starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2017-18190 (published 2018-02-16T17:29Z)

A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1).

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-290
cwe_name: Authentication Bypass by Spoofing
description: This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/apple/cups
commit_details: repo_url: https://github.com/apple/cups
author: Michael R Sweet
author_date: 2017-01-03 13:52:47-05:00
msg: Don't treat "localhost.localdomain" as an allowed replacement for localhost, since it isn't.
repository: repo_url: https://github.com/apple/cups
repo_name: apple/cups
description: Apple CUPS Sources
repo_language: C
owner: apple
file_changes: filename: client.c
change_type: ModificationType.MODIFY
diff: @@ -3890,9 +3890,6 @@ valid_host(cupsd_client_t *con)		/* I - Client connection */
 
     return (!_cups_strcasecmp(con->clientname, "localhost") ||
 	    !_cups_strcasecmp(con->clientname, "localhost.") ||
-#ifdef __linux
-	    !_cups_strcasecmp(con->clientname, "localhost.localdomain") ||
-#endif /* __linux */
             !strcmp(con->clientname, "127.0.0.1") ||
 	    !strcmp(con->clientname, "[::1]"));
   }

programming_language: C
CVE-2019-1020014 (published 2019-07-29T13:15Z)

docker-credential-helpers before 0.6.3 has a double free in the List functions.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-415
cwe_name: Double Free
description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
extended_description: When a program calls free() twice with the same argument, the program's memory management data structures become corrupted. This corruption can cause the program to crash or, in some circumstances, cause two later calls to malloc() to return the same pointer. If malloc() returns the same value twice and the program later gives the attacker control over the data that is written into this doubly-allocated memory, the program becomes vulnerable to a buffer overflow attack.
         

Fix information:
repo_url: https://github.com/docker/docker-credential-helpers
commit_details: repo_url: https://github.com/docker/docker-credential-helpers
author: Guillaume Rose
author_date: 2019-07-16 09:57:38+02:00
msg: Merge pull request from GHSA-g9w7-h2f5-5vp2

Fix a double free in the List functions
repository: repo_url: https://github.com/docker/docker-credential-helpers
repo_name: docker/docker-credential-helpers
description: Programs to keep Docker login credentials safe by storing in platform keystores
repo_language: Go
owner: docker
CVE-2024-24474 (published 2024-02-20T18:15Z)

QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/qemu/qemu
commit_details: repo_url: https://github.com/qemu/qemu
author: Mark Cave-Ayland
author_date: 2023-09-13 21:44:09+01:00
msg: esp: restrict non-DMA transfer length to that of available data

In the case where a SCSI layer transfer is incorrectly terminated, it is
possible for a TI command to cause a SCSI buffer overflow due to the
expected transfer data length being less than the available data in the
FIFO. When this occurs the unsigned async_len variable underflows and
becomes a large offset which writes past the end of the allocated SCSI
buffer.

Restrict the non-DMA transfer length to be the smallest of the expected
transfer length and the available FIFO data to ensure that it is no longer
possible for the SCSI buffer overflow to occur.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1810
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20230913204410.65650-3-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
repository: repo_url: https://github.com/qemu/qemu
repo_name: qemu/qemu
description: Official QEMU mirror. Please see https://www.qemu.org/contribute/ for how to submit changes to QEMU. Pull Requests are ignored. Please only use release tarballs from the QEMU website.
repo_language: C
owner: qemu
file_changes: filename: esp.c
change_type: ModificationType.MODIFY
diff: @@ -759,7 +759,8 @@ static void esp_do_nodma(ESPState *s)
     }
 
     if (to_device) {
-        len = MIN(fifo8_num_used(&s->fifo), ESP_FIFO_SZ);
+        len = MIN(s->async_len, ESP_FIFO_SZ);
+        len = MIN(len, fifo8_num_used(&s->fifo));
         esp_fifo_pop_buf(&s->fifo, s->async_buf, len);
         s->async_buf += len;
         s->async_len -= len;

programming_language: C
CVE-2020-7611 (published 2020-03-30T22:15Z)

