starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2014-9490 (published 2015-01-20T15:59Z)

The numtok function in lib/raven/okjson.rb in the raven-ruby gem before 0.12.2 for Ruby allows remote attackers to cause a denial of service via a large exponent value in a scientific number.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)

Weakness information:
cwe_id: CWE-399
cwe_name: Resource Management Errors
description: Weaknesses in this category are related to improper management of system resources.

Fix information:
repo_url: https://github.com/getsentry/raven-ruby
commit_details: repo_url: https://github.com/getsentry/raven-ruby
author: David Cramer
author_date: 2014-12-08 09:15:30-08:00
msg: Remove scientific computation from okjson

Conflicts:
	spec/raven/okjson_spec.rb
repository: repo_url: https://github.com/getsentry/raven-ruby
repo_name: getsentry/sentry-ruby
description: Sentry SDK for Ruby
repo_language: Ruby
owner: getsentry
file_changes: filename: okjson.rb
change_type: ModificationType.MODIFY
diff: @@ -278,7 +278,8 @@ private
       elsif m[2]
         [:val, m[0], Float(m[0])]
       else
-        [:val, m[0], Integer(m[1])*(10**m[3][1..-1].to_i(10))]
+        # We don't convert scientific notation
+        [:val, m[0], m[0]]
       end
     else
       []
@@ -609,4 +610,4 @@ private
   Spc = ' '[0]
   Unesc = {?b=>?\b, ?f=>?\f, ?n=>?\n, ?r=>?\r, ?t=>?\t}
 end
-end
\ No newline at end of file
+end

programming_language: Ruby
filename: okjson_spec.rb
change_type: ModificationType.MODIFY
diff: @@ -20,8 +20,8 @@ describe Raven::OkJson do
     end
   end
 
-  it 'parses zero-leading exponent numbers correctly' do
-    expect(Raven::OkJson.decode("[123e090]")).to eq [123000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000]
+  it 'does not parse scientific notation' do
+    expect(Raven::OkJson.decode("[123e090]")).to eq ["123e090"]
   end
 
   it 'it raises the correct error on strings that look like incomplete objects' do

programming_language: Ruby
CVE-2019-15026 (published 2019-08-30T15:15Z)

memcached 1.5.16, when UNIX sockets are used, has a stack-based buffer over-read in conn_to_str in memcached.c.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/memcached/memcached
commit_details: repo_url: https://github.com/memcached/memcached
author: dormando
author_date: 2019-08-29 14:10:44-07:00
msg: fix strncpy call to avoid ASAN violation

Ensure we're only reading to the size of the smallest buffer, since
they're both on the stack and could potentially overlap. Overlapping is
defined as ... undefined behavior. I've looked through all available
implementations of strncpy and they still only copy from the first \0
found.

We'll also never read past the end of sun_path since we _supply_
sun_path with a proper null terminator.
repository: repo_url: https://github.com/memcached/memcached
repo_name: memcached/memcached
description: memcached development tree
repo_language: C
owner: memcached
file_changes: filename: memcached.c
change_type: ModificationType.MODIFY
diff: @@ -3463,6 +3463,7 @@ static inline void get_conn_text(const conn *c, const int af,
     addr_text[0] = '\0';
     const char *protoname = "?";
     unsigned short port = 0;
+    size_t pathlen = 0;
 
     switch (af) {
         case AF_INET:
@@ -3488,10 +3489,27 @@ static inline void get_conn_text(const conn *c, const int af,
             break;
 
