starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2019-13225 (published 2019-07-10T14:15Z)

A NULL Pointer Dereference in match_at() in regexec.c in Oniguruma 6.9.2 allows attackers to potentially cause denial of service by providing a crafted regular expression. Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/kkos/oniguruma
commit_details: repo_url: https://github.com/kkos/oniguruma
author: K.Kosako
author_date: 2019-06-27 14:11:55+09:00
msg: Fix CVE-2019-13225: problem in converting if-then-else pattern to bytecode.
repository: repo_url: https://github.com/kkos/oniguruma
repo_name: kkos/oniguruma
description: regular expression library
repo_language: C
owner: kkos
file_changes: filename: regcomp.c
change_type: ModificationType.MODIFY
diff: @@ -1307,8 +1307,9 @@ compile_length_bag_node(BagNode* node, regex_t* reg)
         len += tlen;
       }
 
+      len += SIZE_OP_JUMP + SIZE_OP_ATOMIC_END;
+
       if (IS_NOT_NULL(Else)) {
-        len += SIZE_OP_JUMP;
         tlen = compile_length_tree(Else, reg);
         if (tlen < 0) return tlen;
         len += tlen;
@@ -1455,7 +1456,7 @@ compile_bag_node(BagNode* node, regex_t* reg, ScanEnv* env)
 
   case BAG_IF_ELSE:
     {
-      int cond_len, then_len, jump_len;
+      int cond_len, then_len, else_len, jump_len;
       Node* cond = NODE_BAG_BODY(node);
       Node* Then = node->te.Then;
       Node* Else = node->te.Else;
@@ -1472,8 +1473,7 @@ compile_bag_node(BagNode* node, regex_t* reg, ScanEnv* env)
       else
         then_len = 0;
 
-      jump_len = cond_len + then_len + SIZE_OP_ATOMIC_END;
-      if (IS_NOT_NULL(Else)) jump_len += SIZE_OP_JUMP;
+      jump_len = cond_len + then_len + SIZE_OP_ATOMIC_END + SIZE_OP_JUMP;
 
       r = add_op(reg, OP_PUSH);
       if (r != 0) return r;
@@ -1490,11 +1490,20 @@ compile_bag_node(BagNode* node, regex_t* reg, ScanEnv* env)
       }
 
       if (IS_NOT_NULL(Else)) {
-        int else_len = compile_length_tree(Else, reg);
-        r = add_op(reg, OP_JUMP);
-        if (r != 0) return r;
-        COP(reg)->jump.addr = else_len + SIZE_INC_OP;
+        else_len = compile_length_tree(Else, reg);
+        if (else_len < 0) return else_len;
+      }
+      else
+        else_len = 0;
 
+      r = add_op(reg, OP_JUMP);
+      if (r != 0) return r;
+      COP(reg)->jump.addr = SIZE_OP_ATOMIC_END + else_len + SIZE_INC_OP;
+
+      r = add_op(reg, OP_ATOMIC_END);
+      if (r != 0) return r;
+
+      if (IS_NOT_NULL(Else)) {
         r = compile_tree(Else, reg, env);
       }
     }

programming_language: C
CVE-2024-37300 (published 2024-06-12T16:15Z)

OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. JupyterHub < 5.0, when used with `GlobusOAuthenticator`, could be configured to allow all users from a particular institution only. This worked fine prior to JupyterHub 5.0, because `allow_all` did not take precedence over `identity_provider`. Since JupyterHub 5.0, `allow_all` does take precedence over `identity_provider`. On a hub with the same config, now all users will be allowed to login, regardless of `identity_provider`. `identity_provider` will basically be ignored. This is a documented change in JupyterHub 5.0, but is likely to catch many users by surprise. OAuthenticator 16.3.1 fixes the issue with JupyterHub 5.0, and does not affect previous versions. As a workaround, do not upgrade to JupyterHub 5.0 when using `GlobusOAuthenticator` in the prior configuration.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/jupyterhub/oauthenticator
commit_details: repo_url: https://github.com/jupyterhub/oauthenticator
author: Yuvi Panda
author_date: 2024-06-11 15:23:56-07:00
msg: Merge pull request from GHSA-gprj-3p75-f996

globus: apply identity_provider restriction in `check_blocked_users`
repository: repo_url: https://github.com/jupyterhub/oauthenticator
repo_name: jupyterhub/oauthenticator
description: OAuth + JupyterHub Authenticator = OAuthenticator
repo_language: Python
owner: jupyterhub
CVE-2019-17582 (published 2021-02-09T19:15Z)

A use-after-free in the _zip_dirent_read function of zip_dirent.c in libzip 1.2.0 allows attackers to have an unspecified impact by attempting to unzip a malformed ZIP archive. NOTE: the discoverer states "This use-after-free is triggered prior to the double free reported in CVE-2017-12858."

