starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2021-3815 (published 2021-12-08T17:15Z)

utils.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-1321
cwe_name: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
extended_description: 
				By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the product depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf).
				This weakness is usually exploited by using a special attribute of objects called proto,  constructor or prototype. Such attributes give access to the object prototype. This weakness is often found in code that assigns object attributes based on user input, or merges or clones objects recursively.
			
			

Fix information:
repo_url: https://github.com/fabiocaccamo/utils.js
commit_details: repo_url: https://github.com/fabiocaccamo/utils.js
author: Fabio Caccamo
author_date: 2021-12-06 11:45:54+01:00
msg: Fixed prototype pollution. #6
repository: repo_url: https://github.com/fabiocaccamo/utils.js
repo_name: fabiocaccamo/utils.js
description: :construction_worker: :wrench: zero dependencies vanilla JavaScript utils.
repo_language: JavaScript
owner: fabiocaccamo
file_changes: filename: ObjectUtil.js
change_type: ModificationType.MODIFY
diff: @@ -217,6 +217,9 @@ ObjectUtil = {
             var cursor = obj;
             for (var i = 0, j = keys.length; i < j; i++) {
                 key = keys[i];
+                if (key === '__proto__') {
+                    break;
+                }
                 if (!TypeUtil.isObject(cursor[key])) {
                     cursor[key] = {};
                 }

programming_language: JavaScript
filename: test_object.js
change_type: ModificationType.MODIFY
diff: @@ -304,6 +304,11 @@ describe('object', function() {
             f(o, 'e.f.g', 'ok 2');
             test.assertEqual(o['e']['f']['g'], 'ok 2');
         });
+        it('test prototype pollution', function() {
+            f(o, '__proto__.polluted', true);
+            test.assertUndefined(o['polluted']);
+            test.assertUndefined({}.polluted);
+        });
     });
     describe('length', function() {
         var f = obj.length;

programming_language: JavaScript
CVE-2017-9432 (published 2017-06-05T03:29Z)

Document Liberation Project libstaroffice before 2017-04-07 has an out-of-bounds write caused by a stack-based buffer overflow related to the DatabaseName::read function in lib/StarWriterStruct.cxx.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/fosnola/libstaroffice
commit_details: repo_url: https://github.com/fosnola/libstaroffice
author: David Tardon
author_date: 2017-04-07 19:28:55+02:00
msg: ofz#1029 use correct loop index

To be honest, I think this would be clearer as two separate reads to two
separate vars...
repository: repo_url: https://github.com/fosnola/libstaroffice
repo_name: fosnola/libstaroffice
description: Import filter(based on librevenge) to import all StarOffice document.
repo_language: C++
owner: fosnola
file_changes: filename: StarWriterStruct.cxx
change_type: ModificationType.MODIFY
diff: @@ -327,7 +327,7 @@ bool DatabaseName::read(StarZone &zone)
         }
         data.m_name=libstoff::getString(text);
         int positions[2];
-        for (int j=0; j<2; ++j) positions[i]=int(input->readULong(4));
+        for (int j=0; j<2; ++j) positions[j]=int(input->readULong(4));
         data.m_selection=STOFFVec2i(positions[0],positions[1]);
         m_dataList.push_back(data);
       }

programming_language: C++
CVE-2021-32136 (published 2021-09-13T13:15Z)

Heap buffer overflow in the print_udta function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2021-04-30 10:37:24+02:00
msg: fixed #1765
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: filedump.c
change_type: ModificationType.MODIFY
diff: @@ -1895,12 +1895,18 @@ void print_udta(GF_ISOFile *file, u32 track_number, Bool has_itags)
 			u32 udta_size;
 			gf_isom_get_user_data(file, track_number, type, uuid, j+1, &udta, &udta_size);
 			if (!udta) continue;
-			if (gf_utf8_is_legal(udta, udta_size)) {
+			if (udta_size && gf_utf8_is_legal(udta, udta_size)) {
+				u32 idx;
 				if (first) {
 					fprintf(stderr, "\n");
 					first = GF_FALSE;
 				}
-				fprintf(stderr, "\t%s\n", (char *) udta);
+				fprintf(stderr, "\t");
+				for (idx=0; idx<udta_size; idx++) {
+					if (!udta[idx]) break;
+					fprintf(stderr, "%c", udta[idx]);
+				}
+				fprintf(stderr, "\n");
 			}
 			gf_free(udta);
 		}

programming_language: C
CVE-2015-6252 (published 2015-10-19T10:59Z)

The vhost_dev_ioctl function in drivers/vhost/vhost.c in the Linux kernel before 4.1.5 allows local users to cause a denial of service (memory consumption) via a VHOST_SET_LOG_FD ioctl call that triggers permanent file-descriptor allocation.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)

Weakness information:
cwe_id: CWE-399
cwe_name: Resource Management Errors
description: Weaknesses in this category are related to improper management of system resources.

