starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2018-16645 (published 2018-09-06T22:29Z)

There is an excessive memory allocation issue in the functions ReadBMPImage of coders/bmp.c and ReadDIBImage of coders/dib.c in ImageMagick 7.0.8-11, which allows remote attackers to cause a denial of service via a crafted image file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-770
cwe_name: Allocation of Resources Without Limits or Throttling
description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
extended_description: Code frequently has to work with limited resources, so programmers must be careful to ensure that resources are not consumed too quickly, or too easily.  Without use of quotas, resource limits, or other protection mechanisms, it can be easy for an attacker to consume many resources by rapidly making many requests, or causing larger resources to be used than is needed. When too many resources are allocated, or if a single resource is too large, then it can prevent the code from working correctly, possibly leading to a denial of service.
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2018-08-27 15:24:10-04:00
msg: https://github.com/ImageMagick/ImageMagick/issues/1268
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: bmp.c
change_type: ModificationType.MODIFY
diff: @@ -661,6 +661,8 @@ static Image *ReadBMPImage(const ImageInfo *image_info,ExceptionInfo *exception)
         bmp_info.x_pixels=ReadBlobLSBLong(image);
         bmp_info.y_pixels=ReadBlobLSBLong(image);
         bmp_info.number_colors=ReadBlobLSBLong(image);
+        if (bmp_info.number_colors > GetBlobSize(image))
+          ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
         bmp_info.colors_important=ReadBlobLSBLong(image);
         if (image->debug != MagickFalse)
           {

programming_language: Objective-C
CVE-2019-25078 (published 2022-12-13T18:15Z)

A vulnerability classified as problematic was found in pacparser up to 1.3.x. Affected by this vulnerability is the function pacparser_find_proxy of the file src/pacparser.c. The manipulation of the argument url leads to buffer overflow. Attacking locally is a requirement. Upgrading to version 1.4.0 is able to address this issue. The name of the patch is 853e8f45607cb07b877ffd270c63dbcdd5201ad9. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-215443.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-120
cwe_name: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
extended_description: A buffer overflow condition exists when a product attempts to put more data in a buffer than it can hold, or when it attempts to put data in a memory area outside of the boundaries of a buffer. The simplest type of error, and the most common cause of buffer overflows, is the "classic" case in which the product copies the buffer without restricting how much is copied. Other variants exist, but the existence of a classic overflow strongly suggests that the programmer is not considering even the most basic of security protections.
         

Fix information:
repo_url: https://github.com/manugarg/pacparser
commit_details: repo_url: https://github.com/manugarg/pacparser
author: Manu Garg
author_date: 2022-04-13 14:30:07-07:00
msg: Fix possible memory overwrite vulnerability. (#134)
repository: repo_url: https://github.com/manugarg/pacparser
repo_name: manugarg/pacparser
description: A library to parse proxy auto-config (PAC) files
repo_language: C
owner: manugarg
file_changes: filename: pacparser.c
change_type: ModificationType.MODIFY
diff: @@ -442,11 +442,11 @@ pacparser_find_proxy(const char *url, const char *host)
   // Hostname shouldn't have single quotes in them
   if (strchr(host, '\'')) {
     print_error("%s %s\n", error_prefix,
-		"Invalid hostname: hostname can't have single quotes.");
+      "Invalid hostname: hostname can't have single quotes.");
     return NULL;
   }
 
-  script = (char*) malloc(32 + strlen(url) + strlen(host));
+  script = (char*) malloc(32 + strlen(sanitized_url) + strlen(host));
   script[0] = '\0';
   strcat(script, "findProxyForURL('");
   strcat(script, sanitized_url);

programming_language: C++
CVE-2015-8949 (published 2016-08-19T21:59Z)

Use-after-free vulnerability in the my_login function in DBD::mysql before 4.033_01 allows attackers to have unspecified impact by leveraging a call to mysql_errno after a failure of my_login.

