starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2017-16645 (published 2017-11-07T23:29Z)

The ims_pcu_get_cdc_union_desc function in drivers/input/misc/ims-pcu.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (ims_pcu_parse_cdc_data out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device.

Severity: HIGH
CVSS v2 base score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 6.6, MEDIUM (CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Dmitry Torokhov
author_date: 2017-10-07 11:07:47-07:00
msg: Input: ims-psu - check if CDC union descriptor is sane

Before trying to use CDC union descriptor, try to validate whether that it
is sane by checking that intf->altsetting->extra is big enough and that
descriptor bLength is not too big and not too small.

Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: ims-pcu.c
change_type: ModificationType.MODIFY
diff: @@ -1635,13 +1635,25 @@ ims_pcu_get_cdc_union_desc(struct usb_interface *intf)
 		return NULL;
 	}
 
-	while (buflen > 0) {
+	while (buflen >= sizeof(*union_desc)) {
 		union_desc = (struct usb_cdc_union_desc *)buf;
 
+		if (union_desc->bLength > buflen) {
+			dev_err(&intf->dev, "Too large descriptor\n");
+			return NULL;
+		}
+
 		if (union_desc->bDescriptorType == USB_DT_CS_INTERFACE &&
 		    union_desc->bDescriptorSubType == USB_CDC_UNION_TYPE) {
 			dev_dbg(&intf->dev, "Found union header\n");
-			return union_desc;
+
+			if (union_desc->bLength >= sizeof(*union_desc))
+				return union_desc;
+
+			dev_err(&intf->dev,
+				"Union descriptor to short (%d vs %zd\n)",
+				union_desc->bLength, sizeof(*union_desc));
+			return NULL;
 		}
 
 		buflen -= union_desc->bLength;

programming_language: C
CVE-2022-4878 (published 2023-01-06T10:15Z)

A vulnerability classified as critical has been found in JATOS. Affected is the function ZipUtil of the file modules/common/app/utils/common/ZipUtil.java of the component ZIP Handler. The manipulation leads to path traversal. Upgrading to version 3.7.5-alpha is able to address this issue. The name of the patch is 2b42519f309d8164e8811392770ce604cdabb5da. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217548.

CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/JATOS/JATOS
commit_details: repo_url: https://github.com/JATOS/JATOS
author: Kristian Lange
author_date: 2022-04-23 16:24:52+02:00
msg: ZipUtil.java - check for path traversal attack
repository: repo_url: https://github.com/JATOS/JATOS
repo_name: JATOS/JATOS
description: Just Another Tool for Online Studies
repo_language: JavaScript
owner: JATOS
file_changes: filename: ZipUtil.java
change_type: ModificationType.MODIFY
diff: @@ -34,6 +34,7 @@ public class ZipUtil {
      * zip's content in there. The method can handle recursive unzipping of sub-directories.
      */
     public static File unzip(File fileToUnzip, File destDir) throws IOException {
+        destDir = destDir.toPath().normalize().toFile(); // normalize to prevent path traversal attacks
         FileUtils.deleteQuietly(destDir);
         IOUtils.createDir(destDir);
         destDir.deleteOnExit();

programming_language: Java
CVE-2022-23562 (published 2022-02-04T23:15Z)

Tensorflow is an Open Source Machine Learning Framework. The implementation of `Range` suffers from integer overflows. These can trigger undefined behavior or, in some scenarios, extremely large allocations. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: TensorFlower Gardener
author_date: 2021-12-16 19:26:39-08:00
msg: Merge pull request #52707 from elfringham:init_ops_test_fix

PiperOrigin-RevId: 416941851
Change-Id: Iefa5a9b841b053b36f6b105cd82c9d32d5e47850
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
CVE-2023-36321 (published 2023-10-17T23:15Z)

Connected Vehicle Systems Alliance (COVESA) up to v2.18.8 was discovered to contain a buffer overflow via the component /shared/dlt_common.c.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-120
cwe_name: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
extended_description: A buffer overflow condition exists when a product attempts to put more data in a buffer than it can hold, or when it attempts to put data in a memory area outside of the boundaries of a buffer. The simplest type of error, and the most common cause of buffer overflows, is the "classic" case in which the product copies the buffer without restricting how much is copied. Other variants exist, but the existence of a classic overflow strongly suggests that the programmer is not considering even the most basic of security protections.
         

