starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2022-1341 (published 2022-04-18T17:15Z)

An issue was discovered in in bwm-ng v0.6.2. An arbitrary null write exists in get_cmdln_options() function in src/options.c.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/vgropp/bwm-ng
commit_details: repo_url: https://github.com/vgropp/bwm-ng
author: Oliver Falk
author_date: 2020-07-27 09:25:09+02:00
msg: Fix https://github.com/vgropp/bwm-ng/issues/26
repository: repo_url: https://github.com/vgropp/bwm-ng
repo_name: vgropp/bwm-ng
description: Bandwidth Monitor NG is a small and simple console-based live network and disk io bandwidth monitor for Linux, BSD, Solaris, Mac OS X and others. 
repo_language: C
owner: vgropp
file_changes: filename: options.c
change_type: ModificationType.MODIFY
diff: @@ -335,6 +335,10 @@ void get_cmdln_options(int argc, char *argv[]) {
         pwd_entry=getpwuid(getuid());
         if (pwd_entry!=NULL) {
             str=(char*)malloc(strlen(pwd_entry->pw_dir)+14);
+            if(!str) {
+              printf("Fatal: failed to allocate %zu bytes.\n", strlen(pwd_entry->pw_dir)+14);
+              exit(EXIT_FAILURE);
+            }
             snprintf(str,strlen(pwd_entry->pw_dir)+14,"%s/.bwm-ng.conf",pwd_entry->pw_dir);
             read_config(str);
             free(str);

programming_language: C
CVE-2018-1000524 (published 2018-06-26T16:29Z)

miniSphere version 5.2.9 and earlier contains a Integer Overflow vulnerability in layer_resize() function in map_engine.c that can result in remote denial of service. This attack appear to be exploitable via the victim must load a specially-crafted map which calls SetLayerSize in its entry script. This vulnerability appears to have been fixed in 5.0.3, 5.1.5, 5.2.10 and later.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/fatcerberus/minisphere
commit_details: repo_url: https://github.com/fatcerberus/minisphere
author: Xiaoyin Liu
author_date: 2018-06-12 22:12:57-07:00
msg: Fix integer overflow in layer_resize in map_engine.c (#268)

* Fix integer overflow in layer_resize in map_engine.c

There's a buffer overflow bug in the function layer_resize. It allocates
a buffer `tilemap` with size `x_size * y_size * sizeof(struct map_tile)`.
But it didn't check for integer overflow, so if x_size and y_size are
very large, it's possible that the buffer size is smaller than needed,
causing a buffer overflow later.

PoC: `SetLayerSize(0, 0x7FFFFFFF, 0x7FFFFFFF);`

* move malloc to a separate line
repository: repo_url: https://github.com/fatcerberus/minisphere
repo_name: spheredev/neosphere
description: A lightweight game engine and development platform using JavaScript for game coding, based on the original Sphere engine by Chad Austin but with a redesigned, modern API and brand-new command-line development tools.
repo_language: C
owner: fatcerberus
file_changes: filename: map_engine.c
change_type: ModificationType.MODIFY
diff: @@ -1036,6 +1036,7 @@ layer_resize(int layer, int x_size, int y_size)
 	struct map_tile*    tilemap;
 	struct map_trigger* trigger;
 	struct map_zone*    zone;
+	size_t              tilemap_size;
 
 	int x, y, i;
 
@@ -1044,7 +1045,9 @@ layer_resize(int layer, int x_size, int y_size)
 