Severity: HIGH
CVSS v2 base score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/perl5-dbi/DBD-mysql
commit_details: repo_url: https://github.com/perl5-dbi/DBD-mysql
author: Michiel Beijen
author_date: 2015-11-22 06:22:05-08:00
msg: Merge pull request #45 from hannob/master

Fix use after free error.
repository: repo_url: https://github.com/perl5-dbi/DBD-mysql
repo_name: perl5-dbi/DBD-mysql
description: MySQL driver for the Perl5 Database Interface (DBI)
repo_language: Perl
owner: perl5-dbi
CVE-2013-10016 (published 2023-02-03T20:15Z)

A vulnerability was found in fanzila WebFinance 0.5 and classified as critical. This issue affects some unknown processing of the file htdocs/admin/save_taxes.php. The manipulation of the argument id leads to sql injection. The patch is named 306f170ca2a8203ae3d8f51fb219ba9e05b945e1. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-220055.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/fanzila/WebFinance
commit_details: repo_url: https://github.com/fanzila/WebFinance
author: Cyril Bouthors
author_date: 2013-09-18 15:14:39+02:00
msg: * htdocs/admin/save_taxes.php: fixed another SQL injection
repository: repo_url: https://github.com/fanzila/WebFinance
repo_name: fanzila/WebFinance
description: Web application to manage invoices and handle clients contacts: Python/Django front office, PHP back office, MySQL database
repo_language: PHP
owner: fanzila
file_changes: filename: save_taxes.php
change_type: ModificationType.MODIFY
diff: @@ -33,6 +33,7 @@ require("../inc/main.php");
 must_login();
 
 if ($_GET['action'] == "delete") {
+  $_GET['id'] = mysql_real_escape_string($_GET['id']);
   mysql_query("DELETE FROM webfinance_pref WHERE id_pref=".$_GET['id']);
   $_SESSION['message'] = _('Tax deleted');
   header("Location: preferences.php?tab=Taxes");

programming_language: PHP
CVE-2019-20933 (published 2020-11-19T02:15Z)

InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/influxdata/influxdb
commit_details: repo_url: https://github.com/influxdata/influxdb
author: David Norton
author_date: 2019-04-02 11:26:57-04:00
msg: fix(httpd): fail bearerauth if shared secret blank
repository: repo_url: https://github.com/influxdata/influxdb
repo_name: influxdata/influxdb
description: Scalable datastore for metrics, events, and real-time analytics
repo_language: Rust
owner: influxdata
file_changes: filename: handler.go
change_type: ModificationType.MODIFY
diff: @@ -1581,6 +1581,11 @@ func authenticate(inner func(http.ResponseWriter, *http.Request, meta.User), h *
 					return
 				}
 			case BearerAuthentication:
+				if h.Config.SharedSecret == "" {
+					atomic.AddInt64(&h.stats.AuthenticationFailures, 1)
+					h.httpError(w, "bearer auth disabled", http.StatusUnauthorized)
+					return
+				}
 				keyLookupFn := func(token *jwt.Token) (interface{}, error) {
 					// Check for expected signing method.
 					if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {

programming_language: Go
filename: handler_test.go
change_type: ModificationType.MODIFY
diff: @@ -232,6 +232,24 @@ func TestHandler_Query_Auth(t *testing.T) {
 		t.Fatalf("unexpected body: %s", body)
 	}
 
+	// Test that auth fails if shared secret is blank.
+	origSecret := h.Config.SharedSecret
+	h.Config.SharedSecret = ""
+	token, _ = MustJWTToken("user1", h.Config.SharedSecret, false)
+	signedToken, err = token.SignedString([]byte(h.Config.SharedSecret))
+	if err != nil {
+		t.Fatal(err)
+	}
+	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", signedToken))
+	w = httptest.NewRecorder()
+	h.ServeHTTP(w, req)
+	if w.Code != http.StatusUnauthorized {
+		t.Fatalf("unexpected status: %d: %s", w.Code, w.Body.String())
+	} else if body := strings.TrimSpace(w.Body.String()); body != `{"error":"bearer auth disabled"}` {
+		t.Fatalf("unexpected body: %s", body)
+	}
+	h.Config.SharedSecret = origSecret
+
 	// Test the handler with valid user and password in the url and invalid in
 	// basic auth (prioritize url).
 	w = httptest.NewRecorder()

programming_language: Go
CVE-2013-1428 (published 2013-04-26T16:55Z)

Stack-based buffer overflow in the receive_tcppacket function in net_packet.c in tinc before 1.0.21 and 1.1 before 1.1pre7 allows remote authenticated peers to cause a denial of service (crash) or possibly execute arbitrary code via a large TCP packet.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/gsliepen/tinc
commit_details: repo_url: https://github.com/gsliepen/tinc
author: Guus Sliepen
author_date: 2013-04-12 17:15:05+02:00
msg: Drop packets forwarded via TCP if they are too big (CVE-2013-1428).

