starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2022-0623 (published 2022-02-17T07:15Z)

Out-of-bounds Read in Homebrew mruby prior to 3.2.

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 9.1, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/mruby/mruby
commit_details: repo_url: https://github.com/mruby/mruby
author: Yukihiro "Matz" Matsumoto
author_date: 2022-02-15 18:36:38+09:00
msg: vm.c: should check type before hash access.

Since the operand of double splat (`**`) may not be a hash, simple
assertion (previous code since d42a64e) was not enough for this case.
repository: repo_url: https://github.com/mruby/mruby
repo_name: mruby/mruby
description: Lightweight Ruby
repo_language: C
owner: mruby
file_changes: filename: vm.c
change_type: ModificationType.MODIFY
diff: @@ -2766,7 +2766,7 @@ RETRY_TRY_BLOCK:
       int lim = a+b*2+1;
 
       hash = regs[a];
-      mrb_assert(mrb_hash_p(hash));
+      mrb_ensure_hash_type(mrb, hash);
       for (i=a+1; i<lim; i+=2) {
         mrb_hash_set(mrb, hash, regs[i], regs[i+1]);
       }

programming_language: C
CVE-2024-28123 (published 2024-03-21T02:52Z)

Wasmi is an efficient and lightweight WebAssembly interpreter with a focus on constrained and embedded systems. In the WASMI Interpreter, an Out-of-bounds Buffer Write will arise if the host calls or resumes a Wasm function with more parameters than the default limit (128), as it will surpass the stack value. This doesn’t affect calls from Wasm to Wasm, only from host to Wasm. This vulnerability was patched in version 0.31.1.\n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/wasmi-labs/wasmi
commit_details: repo_url: https://github.com/wasmi-labs/wasmi
author: Robin Freyler
author_date: 2023-12-01 10:35:28+01:00
msg: fix bug in wasmi executor
repository: repo_url: https://github.com/wasmi-labs/wasmi
repo_name: wasmi-labs/wasmi
description: WebAssembly (Wasm) interpreter.
repo_language: Rust
owner: wasmi-labs
file_changes: filename: mod.rs
change_type: ModificationType.MODIFY
diff: @@ -647,7 +647,9 @@ impl<'engine> EngineExecutor<'engine> {
         Results: CallResults,
     {
         self.stack.reset();
-        self.stack.values.extend(params.call_params());
+        let call_params = params.call_params();
+        self.stack.values.reserve(call_params.len())?;
+        self.stack.values.extend(call_params);
         match ctx.as_context().store.inner.resolve_func(func) {
             FuncEntity::Wasm(wasm_func) => {
                 self.stack
@@ -689,7 +691,9 @@ impl<'engine> EngineExecutor<'engine> {
         self.stack
             .values
             .drop(host_func.ty(ctx.as_context()).params().len());
-        self.stack.values.extend(params.call_params());
+        let call_params = params.call_params();
+        self.stack.values.reserve(call_params.len())?;
+        self.stack.values.extend(call_params);
         assert!(
             self.stack.frames.peek().is_some(),
             "a frame must be on the call stack upon resumption"

programming_language: Rust
CVE-2020-26208 (published 2022-02-02T12:15Z)

JHEAD is a simple command line tool for displaying and some manipulation of EXIF header data embedded in Jpeg images from digital cameras. In affected versions there is a heap-buffer-overflow on jhead-3.04/jpgfile.c:285 ReadJpegSections. Crafted jpeg images can be provided to the user resulting in a program crash or potentially incorrect exif information retrieval. Users are advised to upgrade. There is no known workaround for this issue.

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 6.1, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/F-ZhaoYang/jhead
commit_details: repo_url: https://github.com/F-ZhaoYang/jhead
author: Matthias
author_date: 2020-10-23 10:17:20-03:00
msg: Just allocate 20 bytes extra at the end of a section. Otherwise, we end
up with a whole lot of little checks for structures that the file says
are there but are unexpectedly cut off in fuzz tests
repository: repo_url: https://github.com/F-ZhaoYang/jhead
repo_name: visit repo url
description: visit repo url
repo_language: visit repo url
owner: F-ZhaoYang
file_changes: filename: jpgfile.c
change_type: ModificationType.MODIFY
diff: @@ -169,7 +169,10 @@ int ReadJpegSections (FILE * infile, ReadMode_t ReadMode)
 
         Sections[SectionsRead].Size = itemlen;
 
