starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2022-1531 (published 2022-04-29T09:15Z)

SQL injection vulnerability in ARAX-UI Synonym Lookup functionality in GitHub repository rtxteam/rtx prior to checkpoint_2022-04-20 . This vulnerability is critical as it can lead to remote code execution and thus complete server takeover.

Severity: HIGH
CVSS v2 base score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/rtxteam/rtx
commit_details: repo_url: https://github.com/rtxteam/rtx
author: Eric Deutsch
author_date: 2022-04-20 18:38:35+00:00
msg: avoid SQL injection exploits
repository: repo_url: https://github.com/rtxteam/rtx
repo_name: RTXteam/RTX
description: Software repo for Team Expander Agent (Oregon State U., Institute for Systems Biology, and Penn State U.)
repo_language: Python
owner: rtxteam
file_changes: filename: rtxcomplete.py
change_type: ModificationType.MODIFY
diff: @@ -23,6 +23,7 @@ def load():
     database_name = f"{autocomplete_filepath}{os.path.sep}{RTXConfig.autocomplete_path.split('/')[-1]}"
     conn = sqlite3.connect(database_name)
     cursor = conn.cursor()
+    #print(f"INFO: Connected to {database_name}",file=sys.stderr)
     return True
 
 
@@ -39,6 +40,9 @@ def get_nodes_like(word,requested_limit):
     if len(word) < 2:
         return values
 
+    #### Try to avoid SQL injection exploits by sanitizing input #1823
+    word = word.replace('"','')
+
     floor = word[:-1]
     ceiling = floor + 'zz'
 
@@ -103,8 +107,12 @@ def get_nodes_like(word,requested_limit):
         if found_fragment is None:
 
             #### Cache this fragment in the database
-            cursor.execute("INSERT INTO cached_fragments(fragment) VALUES(?)", (word,))
-            fragment_id = cursor.lastrowid
+            try:
+                cursor.execute("INSERT INTO cached_fragments(fragment) VALUES(?)", (word,))
+                fragment_id = cursor.lastrowid
+            except:
+                print(f"ERROR: Unable to INSERT into cached_fragments(fragment)",file=sys.stderr)
+                fragment_id = 0
             if debug:
                 print(f"fragment_id = {fragment_id}")
 

programming_language: Python
CVE-2020-29367 (published 2020-11-27T20:15Z)

blosc2.c in Blosc C-Blosc2 through 2.0.0.beta.5 has a heap-based buffer overflow when there is a lack of space to write compressed data.

Severity: HIGH
CVSS v2 base score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/Blosc/c-blosc2
commit_details: repo_url: https://github.com/Blosc/c-blosc2
author: Nathan Moinvaziri
author_date: 2020-10-17 16:43:22-07:00
msg: Fixed asan heap buffer overflow when not enough space to write compressed block size.
repository: repo_url: https://github.com/Blosc/c-blosc2
repo_name: Blosc/c-blosc2
description: A fast, compressed, persistent binary data store library for C.
repo_language: C
owner: Blosc
file_changes: filename: blosc2.c
change_type: ModificationType.MODIFY
diff: @@ -706,7 +706,7 @@ static bool get_run(const uint8_t* ip, const uint8_t* ip_bound) {
 