Normally all requests sent via the meta connections are checked so that they
cannot be larger than the input buffer. However, when packets are forwarded via
meta connections, they are copied into a packet buffer without checking whether
it fits into it. Since the packet buffer is allocated on the stack, this in
effect allows an authenticated remote node to cause a stack overflow.

This issue was found by Martin Schobert.
repository: repo_url: https://github.com/gsliepen/tinc
repo_name: gsliepen/tinc
description: a VPN daemon
repo_language: C
owner: gsliepen
file_changes: filename: net_packet.c
change_type: ModificationType.MODIFY
diff: @@ -394,6 +394,9 @@ static void receive_udppacket(node_t *n, vpn_packet_t *inpkt) {
 void receive_tcppacket(connection_t *c, const char *buffer, int len) {
 	vpn_packet_t outpkt;
 
+	if(len > sizeof outpkt.data)
+		return;
+
 	outpkt.len = len;
 	if(c->options & OPTION_TCPONLY)
 		outpkt.priority = 0;

programming_language: C
CVE-2022-39170 (published 2022-09-02T03:15Z)

libdwarf 0.4.1 has a double free in _dwarf_exec_frame_instr in dwarf_frame.c.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-415
cwe_name: Double Free
description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
extended_description: When a program calls free() twice with the same argument, the program's memory management data structures become corrupted. This corruption can cause the program to crash or, in some circumstances, cause two later calls to malloc() to return the same pointer. If malloc() returns the same value twice and the program later gives the attacker control over the data that is written into this doubly-allocated memory, the program becomes vulnerable to a buffer overflow attack.
         

Fix information:
repo_url: https://github.com/davea42/libdwarf-code
commit_details: repo_url: https://github.com/davea42/libdwarf-code
author: David Anderson
author_date: 2022-08-27 09:49:37-07:00
msg: A new vulnerability: DW202208-001
	modified:   data.txt
repository: repo_url: https://github.com/davea42/libdwarf-code
repo_name: davea42/libdwarf-code
description: Contains source for libdwarf, a library for reading DWARF2 and later DWARF. Contains  source to create dwarfdump, a program which prints DWARF2 and later DWARF in readable format. Has a very limited DWARF writer set of functions in libdwarfp (producer library). Builds using GNU configure, meson, or cmake.
repo_language: C
owner: davea42
file_changes: filename: data.txt
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,29 @@
 
+
+
+id: DW202208-001
+cve:
+fuzzer: unspecified
+datereported: 2022-08-27
+reportedby: Han Zheng
+vulnerability: Double free in dwarfdump
+product: dwarfdump
+description: A carefully corrupted object file
+  would cause dwarfdump -vv -a 
+  to do a double free in handling an error condition.
+  That could cause a segmentation violation or other
+  major error, terminating the calling application and
+  resulting in Denial Of Service.
+datefixed: 
+references: regressiontests/hanzheng/fuzzedobject
+gitfixid: 
+tarrelease:
+endrec: DW202208-001
+
+
+
+
+
 id: DW202207-001
 cve:
 fuzzer: ossfuzz

programming_language: Markdown
CVE-2022-4748 (published 2022-12-27T09:15Z)

A vulnerability was found in FlatPress. It has been classified as critical. This affects the function doItemActions of the file fp-plugins/mediamanager/panels/panel.mediamanager.file.php of the component File Delete Handler. The manipulation of the argument deletefile leads to path traversal. The name of the patch is 5d5c7f6d8f072d14926fc2c3a97cdd763802f170. It is recommended to apply a patch to fix this issue. The identifier VDB-216861 was assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/flatpressblog/flatpress
commit_details: repo_url: https://github.com/flatpressblog/flatpress
author: azett
author_date: 2022-12-25 15:00:06+01:00
msg: fixes #179, preventing path traversal
repository: repo_url: https://github.com/flatpressblog/flatpress
repo_name: flatpressblog/flatpress
description: FlatPress is a lightweight, easy-to-set-up flat-file blogging engine.
repo_language: PHP
owner: flatpressblog
file_changes: filename: panel.mediamanager.file.php
change_type: ModificationType.MODIFY
diff: @@ -77,6 +77,8 @@ class admin_uploader_mediamanager extends AdminPanelAction {
 		/* delete file */
 		if (isset($_GET ['deletefile'])) {
 			list ($type, $name) = explode("-", $_GET ['deletefile'], 2);
+			// prevent path traversal: remove ".." and "/" resp. "\"
+			$name = preg_replace('(\.\.|\/|\\\\)', '', $name);
 			switch ($type) {
 				case 'attachs':
 					$type = ABS_PATH . ATTACHS_DIR;

programming_language: PHP
CVE-2023-6977 (published 2023-12-20T06:15Z)

This vulnerability enables malicious users to read sensitive files on the server.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-29
cwe_name: Path Traversal: '\..\filename'
description: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.
extended_description: 
            This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.
            This is similar to CWE-25, except using "\" instead of "/". Sometimes a program checks for "..\" at the beginning of the input, so a "\..\" can bypass that check. It is also useful for bypassing path traversal protection schemes that only assume that the "/" separator is valid.
         
