starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2016-10063 (published 2017-03-02T21:59Z)

Buffer overflow in coders/tiff.c in ImageMagick before 6.9.5-1 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file, related to extend validity.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2016-07-06 07:58:52-04:00
msg: ...
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: tiff.c
change_type: ModificationType.MODIFY
diff: @@ -1299,9 +1299,6 @@ RestoreMSCWarning
     image->columns=(size_t) width;
     image->rows=(size_t) height;
     image->depth=(size_t) bits_per_sample;
-    status=SetImageExtent(image,image->columns,image->rows,exception);
-    if (status == MagickFalse)
-      return(DestroyImageList(image));
     if (image->debug != MagickFalse)
       (void) LogMagickEvent(CoderEvent,GetMagickModule(),"Image depth: %.20g",
         (double) image->depth);
@@ -1562,6 +1559,9 @@ RestoreMSCWarning
             }
         goto next_tiff_frame;
       }
+    status=SetImageExtent(image,image->columns,image->rows,exception);
+    if (status == MagickFalse)
+      return(DestroyImageList(image));
     method=ReadGenericMethod;
     if (TIFFGetField(tiff,TIFFTAG_ROWSPERSTRIP,&rows_per_strip) == 1)
       {

programming_language: C
CVE-2021-27213 (published 2021-02-14T04:15Z)

config.py in pystemon before 2021-02-13 allows code execution via YAML deserialization because SafeLoader and safe_load are not used.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-502
cwe_name: Deserialization of Untrusted Data
description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
extended_description: 
            It is often convenient to serialize objects for communication or to save them for later use. However, deserialized data or code can often be modified without using the provided accessor functions if it does not use cryptography to protect itself. Furthermore, any cryptography would still be client-side security -- which is a dangerous security assumption.
            Data that is untrusted can not be trusted to be well-formed.
            When developers place no restrictions on "gadget chains," or series of instances and method invocations that can self-execute during the deserialization process (i.e., before the object is returned to the caller), it is sometimes possible for attackers to leverage them to perform unauthorized actions, like generating a shell.
         
         

Fix information:
repo_url: https://github.com/cvandeplas/pystemon
commit_details: repo_url: https://github.com/cvandeplas/pystemon
author: Asjid Kalam
author_date: 2021-02-13 23:06:38+05:30
msg: Fixed code execution bug using SafeLoader()
repository: repo_url: https://github.com/cvandeplas/pystemon
repo_name: cvandeplas/pystemon
description: Monitoring tool for PasteBin-alike sites written in Python. Inspired by pastemon http://github.com/xme/pastemon
repo_language: Python
owner: cvandeplas
file_changes: filename: config.py
change_type: ModificationType.MODIFY
diff: @@ -304,9 +304,9 @@ class PystemonConfig():
             if self._recent_pyyaml():
                 # https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation
                 # only for 5.1+
-                yamlconfig = yaml.load(open(configfile), Loader=yaml.FullLoader)
+                yamlconfig = yaml.load(open(configfile), Loader=yaml.SafeLoader)
             else:
-                yamlconfig = yaml.load(open(configfile))
+                yamlconfig = yaml.safe_load(open(configfile))
         except yaml.YAMLError as exc:
             logger.error("Error in configuration file {0}:".format(configfile))
             if hasattr(exc, 'problem_mark'):
@@ -315,7 +315,7 @@ class PystemonConfig():
         for includes in yamlconfig.get("includes", []):
             try:
                 logger.debug("loading include '{0}'".format(includes))
-                yamlconfig.update(yaml.load(open(includes)))
+                yamlconfig.update(yaml.safe_load(open(includes)))
             except Exception as e:
                 raise PystemonConfigException("failed to load '{0}': {1}".format(includes, e))
         return yamlconfig

programming_language: Python
CVE-2024-28056 (published 2024-04-15T18:15Z)

Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM roles associated with Amplify projects. When the Authentication component is removed from an Amplify project, a Condition property is removed but "Effect":"Allow" remains present, and consequently sts:AssumeRoleWithWebIdentity would be available to threat actors with no conditions. Thus, if Amplify CLI had been used to remove the Authentication component from a project built between August 2019 and January 2024, an "assume role" may have occurred, and may have been leveraged to obtain unauthorized access to an organization\'s AWS resources. NOTE: the problem could only occur if an authorized AWS user removed an Authentication component. (The vulnerability did not give a threat actor the ability to remove an Authentication component.) However, in realistic situations, an authorized AWS user may have removed an Authentication component, e.g., if the objective were to stop using built-in Cognito resources, or move to a completely different identity provider.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/aws-amplify/amplify-cli
commit_details: repo_url: https://github.com/aws-amplify/amplify-cli
author: Edward Foyle
author_date: 2024-01-09 15:11:49-08:00
msg: fix: set policy effect deny when removing auth (#13523)
repository: repo_url: https://github.com/aws-amplify/amplify-cli
repo_name: aws-amplify/amplify-cli
description: The AWS Amplify CLI is a toolchain for simplifying serverless web and mobile development.
repo_language: TypeScript
owner: aws-amplify
file_changes: filename: update-idp-roles-cfn.json
change_type: ModificationType.MODIFY
diff: @@ -47,6 +47,8 @@
               "            try {",
               "                delete authParamsJson.Statement[0].Condition;",
               "                delete unauthParamsJson.Statement[0].Condition;",
+              "                authParamsJson.Statement[0].Effect = 'Deny'",
+              "                unauthParamsJson.Statement[0].Effect = 'Deny'",
               "                let authParams = {PolicyDocument: JSON.stringify(authParamsJson), RoleName: authRoleName};",
               "                let unauthParams = {PolicyDocument: JSON.stringify(unauthParamsJson), RoleName: unauthRoleName};",
               "                const iam = new IAMClient({region: event.ResourceProperties.region});",

programming_language: JavaScript
CVE-2020-35679 (published 2020-12-24T16:15Z)

smtpd/table.c in OpenSMTPD before 6.8.0p1 lacks a certain regfree, which might allow attackers to trigger a "very significant" memory leak via messages to an instance that performs many regex lookups.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-401
cwe_name: Missing Release of Memory after Effective Lifetime
description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
extended_description: This is often triggered by improper handling of malformed data or unexpectedly interrupted sessions.  In some languages, developers are responsible for tracking memory allocation and releasing the memory.  If there are no more pointers or references to the memory, then it can no longer be tracked and identified for release.
         

Fix information:
repo_url: https://github.com/openbsd/src
commit_details: repo_url: https://github.com/openbsd/src
author: martijn
author_date: 2020-12-23 08:12:14+00:00
msg: Use regfree after we're done with preg.

From gilles@
repository: repo_url: https://github.com/openbsd/src
repo_name: openbsd/src
description: Read-only git conversion of OpenBSD's official CVS src repository. Pull requests not accepted - send diffs to the tech@ mailing list.
repo_language: C
owner: openbsd
file_changes: filename: table.c
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,4 @@
-/*	$OpenBSD: table.c,v 1.48 2019/01/10 07:40:52 eric Exp $	*/
+/*	$OpenBSD: table.c,v 1.49 2020/12/23 08:12:14 martijn Exp $	*/
 
 /*
  * Copyright (c) 2013 Eric Faurot <eric@openbsd.org>
@@ -464,6 +464,7 @@ table_regex_match(const char *string, const char *pattern)
 {
 	regex_t preg;
 	int	cflags = REG_EXTENDED|REG_NOSUB;
+	int ret;
 
 	if (strncmp(pattern, "(?i)", 4) == 0) {
 		cflags |= REG_ICASE;
@@ -473,7 +474,11 @@ table_regex_match(const char *string, const char *pattern)
 	if (regcomp(&preg, pattern, cflags) != 0)
 		return (0);
 
-	if (regexec(&preg, string, 0, NULL, 0) != 0)
+	ret = regexec(&preg, string, 0, NULL, 0);
+
+	regfree(&preg);
+
+	if (ret != 0)
 		return (0);
 
 	return (1);

programming_language: C
CVE-2021-4248 (published 2022-12-18T11:15Z)

A vulnerability was found in kapetan dns up to 6.1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file DNS/Protocol/Request.cs. The manipulation leads to insufficient entropy in prng. The attack may be launched remotely. Upgrading to version 7.0.0 is able to address this issue. The name of the patch is cf7105aa2aae90d6656088fe5a8ee1d5730773b6. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216188.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-330
cwe_name: Use of Insufficiently Random Values
description: The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
extended_description: When product generates predictable values in a context requiring unpredictability, it may be possible for an attacker to guess the next value that will be generated, and use this guess to impersonate another user or access sensitive information.
         

Fix information:
repo_url: https://github.com/kapetan/dns
commit_details: repo_url: https://github.com/kapetan/dns
author: Daniel Joos
author_date: 2021-11-24 13:29:48+01:00
msg: Using a crypto random number generator in `Request` (#88)

* Using a crypto random number generator in `Request`

This changes `Request` to use cryptographically secure
random numbers.
It prevents possible spoofing of DNS responses.

