twilio (whatsapp), Facebook messenger including building a bot.
repo_language: PHP
owner: livehelperchat
file_changes: filename: configuration.php
change_type: ModificationType.MODIFY
diff: @@ -7,6 +7,11 @@ $data = (array)$auditOptions->data;
 
 if ( isset($_POST['StoreOptions']) ) {
 
+    if (!isset($_POST['csfr_token']) || !$currentUser->validateCSFRToken($_POST['csfr_token'])) {
+        erLhcoreClassModule::redirect();
+        exit;
+    }
+    
     $definition = array(
         'days_log' => new ezcInputFormDefinitionElement(ezcInputFormDefinitionElement::OPTIONAL, 'int'),
         'log_js' => new ezcInputFormDefinitionElement(ezcInputFormDefinitionElement::OPTIONAL, 'boolean'),

programming_language: PHP
CVE-2023-38201 (published 2023-08-25T17:15Z)

A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide the true status of a monitored machine if the fake agent is added to the verifier list by a legitimate user, resulting in a breach of the integrity of the registrar database.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/keylime/keylime
commit_details: repo_url: https://github.com/keylime/keylime
author: Marcio Silva
author_date: 2023-07-12 12:05:47-03:00
msg: Fix for CVE-2023-38201 (Security Advisory GHSA-f4r5-q63f-gcww)

In addition to remove the offending message, this patch also ensures
deletion of an agent's record from the database in case of failure after
a single attempt.

Signed-off-by: Marcio Silva <marcio.a.silva@ibm.com>
repository: repo_url: https://github.com/keylime/keylime
repo_name: keylime/keylime
description: A CNCF Project to Bootstrap & Maintain Trust on the Edge / Cloud and IoT
repo_language: Python
owner: keylime
file_changes: filename: registrar_common.py
change_type: ModificationType.MODIFY
diff: @@ -250,7 +250,9 @@ class UnprotectedHandler(BaseHandler):
             try:
                 port = int(port)
                 if port < 1 or port > 65535:
-                    logger.warning("Contact port for agent %s is not a number between 1 and got: %s.", agent_id, port)
+                    logger.warning(
+                        "Contact port for agent %s is not a number between 1 and 65535 got: %s.", agent_id, port
+                    )
                     port = None
             except ValueError:
                 logger.warning("Contact port for agent %s is not a valid number got: %s.", agent_id, port)
@@ -447,7 +449,16 @@ class UnprotectedHandler(BaseHandler):
                     logger.error("SQLAlchemy Error: %s", e)
                     raise
             else:
-                raise Exception(f"Auth tag {auth_tag} does not match expected value {ex_mac}")
+                if agent_id and session.query(RegistrarMain).filter_by(agent_id=agent_id).delete():
+                    try:
+                        session.commit()
+                    except SQLAlchemyError as e:
+                        logger.error("SQLAlchemy Error: %s", e)
+                        raise
+
+                raise Exception(
+                    f"Auth tag {auth_tag} for agent {agent_id} does not match expected value. The agent has been deleted from database, and a restart of it will be required"
+                )
 
             web_util.echo_json_response(self, 200, "Success")
             logger.info("PUT activated: %s", agent_id)

programming_language: Python
CVE-2021-44273 (published 2021-12-23T12:15Z)

e2guardian v5.4.x <= v5.4.3r is affected by missing SSL certificate validation in the SSL MITM engine. In standalone mode (i.e., acting as a proxy or a transparent proxy), with SSL MITM enabled, e2guardian, if built with OpenSSL v1.1.x, did not validate hostnames in certificates of the web servers that it connected to, and thus was itself vulnerable to MITM attacks.

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v3 base score: 7.4, HIGH (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)

Weakness information:
cwe_id: CWE-295
cwe_name: Improper Certificate Validation
description: The product does not validate, or incorrectly validates, a certificate.
extended_description: When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting spoofed data that appears to originate from a trusted host.
         