         

Fix information:
repo_url: https://github.com/mlflow/mlflow
commit_details: repo_url: https://github.com/mlflow/mlflow
author: Harutaka Kawamura
author_date: 2023-12-08 03:28:07+09:00
msg: Improve `is_local_uri` (#10638)

Signed-off-by: harupy <17039389+harupy@users.noreply.github.com>
repository: repo_url: https://github.com/mlflow/mlflow
repo_name: mlflow/mlflow
description: Open source platform for the machine learning lifecycle
repo_language: Python
owner: mlflow
file_changes: filename: uri.py
change_type: ModificationType.MODIFY
diff: @@ -41,6 +41,10 @@ def is_local_uri(uri, is_tracking_or_registry_uri=True):
         return False
 
     parsed_uri = urllib.parse.urlparse(uri)
+    scheme = parsed_uri.scheme
+    if scheme == "":
+        return True
+
     if parsed_uri.hostname and not (
         parsed_uri.hostname == "."
         or parsed_uri.hostname.startswith("localhost")
@@ -48,8 +52,7 @@ def is_local_uri(uri, is_tracking_or_registry_uri=True):
     ):
         return False
 
-    scheme = parsed_uri.scheme
-    if scheme == "" or scheme == "file":
+    if scheme == "file":
         return True
 
     if is_windows() and len(scheme) == 1 and scheme.lower() == pathlib.Path(uri).drive.lower()[0]:

programming_language: Python
filename: test_uri.py
change_type: ModificationType.MODIFY
diff: @@ -99,6 +99,8 @@ def test_is_local_uri():
     assert is_local_uri("file://localhost:5000/mlruns")
     assert is_local_uri("file://127.0.0.1/mlruns")
     assert is_local_uri("file://127.0.0.1:5000/mlruns")
+    assert is_local_uri("//proc/self/root")
+    assert is_local_uri("/proc/self/root")
 
     assert not is_local_uri("file://myhostname/path/to/file")
     assert not is_local_uri("https://whatever")

programming_language: Python
CVE-2018-1999012 (published 2018-07-23T15:29Z)

FFmpeg before commit 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 contains a CWE-835: Infinite loop vulnerability in pva format demuxer that can result in a Vulnerability that allows attackers to consume excessive amount of resources like CPU and RAM. This attack appear to be exploitable via specially crafted PVA file has to be provided as input. This vulnerability appears to have been fixed in 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 and later.

Severity: HIGH
CVSS v2 base score: 7.1 (AV:N/AC:M/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-835
cwe_name: Loop with Unreachable Exit Condition ('Infinite Loop')
description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
extended_description: If the loop can be influenced by an attacker, this weakness could allow attackers to consume excessive resources such as CPU or memory.
         

Fix information:
repo_url: https://github.com/FFmpeg/FFmpeg
commit_details: repo_url: https://github.com/FFmpeg/FFmpeg
author: Michael Niedermayer
author_date: 2018-07-03 22:14:42+02:00
msg: avformat/pva: Check for EOF before retrying in read_part_of_packet()

Fixes: Infinite loop
Fixes: pva-4b1835dbc2027bf3c567005dcc78e85199240d06

Found-by: Paul Ch <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
repository: repo_url: https://github.com/FFmpeg/FFmpeg
repo_name: FFmpeg/FFmpeg
description: Mirror of https://git.ffmpeg.org/ffmpeg.git
repo_language: C
owner: FFmpeg
file_changes: filename: pva.c
change_type: ModificationType.MODIFY
diff: @@ -134,6 +134,10 @@ recover:
             pes_flags              = avio_rb16(pb);
             pes_header_data_length = avio_r8(pb);
 
+            if (avio_feof(pb)) {
+                return AVERROR_EOF;
+            }
+
             if (pes_signal != 1 || pes_header_data_length == 0) {
                 pva_log(s, AV_LOG_WARNING, "expected non empty signaled PES packet, "
                                           "trying to recover\n");

programming_language: C