* Fix style

Co-authored-by: Mirza Kapetanovic <mirza.kapetanovic@gmail.com>
repository: repo_url: https://github.com/kapetan/dns
repo_name: kapetan/dns
description: A DNS library written in C#
repo_language: C#
owner: kapetan
file_changes: filename: Request.cs
change_type: ModificationType.MODIFY
diff: @@ -1,12 +1,13 @@
 ﻿using System;
 using System.Collections.Generic;
 using System.Linq;
+using System.Security.Cryptography;
 using DNS.Protocol.Utils;
 using DNS.Protocol.ResourceRecords;
 
 namespace DNS.Protocol {
     public class Request : IRequest {
-        private static readonly Random RANDOM = new Random();
+        private static readonly RandomNumberGenerator RANDOM = new RNGCryptoServiceProvider();
 
         private IList<Question> questions;
         private Header header;
@@ -41,7 +42,7 @@ public class Request : IRequest {
 
             this.header.OperationCode = OperationCode.Query;
             this.header.Response = false;
-            this.header.Id = RANDOM.Next(UInt16.MaxValue);
+            this.header.Id = NextRandomId();
         }
 
         public Request(IRequest request) {
@@ -112,5 +113,11 @@ public class Request : IRequest {
             header.QuestionCount = questions.Count;
             header.AdditionalRecordCount = additional.Count;
         }
+
+        private ushort NextRandomId() {
+            byte[] buffer = new byte[sizeof(ushort)];
+            RANDOM.GetBytes(buffer);
+            return BitConverter.ToUInt16(buffer, 0);
+        }
     }
 }

programming_language: C#
CVE-2021-3656 (published 2022-03-04T19:15Z)

A flaw was found in the KVM\'s AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "virt_ext" field, this issue could allow a malicious L1 to disable both VMLOAD/VMSAVE intercepts and VLS (Virtual VMLOAD/VMSAVE) for the L2 guest. As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data or potential guest-to-host escape.

Severity: HIGH
CVSS v2 base score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-862
cwe_name: Missing Authorization
description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are not applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Maxim Levitsky
author_date: 2021-07-19 16:05:00+03:00
msg: KVM: nSVM: always intercept VMLOAD/VMSAVE when nested (CVE-2021-3656)

If L1 disables VMLOAD/VMSAVE intercepts, and doesn't enable
Virtual VMLOAD/VMSAVE (currently not supported for the nested hypervisor),
then VMLOAD/VMSAVE must operate on the L1 physical memory, which is only
possible by making L0 intercept these instructions.

Failure to do so allowed the nested guest to run VMLOAD/VMSAVE unintercepted,
and thus read/write portions of the host physical memory.

Fixes: 89c8a4984fc9 ("KVM: SVM: Enable Virtual VMLOAD VMSAVE feature")

Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: nested.c
change_type: ModificationType.MODIFY
diff: @@ -158,6 +158,9 @@ void recalc_intercepts(struct vcpu_svm *svm)
 	/* If SMI is not intercepted, ignore guest SMI intercept as well  */
 	if (!intercept_smi)
 		vmcb_clr_intercept(c, INTERCEPT_SMI);
+
+	vmcb_set_intercept(c, INTERCEPT_VMLOAD);
+	vmcb_set_intercept(c, INTERCEPT_VMSAVE);
 }
 
 static void copy_vmcb_control_area(struct vmcb_control_area *dst,

programming_language: C
CVE-2022-0559 (published 2022-02-16T11:15Z)

Use After Free in GitHub repository radareorg/radare2 prior to 5.6.2.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/radareorg/radare2
commit_details: repo_url: https://github.com/radareorg/radare2
author: pancake
author_date: 2022-02-13 21:27:58+01:00
msg: Prefer memleak over usaf in io.bank's rbtree bug ##crash