 	// allocate a new tilemap and copy the old layer tiles into it.  we can't simply realloc
 	// because the tilemap is a 2D array.
-	if (!(tilemap = malloc(x_size * y_size * sizeof(struct map_tile))))
+	tilemap_size = x_size * y_size * sizeof(struct map_tile);
+	if (x_size == 0 || tilemap_size / x_size / sizeof(struct map_tile) != y_size
+		|| !(tilemap = malloc(tilemap_size)))
 		return false;
 	for (x = 0; x < x_size; ++x) {
 		for (y = 0; y < y_size; ++y) {

programming_language: C
CVE-2022-36084 (published 2022-09-08T22:15Z)

cruddl is software for creating a GraphQL API for a database, using the GraphQL SDL to model a schema. If cruddl starting with version 1.1.0 and prior to versions 2.7.0 and 3.0.2 is used to generate a schema that uses `@flexSearchFulltext`, users of that schema may be able to inject arbitrary AQL queries that will be forwarded to and executed by ArangoDB. Schemas that do not use `@flexSearchFulltext` are not affected. The attacker needs to have `READ` permission to at least one root entity type that has `@flexSearchFulltext` enabled. The issue has been fixed in version 3.0.2 and in version 2.7.0 of cruddl. As a workaround, users can temporarily remove `@flexSearchFulltext` from their schemas.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/AEB-labs/cruddl
commit_details: repo_url: https://github.com/AEB-labs/cruddl
author: Jan Melcher
author_date: 2022-09-02 15:02:46+02:00
msg: Use regular aql framework for flex search expression tokenization
repository: repo_url: https://github.com/AEB-labs/cruddl
repo_name: AEB-labs/cruddl
description: Create a GraphQL API for your database, using the GraphQL SDL to model your schema.
repo_language: TypeScript
owner: AEB-labs
file_changes: filename: aql-generator.ts
change_type: ModificationType.MODIFY
diff: @@ -1762,12 +1762,11 @@ function isStringCaseInsensitive(str: string) {
     return str.toLowerCase() === str.toUpperCase();
 }
 
-export function generateTokenizationQuery(tokensFiltered: ReadonlyArray<FlexSearchTokenizable>) {
-    const fragments: string[] = [];
+export function generateTokenizationQuery(tokensFiltered: ReadonlyArray<FlexSearchTokenizable>): AQLFragment {
+    const fragments: AQLFragment[] = [];
     for (let i = 0; i < tokensFiltered.length; i++) {
         const value = tokensFiltered[i];
-        fragments.push(`token_${i}: TOKENS("${value.expression}", "${value.analyzer}")`);
+        fragments.push(aql`${aql.identifier('token_' + i)}: TOKENS(${value.expression}, ${value.analyzer})`);
     }
-    const query = `RETURN { ${fragments.join(',\n')} }`;
-    return query;
+    return aql`RETURN { ${aql.join(fragments, aql`',\n`)} }`;
 }

programming_language: TypeScript
filename: arangodb-adapter.ts
change_type: ModificationType.MODIFY
diff: @@ -718,7 +718,9 @@ export class ArangoDBAdapter implements DatabaseAdapter {
                 )
         );
 
-        const cursor = await this.db.query(generateTokenizationQuery(tokenizationsFiltered));
+        const aqlFragment = generateTokenizationQuery(tokenizationsFiltered);
+        const queryCode = aqlFragment.getCode();
+        const cursor = await this.db.query(queryCode.code, queryCode.boundValues);
 
         const result = await cursor.next();
         const resultArray: FlexSearchTokenization[] = [];

programming_language: TypeScript
CVE-2024-25674 (published 2024-02-09T09:15Z)

An issue was discovered in MISP before 2.4.184. Organisation logo upload is insecure because of a lack of checks for the file extension and MIME type.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/MISP/MISP
commit_details: repo_url: https://github.com/MISP/MISP
author: Sami Mokaddem
author_date: 2024-01-31 14:27:59+01:00
msg: fix: [security] Improved security checks for organisation logo upload

- As reported by Andrei Agape / Teliacompany

Checks are:
- Maximum file size of 250K since the recommanded picture size is 48x48.
- File extension check
- File mime type checks
repository: repo_url: https://github.com/MISP/MISP
repo_name: MISP/MISP
description: MISP (core software) - Open Source Threat Intelligence and Sharing Platform
repo_language: PHP
owner: MISP
file_changes: filename: OrganisationsController.php
change_type: ModificationType.MODIFY
diff: @@ -481,6 +481,25 @@ class OrganisationsController extends AppController
             $extension = pathinfo($logo['name'], PATHINFO_EXTENSION);
             $filename = $orgId . '.' . ($extension === 'svg' ? 'svg' : 'png');
 