         case AF_UNIX:
+            // this strncpy call originally could piss off an address
+            // sanitizer; we supplied the size of the dest buf as a limiter,
+            // but optimized versions of strncpy could read past the end of
+            // *src while looking for a null terminator. Since buf and
+            // sun_path here are both on the stack they could even overlap,
+            // which is "undefined". In all OSS versions of strncpy I could
+            // find this has no effect; it'll still only copy until the first null
+            // terminator is found. Thus it's possible to get the OS to
+            // examine past the end of sun_path but it's unclear to me if this
+            // can cause any actual problem.
+            //
+            // We need a safe_strncpy util function but I'll punt on figuring
+            // that out for now.
+            pathlen = sizeof(((struct sockaddr_un *)sock_addr)->sun_path);
+            if (MAXPATHLEN <= pathlen) {
+                pathlen = MAXPATHLEN - 1;
+            }
             strncpy(addr_text,
                     ((struct sockaddr_un *)sock_addr)->sun_path,
-                    sizeof(addr_text) - 1);
-            addr_text[sizeof(addr_text)-1] = '\0';
+                    pathlen);
+            addr_text[pathlen] = '\0';
             protoname = "unix";
             break;
     }

programming_language: C
CVE-2016-9555 (published 2016-11-28T03:59Z)

The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel before 4.8.8 lacks chunk-length checking for the first chunk, which allows remote attackers to cause a denial of service (out-of-bounds slab access) or possibly have unspecified other impact via crafted SCTP data.

Severity: HIGH
CVSS v2 base score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Marcelo Ricardo Leitner
author_date: 2016-10-25 14:27:39-02:00
msg: sctp: validate chunk len before actually using it

Andrey Konovalov reported that KASAN detected that SCTP was using a slab
beyond the boundaries. It was caused because when handling out of the
blue packets in function sctp_sf_ootb() it was checking the chunk len
only after already processing the first chunk, validating only for the
2nd and subsequent ones.

The fix is to just move the check upwards so it's also validated for the
1st chunk.

Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Reviewed-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: sm_statefuns.c
change_type: ModificationType.MODIFY
diff: @@ -3422,6 +3422,12 @@ sctp_disposition_t sctp_sf_ootb(struct net *net,
 			return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
 						  commands);
 
+		/* Report violation if chunk len overflows */
+		ch_end = ((__u8 *)ch) + SCTP_PAD4(ntohs(ch->length));
+		if (ch_end > skb_tail_pointer(skb))
+			return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
+						  commands);
+
 		/* Now that we know we at least have a chunk header,
 		 * do things that are type appropriate.
 		 */
@@ -3453,12 +3459,6 @@ sctp_disposition_t sctp_sf_ootb(struct net *net,
 			}
 		}
 
-		/* Report violation if chunk len overflows */
-		ch_end = ((__u8 *)ch) + SCTP_PAD4(ntohs(ch->length));
-		if (ch_end > skb_tail_pointer(skb))
-			return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
-						  commands);
-
 		ch = (sctp_chunkhdr_t *) ch_end;
 	} while (ch_end < skb_tail_pointer(skb));
 

programming_language: C
CVE-2024-29859 (published 2024-03-21T04:15Z)

In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/MISP/MISP
commit_details: repo_url: https://github.com/MISP/MISP
author: iglocska
author_date: 2024-03-05 13:54:28+01:00
msg: fix: [security] properly check for valid file upload

- as kindly reported by Rémi Matasse and Raphael Lob from Synacktiv (https://www.synacktiv.com)
repository: repo_url: https://github.com/MISP/MISP
repo_name: MISP/MISP
description: MISP (core software) - Open Source Threat Intelligence and Sharing Platform
repo_language: PHP
owner: MISP
file_changes: filename: EventsController.php
change_type: ModificationType.MODIFY
diff: @@ -2369,7 +2369,13 @@ class EventsController extends AppController
                     }
 
                     $isXml = $ext === 'xml';
-                    $data = FileAccessTool::readFromFile($file['tmp_name'], $file['size']);
+                    $matches = null;
+                    $tmp_name = $file['tmp_name'];
+                    if (preg_match_all('/[\w\/\-\.]*/', $tmp_name, $matches) && file_exists($file['tmp_name'])) {
+                        $data = FileAccessTool::readFromFile($matches[0][0], $file['size']);
+                    } else {
+                        throw new NotFoundException(__('Invalid file.'));    
+                    }
                 } else {
                     throw new MethodNotAllowedException(__('No file uploaded.'));
                 }
@@ -2378,7 +2384,6 @@ class EventsController extends AppController
                     && (isset($this->request->data['Event']['takeownership']) && $this->request->data['Event']['takeownership'] == 1);
 