-        Data = (uchar *)malloc(itemlen);
+        // Allocate an extra 20 bytes more than needed, because sometimes when reading structures,
+        // if the section erroneously ends before short structures that should be there, that can trip
+        // memory checkers in combination with fuzzers.
+        Data = (uchar *)malloc(itemlen+20);
         if (Data == NULL){
             ErrFatal("Could not allocate memory");
         }
@@ -476,7 +479,7 @@ int ReplaceThumbnail(const char * ThumbFileName)
              return FALSE;
         }
 
-        ThumbLen = 0;
+        ThumbLen = 0;
         ThumbnailFile = NULL;
     }
 

programming_language: C++
CVE-2018-15531 (published 2018-09-26T22:29Z)

JavaMelody before 1.74.0 has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-611
cwe_name: Improper Restriction of XML External Entity Reference
description: The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
extended_description: 
            XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities. It is possible to define an entity by providing a substitution string in the form of a URI. The XML parser can access the contents of this URI and embed these contents back into the XML document for further processing.
            By submitting an XML file that defines an external entity with a file:// URI, an attacker can cause the processing application to read the contents of a local file. For example, a URI such as "file:///c:/winnt/win.ini" designates (in Windows) the file C:\Winnt\win.ini, or file:///etc/passwd designates the password file in Unix-based systems. Using URIs with other schemes such as http://, the attacker can force the application to make outgoing requests to servers that the attacker cannot reach directly, which can be used to bypass firewall restrictions or hide the source of attacks such as port scanning.
            Once the content of the URI is read, it is fed back into the application that is processing the XML. This application may echo back the data (e.g. in an error message), thereby exposing the file contents.
         
         

Fix information:
repo_url: https://github.com/javamelody/javamelody
commit_details: repo_url: https://github.com/javamelody/javamelody
author: evernat
author_date: 2018-09-04 08:31:29+02:00
msg: fix for security
repository: repo_url: https://github.com/javamelody/javamelody
repo_name: javamelody/javamelody
description: JavaMelody : monitoring of JavaEE applications
repo_language: Java
owner: javamelody
file_changes: filename: PayloadNameRequestWrapper.java
change_type: ModificationType.MODIFY
diff: @@ -235,6 +235,8 @@ public class PayloadNameRequestWrapper extends HttpServletRequestWrapper {
 		try {
 			// newInstance() et pas newFactory() pour java 1.5 (issue 367)
 			final XMLInputFactory factory = XMLInputFactory.newInstance();
+			factory.setProperty(XMLInputFactory.SUPPORT_DTD, false); // disable DTDs entirely for that factory
+			factory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false); // disable external entities
 			final XMLStreamReader xmlReader;
 			if (charEncoding != null) {
 				xmlReader = factory.createXMLStreamReader(stream, charEncoding);

programming_language: Java
CVE-2020-4031 (published 2020-06-22T22:15Z)

In FreeRDP before version 2.1.2, there is a use-after-free in gdi_SelectObject. All FreeRDP clients using compatibility mode with /relax-order-checks are affected. This is fixed in version 2.1.2.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/FreeRDP/FreeRDP
commit_details: repo_url: https://github.com/FreeRDP/FreeRDP
author: akallabeth
author_date: 2020-05-25 14:03:12+02:00
msg: Fixed double free
repository: repo_url: https://github.com/FreeRDP/FreeRDP
repo_name: FreeRDP/FreeRDP
description: FreeRDP is a free remote desktop protocol library and clients
repo_language: C
owner: FreeRDP
file_changes: filename: shadow_server.c
change_type: ModificationType.MODIFY
diff: @@ -586,14 +586,19 @@ int shadow_server_start(rdpShadowServer* server)
 		char** list = CommandLineParseCommaSeparatedValuesEx(NULL, server->ipcSocket, &count);
 		if (!list || (count <= 1))
 		{
-			free(list);
 			if (server->ipcSocket == NULL)
 			{
 				if (!open_port(server, NULL))
+				{
+					free(list);
 					return -1;
+				}
 			}
 			else
+			{
+				free(list);
 				return -1;
+			}
 		}
 
 		for (x = 1; x < count; x++)

programming_language: C
CVE-2022-0860 (published 2022-03-11T13:15Z)

Improper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2.