+            if ($logo['size'] > 250*1024) {
+                $this->Flash->error(__('This organisation logo is too large, maximum file size allowed is 250kB.'));
+                return false;
+            }
+
+            if ($extension !== 'svg' && $extension !== 'png') {
+                $this->Flash->error(__('Invalid file extension, Only PNG and SVG images are allowed.'));
+                return false;
+            }
+
+            $imgMime = mime_content_type($logo['tmp_name']);
+            if ($extension === 'png' && !exif_imagetype($logo['tmp_name'])) {
+                $this->Flash->error(__('This is not a valid PNG image.'));
+                return false;
+            } else if ($extension === 'svg' && !($imgMime === 'image/svg+xml' || $imgMime === 'image/svg')) {
+                $this->Flash->error(__('This is not a valid SVG image.'));
+                return false;
+            }
+
             if ($extension === 'svg' && !Configure::read('Security.enable_svg_logos')) {
                 $this->Flash->error(__('Invalid file extension, SVG images are not allowed.'));
                 return false;

programming_language: PHP
CVE-2016-10208 (published 2017-02-06T06:59Z)

The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.9.8 does not properly validate meta block groups, which allows physically proximate attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 4.3, MEDIUM (CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Eryu Guan
author_date: 2016-12-01 15:08:37-05:00
msg: ext4: validate s_first_meta_bg at mount time

Ralf Spenneberg reported that he hit a kernel crash when mounting a
modified ext4 image. And it turns out that kernel crashed when
calculating fs overhead (ext4_calculate_overhead()), this is because
the image has very large s_first_meta_bg (debug code shows it's
842150400), and ext4 overruns the memory in count_overhead() when
setting bitmap buffer, which is PAGE_SIZE.

ext4_calculate_overhead():
  buf = get_zeroed_page(GFP_NOFS);  <=== PAGE_SIZE buffer
  blks = count_overhead(sb, i, buf);

count_overhead():
  for (j = ext4_bg_num_gdb(sb, grp); j > 0; j--) { <=== j = 842150400
          ext4_set_bit(EXT4_B2C(sbi, s++), buf);   <=== buffer overrun
          count++;
  }

This can be reproduced easily for me by this script:

  #!/bin/bash
  rm -f fs.img
  mkdir -p /mnt/ext4
  fallocate -l 16M fs.img
  mke2fs -t ext4 -O bigalloc,meta_bg,^resize_inode -F fs.img
  debugfs -w -R "ssv first_meta_bg 842150400" fs.img
  mount -o loop fs.img /mnt/ext4

Fix it by validating s_first_meta_bg first at mount time, and
refusing to mount if its value exceeds the largest possible meta_bg
number.

Reported-by: Ralf Spenneberg <ralf@os-t.de>
Signed-off-by: Eryu Guan <guaneryu@gmail.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reviewed-by: Andreas Dilger <adilger@dilger.ca>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: super.c
change_type: ModificationType.MODIFY
diff: @@ -3842,6 +3842,15 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
 			(EXT4_MAX_BLOCK_FILE_PHYS / EXT4_BLOCKS_PER_GROUP(sb)));
 	db_count = (sbi->s_groups_count + EXT4_DESC_PER_BLOCK(sb) - 1) /
 		   EXT4_DESC_PER_BLOCK(sb);
+	if (ext4_has_feature_meta_bg(sb)) {
+		if (le32_to_cpu(es->s_first_meta_bg) >= db_count) {
+			ext4_msg(sb, KERN_WARNING,
+				 "first meta block group too large: %u "
+				 "(group descriptor block count %u)",
+				 le32_to_cpu(es->s_first_meta_bg), db_count);
+			goto failed_mount;
+		}
+	}
 	sbi->s_group_desc = ext4_kvmalloc(db_count *
 					  sizeof(struct buffer_head *),
 					  GFP_KERNEL);

programming_language: C
CVE-2022-29361 (published 2022-05-25T01:15Z)

Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body. NOTE: the vendor's position is that this behavior can only occur in unsupported configurations involving development mode and an HTTP server from outside the Werkzeug project

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-444
cwe_name: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
description: The product acts as an intermediary HTTP agent
         (such as a proxy or firewall) in the data flow between two
         entities such as a client and server, but it does not
         interpret malformed HTTP requests or responses in ways that
         are consistent with how the messages will be processed by
         those entities that are at the ultimate destination.
extended_description: 
	   HTTP requests or responses ("messages") can be
	   malformed or unexpected in ways that cause web servers or
	   clients to interpret the messages in different ways than
	   intermediary HTTP agents such as load balancers, reverse
	   proxies, web caching proxies, application firewalls,
	   etc. For example, an adversary may be able to add duplicate
	   or different header fields that a client or server might
	   interpret as one set of messages, whereas the intermediary
	   might interpret the same sequence of bytes as a different
	   set of messages. For example, discrepancies can arise in
	   how to handle duplicate headers like two Transfer-encoding
	   (TE) or two Content-length (CL), or the malicious HTTP
	   message will have different headers for TE and
	   CL.
	   The inconsistent parsing and interpretation of messages
	   can allow the adversary to "smuggle" a message to the
	   client/server without the intermediary being aware of it.
	   This weakness is usually the result of the usage
	   of outdated or incompatible HTTP protocol versions in the
	   HTTP agents.
         
         

Fix information:
repo_url: https://github.com/pallets/werkzeug
commit_details: repo_url: https://github.com/pallets/werkzeug
author: David Lord
author_date: 2022-02-17 16:24:11-08:00
msg: Merge branch '2.0.x'
repository: repo_url: https://github.com/pallets/werkzeug
repo_name: pallets/werkzeug
description: The comprehensive WSGI web application library.
repo_language: Python
owner: pallets
CVE-2021-4294 (published 2022-12-28T17:15Z)

A vulnerability was found in OpenShift OSIN. It has been classified as problematic. This affects the function ClientSecretMatches/CheckClientSecret. The manipulation of the argument secret leads to observable timing discrepancy. The name of the patch is 8612686d6dda34ae9ef6b5a974e4b7accb4fea29. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216987.

CVSS v3 base score: 5.9, MEDIUM (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-203
cwe_name: Observable Discrepancy
description: The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
extended_description: Discrepancies can take many forms, and variations may be detectable in timing, control flow, communications such as replies or requests, or general behavior. These discrepancies can reveal information about the product's operation or internal state to an unauthorized actor. In some cases, discrepancies can be used by attackers to form a side channel.
         

Fix information:
repo_url: https://github.com/openshift/osin
commit_details: repo_url: https://github.com/openshift/osin
author: Stanislav Laznicka
author_date: 2020-05-20 13:12:58+02:00
msg: Use constant time comparisons for client secrets

This is a precaution to avoid possible timing attacks on
client secrets.
repository: repo_url: https://github.com/openshift/osin
repo_name: openshift/osin
description: Golang OAuth2 server library
repo_language: Go
owner: openshift
file_changes: filename: client.go
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,7 @@
 package osin
 
+import "crypto/subtle"
+
 // Client information
 type Client interface {
 	// Client id
@@ -49,7 +51,7 @@ func (d *DefaultClient) GetUserData() interface{} {
 