 /* Shuffle & compress a single block */
 static int blosc_c(struct thread_context* thread_context, int32_t bsize,
-                   int32_t leftoverblock, int32_t ntbytes, int32_t maxbytes,
+                   int32_t leftoverblock, int32_t ntbytes, int32_t destsize,
                    const uint8_t* src, const int32_t offset, uint8_t* dest,
                    uint8_t* tmp, uint8_t* tmp2) {
   blosc2_context* context = thread_context->parent_context;
@@ -772,6 +772,10 @@ static int blosc_c(struct thread_context* thread_context, int32_t bsize,
     if (get_run(ip, ipbound)) {
       // A run.  Encode the repeated byte as a negative length in the length of the split.
       int32_t value = _src[j * neblock];
+      if (ntbytes > destsize) {
+        /* Not enough space to write out compressed block size */
+        return -1;
+      }
       _sw32(dest - 4, -value);
       continue;
     }
@@ -782,9 +786,9 @@ static int blosc_c(struct thread_context* thread_context, int32_t bsize,
       maxout = (int32_t)snappy_max_compressed_length((size_t)neblock);
     }
   #endif /*  HAVE_SNAPPY */
-    if (ntbytes + maxout > maxbytes) {
+    if (ntbytes + maxout > destsize) {
       /* avoid buffer * overrun */
-      maxout = (int64_t)maxbytes - (int64_t)ntbytes;
+      maxout = (int64_t)destsize - (int64_t)ntbytes;
       if (maxout <= 0) {
         return 0;                  /* non-compressible block */
       }
@@ -859,7 +863,7 @@ static int blosc_c(struct thread_context* thread_context, int32_t bsize,
         /* The compressor has been unable to compress data at all. */
         /* Before doing the copy, check that we are not running into a
            buffer overflow. */
-        if ((ntbytes + neblock) > maxbytes) {
+        if ((ntbytes + neblock) > destsize) {
           return 0;    /* Non-compressible data */
         }
         memcpy(dest, _src + j * neblock, (unsigned int)neblock);

programming_language: C
CVE-2024-21646 (published 2024-01-09T01:15Z)

Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to implement AMQP protocol communication.  When clients using this library receive a crafted binary type data, an integer overflow or wraparound or memory safety issue can occur and may cause remote code execution.  This vulnerability has been patched in release 2024-01-01.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/Azure/azure-uamqp-c
commit_details: repo_url: https://github.com/Azure/azure-uamqp-c
author: Eric Wolz
author_date: 2023-12-05 16:07:53-08:00
msg: int overflow for binary_value size malloc (#444)

* int overflow for binary_value size malloc

* update PR feedback

* pr feedback
repository: repo_url: https://github.com/Azure/azure-uamqp-c
repo_name: Azure/azure-uamqp-c
description: AMQP library for C
repo_language: C
owner: Azure
file_changes: filename: amqpvalue.c
change_type: ModificationType.MODIFY
diff: @@ -5912,7 +5912,17 @@ static int internal_decoder_decode_bytes(INTERNAL_DECODER_DATA* internal_decoder
                             }
                             else
                             {
-                                internal_decoder_data->decode_to_value->value.binary_value.bytes = (unsigned char*)malloc((size_t)internal_decoder_data->decode_to_value->value.binary_value.length + 1);
+                                size_t malloc_size = (size_t)internal_decoder_data->decode_to_value->value.binary_value.length + 1;
+                                if (malloc_size == 0)
+                                {
+                                    internal_decoder_data->decode_to_value->value.binary_value.bytes = NULL;
+                                    LogError("Invalid binary_value size exceeded max allocation");
+                                }
+                                else
+                                {
+                                    internal_decoder_data->decode_to_value->value.binary_value.bytes = (unsigned char*)malloc(malloc_size);
+                                }
+
                                 if (internal_decoder_data->decode_to_value->value.binary_value.bytes == NULL)
                                 {
                                     /* Codes_SRS_AMQPVALUE_01_326: [If any allocation failure occurs during decoding, amqpvalue_decode_bytes shall fail and return a non-zero value.] */

programming_language: SQL
CVE-2017-17499 (published 2017-12-11T02:29Z)

ImageMagick before 6.9.9-24 and 7.x before 7.0.7-12 has a use-after-free in Magick::Image::read in Magick++/lib/Image.cpp.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Dirk Lemstra
author_date: 2017-11-18 10:23:27+01:00
msg: Added missing return to avoid use after free.
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: Image.cpp
change_type: ModificationType.MODIFY
diff: @@ -5087,6 +5087,7 @@ void Magick::Image::read(MagickCore::Image *image,
       if (!quiet())
         throwExceptionExplicit(MagickCore::ImageWarning,
           "No image was loaded.");
+      return;
     }
   ThrowImageException;
 }

programming_language: C++
CVE-2022-47021 (published 2023-01-20T19:15Z)

A null pointer dereference issue was discovered in functions op_get_data and op_open1 in opusfile.c in xiph opusfile 0.9 thru 0.12 allows attackers to cause denial of service or other unspecified impacts.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/xiph/opusfile
commit_details: repo_url: https://github.com/xiph/opusfile
author: Ralph Giles
author_date: 2022-09-06 19:04:31-07:00
msg: Propagate allocation failure from ogg_sync_buffer.