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Marc-André Lureau
author_date: 2015-07-17 15:32:03+02:00
msg: vhost: actually track log eventfd file

While reviewing vhost log code, I found out that log_file is never
set. Note: I haven't tested the change (QEMU doesn't use LOG_FD yet).

Cc: stable@vger.kernel.org
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: vhost.c
change_type: ModificationType.MODIFY
diff: @@ -995,6 +995,7 @@ long vhost_dev_ioctl(struct vhost_dev *d, unsigned int ioctl, void __user *argp)
 		}
 		if (eventfp != d->log_file) {
 			filep = d->log_file;
+			d->log_file = eventfp;
 			ctx = d->log_ctx;
 			d->log_ctx = eventfp ?
 				eventfd_ctx_fileget(eventfp) : NULL;

programming_language: C
CVE-2011-0766 (published 2011-05-31T20:55Z)

The random number generator in the Crypto application before 2.0.2.2, and SSH before 2.0.5, as used in the Erlang/OTP ssh library before R14B03, uses predictable seeds based on the current time, which makes it easier for remote attackers to guess DSA host and SSH session keys.

Severity: HIGH
CVSS v2 base score: 7.8 (AV:N/AC:L/Au:N/C:C/I:N/A:N)

Weakness information:
cwe_id: CWE-310
cwe_name: Cryptographic Issues
description: Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.

Fix information:
repo_url: https://github.com/erlang/otp
commit_details: repo_url: https://github.com/erlang/otp
author: Niclas Eklund
author_date: 2011-04-20 18:19:31+02:00
msg: Merge branch 'maint-r14' into dev
repository: repo_url: https://github.com/erlang/otp
repo_name: erlang/otp
description: Erlang/OTP
repo_language: Erlang
owner: erlang
CVE-2018-7480 (published 2018-02-25T20:29Z)

The blkcg_init_queue function in block/blk-cgroup.c in the Linux kernel before 4.11 allows local users to cause a denial of service (double free) or possibly have unspecified other impact by triggering a creation failure.

Severity: HIGH
CVSS v2 base score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-415
cwe_name: Double Free
description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
extended_description: When a program calls free() twice with the same argument, the program's memory management data structures become corrupted. This corruption can cause the program to crash or, in some circumstances, cause two later calls to malloc() to return the same pointer. If malloc() returns the same value twice and the program later gives the attacker control over the data that is written into this doubly-allocated memory, the program becomes vulnerable to a buffer overflow attack.
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Hou Tao
author_date: 2017-02-03 17:19:07+08:00
msg: blkcg: fix double free of new_blkg in blkcg_init_queue

If blkg_create fails, new_blkg passed as an argument will
be freed by blkg_create, so there is no need to free it again.

Signed-off-by: Hou Tao <houtao1@huawei.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: blk-cgroup.c
change_type: ModificationType.MODIFY
diff: @@ -1079,10 +1079,8 @@ int blkcg_init_queue(struct request_queue *q)
 	if (preloaded)
 		radix_tree_preload_end();
 
-	if (IS_ERR(blkg)) {
-		blkg_free(new_blkg);
+	if (IS_ERR(blkg))
 		return PTR_ERR(blkg);
-	}
 
 	q->root_blkg = blkg;
 	q->root_rl.blkg = blkg;

programming_language: C
CVE-2016-10053 (published 2017-03-23T17:59Z)

The WriteTIFFImage function in coders/tiff.c in ImageMagick before 6.9.5-8 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-369
cwe_name: Divide By Zero
description: The product divides a value by zero.
extended_description: This weakness typically occurs when an unexpected value is provided to the product, or if an error occurs that is not properly detected. It frequently occurs in calculations involving physical dimensions such as size, length, width, and height.
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2016-08-24 09:45:35-04:00
msg: Fix TIFF divide by zero (bug report from Donghai Zhu)
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: ChangeLog
change_type: ModificationType.MODIFY
diff: @@ -1,8 +1,8 @@
 2016-08-15  7.0.2-10 Cristy  <quetzlzacatenango@image...>
   * Prevent buffer overflow in BMP & SGI coders (bug report from
     pwchen&rayzhong of tencent).
-  * Prevent buffer overflow in SIXEL, PDB, MAP, and CALS coders (bug report
-    from Donghai Zhu).
+  * Prevent buffer overflow and other problems in SIXEL, PDB, MAP, TIFF and
+    CALS coders (bug report from Donghai Zhu).
 
