starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2023-4722 (published 2023-09-01T16:15Z)

Integer Overflow or Wraparound in GitHub repository gpac/gpac prior to 2.3-DEV.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2023-09-01 11:58:14+02:00
msg: Fixed #2579
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: mux_isom.c
change_type: ModificationType.MODIFY
diff: @@ -5713,7 +5713,7 @@ static GF_Err mp4_mux_initialize_movie(GF_MP4MuxCtx *ctx)
 		if (p && p->value.lfrac.den) {
 			tkw->pid_dur = p->value.lfrac;
 			if (tkw->pid_dur.num<0) tkw->pid_dur.num = -tkw->pid_dur.num;
-			if (max_dur.num * (s64) tkw->pid_dur.den < (s64) max_dur.den * tkw->pid_dur.num) {
+			if (gf_timestamp_less(max_dur.num, max_dur.den, tkw->pid_dur.num, tkw->pid_dur.den)) {
 				max_dur.num = tkw->pid_dur.num;
 				max_dur.den = tkw->pid_dur.den;
 			}

programming_language: C
CVE-2015-10103 (published 2023-04-17T19:15Z)

A vulnerability, which was classified as problematic, was found in InternalError503 Forget It up to 1.3. This affects an unknown part of the file js/settings.js. The manipulation of the argument setForgetTime with the input 0 leads to infinite loop. It is possible to launch the attack on the local host. Upgrading to version 1.4 is able to address this issue. The patch is named adf0c7fd59b9c935b4fd675c556265620124999c. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-226119.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-835
cwe_name: Loop with Unreachable Exit Condition ('Infinite Loop')
description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
extended_description: If the loop can be influenced by an attacker, this weakness could allow attackers to consume excessive resources such as CPU or memory.
         

Fix information:
repo_url: https://github.com/InternalError503/forget-it
commit_details: repo_url: https://github.com/InternalError503/forget-it
author: toady
author_date: 2015-10-12 00:13:46+10:00
msg: Fixed: denial of service loop if setForgetTime set to 0.

A small issue with setForgetTime input field would allow users to
manually enter 0 value in the input and save it causing the timed forget
loop to rapidly refresh causing a denial of service.
repository: repo_url: https://github.com/InternalError503/forget-it
repo_name: InternalError503/forget-it
description: Source code repository for forget it.
repo_language: JavaScript
owner: InternalError503
file_changes: filename: settings.js
change_type: ModificationType.MODIFY
diff: @@ -87,7 +87,16 @@
                     text: ""
                 });
 	        });
-
+			
+			//Important: setForgetTime can't be less then 1 minute (denial of service loop)
+			$('#setForgetTime').change(function() {
+				if(document.getElementById('setForgetTime').value > 0){
+					forgetitoptions.forget_save_options();
+				}else{
+					document.getElementById('setForgetTime').value = 1;
+				}	
+			});
+			
 	        //Save settings as they are changed.	
 	        $("#enableConfirmData, \
 			#clearDataFrom, \
@@ -98,8 +107,7 @@
 			#dataLocalStorage, #dataPluginData, \
 			#dataPasswords, #dataWebSQL, \
 			#enableTimedForget, #timedForgetHour, \
-			#timedForgetMinute, #timedForgetTime, \
-			#setForgetTime").change(function() {
+			#timedForgetMinute, #timedForgetTime").change(function() {
 	            forgetitoptions.forget_save_options();
 	        });
 			

programming_language: JavaScript
CVE-2017-5551 (published 2017-02-06T06:59Z)

The simple_set_acl function in fs/posix_acl.c in the Linux kernel before 4.9.6 preserves the setgid bit during a setxattr call involving a tmpfs filesystem, which allows local users to gain group privileges by leveraging the existence of a setgid program with restrictions on execute permissions.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-7097.

Severity: LOW
CVSS v2 base score: 3.6 (AV:L/AC:L/Au:N/C:P/I:P/A:N)
CVSS v3 base score: 4.4, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Gu Zheng
author_date: 2017-01-09 09:34:48+08:00
msg: tmpfs: clear S_ISGID when setting posix ACLs

This change was missed the tmpfs modification in In CVE-2016-7097
commit 073931017b49 ("posix_acl: Clear SGID bit when setting
file permissions")
It can test by xfstest generic/375, which failed to clear
setgid bit in the following test case on tmpfs:

  touch $testfile
  chown 100:100 $testfile
  chmod 2755 $testfile
  _runas -u 100 -g 101 -- setfacl -m u::rwx,g::rwx,o::rwx $testfile