                 $publish = $this->request->data['Event']['publish'] ?? false;
-
                 try {
                     $results = $this->Event->addMISPExportFile($this->Auth->user(), $data, $isXml, $takeOwnership, $publish);
                 } catch (Exception $e) {

programming_language: PHP
CVE-2018-18585 (published 2018-10-23T02:29Z)

chmd_read_headers in mspack/chmd.c in libmspack before 0.8alpha accepts a filename that has \'\\0\' as its first or second character (such as the "/\\0" name).

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/kyz/libmspack
commit_details: repo_url: https://github.com/kyz/libmspack
author: Stuart Caie
author_date: 2018-10-17 11:29:03+01:00
msg: Avoid returning CHM file entries that are "blank" because they have embedded null bytes
repository: repo_url: https://github.com/kyz/libmspack
repo_name: kyz/libmspack
description: A library for some loosely related Microsoft compression formats, CAB, CHM, HLP, LIT, KWAJ and SZDD.
repo_language: C
owner: kyz
file_changes: filename: ChangeLog
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,9 @@
+2018-10-17  Stuart Caie <kyzer@cabextract.org.uk>
+  
+        * chmd_read_headers(): again reject files with blank filenames, this
+        time because their 1st or 2nd byte is null, not because their length
+        is zero.  Thanks again to Hanno Böck for finding the issue.
+
 2018-10-16  Stuart Caie <kyzer@cabextract.org.uk>
 
 	* Makefile.am: using automake _DEPENDENCIES for chmd_test appears to

programming_language: Markdown
filename: chmd.c
change_type: ModificationType.MODIFY
diff: @@ -447,14 +447,14 @@ static int chmd_read_headers(struct mspack_system *sys, struct mspack_file *fh,
     while (num_entries--) {
       READ_ENCINT(name_len);
       if (name_len > (unsigned int) (end - p)) goto chunk_end;
-      /* consider blank filenames to be an error */
-      if (name_len == 0) goto chunk_end;
       name = p; p += name_len;
-
       READ_ENCINT(section);
       READ_ENCINT(offset);
       READ_ENCINT(length);
 
+      /* ignore blank or one-char (e.g. "/") filenames we'd return as blank */
+      if (name_len < 2 || !name[0] || !name[1]) continue;
+
       /* empty files and directory names are stored as a file entry at
        * offset 0 with length 0. We want to keep empty files, but not
        * directory names, which end with a "/" */

programming_language: C
CVE-2023-46130 (published 2023-11-10T15:15Z)

Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, some theme components allow users to add svgs with unlimited `height` attributes, and this can affect the availability of subsequent replies in a topic. Most Discourse instances are unaffected, only instances with the svgbob or the mermaid theme component are within scope. The issue is patched in version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches. As a workaround, disable or remove the relevant theme components. 

CVSS v3 base score: 5.4, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L)

Weakness information:
cwe_id: CWE-770
cwe_name: Allocation of Resources Without Limits or Throttling
description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
extended_description: Code frequently has to work with limited resources, so programmers must be careful to ensure that resources are not consumed too quickly, or too easily.  Without use of quotas, resource limits, or other protection mechanisms, it can be easy for an attacker to consume many resources by rapidly making many requests, or causing larger resources to be used than is needed. When too many resources are allocated, or if a single resource is too large, then it can prevent the code from working correctly, possibly leading to a denial of service.
         