All versions of io.micronaut:micronaut-http-client before 1.2.11 and all versions from 1.3.0 before 1.3.2 are vulnerable to HTTP Request Header Injection due to not validating request headers passed to the client.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-444
cwe_name: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
description: The product acts as an intermediary HTTP agent
         (such as a proxy or firewall) in the data flow between two
         entities such as a client and server, but it does not
         interpret malformed HTTP requests or responses in ways that
         are consistent with how the messages will be processed by
         those entities that are at the ultimate destination.
extended_description: 
	   HTTP requests or responses ("messages") can be
	   malformed or unexpected in ways that cause web servers or
	   clients to interpret the messages in different ways than
	   intermediary HTTP agents such as load balancers, reverse
	   proxies, web caching proxies, application firewalls,
	   etc. For example, an adversary may be able to add duplicate
	   or different header fields that a client or server might
	   interpret as one set of messages, whereas the intermediary
	   might interpret the same sequence of bytes as a different
	   set of messages. For example, discrepancies can arise in
	   how to handle duplicate headers like two Transfer-encoding
	   (TE) or two Content-length (CL), or the malicious HTTP
	   message will have different headers for TE and
	   CL.
	   The inconsistent parsing and interpretation of messages
	   can allow the adversary to "smuggle" a message to the
	   client/server without the intermediary being aware of it.
	   This weakness is usually the result of the usage
	   of outdated or incompatible HTTP protocol versions in the
	   HTTP agents.
         
         

Fix information:
repo_url: https://github.com/micronaut-projects/micronaut-core
commit_details: repo_url: https://github.com/micronaut-projects/micronaut-core
author: jameskleeh
author_date: 2020-03-09 14:20:28-04:00
msg: Validate client headers
repository: repo_url: https://github.com/micronaut-projects/micronaut-core
repo_name: micronaut-projects/micronaut-core
description: Micronaut Application Framework
repo_language: Java
owner: micronaut-projects
file_changes: filename: NettyHttpHeaders.java
change_type: ModificationType.MODIFY
diff: @@ -53,7 +53,7 @@ public class NettyHttpHeaders implements MutableHttpHeaders {
      * Default constructor.
      */
     public NettyHttpHeaders() {
-        this.nettyHeaders = new DefaultHttpHeaders(false);
+        this.nettyHeaders = new DefaultHttpHeaders();
         this.conversionService = ConversionService.SHARED;
     }
 

programming_language: Java
CVE-2017-9250 (published 2017-05-28T20:29Z)

The lexer_process_char_literal function in jerry-core/parser/js/js-lexer.c in JerryScript 1.0 does not skip memory allocation for empty strings, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via malformed JavaScript source code, related to the jmem_heap_free_block function.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/jerryscript-project/jerryscript
commit_details: repo_url: https://github.com/jerryscript-project/jerryscript
author: Zoltan Herczeg
author_date: 2017-05-22 13:17:08+02:00
msg: Do not allocate memory for zero length strings. (#1844)

Fixes #1821.

JerryScript-DCO-1.0-Signed-off-by: Zoltan Herczeg zherczeg.u-szeged@partner.samsung.com
repository: repo_url: https://github.com/jerryscript-project/jerryscript
repo_name: jerryscript-project/jerryscript
description: Ultra-lightweight JavaScript engine for the Internet of Things.
repo_language: C
owner: jerryscript-project
file_changes: filename: js-lexer.c
change_type: ModificationType.MODIFY
diff: @@ -1197,6 +1197,11 @@ lexer_process_char_literal (parser_context_t *context_p, /**< context */
     parser_raise_error (context_p, PARSER_ERR_LITERAL_LIMIT_REACHED);
   }
 
+  if (length == 0)
+  {
+    has_escape = false;
+  }
+
   literal_p = (lexer_literal_t *) parser_list_append (context_p, &context_p->literal_pool);
   literal_p->prop.length = (uint16_t) length;
   literal_p->type = literal_type;

programming_language: C
filename: regression-test-issue-1833.js
change_type: ModificationType.ADD
diff: @@ -0,0 +1,16 @@
+// Copyright JS Foundation and other contributors, http://js.foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+'\
+'

programming_language: Go
CVE-2024-32474 (published 2024-04-18T20:15Z)