 // Implement the ClientSecretMatcher interface
 func (d *DefaultClient) ClientSecretMatches(secret string) bool {
-	return d.Secret == secret
+	return subtle.ConstantTimeCompare([]byte(d.Secret), []byte(secret)) == 1
 }
 
 func (d *DefaultClient) CopyFrom(client Client) {

programming_language: Go
filename: util.go
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,7 @@
 package osin
 
 import (
+	"crypto/subtle"
 	"encoding/base64"
 	"errors"
 	"net/http"
@@ -28,7 +29,7 @@ func CheckClientSecret(client Client, secret string) bool {
 		return client.ClientSecretMatches(secret)
 	default:
 		// Fallback to the less secure method of extracting the plain text secret from the client for comparison
-		return client.GetSecret() == secret
+		return subtle.ConstantTimeCompare([]byte(client.GetSecret()), []byte(secret)) == 1
 	}
 }
 

programming_language: Go
CVE-2021-33796 (published 2023-07-07T18:15Z)

In MuJS before version 1.1.2, a use-after-free flaw in the regexp source property access may cause denial of service.\n\n

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/ccxvii/mujs
commit_details: repo_url: https://github.com/ccxvii/mujs
author: Tor Andersson
author_date: 2021-04-23 11:11:28+02:00
msg: Fix use-after-free in regexp source property access.

The underlying string of the "source" property of a regular expression
object can be freed if the regexp is garbage collected.

This could lead to a use-after-free, because the accessor incorrectly
assumed that the regexp source was an interned (thus never freed) string.
Fix this by calling js_pushstring instead of the faster but unsafe
js_pushliteral.

Many thanks to Connor Nelson for spotting this!
repository: repo_url: https://github.com/ccxvii/mujs
repo_name: ccxvii/mujs
description: An embeddable Javascript interpreter in C.
repo_language: C
owner: ccxvii
file_changes: filename: jsrun.c
change_type: ModificationType.MODIFY
diff: @@ -522,7 +522,7 @@ static int jsR_hasproperty(js_State *J, js_Object *obj, const char *name)
 
 	else if (obj->type == JS_CREGEXP) {
 		if (!strcmp(name, "source")) {
-			js_pushliteral(J, obj->u.r.source);
+			js_pushstring(J, obj->u.r.source);
 			return 1;
 		}
 		if (!strcmp(name, "global")) {

programming_language: C
CVE-2023-34097 (published 2023-06-05T21:15Z)

hoppscotch is an open source API development ecosystem. In versions prior to 2023.4.5 the database password is exposed in the logs when showing the database connection string. Attackers with access to read system logs will be able to elevate privilege with full access to the database. Users are advised to upgrade. There are no known workarounds for this vulnerability. 

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-532
cwe_name: Insertion of Sensitive Information into Log File
description: Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
extended_description: 
            While logging all information may be helpful during development stages, it is important that logging levels be set appropriately before a product ships so that sensitive user data and system information are not accidentally exposed to potential attackers.
            Different log files may be produced and stored for:
            
               Server log files (e.g. server.log).  This can give information on whatever application left the file. Usually this can give full path names and system information, and sometimes usernames and passwords.
               log files that are used for debugging
            
         
         

Fix information:
repo_url: https://github.com/hoppscotch/hoppscotch
commit_details: repo_url: https://github.com/hoppscotch/hoppscotch
author: Andrew Bastin
author_date: 2023-06-04 23:33:32-04:00
msg: fix: stop logging DATABASE_URL in logs
repository: repo_url: https://github.com/hoppscotch/hoppscotch
repo_name: hoppscotch/hoppscotch
description: Open source API development ecosystem - https://hoppscotch.io (open-source alternative to Postman, Insomnia)
repo_language: TypeScript
owner: hoppscotch
file_changes: filename: main.ts
change_type: ModificationType.MODIFY
diff: @@ -9,7 +9,6 @@ import { emitGQLSchemaFile } from './gql-schema';
 async function bootstrap() {
   console.log(`Running in production: ${process.env.PRODUCTION}`);
   console.log(`Port: ${process.env.PORT}`);
-  console.log(`Database: ${process.env.DATABASE_URL}`);
 
   const app = await NestFactory.create(AppModule);
 

programming_language: TypeScript