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/nih-at/libzip
commit_details: repo_url: https://github.com/nih-at/libzip
author: Thomas Klausner
author_date: 2017-08-14 10:55:44+02:00
msg: Fix double free().

Found by Brian 'geeknik' Carpenter using AFL.
repository: repo_url: https://github.com/nih-at/libzip
repo_name: nih-at/libzip
description: A C library for reading, creating, and modifying zip archives.
repo_language: C
owner: nih-at
file_changes: filename: THANKS
change_type: ModificationType.MODIFY
diff: @@ -12,6 +12,7 @@ BALATON Zoltan <balaton@eik.bme.hu>
 Benjamin Gilbert <bgilbert@backtick.net>
 Boaz Stolk <bstolk@aweta.nl>
 Bogdan <bogiebog@gmail.com>
+Brian 'geeknik' Carpenter <geeknik@protonmail.ch>
 Chris Nehren <cnehren+libzip@pobox.com>
 Coverity <info@coverity.com>
 Dane Springmeyer <dane.springmeyer@gmail.com>

programming_language: Markdown
filename: zip_dirent.c
change_type: ModificationType.MODIFY
diff: @@ -579,9 +579,6 @@ _zip_dirent_read(zip_dirent_t *zde, zip_source_t *src, zip_buffer_t *buffer, boo
     }
 
     if (!_zip_dirent_process_winzip_aes(zde, error)) {
-	if (!from_buffer) {
-	    _zip_buffer_free(buffer);
-	}
 	return -1;
     }
 

programming_language: C
CVE-2024-0440 (published 2024-02-26T16:27Z)

Attacker, with permission to submit a link or submits a link via POST  to be collected that is using the file:// protocol can then introspect host files and other relatively stored files.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/mintplex-labs/anything-llm
commit_details: repo_url: https://github.com/mintplex-labs/anything-llm
author: Timothy Carambat
author_date: 2024-01-11 12:29:00-08:00
msg: Strict link protocol validation (#577)
repository: repo_url: https://github.com/mintplex-labs/anything-llm
repo_name: Mintplex-Labs/anything-llm
description: The all-in-one Desktop & Docker AI application with full RAG and AI Agent capabilities.
repo_language: JavaScript
owner: mintplex-labs
file_changes: filename: index.js
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,9 @@
+const VALID_PROTOCOLS = ["https:", "http:"];
+
 function validURL(url) {
   try {
-    new URL(url);
+    const destination = new URL(url);
+    if (!VALID_PROTOCOLS.includes(destination.protocol)) return false;
     return true;
   } catch {}
   return false;

programming_language: JavaScript
CVE-2024-29197 (published 2024-03-26T15:15Z)

Pimcore is an Open Source Data & Experience Management Platform. Any call with the query argument `?pimcore_preview=true` allows to view unpublished sites. In previous versions of Pimcore, session information would propagate to previews, so only a logged in user could open a preview. This no longer applies. Previews are broad open to any user and with just the hint of a restricted link one could gain access to possible confident / unreleased information. This vulnerability is fixed in 11.2.2 and 11.1.6.1.\n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/pimcore/pimcore
commit_details: repo_url: https://github.com/pimcore/pimcore
author: Martin Eiber
author_date: 2024-03-25 16:47:10+01:00
msg: Merge pull request from GHSA-5737-rqv4-v445

* Do not allow access to preview for non-user.

* Add logger.
repository: repo_url: https://github.com/pimcore/pimcore
repo_name: pimcore/pimcore
description: Core Framework for the Open Source Data & Experience Management Platform (PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce)
repo_language: PHP
owner: pimcore
file_changes: filename: ElementListener.php
change_type: ModificationType.MODIFY
diff: @@ -34,6 +34,7 @@ use Symfony\Component\HttpFoundation\Session\SessionInterface;
 use Symfony\Component\HttpKernel\Event\ControllerEvent;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 use Symfony\Component\HttpKernel\KernelEvents;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
 
 /**
  * Handles element setup logic from request.
@@ -82,6 +83,14 @@ class ElementListener implements EventSubscriberInterface, LoggerAwareInterface
                 $user = $this->userLoader->getUser();
             }
 
+            if ($document && !$document->isPublished() && !$user) {
+                $this->logger->warning(
+                    "Denying access to document {$document->getFullPath()} as it is unpublished and there is no user in the session."
+                );
+
+                throw new AccessDeniedHttpException(sprintf('Access denied for %s', $document->getFullPath()));
+            }
+
             // editmode, pimcore_preview & pimcore_version
             if ($user) {
                 $document = $this->handleAdminUserDocumentParams($request, $document, $user);

programming_language: PHP
CVE-2021-30015 (published 2021-04-19T20:15Z)