Fix information:
repo_url: https://github.com/e2guardian/e2guardian
commit_details: repo_url: https://github.com/e2guardian/e2guardian
author: Philip Pearce
author_date: 2021-11-23 09:52:38+00:00
msg: Fix bug #707 cert hostnames not being checked
- only happened when openssl v1.1 is used
repository: repo_url: https://github.com/e2guardian/e2guardian
repo_name: e2guardian/e2guardian
description: E2guardian is a web content filter that  can work in proxy, transparent or icap server modes
repo_language: HTML
owner: e2guardian
file_changes: filename: Socket.cpp
change_type: ModificationType.MODIFY
diff: @@ -377,6 +377,10 @@ int Socket::startSslClient(const std::string &certificate_path, String hostname)
     //fcntl(this->getFD() ,F_SETFL, O_NONBLOCK); // blocking mode used currently
     SSL_set_fd(ssl, this->getFD());
     SSL_set_tlsext_host_name(ssl, hostname.c_str());
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+#else
+  X509_VERIFY_PARAM_set1_host(SSL_get0_param(ssl),hostname.c_str(),0);
+#endif
 
     //make io non blocking as select wont tell us if we can do a read without blocking
     //BIO_set_nbio(SSL_get_rbio(ssl),1l);  // blocking mode used currently

programming_language: C++
CVE-2017-16820 (published 2017-11-14T21:29Z)

The csnmp_read_table function in snmp.c in the SNMP plugin in collectd before 5.6.3 is susceptible to a double free in a certain error case, which could lead to a crash (or potentially have other impact).

Severity: HIGH
CVSS v2 base score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-415
cwe_name: Double Free
description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
extended_description: When a program calls free() twice with the same argument, the program's memory management data structures become corrupted. This corruption can cause the program to crash or, in some circumstances, cause two later calls to malloc() to return the same pointer. If malloc() returns the same value twice and the program later gives the attacker control over the data that is written into this doubly-allocated memory, the program becomes vulnerable to a buffer overflow attack.
         

Fix information:
repo_url: https://github.com/collectd/collectd
commit_details: repo_url: https://github.com/collectd/collectd
author: Pavel Rochnyack
author_date: 2017-05-31 23:27:13+07:00
msg: snmp plugin: Fix double free of request PDU

snmp_sess_synch_response() always frees request PDU, in both case of request
error and success. If error condition occurs inside of `while (status == 0)`
loop, double free of `req` happens.

Issue: #2291
Signed-off-by: Florian Forster <octo@collectd.org>
repository: repo_url: https://github.com/collectd/collectd
repo_name: collectd/collectd
description: The system statistics collection daemon. Please send Pull Requests here!
repo_language: C
owner: collectd
file_changes: filename: snmp.c
change_type: ModificationType.MODIFY
diff: @@ -1357,11 +1357,13 @@ static int csnmp_read_table(host_definition_t *host, data_definition_t *data) {
     if (oid_list_todo_num == 0) {
       /* The request is still empty - so we are finished */
       DEBUG("snmp plugin: all variables have left their subtree");
+      snmp_free_pdu(req);
       status = 0;
       break;
     }
 
     res = NULL;
+    /* snmp_sess_synch_response always frees our req PDU */
     status = snmp_sess_synch_response(host->sess_handle, req, &res);
     if ((status != STAT_SUCCESS) || (res == NULL)) {
       char *errstr = NULL;
@@ -1376,8 +1378,6 @@ static int csnmp_read_table(host_definition_t *host, data_definition_t *data) {
         snmp_free_pdu(res);
       res = NULL;
 
-      /* snmp_synch_response already freed our PDU */
-      req = NULL;
       sfree(errstr);
       csnmp_host_close_session(host);
 
@@ -1492,9 +1492,6 @@ static int csnmp_read_table(host_definition_t *host, data_definition_t *data) {
     snmp_free_pdu(res);
   res = NULL;
 
-  if (req != NULL)
-    snmp_free_pdu(req);
-  req = NULL;
 
   if (status == 0)
     csnmp_dispatch_table(host, data, instance_list_head, value_list_head);

programming_language: C
CVE-2016-7144 (published 2017-01-18T17:59Z)

The m_authenticate function in modules/m_sasl.c in UnrealIRCd before 3.2.10.7 and 4.x before 4.0.6 allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted AUTHENTICATE parameter.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.1, HIGH (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/unrealircd/unrealircd
commit_details: repo_url: https://github.com/unrealircd/unrealircd
author: Bram Matthys
author_date: 2016-09-03 20:08:21+02:00
msg: Fix AUTHENTICATE bug
repository: repo_url: https://github.com/unrealircd/unrealircd
repo_name: unrealircd/unrealircd
description: Official UnrealIRCd repository. Downloads are available from our site
repo_language: C
owner: unrealircd
file_changes: filename: m_sasl.c
change_type: ModificationType.MODIFY
diff: @@ -230,6 +230,12 @@ CMD_FUNC(m_authenticate)
 		return 0;
 	}
 
+	if ((parv[1][0] == ':') || strchr(parv[1], ' '))
+	{
+		sendto_one(sptr, err_str(ERR_CANNOTDOCOMMAND), me.name, "*", "AUTHENTICATE", "Invalid parameter");
+		return 0;
+	}
+
 	if (strlen(parv[1]) > 400)
 	{
 		sendto_one(sptr, err_str(ERR_SASLTOOLONG), me.name, BadPtr(sptr->name) ? "*" : sptr->name);

programming_language: C
CVE-2019-15901 (published 2019-10-18T16:15Z)

An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. A setusercontext(3) call with flags to change the UID, primary GID, and secondary GIDs was replaced (on certain platforms: Linux and possibly NetBSD) with a single setuid(2) call. This resulted in neither changing the group id nor initializing secondary group ids.