Fix information:
repo_url: https://github.com/discourse/discourse
commit_details: repo_url: https://github.com/discourse/discourse
author: Penar Musaraj
author_date: 2023-10-17 09:55:02-04:00
msg: SECURITY: Limit height of pre/svg elements

Ensures posts cannot have SVG or PRE elements that are too tall.
repository: repo_url: https://github.com/discourse/discourse
repo_name: discourse/discourse
description: A platform for community discussion. Free, open, simple.
repo_language: Ruby
owner: discourse
file_changes: filename: topic-post.scss
change_type: ModificationType.MODIFY
diff: @@ -208,6 +208,10 @@
       height: var(--calculated-height);
     }
   }
+
+  svg {
+    max-height: 2000px;
+  }
 }
 
 // add staff color
@@ -1008,6 +1012,7 @@ aside.quote {
 }
 
 pre {
+  max-height: 2000px;
   code {
     word-wrap: normal;
     display: block;

programming_language: CSS
CVE-2020-21049 (published 2021-09-14T16:15Z)

An invalid read in the stb_image.h component of libsixel prior to v1.8.5 allows attackers to cause a denial of service (DOS) via a crafted PSD file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/saitoha/libsixel
commit_details: repo_url: https://github.com/saitoha/libsixel
author: Hayaki Saito
author_date: 2019-12-23 13:20:08+00:00
msg: Introduce SIXEL_ALLOCATE_BYTES_MAX macro and limit allocation size to 128MB(#74)
repository: repo_url: https://github.com/saitoha/libsixel
repo_name: saitoha/libsixel
description: A SIXEL encoder/decoder implementation derived from kmiya's sixel (https://github.com/saitoha/sixel).
repo_language: C
owner: saitoha
file_changes: filename: sixel.h.in
change_type: ModificationType.MODIFY
diff: @@ -39,6 +39,7 @@ typedef unsigned char sixel_index_t;
 #define SIXEL_PALETTE_MIN            2
 #define SIXEL_PALETTE_MAX            256
 #define SIXEL_USE_DEPRECATED_SYMBOLS 1
+#define SIXEL_ALLOCATE_BYTES_MAX     10248UL * 1024UL * 128UL   /* up to 128M */
 
 /* return value */
 typedef int SIXELSTATUS;

programming_language: C++
filename: allocator.c
change_type: ModificationType.MODIFY
diff: @@ -152,6 +152,11 @@ sixel_allocator_malloc(
             "sixel_allocator_malloc: called with n == 0");
         return NULL;
     }
+
+    if (n > SIXEL_ALLOCATE_BYTES_MAX) {
+        return NULL;
+    }
+
     return allocator->fn_malloc(n);
 }
 
@@ -163,10 +168,24 @@ sixel_allocator_calloc(
     size_t              /* in */ nelm,        /* number of elements */
     size_t              /* in */ elsize)      /* size of element */
 {
+    size_t n;
+
     /* precondition */
     assert(allocator);
     assert(allocator->fn_calloc);
 
+    n = nelm * elsize;
+
+    if (n == 0) {
+        sixel_helper_set_additional_message(
+            "sixel_allocator_malloc: called with n == 0");
+        return NULL;
+    }
+
+    if (n > SIXEL_ALLOCATE_BYTES_MAX) {
+        return NULL;
+    }
+
     return allocator->fn_calloc(nelm, elsize);
 }
 
@@ -182,6 +201,16 @@ sixel_allocator_realloc(
     assert(allocator);
     assert(allocator->fn_realloc);
 
+    if (n == 0) {
+        sixel_helper_set_additional_message(
+            "sixel_allocator_malloc: called with n == 0");
+        return NULL;
+    }
+
+    if (n > SIXEL_ALLOCATE_BYTES_MAX) {
+        return NULL;
+    }
+
     return allocator->fn_realloc(p, n);
 }
 

programming_language: C
CVE-2021-29063 (published 2021-06-21T20:15Z)

A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Mpmath v1.0.0 through v1.2.1 when the mpmathify function is called.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-770
cwe_name: Allocation of Resources Without Limits or Throttling
description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
extended_description: Code frequently has to work with limited resources, so programmers must be careful to ensure that resources are not consumed too quickly, or too easily.  Without use of quotas, resource limits, or other protection mechanisms, it can be easy for an attacker to consume many resources by rapidly making many requests, or causing larger resources to be used than is needed. When too many resources are allocated, or if a single resource is too large, then it can prevent the code from working correctly, possibly leading to a denial of service.
         