There is a Null Pointer Dereference in function filter_core/filter_pck.c:gf_filter_pck_new_alloc_internal in GPAC 1.0.1. The pid comes from function av1dmx_parse_flush_sample, the ctx.opid maybe NULL. The result is a crash in gf_filter_pck_new_alloc_internal.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2021-03-29 09:21:51+02:00
msg: fixed #1719
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: reframe_av1.c
change_type: ModificationType.MODIFY
diff: @@ -739,6 +739,9 @@ static GF_Err av1dmx_parse_flush_sample(GF_Filter *filter, GF_AV1DmxCtx *ctx)
 	GF_FilterPacket *pck;
 	u8 *output;
 
+	if (!ctx->opid)
+		return GF_NON_COMPLIANT_BITSTREAM;
+		
 	gf_bs_get_content_no_truncate(ctx->state.bs, &ctx->state.frame_obus, &pck_size, &ctx->state.frame_obus_alloc);
 
 	if (!pck_size) {

programming_language: C
CVE-2019-11463 (published 2019-04-23T03:29Z)

A memory leak in archive_read_format_zip_cleanup in archive_read_support_format_zip.c in libarchive 3.3.4-dev allows remote attackers to cause a denial of service via a crafted ZIP file because of a HAVE_LZMA_H typo. NOTE: this only affects users who downloaded the development code from GitHub. Users of the product's official releases are unaffected.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-401
cwe_name: Missing Release of Memory after Effective Lifetime
description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
extended_description: This is often triggered by improper handling of malformed data or unexpectedly interrupted sessions.  In some languages, developers are responsible for tracking memory allocation and releasing the memory.  If there are no more pointers or references to the memory, then it can no longer be tracked and identified for release.
         

Fix information:
repo_url: https://github.com/libarchive/libarchive
commit_details: repo_url: https://github.com/libarchive/libarchive
author: Martin Matuska
author_date: 2019-04-21 00:53:02+02:00
msg: Fix typo in preprocessor macro in archive_read_format_zip_cleanup()

Frees lzma_stream on cleanup()

Fixes #1165
repository: repo_url: https://github.com/libarchive/libarchive
repo_name: libarchive/libarchive
description: Multi-format archive and compression library
repo_language: C
owner: libarchive
file_changes: filename: archive_read_support_format_zip.c
change_type: ModificationType.MODIFY
diff: @@ -2751,7 +2751,7 @@ archive_read_format_zip_cleanup(struct archive_read *a)
 		inflateEnd(&zip->stream);
 #endif
 
-#if HAVA_LZMA_H && HAVE_LIBLZMA
+#if HAVE_LZMA_H && HAVE_LIBLZMA
     if (zip->zipx_lzma_valid) {
 		lzma_end(&zip->zipx_lzma_stream);
 	}

programming_language: C
CVE-2013-0250 (published 2014-06-06T14:55Z)

The init_nss_hash function in exec/totemcrypto.c in Corosync 2.0 before 2.3 does not properly initialize the HMAC key, which allows remote attackers to cause a denial of service (crash) via a crafted packet.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/corosync/corosync
commit_details: repo_url: https://github.com/corosync/corosync
author: Fabio M. Di Nitto
author_date: 2013-01-14 11:12:48+01:00
msg: totemcrypto: fix hmac key initialization

Signed-off-by: Fabio M. Di Nitto <fdinitto@redhat.com>
Reviewed-by: Jan Friesse <jfriesse@redhat.com>
repository: repo_url: https://github.com/corosync/corosync
repo_name: corosync/corosync
description: The Corosync Cluster Engine
repo_language: C
owner: corosync
file_changes: filename: totemcrypto.c
change_type: ModificationType.MODIFY
diff: @@ -478,8 +478,8 @@ static int init_nss_hash(struct crypto_instance *instance)
 	}
 
 	hash_param.type = siBuffer;
-	hash_param.data = 0;
-	hash_param.len = 0;
+	hash_param.data = instance->private_key;
+	hash_param.len = instance->private_key_len;
 
 	hash_slot = PK11_GetBestSlot(hash_to_nss[instance->crypto_hash_type], NULL);
 	if (hash_slot == NULL) {

programming_language: C
CVE-2019-16235 (published 2019-09-11T19:15Z)