Instead of segfault, report OP_EFAULT if ogg_sync_buffer returns
a null pointer. This allows more graceful recovery by the caller
in the unlikely event of a fallible ogg_malloc call.

We do check the return value elsewhere in the code, so the new
checks make the code more consistent.

Thanks to https://github.com/xiph/opusfile/issues/36 for reporting.

Signed-off-by: Timothy B. Terriberry <tterribe@xiph.org>
Signed-off-by: Mark Harris <mark.hsj@gmail.com>
repository: repo_url: https://github.com/xiph/opusfile
repo_name: xiph/opusfile
description: Stand-alone decoder library for .opus streams
repo_language: C
owner: xiph
file_changes: filename: opusfile.c
change_type: ModificationType.MODIFY
diff: @@ -148,6 +148,7 @@ static int op_get_data(OggOpusFile *_of,int _nbytes){
   int            nbytes;
   OP_ASSERT(_nbytes>0);
   buffer=(unsigned char *)ogg_sync_buffer(&_of->oy,_nbytes);
+  if(OP_UNLIKELY(buffer==NULL))return OP_EFAULT;
   nbytes=(int)(*_of->callbacks.read)(_of->stream,buffer,_nbytes);
   OP_ASSERT(nbytes<=_nbytes);
   if(OP_LIKELY(nbytes>0))ogg_sync_wrote(&_of->oy,nbytes);
@@ -1527,6 +1528,7 @@ static int op_open1(OggOpusFile *_of,
   if(_initial_bytes>0){
     char *buffer;
     buffer=ogg_sync_buffer(&_of->oy,(long)_initial_bytes);
+    if(OP_UNLIKELY(buffer==NULL))return OP_EFAULT;
     memcpy(buffer,_initial_data,_initial_bytes*sizeof(*buffer));
     ogg_sync_wrote(&_of->oy,(long)_initial_bytes);
   }

programming_language: C++
CVE-2014-9709 (published 2015-03-30T10:59Z)

The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x before 5.6.5, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted GIF image that is improperly handled by the gdImageCreateFromGif function.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://bitbucket.org/libgd/gd-libgd
commit_details: repo_url: https://bitbucket.org/libgd/gd-libgd
author: Remi Collet
author_date: 2014-12-13 08:48:18+01:00
msg: Fix possible buffer read overflow
detected by -fsanitize=address, thanks to Jan Bee
repository: repo_url: https://bitbucket.org/libgd/gd-libgd
repo_name: visit repo url
description: visit repo url
repo_language: visit repo url
owner: libgd
file_changes: filename: gd_gif_in.c
change_type: ModificationType.MODIFY
diff: @@ -75,8 +75,10 @@ static struct {
 
 #define STACK_SIZE ((1<<(MAX_LWZ_BITS))*2)
 
+#define CSD_BUF_SIZE 280
+
 typedef struct {
-	unsigned char buf[280];
+	unsigned char buf[CSD_BUF_SIZE];
 	int curbit;
 	int lastbit;
 	int done;
@@ -468,7 +470,12 @@ GetCode_(gdIOCtx *fd, CODE_STATIC_DATA *scd, int code_size, int flag, int *ZeroD
 
 	ret = 0;
 	for (i = scd->curbit, j = 0; j < code_size; ++i, ++j) {
-		ret |= ((scd->buf[i / 8] & (1 << (i % 8))) != 0) << j;
+		if (i < CSD_BUF_SIZE * 8) {
+			ret |= ((scd->buf[i / 8] & (1 << (i % 8))) != 0) << j;
+		} else {
+			ret = -1;
+			break;
+		}
 	}
 
 	scd->curbit += code_size;

programming_language: C
CVE-2020-7754 (published 2020-10-27T15:15Z)

This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/npm/npm-user-validate
commit_details: repo_url: https://github.com/npm/npm-user-validate
author: Darcy Clarke
author_date: 2020-10-15 17:59:42-04:00
msg: fix: update email validation