Fix information:
repo_url: https://github.com/michael-methner/dlt-daemon
commit_details: repo_url: https://github.com/michael-methner/dlt-daemon
author: Michael Methner
author_date: 2023-01-27 10:51:07+01:00
msg: Check for negative index in dlt_file_message

Fixes #436

Signed-off-by: Michael Methner <mmethner@de.adit-jv.com>
repository: repo_url: https://github.com/michael-methner/dlt-daemon
repo_name: michael-methner/dlt-daemon
description: Diagnostic Log and Trace.
repo_language: C
owner: michael-methner
file_changes: filename: dlt_common.c
change_type: ModificationType.MODIFY
diff: @@ -1718,7 +1718,7 @@ DltReturnValue dlt_file_message(DltFile *file, int index, int verbose)
         return DLT_RETURN_WRONG_PARAMETER;
 
     /* check if message is in range */
-    if (index >= file->counter) {
+    if (index < 0 || index >= file->counter) {
         dlt_vlog(LOG_WARNING, "Message %d out of range!\r\n", index);
         return DLT_RETURN_WRONG_PARAMETER;
     }

programming_language: C
CVE-2018-25057 (published 2022-12-28T21:15Z)

A vulnerability was found in simple_php_link_shortener. It has been classified as critical. Affected is an unknown function of the file index.php. The manipulation of the argument $link["id"] leads to sql injection. The name of the patch is b26ac6480761635ed94ccb0222ba6b732de6e53f. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216996.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/mikebharris/simple_php_link_shortener
commit_details: repo_url: https://github.com/mikebharris/simple_php_link_shortener
author: Mike B Harris
author_date: 2018-06-25 23:47:27+01:00
msg: Better protection against SQL injection
repository: repo_url: https://github.com/mikebharris/simple_php_link_shortener
repo_name: mikebharris/simple_php_link_shortener
description: A very simple lightweight URL shorter or simplifier written in PHP
repo_language: PHP
owner: mikebharris
file_changes: filename: index.php
change_type: ModificationType.MODIFY
diff: @@ -30,7 +30,7 @@ if (isset($_SERVER["QUERY_STRING"]) && ($_SERVER["QUERY_STRING"] != '')) {
   }
 
   $link = $result->fetch_array(MYSQLI_ASSOC);
-  $query = "UPDATE short_links SET count = count + 1, last_request = NOW() WHERE id = " . $link["id"];
+  $query = sprintf("UPDATE short_links SET count = count + 1, last_request = NOW() WHERE id = ''%s''", $link["id"]);
 
   $result = $mysqli->query($query);
 

programming_language: PHP
CVE-2023-34474 (published 2023-06-16T20:15Z)

A heap-based buffer overflow issue was discovered in ImageMagick's ReadTIM2ImageData() function in coders/tim2.c. A local attacker could trick the user in opening specially crafted file, triggering an out-of-bounds read error, allowing an application to crash, resulting in a denial of service.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2023-05-15 14:22:11-04:00
msg: carefully crafted image files (TIM2, JPEG) no longer overflow buffer nor use heap after free (thanks to Juzhi Lu, Zhen Zhou, Likang Luo of NSFOCUS Security Team)
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: profile.c
change_type: ModificationType.MODIFY
diff: @@ -2458,11 +2458,12 @@ static void ReplaceXmpValue(StringInfo *profile,size_t start,size_t end,
   if (new_length > length)
     SetStringInfoLength(profile,new_length);
   datum=(char *) GetStringInfoDatum(profile);
-  memmove(datum+start+value_length,datum+end,length-end);
-  memcpy(datum+start,value,value_length);
+  (void) memmove(datum+start+value_length,datum+end,length-end);
+  (void) memcpy(datum+start,value,value_length);
   if (new_length < length)
     {
       SetStringInfoLength(profile,new_length);
+      datum=(char *) GetStringInfoDatum(profile);
       *(datum+new_length)='\0';
     }
 }

programming_language: Objective-C
filename: tim2.c
change_type: ModificationType.MODIFY
diff: @@ -517,10 +517,12 @@ static MagickBooleanType ReadTIM2ImageData(const ImageInfo *image_info,
     /*
       * ### Read CLUT Data ###
       */
-    clut_data=(unsigned char *) AcquireQuantumMemory(1,header->clut_size);
+    clut_data=(unsigned char *) AcquireQuantumMemory(2,
+      MagickMax(header->clut_size,image->colors));
     if (clut_data == (unsigned char *) NULL)
       ThrowBinaryException(ResourceLimitError,"MemoryAllocationFailed",
         image_info->filename);
+    (void) memset(clut_data,0,2*MagickMax(header->clut_size,image->colors));
     count=ReadBlob(image,header->clut_size,clut_data);
     if (count != (ssize_t) (header->clut_size))
       {

programming_language: Objective-C
CVE-2024-26128 (published 2024-02-22T19:15Z)

baserCMS is a website development framework. Prior to version 5.0.9, there is a cross-site scripting vulnerability in the content management feature. Version 5.0.9 contains a fix for this vulnerability.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/baserproject/basercms
commit_details: repo_url: https://github.com/baserproject/basercms
author: sakaguchi
author_date: 2024-02-22 15:20:00+09:00
msg: Merge pull request from GHSA-jjxq-m8h3-4vw5
repository: repo_url: https://github.com/baserproject/basercms
repo_name: baserproject/basercms
description: baserCMS :  Based Website Development Project
repo_language: PHP
owner: baserproject
file_changes: filename: BcAdminFormHelper.php
change_type: ModificationType.MODIFY
diff: @@ -63,7 +63,7 @@ class BcAdminFormHelper extends BcFormHelper
                         'deleteLabel' => ['class' => 'bca-file__delete-label'],
                         'figure' => ['class' => 'bca-file__figure'],
                         'img' => ['class' => 'bca-file__img'],
-                        'figcaption' => ['class' => 'bca-file__figcaption']
+                        'figcaption' => ['class' => 'bca-file__figcaption', 'escape' => true]
                     ], $options);
                     break;
                 case 'dateTimePicker':

programming_language: PHP
CVE-2016-15013 (published 2023-01-07T20:15Z)