Dino before 2019-09-10 does not properly check the source of a carbons message in module/xep/0280_message_carbons.vala.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-346
cwe_name: Origin Validation Error
description: The product does not properly verify that the source of data or communication is valid.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/dino/dino
commit_details: repo_url: https://github.com/dino/dino
author: Marvin W
author_date: 2019-09-10 21:01:03+02:00
msg: Fix check of source of a carbons message
repository: repo_url: https://github.com/dino/dino
repo_name: dino/dino
description: Modern XMPP ("Jabber") Chat Client using GTK+/Vala
repo_language: Vala
owner: dino
file_changes: filename: 0280_message_carbons.vala
change_type: ModificationType.MODIFY
diff: @@ -52,9 +52,9 @@ public class ReceivedPipelineListener : StanzaListener<MessageStanza> {
             StanzaNode? forwarded_node = carbons_node.get_subnode("forwarded", "urn:xmpp:forward:0");
             if (forwarded_node != null) {
                 StanzaNode? message_node = forwarded_node.get_subnode("message", Xmpp.NS_URI);
-                string? from_attribute = message_node.get_attribute("from", Xmpp.NS_URI);
                 // Any forwarded copies received by a Carbons-enabled client MUST be from that user's bare JID; any copies that do not meet this requirement MUST be ignored.
-                if (from_attribute != null && from_attribute == stream.get_flag(Bind.Flag.IDENTITY).my_jid.bare_jid.to_string()) {
+                if (!message.from.equals(stream.get_flag(Bind.Flag.IDENTITY).my_jid.bare_jid)) {
+                    warning("Received alleged carbon message from %s, ignoring", message.from.to_string());
                     return true;
                 }
                 if (received_node != null) {

programming_language: Java
CVE-2016-8887 (published 2017-03-23T18:59Z)

The jp2_colr_destroy function in libjasper/jp2/jp2_cod.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (NULL pointer dereference).

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/mdadams/jasper
commit_details: repo_url: https://github.com/mdadams/jasper
author: Michael Adams
author_date: 2016-10-21 00:00:27-07:00
msg: Fixed a bug that resulted in the destruction of JP2 box data that had never
been constructed in the first place.
repository: repo_url: https://github.com/mdadams/jasper
repo_name: jasper-software/jasper
description: Official Repository for the JasPer Image Coding Toolkit
repo_language: C
owner: mdadams
file_changes: filename: jp2_cod.c
change_type: ModificationType.MODIFY
diff: @@ -258,6 +258,10 @@ jp2_box_t *jp2_box_get(jas_stream_t *in)
 	box->info = boxinfo;
 	box->ops = &boxinfo->ops;
 	box->len = len;
+	JAS_DBGLOG(10, (
+	  "preliminary processing of JP2 box: type=%c%s%c (0x%08x); length=%d\n",
+	  '"', boxinfo->name, '"', box->type, box->len
+	  ));
 	if (box->len == 1) {
 		if (jp2_getuint64(in, &extlen)) {
 			goto error;
@@ -282,6 +286,9 @@ jp2_box_t *jp2_box_get(jas_stream_t *in)
 			goto error;
 		}
 		if (jas_stream_copy(tmpstream, in, box->datalen)) {
+			// Mark the box data as never having been constructed
+			// so that we will not errantly attempt to destroy it later.
+			box->ops = &jp2_boxinfo_unk.ops;
 			jas_eprintf("cannot copy box data\n");
 			goto error;
 		}

programming_language: C
filename: jp2_dec.c
change_type: ModificationType.MODIFY
diff: @@ -155,7 +155,7 @@ jas_image_t *jp2_decode(jas_stream_t *in, char *optstr)
 	found = 0;
 	while ((box = jp2_box_get(in))) {
 		if (jas_getdbglevel() >= 1) {
-			jas_eprintf("box type %s\n", box->info->name);
+			jas_eprintf("got box type %s\n", box->info->name);
 		}
 		switch (box->type) {
 		case JP2_BOX_JP2C:

programming_language: C
CVE-2022-1441 (published 2022-04-25T17:15Z)

MP4Box is a component of GPAC-2.0.0, which is a widely-used third-party package on RPM Fusion. When MP4Box tries to parse a MP4 file, it calls the function `diST_box_read()` to read from video. In this function, it allocates a buffer `str` with fixed length. However, content read from `bs` is controllable by user, so is the length, which causes a buffer overflow.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2022-04-19 09:15:58+02:00
msg: fixed #2175
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: box_code_3gpp.c
change_type: ModificationType.MODIFY
diff: @@ -1128,20 +1128,12 @@ void diST_box_del(GF_Box *s)
 
 GF_Err diST_box_read(GF_Box *s, GF_BitStream *bs)
 {
-	u32 i;
-	char str[1024];
 	GF_DIMSScriptTypesBox *p = (GF_DIMSScriptTypesBox *)s;
 
-	i=0;
-	str[0]=0;
-	while (1) {
-		str[i] = gf_bs_read_u8(bs);
-		if (!str[i]) break;
-		i++;
-	}
-	ISOM_DECREASE_SIZE(p, i);
-
-	p->content_script_types = gf_strdup(str);
+	p->content_script_types = gf_malloc(sizeof(char) * (s->size+1));
+	if (!p->content_script_types) return GF_OUT_OF_MEM;
+	gf_bs_read_data(bs, p->content_script_types, s->size);
+	p->content_script_types[s->size] = 0;
 	return GF_OK;
 }
 

programming_language: C