Sentry is an error tracking and performance monitoring platform. Prior to 24.4.1, when authenticating as a superuser to Sentry with a username and password, the password is leaked as cleartext in logs under the _event_: `auth-index.validate_superuser`. An attacker with access to the log data could use these leaked credentials to login to the Sentry system as superuser. Self-hosted users on affected versions should upgrade to 24.4.1 or later. Users can configure the logging level to exclude logs of the `INFO` level and only generate logs for levels at `WARNING` or more.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/getsentry/sentry
commit_details: repo_url: https://github.com/getsentry/sentry
author: Cathy Teng
author_date: 2024-04-17 14:56:56-07:00
msg: chore(auth): explicitly log challenge and response for debugging (#69148)
repository: repo_url: https://github.com/getsentry/sentry
repo_name: getsentry/sentry
description: Developer-first error tracking and performance monitoring
repo_language: Python
owner: getsentry
file_changes: filename: auth_index.py
change_type: ModificationType.MODIFY
diff: @@ -140,7 +140,6 @@ class AuthIndexEndpoint(BaseAuthIndexEndpoint):
         logger.info(
             "auth-index.validate_superuser",
             extra={
-                "validator": validator,
                 "user": request.user.id,
                 "raise_exception": not DISABLE_SSO_CHECK_FOR_LOCAL_DEV,
                 "verify_authenticator": verify_authenticator,

programming_language: Python
CVE-2022-47933 (published 2022-12-24T22:15Z)

Brave Browser before 1.42.51 allowed a remote attacker to cause a denial of service via a crafted HTML file that references the IPFS scheme. This vulnerability is caused by an uncaught exception in the function ipfs::OnBeforeURLRequest_IPFSRedirectWork() in ipfs_redirect_network_delegate_helper.cc.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-755
cwe_name: Improper Handling of Exceptional Conditions
description: The product does not handle or incorrectly handles an exceptional condition.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/brave/brave-core
commit_details: repo_url: https://github.com/brave/brave-core
author: cypt4
author_date: 2022-07-01 23:18:47-07:00
msg: Merge pull request #13989 from brave/brave_23646

Do not proceed loading ipfs resources if ipfs is disabled
repository: repo_url: https://github.com/brave/brave-core
repo_name: brave/brave-core
description: Core engine for the Brave browser for mobile and desktop. For issues https://github.com/brave/brave-browser/issues
repo_language: HTML
owner: brave
CVE-2020-15150 (published 2020-09-01T17:15Z)

There is a vulnerability in Paginator (Elixir/Hex package) which makes it susceptible to Remote Code Execution (RCE) attacks via input parameters to the paginate() function. This will potentially affect all current users of Paginator prior to version 1.0.0. The vulnerability has been patched in version 1.0.0 and all users should upgrade to this version immediately. Note that this patched version uses a dependency that requires an Elixir version >=1.5.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-94
cwe_name: Improper Control of Generation of Code ('Code Injection')
description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
extended_description: 
            When a product allows a user's input to contain code syntax, it might be possible for an attacker to craft the code in such a way that it will alter the intended control flow of the product. Such an alteration could lead to arbitrary code execution.
            Injection problems encompass a wide variety of issues -- all mitigated in very different ways. For this reason, the most effective way to discuss these weaknesses is to note the distinct features which classify them as injection weaknesses. The most important issue to note is that all injection problems share one thing in common -- i.e., they allow for the injection of control plane data into the user-controlled data plane. This means that the execution of the process may be altered by sending code in through legitimate data channels, using no other mechanism. While buffer overflows, and many other flaws, involve the use of some further issue to gain execution, injection problems need only for the data to be parsed. The most classic instantiations of this category of weakness are SQL injection and format string vulnerabilities.
         
         

Fix information:
repo_url: https://github.com/duffelhq/paginator
commit_details: repo_url: https://github.com/duffelhq/paginator
author: Walter Carvalho
author_date: 2020-08-17 19:08:18+01:00
msg: Merge pull request from GHSA-w98m-2xqg-9cvj

Fix unsafe binary to term
repository: repo_url: https://github.com/duffelhq/paginator
repo_name: duffelhq/paginator
description: Cursor-based pagination for Elixir Ecto
repo_language: Elixir
owner: duffelhq
CVE-2018-14015 (published 2018-07-12T20:29Z)