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N)
CVSS v3 base score: 9.1, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

Weakness information:
cwe_id: CWE-285
cwe_name: Improper Authorization
description: The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are not applied consistently - or not at all - users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/cobbler/cobbler
commit_details: repo_url: https://github.com/cobbler/cobbler
author: Enno G
author_date: 2022-03-11 09:59:35+01:00
msg: Merge pull request from GHSA-mcg6-h362-cmq5

Security: Fix CVE-2022-0860
repository: repo_url: https://github.com/cobbler/cobbler
repo_name: cobbler/cobbler
description: Cobbler is a versatile Linux deployment server
repo_language: Python
owner: cobbler
CVE-2020-19491 (published 2021-07-21T18:15Z)

There is an invalid memory access bug in cgif.c that leads to a Segmentation fault in sam2p 0.49.4. A crafted input will lead to a denial of service or possibly unspecified other impact.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/pts/sam2p
commit_details: repo_url: https://github.com/pts/sam2p
author: Peter Szabo
author_date: 2019-07-18 16:56:16+02:00
msg: fixed segfault in GIF reading; this fixes https://github.com/pts/sam2p/issues/67
repository: repo_url: https://github.com/pts/sam2p
repo_name: pts/sam2p
description: raster (bitmap) image converter with smart PDF and PostScript (EPS) output
repo_language: C++
owner: pts
file_changes: filename: cgif.c
change_type: ModificationType.MODIFY
diff: @@ -1551,7 +1551,8 @@ int CGIFFF DGifSlurp(CGIFFF GifFileType *GifFile)
   			  memcpy(ep->Bytes,ExtData,ep->ByteCount * sizeof(char));
   			#else
   			  if (ExtData==NULL) break;
-  			  AddExtensionBlock(sp, ExtData[0], ExtData+1);
+                          AddExtensionBlock(&ext, ExtData[0], ExtData+1);
+                          ext.ExtensionBlocks[ext.ExtensionBlockCount-1].code=ext_code;
   			#endif
 		    }
 		}

programming_language: C
CVE-2021-44078 (published 2021-12-26T05:15Z)

An issue was discovered in split_region in uc.c in Unicorn Engine before 2.0.0-rc5. It allows local attackers to escape the sandbox. An attacker must first obtain the ability to execute crafted code in the target sandbox in order to exploit this vulnerability. The specific flaw exists within the virtual memory manager. The issue results from the faulty comparison of GVA and GPA while calling uc_mem_map_ptr to free part of a claimed memory block. An attacker can leverage this vulnerability to escape the sandbox and execute arbitrary code on the host machine.

Severity: MEDIUM
CVSS v2 base score: 6.9 (AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 8.1, HIGH (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-697
cwe_name: Incorrect Comparison
description: The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
extended_description: 
            This Pillar covers several possibilities:
               
                  the comparison checks one factor incorrectly;
                  the comparison should consider multiple factors, but it does not check at least one of those factors at all;
                  the comparison checks the wrong factor.
               
         
         

Fix information:
repo_url: https://github.com/unicorn-engine/unicorn
commit_details: repo_url: https://github.com/unicorn-engine/unicorn
author: lazymio
author_date: 2021-11-23 23:22:53+01:00
msg: Fix wrong offset used in split_region
repository: repo_url: https://github.com/unicorn-engine/unicorn
repo_name: unicorn-engine/unicorn
description: Unicorn CPU emulator framework (ARM, AArch64, M68K, Mips, Sparc, PowerPC, RiscV, S390x, TriCore, X86)
repo_language: C
owner: unicorn-engine
file_changes: filename: translate-all.c
change_type: ModificationType.MODIFY
diff: @@ -985,7 +985,9 @@ static void uc_invalidate_tb(struct uc_struct *uc, uint64_t start_addr, size_t l
 {
     tb_page_addr_t start, end;
 
-    // GVA to GPA (GPA -> HVA via page_find, HVA->HPA via host mmu)
+    // GVA to GPA 
+    // (GPA -> HVA via memory_region_get_ram_addr(mr) + GPA + block->host,
+    // HVA->HPA via host mmu)
     start = get_page_addr_code(uc->cpu->env_ptr, start_addr) & (target_ulong)(-1);
     
     // For 32bit target.

programming_language: C
filename: uc.c
change_type: ModificationType.MODIFY
diff: @@ -1090,7 +1090,8 @@ static bool split_region(struct uc_struct *uc, MemoryRegion *mr,
 
     QLIST_FOREACH(block, &uc->ram_list.blocks, next)
     {
-        if (block->offset <= mr->addr &&
+        // block->offset is the offset within ram_addr_t, not GPA
+        if (block->mr->addr <= mr->addr &&
             block->used_length >= (mr->end - mr->addr)) {
             break;
         }

programming_language: C
CVE-2024-39904 (published 2024-07-11T16:15Z)