* That's a workaround, proper fix will come later
* Reproducer: bins/fuzzed/iobank-crash
* Reported by Akyne Choi via huntr.dev
repository: repo_url: https://github.com/radareorg/radare2
repo_name: radareorg/radare2
description: UNIX-like reverse engineering framework and command-line toolset
repo_language: C
owner: radareorg
file_changes: filename: io_bank.c
change_type: ModificationType.MODIFY
diff: @@ -226,12 +226,18 @@ R_API bool r_io_bank_map_add_top(RIO *io, const ut32 bankid, const ut32 mapid) {
 		r_io_submap_set_to (bd, r_io_submap_from (sm) - 1);
 		entry = r_rbnode_next (entry);
 	}
-	while (entry && r_io_submap_to (((RIOSubMap *)entry->data)) <= r_io_submap_to (sm)) {
+	ut64 smto = r_io_submap_to (sm);
+	while (entry && r_io_submap_to (((RIOSubMap *)entry->data)) <= smto) {
 		//delete all submaps that are completly included in sm
 		RRBNode *next = r_rbnode_next (entry);
 		// this can be optimized, there is no need to do search here
+		// XXX this is a workaround to avoid an UAF in Reproducer: iobank-crash
+		void *smfree = bank->submaps->free;
+		bank->submaps->free = NULL;
 		bool a = r_crbtree_delete (bank->submaps, entry->data, _find_sm_by_from_vaddr_cb, NULL);
+		bank->submaps->free = smfree;
 		if (!a) {
+			entry = NULL;
 			break;
 		}
 		entry = next;

programming_language: C
filename: new_rbtree.c
change_type: ModificationType.MODIFY
diff: @@ -138,9 +138,9 @@ R_API bool r_crbtree_insert(RRBTree *tree, void *data, RRBComparator cmp, void *
 	r_return_val_if_fail (tree && data && cmp, false);
 	bool inserted = false;
 
-	if (tree->root == NULL) {
+	if (!tree->root) {
 		tree->root = _node_new (data, NULL);
-		if (tree->root == NULL) {
+		if (!tree->root) {
 			return false;
 		}
 		inserted = true;

programming_language: C
CVE-2020-11088 (published 2020-05-29T20:15Z)

In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This has been fixed in 2.1.0.

Severity: MEDIUM
CVSS v2 base score: 5.5 (AV:N/AC:L/Au:S/C:P/I:N/A:P)
CVSS v3 base score: 5.4, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/FreeRDP/FreeRDP
commit_details: repo_url: https://github.com/FreeRDP/FreeRDP
author: akallabeth
author_date: 2020-04-15 16:48:50+02:00
msg: Fixed oob read in ntlm_read_NegotiateMessage
repository: repo_url: https://github.com/FreeRDP/FreeRDP
repo_name: FreeRDP/FreeRDP
description: FreeRDP is a free remote desktop protocol library and clients
repo_language: C
owner: FreeRDP
file_changes: filename: ntlm_message.c
change_type: ModificationType.MODIFY
diff: @@ -219,6 +219,11 @@ SECURITY_STATUS ntlm_read_NegotiateMessage(NTLM_CONTEXT* context, PSecBuffer buf
 		return SEC_E_INVALID_TOKEN;
 	}
 
+	if (Stream_GetRemainingLength(s) < 4)
+	{
+		Stream_Free(s, FALSE);
+		return SEC_E_INVALID_TOKEN;
+	}
 	Stream_Read_UINT32(s, message->NegotiateFlags); /* NegotiateFlags (4 bytes) */
 
 	if (!((message->NegotiateFlags & NTLMSSP_REQUEST_TARGET) &&

programming_language: C
CVE-2014-125057 (published 2023-01-07T10:15Z)

A vulnerability was found in mrobit robitailletheknot. It has been classified as problematic. This affects an unknown part of the file app/filters.php of the component CSRF Token Handler. The manipulation of the argument _token leads to incorrect comparison. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The patch is named 6b2813696ccb88d0576dfb305122ee880eb36197. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217599.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-697
cwe_name: Incorrect Comparison
description: The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
extended_description: 
            This Pillar covers several possibilities:
               
                  the comparison checks one factor incorrectly;
                  the comparison should consider multiple factors, but it does not check at least one of those factors at all;
                  the comparison checks the wrong factor.
               
         
         

Fix information:
repo_url: https://github.com/mrobit/robitailletheknot
commit_details: repo_url: https://github.com/mrobit/robitailletheknot
author: Matthew Robitaille
author_date: 2014-11-10 10:31:00-05:00
msg: Patch security vulnerability.
repository: repo_url: https://github.com/mrobit/robitailletheknot
repo_name: mrobit/robitailletheknot
description: Site for #robitailletheknot.
repo_language: JavaScript
owner: mrobit
file_changes: filename: filters.php
change_type: ModificationType.MODIFY
diff: @@ -83,7 +83,7 @@ Route::filter('guest', function()
 
 Route::filter('csrf', function()
 {
-	if (Session::token() != Input::get('_token'))
+	if (Session::token() !== Input::get('_token'))
 	{
 		throw new Illuminate\Session\TokenMismatchException;
 	}

programming_language: PHP