PR-URL: https://github.com/isaacs/npm-user-validate/pull/15
Credit: @
Close: #15
Reviewed-by: @isaacs
repository: repo_url: https://github.com/npm/npm-user-validate
repo_name: npm/npm-user-validate
description: user validation
repo_language: JavaScript
owner: npm
file_changes: filename: npm-user-validate.js
change_type: ModificationType.MODIFY
diff: @@ -11,6 +11,7 @@ var requirements = exports.requirements = {
   },
   password: {},
   email: {
+    length: 'Email length must be less then or equal to 254 characters long',
     valid: 'Email must be an email address'
   }
 }
@@ -45,7 +46,10 @@ function username (un) {
 }
 
 function email (em) {
-  if (!em.match(/^.+@.+\..+$/)) {
+  if (em.length > 254) {
+    return new Error(requirements.email.length)
+  }
+  if (!em.match(/^[^@]+@.+\..+$/)) {
     return new Error(requirements.email.valid)
   }
 

programming_language: CoffeeScript
filename: email.test.js
change_type: ModificationType.MODIFY
diff: @@ -7,6 +7,13 @@ test('email misses an @', function (t) {
   t.end()
 })
 
+test('email is longer then 254 characters', function (t) {
+  var str = '@'.repeat(255)
+  var err = v(str)
+  t.type(err, 'object')
+  t.end()
+})
+
 test('email misses a dot', function (t) {
   var err = v('name@domain')
   t.type(err, 'object')

programming_language: JavaScript
CVE-2021-45010 (published 2022-03-15T12:15Z)

A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attackers (with valid user accounts) to upload malicious PHP files to the webroot, leading to code execution.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/prasathmani/tinyfilemanager
commit_details: repo_url: https://github.com/prasathmani/tinyfilemanager
author: febinrev
author_date: 2021-11-12 08:31:02+05:30
msg: Patched the RCE (#636)

I have patched the file upload directory traversal to Authenticated Remote Code Execution Vulnerability.
repository: repo_url: https://github.com/prasathmani/tinyfilemanager
repo_name: prasathmani/tinyfilemanager
description: Single-file PHP file manager, browser and manage your files efficiently and easily with tinyfilemanager
repo_language: PHP
owner: prasathmani
file_changes: filename: tinyfilemanager.php
change_type: ModificationType.MODIFY
diff: @@ -880,7 +880,7 @@ if (!empty($_FILES) && !FM_READONLY) {
 
     $targetPath = $path . $ds;
     if ( is_writable($targetPath) ) {
-        $fullPath = $path . '/' . $_REQUEST['fullpath'];
+        $fullPath = $path . '/' . str_replace("./","_",$_REQUEST['fullpath']);
         $folder = substr($fullPath, 0, strrpos($fullPath, "/"));
 
         if(file_exists ($fullPath) && !$override_file_name) {

programming_language: PHP
CVE-2023-30850 (published 2023-04-27T17:15Z)

Pimcore is an open source data and experience management platform. Prior to version 10.5.21, a SQL Injection vulnerability exists in the admin translations API. Users should update to version 10.5.21 to receive a patch or, as a workaround, or apply the patch manually.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/pimcore/pimcore
commit_details: repo_url: https://github.com/pimcore/pimcore
author: Christian F
author_date: 2023-04-20 11:51:21+02:00
msg: fixed sql injection in translation api (#14952)
repository: repo_url: https://github.com/pimcore/pimcore
repo_name: pimcore/pimcore
description: Core Framework for the Open Source Data & Experience Management Platform (PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce)
repo_language: PHP
owner: pimcore
file_changes: filename: TranslationController.php
change_type: ModificationType.MODIFY
diff: @@ -650,7 +650,7 @@ class TranslationController extends AdminController
                 }
 
                 if ($field && $value) {
-                    $condition = $field . ' ' . $operator . ' ' . $db->quote($value);
+                    $condition = $db->quoteIdentifier($field) . ' ' . $operator . ' ' . $db->quote($value);
 
                     if ($languageMode) {
                         $conditions[$fieldname] = $condition;

programming_language: PHP