The sdb_set_internal function in sdb.c in radare2 2.7.0 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted ELF file because of missing input validation in r_bin_dwarf_parse_comp_unit in libr/bin/dwarf.c.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/radareorg/radare2
commit_details: repo_url: https://github.com/radareorg/radare2
author: radare
author_date: 2018-06-25 00:07:45+02:00
msg: Fix #10465 - Avoid string on low addresses (workaround) for corrupted dwarf (#10478)
repository: repo_url: https://github.com/radareorg/radare2
repo_name: radareorg/radare2
description: UNIX-like reverse engineering framework and command-line toolset
repo_language: C
owner: radareorg
file_changes: filename: dwarf.c
change_type: ModificationType.MODIFY
diff: @@ -1361,7 +1361,11 @@ static const ut8 *r_bin_dwarf_parse_comp_unit(Sdb *s, const ut8 *obuf,
 					&cu->hdr, debug_str, debug_str_len);
 			if (cu->dies[cu->length].attr_values[i].name == DW_AT_comp_dir) {
 				const char *name = cu->dies[cu->length].attr_values[i].encoding.str_struct.string;
-				sdb_set (s, "DW_AT_comp_dir", name, 0);
+				if (name > 1024) { // solve some null derefs
+					sdb_set (s, "DW_AT_comp_dir", name, 0);
+				} else {
+					eprintf ("Invalid string pointer at %p\n", name);
+				}
 			}
 			cu->dies[cu->length].length++;
 		}

programming_language: Lua
CVE-2020-16587 (published 2020-12-09T21:15Z)

A heap-based buffer overflow vulnerability exists in Academy Software Foundation OpenEXR 2.3.0 in chunkOffsetReconstruction in ImfMultiPartInputFile.cpp that can cause a denial of service via a crafted EXR file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/AcademySoftwareFoundation/openexr
commit_details: repo_url: https://github.com/AcademySoftwareFoundation/openexr
author: Kimball Thurston
author_date: 2019-07-25 20:01:56+12:00
msg: Fix #491, issue with part number range check reconstructing chunk offset table

The chunk offset was incorrectly testing for a part number that was the
same size (i.e. an invalid index)

Signed-off-by: Kimball Thurston <kdt3rd@gmail.com>
repository: repo_url: https://github.com/AcademySoftwareFoundation/openexr
repo_name: AcademySoftwareFoundation/openexr
description: The OpenEXR project provides the specification and reference implementation of the EXR file format, the professional-grade image storage format of the motion picture industry.
repo_language: C
owner: AcademySoftwareFoundation
file_changes: filename: ImfMultiPartInputFile.cpp
change_type: ModificationType.MODIFY
diff: @@ -571,7 +571,7 @@ MultiPartInputFile::Data::chunkOffsetReconstruction(OPENEXR_IMF_INTERNAL_NAMESPA
             
             
             
-            if(partNumber<0 || partNumber> static_cast<int>(parts.size()))
+            if(partNumber<0 || partNumber>= static_cast<int>(parts.size()))
             {
                 throw IEX_NAMESPACE::IoExc("part number out of range");
             }

programming_language: C++
CVE-2024-35227 (published 2024-07-03T18:15Z)

Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch, Oneboxing against a carefully crafted malicious URL can reduce the availability of a Discourse instance. The problem has been patched in version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch. There are no known workarounds available for this vulnerability. 


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/discourse/discourse
commit_details: repo_url: https://github.com/discourse/discourse
author: Alan Guo Xiang Tan
author_date: 2024-05-23 09:48:54+08:00
msg: SECURITY: Avoid the use of `Object#send` in `Onebox::Engine::StandardEmbed`

Use `Object#public_send` instead which is much safer
repository: repo_url: https://github.com/discourse/discourse
repo_name: discourse/discourse
description: A platform for community discussion. Free, open, simple.
repo_language: Ruby
owner: discourse
file_changes: filename: standard_embed.rb
change_type: ModificationType.MODIFY
diff: @@ -161,7 +161,7 @@ module Onebox
 
       def set_from_normalizer_data(normalizer)
         normalizer.data.each do |k, _|
-          v = normalizer.send(k)
+          v = normalizer.public_send(k)
           @raw[k] ||= v unless v.nil?
         end
       end

programming_language: Ruby