Signed-off-by: Gu Zheng <guzheng1@huawei.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: posix_acl.c
change_type: ModificationType.MODIFY
diff: @@ -922,11 +922,10 @@ int simple_set_acl(struct inode *inode, struct posix_acl *acl, int type)
 	int error;
 
 	if (type == ACL_TYPE_ACCESS) {
-		error = posix_acl_equiv_mode(acl, &inode->i_mode);
-		if (error < 0)
-			return 0;
-		if (error == 0)
-			acl = NULL;
+		error = posix_acl_update_mode(inode,
+				&inode->i_mode, &acl);
+		if (error)
+			return error;
 	}
 
 	inode->i_ctime = current_time(inode);

programming_language: C
CVE-2022-31002 (published 2022-05-31T19:15Z)

Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, an attacker can send a message with evil sdp to FreeSWITCH, which may cause a crash. This type of crash may be caused by a URL ending with `%`. Version 1.13.8 contains a patch for this issue.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/freeswitch/sofia-sip
commit_details: repo_url: https://github.com/freeswitch/sofia-sip
author: Andrey Volk
author_date: 2022-05-25 16:54:12+03:00
msg: Merge pull request from GHSA-g3x6-p824-x6hm

Fix Out-of-bound read in url_canonize2 and url_canonize3
repository: repo_url: https://github.com/freeswitch/sofia-sip
repo_name: freeswitch/sofia-sip
description: Sofia-SIP is an open-source SIP User-Agent library, compliant with the IETF RFC3261 specification.
repo_language: C
owner: freeswitch
CVE-2021-4245 (published 2022-12-15T20:15Z)

A vulnerability classified as problematic has been found in chbrown rfc6902. This affects an unknown part of the file pointer.ts. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The exploit has been disclosed to the public and may be used. The name of the patch is c006ce9faa43d31edb34924f1df7b79c137096cf. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-215883.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-1321
cwe_name: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
extended_description: 
				By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the product depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf).
				This weakness is usually exploited by using a special attribute of objects called proto,  constructor or prototype. Such attributes give access to the object prototype. This weakness is often found in code that assigns object attributes based on user input, or merges or clones objects recursively.
			
			

Fix information:
repo_url: https://github.com/chbrown/rfc6902
commit_details: repo_url: https://github.com/chbrown/rfc6902
author: arjunshibu
author_date: 2020-11-23 20:18:52+05:30
msg: Fix prototype pollution vulnerability

Closes #76
repository: repo_url: https://github.com/chbrown/rfc6902
repo_name: chbrown/rfc6902
description: Complete implementation of RFC6902 in TypeScript
repo_language: TypeScript
owner: chbrown
file_changes: filename: pointer.ts
change_type: ModificationType.MODIFY
diff: @@ -69,6 +69,9 @@ export class Pointer {
     for (let i = 1, l = this.tokens.length; i < l; i++) {
       parent = value
       key = this.tokens[i]
+      if (key == '__proto__' || key == 'constructor' || key == 'prototype') {
+        continue
+      }
       // not sure if this the best way to handle non-existant paths...
       value = (parent || {})[key]
     }

programming_language: TypeScript
CVE-2023-0227 (published 2023-01-12T01:15Z)

Insufficient Session Expiration in GitHub repository pyload/pyload prior to 0.5.0b3.dev36.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-613
cwe_name: Insufficient Session Expiration
description: According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/pyload/pyload
commit_details: repo_url: https://github.com/pyload/pyload
author: GammaC0de
author_date: 2023-01-12 02:00:29+02:00
msg: fix issue that caused the session not expire after user was deleted
repository: repo_url: https://github.com/pyload/pyload
repo_name: pyload/pyload
description: The free and open-source Download Manager written in pure Python
repo_language: Python
owner: pyload
file_changes: filename: __init__.py
change_type: ModificationType.MODIFY
diff: @@ -1117,7 +1117,7 @@ class Api:
     @permission(Perms.STATUS)
     def get_events(self, uuid):
         """
-        Lists occured events, may be affected to changes in future.
+        Lists occurred events, may be affected to changes in the future.
 