Fix information:
repo_url: https://github.com/fredrik-johansson/mpmath
commit_details: repo_url: https://github.com/fredrik-johansson/mpmath
author: Fredrik Johansson
author_date: 2021-02-10 17:31:40+01:00
msg: Merge pull request #570 from vks/fix-redos

Fix ReDOS vulnerability
repository: repo_url: https://github.com/fredrik-johansson/mpmath
repo_name: mpmath/mpmath
description: Python library for arbitrary-precision floating-point arithmetic
repo_language: Python
owner: fredrik-johansson
CVE-2024-26147 (published 2024-02-21T23:15Z)

Helm is a package manager for Charts for Kubernetes. Versions prior to 3.14.2 contain an uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content. When either an `index.yaml` file or a plugins `plugin.yaml` file were missing all metadata a panic would occur in Helm. In the Helm SDK, this is found when using the `LoadIndexFile` or `DownloadIndexFile` functions in the `repo` package or the `LoadDir` function in the `plugin` package. For the Helm client this impacts functions around adding a repository and all Helm functions if a malicious plugin is added as Helm inspects all known plugins on each invocation. This issue has been resolved in Helm v3.14.2. If a malicious plugin has been added which is causing all Helm client commands to panic, the malicious plugin can be manually removed from the filesystem. If using Helm SDK versions prior to 3.14.2, calls to affected functions can use `recover` to catch the panic.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/helm/helm
commit_details: repo_url: https://github.com/helm/helm
author: Matt Farina
author_date: 2024-02-21 15:09:05-05:00
msg: Merge pull request from GHSA-r53h-jv2g-vpx6

Some fixes
repository: repo_url: https://github.com/helm/helm
repo_name: helm/helm
description: The Kubernetes Package Manager
repo_language: Go
owner: helm
CVE-2022-2816 (published 2022-08-15T22:15Z)

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0212.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Bram Moolenaar
author_date: 2022-08-14 21:46:07+01:00
msg: patch 9.0.0212: invalid memory access when compiling :unlet

Problem:    Invalid memory access when compiling :unlet.
Solution:   Don't read past the end of the line.
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: test_vim9_cmd.vim
change_type: ModificationType.MODIFY
diff: @@ -1740,12 +1740,19 @@ def Test_lockvar()
 
   lines =<< trim END
       def _()
-        s:0([], s:0)
         lockv
       enddef
       defcomp
   END
-  v9.CheckScriptFailure(lines, 'E179', 2)
+  v9.CheckScriptFailure(lines, 'E179', 1)
+
+  lines =<< trim END
+      def T()
+        unlet
+      enddef
+      defcomp
+  END
+  v9.CheckScriptFailure(lines, 'E179', 1)
 enddef
 
 def Test_substitute_expr()

programming_language: Python
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -735,6 +735,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    212,
 /**/
     211,
 /**/

programming_language: Ruby
filename: vim9cmds.c
change_type: ModificationType.MODIFY
diff: @@ -92,6 +92,12 @@ free_locals(cctx_T *cctx)
     int
 check_vim9_unlet(char_u *name)
 {
+    if (*name == NUL)
+    {
+	semsg(_(e_argument_required_for_str), "unlet");
+	return FAIL;
+    }
+
     if (name[1] != ':' || vim_strchr((char_u *)"gwtb", *name) == NULL)
     {
 	// "unlet s:var" is allowed in legacy script.

programming_language: C