A vulnerability was found in ForumHulp searchresults. It has been rated as critical. Affected by this issue is the function list_keywords of the file event/listener.php. The manipulation of the argument word leads to sql injection. The name of the patch is dd8a312bb285ad9735a8e1da58e9e955837b7322. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217628.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/ForumHulp/searchresults
commit_details: repo_url: https://github.com/ForumHulp/searchresults
author: Daniel Mota
author_date: 2016-10-25 16:59:22+01:00
msg: SQL Injection Fix

This would fix a Major SQL Injection Flaw. I guess the $this->db->sql_escape is the right function.
repository: repo_url: https://github.com/ForumHulp/searchresults
repo_name: ForumHulp/searchresults
description: A phpBB 3 extension displaying a list of words you visitors searched for
repo_language: PHP
owner: ForumHulp
file_changes: filename: listener.php
change_type: ModificationType.MODIFY
diff: @@ -73,11 +73,11 @@ class listener implements EventSubscriberInterface
 				continue;
 			}
 
-			$sql = 'SELECT word_id FROM ' . SEARCH_WORDLIST_TABLE . ' WHERE word_text = "' . $word . '"';
+			$sql = 'SELECT word_id FROM ' . SEARCH_WORDLIST_TABLE . ' WHERE word_text = "' . $this->db->sql_escape($word) . '"';
 			$resulttemp = $this->db->sql_query($sql);
 			$found = ($rowtemp = $this->db->sql_fetchrow($resulttemp));
 
-			$sql = 'SELECT search_keywords, last_time FROM ' . $this->searchresults_table . ' WHERE search_keywords = "' . $word . '"';
+			$sql = 'SELECT search_keywords, last_time FROM ' . $this->searchresults_table . ' WHERE search_keywords = "' . $this->db->sql_escape($word) . '"';
 			$result = $this->db->sql_query($sql);
 			$used = ($row = $this->db->sql_fetchrow($result));
 			$this->db->sql_freeresult($result);

programming_language: PHP
CVE-2017-8925 (published 2017-05-12T21:29Z)

The omninet_open function in drivers/usb/serial/omninet.c in the Linux kernel before 4.10.4 allows local users to cause a denial of service (tty exhaustion) by leveraging reference count mishandling.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-404
cwe_name: Improper Resource Shutdown or Release
description: The product does not release or incorrectly releases a resource before it is made available for re-use.
extended_description: When a resource is created or allocated, the developer is responsible for properly releasing the resource as well as accounting for all potential paths of expiration or invalidation, such as a set period of time or revocation.
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Johan Hovold
author_date: 2017-03-06 17:36:38+01:00
msg: USB: serial: omninet: fix reference leaks at open

This driver needlessly took another reference to the tty on open, a
reference which was then never released on close. This lead to not just
a leak of the tty, but also a driver reference leak that prevented the
driver from being unloaded after a port had once been opened.

Fixes: 4a90f09b20f4 ("tty: usb-serial krefs")
Cc: stable <stable@vger.kernel.org>	# 2.6.28
Signed-off-by: Johan Hovold <johan@kernel.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: omninet.c
change_type: ModificationType.MODIFY
diff: @@ -142,12 +142,6 @@ static int omninet_port_remove(struct usb_serial_port *port)
 
 static int omninet_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
-	struct usb_serial	*serial = port->serial;
-	struct usb_serial_port	*wport;
-
-	wport = serial->port[1];
-	tty_port_tty_set(&wport->port, tty);
-
 	return usb_serial_generic_open(tty, port);
 }
 

programming_language: C
CVE-2015-0258 (published 2020-02-17T18:15Z)

Multiple incomplete blacklist vulnerabilities in the avatar upload functionality in manageuser.php in Collabtive before 2.1 allow remote authenticated users to execute arbitrary code by uploading a file with a (1) .php3, (2) .php4, (3) .php5, or (4) .phtml extension.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/philippK-de/Collabtive
commit_details: repo_url: https://github.com/philippK-de/Collabtive
author: Philipp Kiszka
author_date: 2015-02-05 05:15:40+01:00
msg: fix code execution filter

in avatar upload
repository: repo_url: https://github.com/philippK-de/Collabtive
repo_name: philippK-de/Collabtive
description: Collabtive is web based project management software
repo_language: PHP
owner: philippK-de
file_changes: filename: manageuser.php
change_type: ModificationType.MODIFY
diff: @@ -151,7 +151,7 @@ if ($action == "loginerror") {
             die();
         }
         // don't upload php scripts
-        if ($erweiterung == "php" or $erweiterung == "pl") {
+        if (stristr($erweiterung,"php") or $erweiterung == "pl") {
             $loc = $url . "manageuser.php?action=profile&id=$userid";
             header("Location: $loc");
             die();

programming_language: PHP