         :param uuid:
         :return: list of `Events`
@@ -1230,6 +1230,15 @@ class Api:
         """
         return self.pyload.db.check_auth(username, password)
 
+    def user_exists(self, username):
+        """
+        Check if a user actually exists in the database.
+
+        :param username:
+        :return: boolean
+        """
+        return self.pyload.db.user_exists(username)
+
     @legacy("isAuthorized")
     def is_authorized(self, func, userdata):
         """

programming_language: Python
filename: user_database.py
change_type: ModificationType.MODIFY
diff: @@ -92,6 +92,11 @@ class UserDatabaseMethods:
     def set_role(self, user, role):
         self.c.execute("UPDATE users SET role=? WHERE name=?", (role, user))
 
+    @style.queue
+    def user_exists(self, user):
+        self.c.execute("SELECT name FROM users WHERE name=?", (user,))
+        return self.c.fetchone() is not None
+
     @style.queue
     def list_users(self):
         self.c.execute("SELECT name FROM users")

programming_language: Python
filename: helpers.py
change_type: ModificationType.MODIFY
diff: @@ -164,9 +164,11 @@ def apiver_check(func):
 
 
 def is_authenticated(session=flask.session):
-    return session.get("name") and session.get(
-        "authenticated"
-    )  # NOTE: why checks name?
+    api = flask.current_app.config["PYLOAD_API"]
+    user = session.get("name")
+    authenticated = session.get("authenticated")
+
+    return authenticated and api.user_exists(user)
 
 
 def login_required(perm):

programming_language: Python
CVE-2021-37704 (published 2021-08-12T20:15Z)

PhpFastCache is a high-performance backend cache system (packagist package phpfastcache/phpfastcache). In versions before 6.1.5, 7.1.2, and 8.0.7 the `phpinfo()` can be exposed if the `/vendor` is not protected from public access. This is a rare situation today since the vendor directory is often located outside the web directory or protected via server rule (.htaccess, etc). Only the v6, v7 and v8 will be patched respectively in 8.0.7, 7.1.2, 6.1.5. Older versions such as v5, v4 are not longer supported and will **NOT** be patched. As a workaround, protect the `/vendor` directory from public access.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)
CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-668
cwe_name: Exposure of Resource to Wrong Sphere
description: The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
extended_description: 
            Resources such as files and directories may be inadvertently exposed through mechanisms such as insecure permissions, or when a program accidentally operates on the wrong object. For example, a program may intend that private files can only be provided to a specific user. This effectively defines a control sphere that is intended to prevent attackers from accessing these private files. If the file permissions are insecure, then parties other than the user will be able to access those files.
            A separate control sphere might effectively require that the user can only access the private files, but not any other files on the system. If the program does not ensure that the user is only requesting private files, then the user might be able to access other files on the system.
            In either case, the end result is that a resource has been exposed to the wrong party.
         
         

Fix information:
repo_url: https://github.com/PHPSocialNetwork/phpfastcache
commit_details: repo_url: https://github.com/PHPSocialNetwork/phpfastcache
author: Georges.L
author_date: 2021-08-12 13:40:37+02:00
msg: Merge pull request #813 from Geolim4/master

[V8] Fixed vulnerability issue that cause exposed phpinfo() in some situations
repository: repo_url: https://github.com/PHPSocialNetwork/phpfastcache
repo_name: PHPSocialNetwork/phpfastcache
description: A high-performance backend cache system.  It is intended for use in speeding up dynamic web applications by alleviating database load.  Well implemented, it can drops the database load to almost nothing, yielding faster page load times for users, better resource utilization.  It is simple yet powerful. 
repo_language: PHP
owner: PHPSocialNetwork
CVE-2013-7022 (published 2013-12-09T16:36Z)

The g2m_init_buffers function in libavcodec/g2meet.c in FFmpeg before 2.1 does not properly allocate memory for tiles, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Go2Webinar data.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/FFmpeg/FFmpeg
commit_details: repo_url: https://github.com/FFmpeg/FFmpeg
author: Michael Niedermayer
author_date: 2013-09-21 23:34:11+02:00
msg: avcodec/g2meet: Fix framebuf size

Currently the code can in some cases draw tiles that hang outside the
allocated buffer. This patch increases the buffer size to avoid out
of array accesses. An alternative would be to fail if such tiles are
encountered.
I do not know if any valid files use such hanging tiles.