Severity: HIGH
CVSS v2 base score: 9.0 (AV:N/AC:L/Au:S/C:C/I:C/A:C)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-269
cwe_name: Improper Privilege Management
description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/slicer69/doas
commit_details: repo_url: https://github.com/slicer69/doas
author: Duncan Overbruck
author_date: 2019-09-03 00:41:14+02:00
msg: fix the setusercontext(3) workaround

Seeing this being used on even more system like Illumos with this ugly
and security critical bug open makes me cringe every time I check if it
was finally fixed.

I reported it directly to the maintainer in 2017. I reported it to
pkgsrc-security@netbsd.org without a response.
repository: repo_url: https://github.com/slicer69/doas
repo_name: slicer69/doas
description: A port of OpenBSD's doas which runs on FreeBSD, Linux, NetBSD, and illumos
repo_language: C
owner: slicer69
file_changes: filename: doas.c
change_type: ModificationType.MODIFY
diff: @@ -542,6 +542,23 @@ main(int argc, char **argv)
 	    LOGIN_SETPRIORITY | LOGIN_SETRESOURCES | LOGIN_SETUMASK |
 	    LOGIN_SETUSER) != 0)
 		errx(1, "failed to set user context for target");
+#else
+	#if defined(__linux__) || defined(__FreeBSD__) || defined(__NetBSD__)
+	if (setresgid(target_pw->pw_gid, target_pw->pw_gid, target_pw->pw_gid) == -1)
+		err(1, "setresgid");
+	#else
+	if (setregid(target_pw->pw_gid, target_pw->pw_gid) == -1)
+		err(1, "setregid");
+	#endif
+	if (initgroups(target_pw->pw_name, target_pw->pw_gid) == -1)
+		err(1, "initgroups");
+	#if defined(__linux__) || defined(__FreeBSD__) || defined(__NetBSD__)
+	if (setresuid(target, target, target) == -1)
+		err(1, "setresuid");
+	#else
+	if (setreuid(target, target) == -1)
+		err(1, "setreuid");
+	#endif
 #endif
         /*
 	if (pledge("stdio rpath exec", NULL) == -1)
@@ -557,14 +574,6 @@ main(int argc, char **argv)
         if (pledge("stdio exec", NULL) == -1)
 		err(1, "pledge");
         */
-#ifndef HAVE_LOGIN_CAP_H
-        /* If we effectively are root, set the UID to actually be root to avoid
-           permission errors. */
-        if (target != 0)
-           setuid(target);
-        if ( geteuid() == ROOT_UID )
-           setuid(ROOT_UID);
-#endif
 
 	syslog(LOG_AUTHPRIV | LOG_INFO, "%s ran command %s as %s from %s",
 	    myname, cmdline, target_pw->pw_name, cwd);

programming_language: C
CVE-2022-1899 (published 2022-05-26T17:15Z)

Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0.

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 9.1, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/radareorg/radare2
commit_details: repo_url: https://github.com/radareorg/radare2
author: pancake
author_date: 2022-05-26 17:42:39+02:00
msg: Fix integer overflow in string search causing oobread ##crash

* Reported by @greatergoodest via huntrdev
* BountyID: 8a3dc5cb-08b3-4807-82b2-77f08c137a04
* Reproducer bfileovf
repository: repo_url: https://github.com/radareorg/radare2
repo_name: radareorg/radare2
description: UNIX-like reverse engineering framework and command-line toolset
repo_language: C
owner: radareorg
file_changes: filename: bfile.c
change_type: ModificationType.MODIFY
diff: @@ -178,19 +178,19 @@ static int string_scan_range(RList *list, RBinFile *bf, int min,
 	free (charset);
 	RConsIsBreaked is_breaked = (bin && bin->consb.is_breaked)? bin->consb.is_breaked: NULL;
 	// may oobread
-	while (needle < to) {
+	while (needle < to && needle < UT64_MAX - 4) {
 		if (is_breaked && is_breaked ()) {
 			break;
 		}
 		// smol optimization
-		if (needle + 4 < to) {
-			ut32 n1 = r_read_le32 (buf + needle - from);
+		if (needle < to - 4) {
+			ut32 n1 = r_read_le32 (buf + (needle - from));
 			if (!n1) {
 				needle += 4;
 				continue;
 			}
 		}
-		rc = r_utf8_decode (buf + needle - from, to - needle, NULL);
+		rc = r_utf8_decode (buf + (needle - from), to - needle, NULL);
 		if (!rc) {
 			needle++;
 			continue;
@@ -198,7 +198,7 @@ static int string_scan_range(RList *list, RBinFile *bf, int min,
 		bool addr_aligned = !(needle % 4);
 