 2016-08-14  7.0.2-9 Cristy  <quetzlzacatenango@image...>
   * Release ImageMagick version 7.0.2-9, GIT revision 18707:2c02f09:20160814.

programming_language: Markdown
filename: tiff.c
change_type: ModificationType.MODIFY
diff: @@ -3479,7 +3479,9 @@ static MagickBooleanType WriteTIFFImage(const ImageInfo *image_info,
       if ((image_info->interlace == PlaneInterlace) ||
           (image_info->interlace == PartitionInterlace))
         (void) TIFFSetField(tiff,TIFFTAG_PLANARCONFIG,PLANARCONFIG_SEPARATE);
-     rows_per_strip=TIFFDefaultStripSize(tiff,0);
+    rows_per_strip=1;
+    if (TIFFScanlineSize(tiff) != 0)
+      rows_per_strip=TIFFDefaultStripSize(tiff,0);
     option=GetImageOption(image_info,"tiff:rows-per-strip");
     if (option != (const char *) NULL)
       rows_per_strip=(size_t) strtol(option,(char **) NULL,10);

programming_language: C
CVE-2021-29455 (published 2021-04-19T19:15Z)

Grassroot Platform is an application to make it faster, cheaper and easier to persistently organize and mobilize people in low-income communities. Grassroot Platform before master deployment as of 2021-04-16 did not properly verify the signature of JSON Web Tokens when refreshing an existing JWT. This allows to forge a valid JWT. The problem has been patched in version 1.3.1 by deprecating the JWT refresh function, which was an overdue deprecation regardless (the "refresh" flow is no longer used).

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-347
cwe_name: Improper Verification of Cryptographic Signature
description: The product does not verify, or incorrectly verifies, the cryptographic signature for data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/grassrootza/grassroot-platform
commit_details: repo_url: https://github.com/grassrootza/grassroot-platform
author: Luke Jordan
author_date: 2021-04-16 16:45:39+02:00
msg: Merge pull request #412 from grassrootza/fix/refresh

Removing deprecated refresh function
repository: repo_url: https://github.com/grassrootza/grassroot-platform
repo_name: grassrootza/grassroot-platform
description: Modular application to make it easier and faster to organize and mobilize people, through a meeting organizer, vote taker, action logger and group manager.
repo_language: Java
owner: grassrootza
CVE-2021-4287 (published 2022-12-27T11:15Z)

A vulnerability, which was classified as problematic, was found in ReFirm Labs binwalk up to 2.3.2. Affected is an unknown function of the file src/binwalk/modules/extractor.py of the component Archive Extraction Handler. The manipulation leads to symlink following. It is possible to launch the attack remotely. Upgrading to version 2.3.3 is able to address this issue. The name of the patch is fa0c0bd59b8588814756942fe4cb5452e76c1dcd. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216876.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-59
cwe_name: Improper Link Resolution Before File Access ('Link Following')
description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/ReFirmLabs/binwalk
commit_details: repo_url: https://github.com/ReFirmLabs/binwalk
author: Peter Eacmen
author_date: 2021-09-10 13:46:40-04:00
msg: Merge pull request #556 from ReFirmLabs/unpriv_user_exec

Symlink directory traversal security fix
repository: repo_url: https://github.com/ReFirmLabs/binwalk
repo_name: ReFirmLabs/binwalk
description: Firmware Analysis Tool
repo_language: Python
owner: ReFirmLabs
CVE-2017-13018 (published 2017-09-14T06:29Z)

The PGM parser in tcpdump before 4.9.2 has a buffer over-read in print-pgm.c:pgm_print().

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/the-tcpdump-group/tcpdump
commit_details: repo_url: https://github.com/the-tcpdump-group/tcpdump
author: Guy Harris
author_date: 2017-03-21 19:49:28-07:00
msg: CVE-2017-13018/PGM: Add a missing bounds check.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't be rejected as an invalid capture.
repository: repo_url: https://github.com/the-tcpdump-group/tcpdump
repo_name: the-tcpdump-group/tcpdump
description: the TCPdump network dissector
repo_language: C
owner: the-tcpdump-group
file_changes: filename: print-pgm.c
change_type: ModificationType.MODIFY
diff: @@ -457,6 +457,10 @@ pgm_print(netdissect_options *ndo,
 		    ND_PRINT((ndo, "[Total option length leaves no room for final option]"));
 		    return;
 		}
+		if (!ND_TTEST2(*bp, 2)) {
+		    ND_PRINT((ndo, " [|OPT]"));
+		    return;
+		}
 		opt_type = *bp++;
 		opt_len = *bp++;
 		if (opt_len < PGM_MIN_OPT_LEN) {