Fixes Ticket2971
Found-by: ami_stuff
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
repository: repo_url: https://github.com/FFmpeg/FFmpeg
repo_name: FFmpeg/FFmpeg
description: Mirror of https://git.ffmpeg.org/ffmpeg.git
repo_language: C
owner: FFmpeg
file_changes: filename: g2meet.c
change_type: ModificationType.MODIFY
diff: @@ -443,8 +443,8 @@ static int g2m_init_buffers(G2MContext *c)
     int aligned_height;
 
     if (!c->framebuf || c->old_width < c->width || c->old_height < c->height) {
-        c->framebuf_stride = FFALIGN(c->width * 3, 16);
-        aligned_height     = FFALIGN(c->height,    16);
+        c->framebuf_stride = FFALIGN(c->width + 15, 16) * 3;
+        aligned_height     = c->height + 15;
         av_free(c->framebuf);
         c->framebuf = av_mallocz(c->framebuf_stride * aligned_height);
         if (!c->framebuf)

programming_language: C
CVE-2024-27285 (published 2024-02-28T20:15Z)

YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc\'s generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.  This vulnerability is fixed in 0.9.36.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/lsegal/yard
commit_details: repo_url: https://github.com/lsegal/yard
author: Loren Segal
author_date: 2024-02-28 10:03:58-08:00
msg: Merge pull request from GHSA-8mq4-9jjh-9xrc

Patch XSS and Open-Redirect in frames.erb
repository: repo_url: https://github.com/lsegal/yard
repo_name: lsegal/yard
description: YARD is a Ruby Documentation tool. The Y stands for "Yay!"
repo_language: Ruby
owner: lsegal
repo_url: https://github.com/lsegal/yard
commit_details: repo_url: https://github.com/lsegal/yard
author: Loren Segal
author_date: 2024-02-29 14:15:39-08:00
msg: Merge pull request #1538 from RedYetiDev/patch-2

Update frames.erb for better XSS check
repository: repo_url: https://github.com/lsegal/yard
repo_name: lsegal/yard
description: YARD is a Ruby Documentation tool. The Y stands for "Yay!"
repo_language: Ruby
owner: lsegal
CVE-2022-1244 (published 2022-04-05T19:15Z)

heap-buffer-overflow in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of inducing denial of service.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-122
cwe_name: Heap-based Buffer Overflow
description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/radareorg/radare2
commit_details: repo_url: https://github.com/radareorg/radare2
author: pancake
author_date: 2022-04-05 19:39:26+02:00
msg: Fix oobread in dyldcache ##crash

* Reported by @hdthky via huntr.dev
* Reproducers: poc1
* BountyID: 8ae2c61a-2220-47a5-bfe8-fe6d41ab1f82
repository: repo_url: https://github.com/radareorg/radare2
repo_name: radareorg/radare2
description: UNIX-like reverse engineering framework and command-line toolset
repo_language: C
owner: radareorg
file_changes: filename: dyldcache.h
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,4 @@
-/* radare - LGPL - Copyright 2009-2010 nibble<.ds@gmail.com> */
+/* radare - LGPL - Copyright 2009-2022 nibble, pancake */
 
 #include <r_types.h>
 #include "mach0_specs.h"

programming_language: C
filename: bin_dyldcache.c
change_type: ModificationType.MODIFY
diff: @@ -1247,7 +1247,8 @@ static RList *create_cache_bins(RBinFile *bf, RDyldCache *cache) {
 			if (deps && !deps[j]) {
 				continue;
 			}
-			ut64 pa = va2pa (img[j].address, hdr->mappingCount, &cache->maps[maps_index], cache->buf, 0, NULL, NULL);
+			// ut64 pa = va2pa (img[j].address, hdr->mappingCount, &cache->maps[maps_index], cache->buf, 0, NULL, NULL);
+			ut64 pa = va2pa (img[j].address, cache->n_maps, &cache->maps[maps_index], cache->buf, 0, NULL, NULL);
 			if (pa == UT64_MAX) {
 				continue;
 			}

programming_language: C
CVE-2017-6415 (published 2017-03-02T01:59Z)

The dex_parse_debug_item function in libr/bin/p/bin_dex.c in radare2 1.2.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted DEX file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/radareorg/radare2
commit_details: repo_url: https://github.com/radareorg/radare2
author: h4ng3r
author_date: 2017-03-01 12:39:11+01:00
msg: fix #6872
repository: repo_url: https://github.com/radareorg/radare2
repo_name: radareorg/radare2
description: UNIX-like reverse engineering framework and command-line toolset
repo_language: C
owner: radareorg
file_changes: filename: bin_dex.c
change_type: ModificationType.MODIFY
diff: @@ -377,6 +377,9 @@ static void dex_parse_debug_item(RBinFile *binfile, RBinDexObj *bin,
 		--parameters_size;
 	}
 
+	if (p4 <= 0) {
+		return;
+	}
 	ut8 opcode = *(p4++) & 0xff;
 	while (keep) {
 		switch (opcode) {

programming_language: C