 		if (type == R_STRING_TYPE_DETECT) {
-			char *w = (char *)buf + needle + rc - from;
+			char *w = (char *)buf + (needle + rc - from);
 			if (((to - needle) > 8 + rc)) {
 				// TODO: support le and be
 				bool is_wide32le = (needle + rc + 2 < to) && (!w[0] && !w[1] && !w[2] && w[3] && !w[4]);
@@ -248,7 +248,7 @@ static int string_scan_range(RList *list, RBinFile *bf, int min,
 					rc = 2;
 				}
 			} else {
-				rc = r_utf8_decode (buf + needle - from, to - needle, &r);
+				rc = r_utf8_decode (buf + (needle - from), to - needle, &r);
 				if (rc > 1) {
 					str_type = R_STRING_TYPE_UTF8;
 				}

programming_language: C
CVE-2021-43579 (published 2022-01-10T14:10Z)

A stack-based buffer overflow in image_load_bmp() in HTMLDOC <= 1.9.13 results in remote code execution if the victim converts an HTML document linking to a crafted BMP file.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/michaelrsweet/htmldoc
commit_details: repo_url: https://github.com/michaelrsweet/htmldoc
author: Michael R Sweet
author_date: 2021-11-05 09:35:10-04:00
msg: Fix potential BMP stack overflow (Issue #453)
repository: repo_url: https://github.com/michaelrsweet/htmldoc
repo_name: michaelrsweet/htmldoc
description: HTML Conversion Software
repo_language: C++
owner: michaelrsweet
file_changes: filename: CHANGES.md
change_type: ModificationType.MODIFY
diff: @@ -6,6 +6,7 @@
 - Fixed a crash bug when a HTML comment contains an invalid nul character
   (Issue #439)
 - Fixed a crash bug with bogus BMP images (Issue #444)
+- Fixed a stack overflow bug with bogus BMP images (Issue #453)
 
 
 # Changes in HTMLDOC v1.9.12

programming_language: Markdown
filename: image.cxx
change_type: ModificationType.MODIFY
diff: @@ -919,12 +919,16 @@ image_load_bmp(image_t *img,	/* I - Image to load into */
     return (-1);
 
   if (info_size > 40)
+  {
     for (info_size -= 40; info_size > 0; info_size --)
       getc(fp);
+  }
 
   // Get colormap...
   if (colors_used == 0 && depth <= 8)
     colors_used = 1 << depth;
+  else if (colors_used > 256)
+    return (-1);
 
   fread(colormap, (size_t)colors_used, 4, fp);
 

programming_language: C
CVE-2017-7274 (published 2017-03-27T17:59Z)

The r_pkcs7_parse_cms function in libr/util/r_pkcs7.c in radare2 1.3.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PE file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/radare/radare2
commit_details: repo_url: https://github.com/radare/radare2
author: Giovanni
author_date: 2017-03-27 12:55:16+02:00
msg: Fix #7152 - Null deref in cms
repository: repo_url: https://github.com/radare/radare2
repo_name: radareorg/radare2
description: UNIX-like reverse engineering framework and command-line toolset
repo_language: C
owner: radare
file_changes: filename: r_pkcs7.c
change_type: ModificationType.MODIFY
diff: @@ -284,7 +284,9 @@ RCMS *r_pkcs7_parse_cms (const ut8 *buffer, ut32 length) {
 		return NULL;
 	}
 	object = r_asn1_create_object (buffer, length);
-	if (!object || object->list.length != 2 || !object->list.objects[0] || object->list.objects[1]->list.length != 1) {
+	if (!object || object->list.length != 2 || !object->list.objects ||
+		!object->list.objects[0] || !object->list.objects[1] ||
+		object->list.objects[1]->list.length != 1) {
 		r_asn1_free_object (object);
 		free (container);
 		return NULL;

programming_language: C