programming_language: C
filename: TESTLIST
change_type: ModificationType.MODIFY
diff: @@ -519,6 +519,7 @@ esis_snpa_asan-3	esis_snpa_asan-3.pcap		esis_snpa_asan-3.out	-v
 esis_snpa_asan-4	esis_snpa_asan-4.pcap		esis_snpa_asan-4.out	-v
 esis_snpa_asan-5	esis_snpa_asan-5.pcap		esis_snpa_asan-5.out	-v
 dhcp6_reconf_asan	dhcp6_reconf_asan.pcap		dhcp6_reconf_asan.out	-v
+pgm_opts_asan		pgm_opts_asan.pcap		pgm_opts_asan.out	-v
 
 # RTP tests
 # fuzzed pcap

programming_language: Shell
filename: pgm_opts_asan.out
change_type: ModificationType.ADD
diff: @@ -0,0 +1,2 @@
+IP (tos 0x41,ECT(1), id 0, offset 0, flags [none], proto PGM (113), length 32639, options (unknown 89 [bad length 232]), bad cksum 5959 (->9eb9)!)
+    128.121.89.107 > 89.89.16.63: 128.121.89.107.4 > 89.89.16.63.225: PGM, length 0 0x3414eb1f0022 UNKNOWN type 0x1f OPTS LEN 225 OPT_1F [13]  OPT_06 [26]  PATH_NLA [4] [|OPT]

programming_language: Haskell
CVE-2021-32823 (published 2021-06-24T00:15Z)

In the bindata RubyGem before version 2.4.10 there is a potential denial-of-service vulnerability. In affected versions it is very slow for certain classes in BinData to be created. For example BinData::Bit100000, BinData::Bit100001, BinData::Bit100002, BinData::Bit<N>. In combination with <user_input>.constantize there is a potential for a CPU-based DoS. In version 2.4.10 bindata improved the creation time of Bits and Integers.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 3.7, LOW (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/dmendel/bindata
commit_details: repo_url: https://github.com/dmendel/bindata
author: Dion Mendel
author_date: 2021-05-18 11:39:35+08:00
msg: Improved creation time of Bits and Integers
repository: repo_url: https://github.com/dmendel/bindata
repo_name: dmendel/bindata
description: BinData - Reading and Writing Binary Data in Ruby
repo_language: Ruby
owner: dmendel
file_changes: filename: ChangeLog.rdoc
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,9 @@
 = BinData Changelog
 
+== Version 2.4.10 (2021-05-18)
+
+* Improve speed of dynamic object creation.  Reported by Charlie Ablett.
+
 == Version 2.4.9 (2021-04-22)
 
 * Change example from Fixnum to Integer.  Thanks to Tim Chambers.

programming_language: Markdown
filename: bits.rb
change_type: ModificationType.MODIFY
diff: @@ -115,14 +115,14 @@ module BinData
         end
 
         if signed == :signed
-          max = (1 << (nbits - 1)) - 1
-          min = -(max + 1)
+          max = "max = (1 << (#{nbits} - 1)) - 1"
+          min = "min = -(max + 1)"
         else
-          min = 0
-          max = (1 << nbits) - 1
+          min = "min = 0"
+          max = "max = (1 << #{nbits}) - 1"
         end
 
-        clamp = "(val < #{min}) ? #{min} : (val > #{max}) ? #{max} : val"
+        clamp = "(#{max}; #{min}; val = (val < min) ? min : (val > max) ? max : val)"
 
         if nbits == 1
           # allow single bits to be used as booleans

programming_language: Ruby
filename: int.rb
change_type: ModificationType.MODIFY
diff: @@ -59,14 +59,16 @@ module BinData
 
       def create_clamp_code(nbits, signed)
         if signed == :signed
-          max = (1 << (nbits - 1)) - 1
-          min = -(max + 1)
+          max = "max = (1 << (#{nbits} - 1)) - 1"
+          min = "min = -(max + 1)"
         else
-          max = (1 << nbits) - 1
-          min = 0
+          max = "max = (1 << #{nbits}) - 1"
+          min = "min = 0"
         end
 
-        "val = (val < #{min}) ? #{min} : (val > #{max}) ? #{max} : val"
+        clamp = "(#{max}; #{min}; val = (val < min) ? min : (val > max) ? max : val)"
+
+        "val = #{clamp}"
       end
 
       def create_read_code(nbits, endian, signed)

programming_language: Ruby