VNote is a note-taking platform. Prior to 3.18.1, a code execution vulnerability existed in VNote, which allowed an attacker to execute arbitrary programs on the victim's system. A crafted URI can be used in a note to perform this attack using file:/// as a link. For example, file:///C:/WINDOWS/system32/cmd.exe. This allows attackers to execute arbitrary programs by embedding a reference to a local executable file such as file:///C:/WINDOWS/system32/cmd.exe and file:///C:/WINDOWS/system32/calc.exe. This vulnerability can be exploited by creating and sharing specially crafted notes. An attacker could send a crafted note file and perform further attacks. This vulnerability is fixed in 3.18.1.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/vnotex/vnote
commit_details: repo_url: https://github.com/vnotex/vnote
author: Le Tan
author_date: 2024-07-07 22:51:07+08:00
msg: check link before open
repository: repo_url: https://github.com/vnotex/vnote
repo_name: vnotex/vnote
description: A pleasant note-taking platform.
repo_language: C++
owner: vnotex
file_changes: filename: widgetutils.cpp
change_type: ModificationType.MODIFY
diff: @@ -27,6 +27,8 @@
 #include <QFormLayout>
 
 #include <core/global.h>
+#include <widgets/messageboxhelper.h>
+#include <widgets/mainwindow.h>
 
 using namespace vnotex;
 
@@ -75,6 +77,19 @@ QSize WidgetUtils::availableScreenSize(QWidget *p_widget)
 
 void WidgetUtils::openUrlByDesktop(const QUrl &p_url)
 {
+    const auto scheme = p_url.scheme();
+    if (scheme != "http" && scheme != "https") {
+        // Prompt for user.
+        int ret = MessageBoxHelper::questionYesNo(MessageBoxHelper::Warning,
+                                                  MainWindow::tr("Are you sure to open link (%1)?").arg(p_url.toString()),
+                                                  MainWindow::tr("Malicious link might do harm to your device."),
+                                                  QString(),
+                                                  nullptr);
+        if (ret == QMessageBox::No) {
+            return;
+        }
+    }
+
     QDesktopServices::openUrl(p_url);
 }
 

programming_language: C++
CVE-2022-4564 (published 2022-12-16T17:15Z)

A vulnerability classified as problematic has been found in University of Central Florida Materia up to 9.0.0. This affects the function before of the file fuel/app/classes/controller/api.php of the component API Controller. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 9.0.1-alpha1 is able to address this issue. The name of the patch is af259115d2e8f17068e61902151ee8a9dbac397b. It is recommended to upgrade the affected component. The identifier VDB-215973 was assigned to this vulnerability.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/ucfopen/Materia
commit_details: repo_url: https://github.com/ucfopen/Materia
author: Corey Peterson
author_date: 2022-04-18 16:06:47-04:00
msg: Merge pull request #1371 from FrenjaminBanklin/feature/api-v1-csrf-mitigation

Add Origin/Referer request header checks to old V1 API controller.
repository: repo_url: https://github.com/ucfopen/Materia
repo_name: ucfopen/Materia
description: Engage students with easily embedded apps for online courses. Supercharge your course with compelling experiences and game mechanics.
repo_language: PHP
owner: ucfopen
CVE-2022-4849 (published 2022-12-29T18:15Z)

Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/usememos/memos
commit_details: repo_url: https://github.com/usememos/memos
author: boojack
author_date: 2022-12-30 00:17:19+08:00
msg: chore: fix CSRF (#876)
repository: repo_url: https://github.com/usememos/memos
repo_name: usememos/memos
description: An open source, lightweight note-taking service. Easily capture and share your great thoughts.
repo_language: Go
owner: usememos
file_changes: filename: acl.go
change_type: ModificationType.MODIFY
diff: @@ -27,6 +27,7 @@ func setUserSession(ctx echo.Context, user *api.User) error {
 		Path:     "/",
 		MaxAge:   3600 * 24 * 30,
 		HttpOnly: true,
+		SameSite: http.SameSiteStrictMode,
 	}
 	sess.Values[userIDContextKey] = user.ID
 	err := sess.Save(ctx.Request(), ctx.Response())

programming_language: Go
filename: server.go
change_type: ModificationType.MODIFY
diff: @@ -36,6 +36,10 @@ func NewServer(profile *profile.Profile) *Server {
 			`"status":${status},"error":"${error}"}` + "\n",
 	}))
 
+	e.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
+		TokenLookup: "cookie:_csrf",
+	}))
+
 	e.Use(middleware.CORS())
 
 	e.Use(middleware.TimeoutWithConfig(middleware.TimeoutConfig{

programming_language: Go