starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2021-23518 (published 2022-01-21T20:15Z)

The package cached-path-relative before 1.1.0 are vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in the cachedPathRelative function, which allows access to the parent prototype properties when the object is used to create the cached relative path. When using the origin path as __proto__, the attribute of the object is accessed instead of a path. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-CACHEDPATHRELATIVE-72573

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-1321
cwe_name: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
extended_description: 
				By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the product depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf).
				This weakness is usually exploited by using a special attribute of objects called proto,  constructor or prototype. Such attributes give access to the object prototype. This weakness is often found in code that assigns object attributes based on user input, or merges or clones objects recursively.
			
			

Fix information:
repo_url: https://github.com/ashaffer/cached-path-relative
commit_details: repo_url: https://github.com/ashaffer/cached-path-relative
author: Andrew
author_date: 2022-01-19 11:12:34-08:00
msg: Fix other instances of prototype pollution vulnerability
repository: repo_url: https://github.com/ashaffer/cached-path-relative
repo_name: ashaffer/cached-path-relative
repo_language: JavaScript
owner: ashaffer
file_changes: filename: index.js
change_type: ModificationType.MODIFY
diff: @@ -27,7 +27,7 @@ function cachedPathRelative (from, to) {
   // to invalidate the cache
   var cwd = process.cwd()
   if (cwd !== lastCwd) {
-    cache = {}
+    cache = Object.create(null)
     lastCwd = cwd
   }
 
@@ -35,7 +35,7 @@ function cachedPathRelative (from, to) {
 
   var result = relative.call(path, from, to)
 
-  cache[from] = cache[from] || {}
+  cache[from] = cache[from] || Object.create(null)
   cache[from][to] = result
 
   return result

programming_language: Scala
CVE-2014-9621 (published 2015-01-21T18:59Z)

The ELF parser in file 5.16 through 5.21 allows remote attackers to cause a denial of service via a long string.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)

Weakness information:
cwe_id: CWE-399
cwe_name: Resource Management Errors
description: Weaknesses in this category are related to improper management of system resources.

Fix information:
repo_url: https://github.com/file/file
commit_details: repo_url: https://github.com/file/file
author: Christos Zoulas
author_date: 2014-12-16 23:29:42+00:00
msg: Limit string printing to 100 chars, and add flags I forgot in the previous
commit.
repository: repo_url: https://github.com/file/file
repo_name: file/file
description: Read-only mirror of file CVS repository, updated every half hour. NOTE: do not make pull requests here, nor comment any commits, submit them usual way to bug tracker or to the mailing list. Maintainer(s) are not tracking  this git mirror.
repo_language: C
owner: file
file_changes: filename: readelf.c
change_type: ModificationType.MODIFY
diff: @@ -27,7 +27,7 @@
 #include "file.h"
 
 #ifndef lint
-FILE_RCSID("@(#)$File: readelf.c,v 1.115 2014/12/16 20:53:05 christos Exp $")
+FILE_RCSID("@(#)$File: readelf.c,v 1.116 2014/12/16 23:18:40 christos Exp $")
 #endif
 
 #ifdef BUILTIN_ELF
@@ -900,19 +900,23 @@ donote(struct magic_set *ms, void *vbuf, size_t offset, size_t size,
 	}
 
 	if (namesz == 7 && strcmp((char *)&nbuf[noff], "NetBSD") == 0) {
+		if (descsz > 100)
+			descsz = 100;
 		switch (xnh_type) {
 	    	case NT_NETBSD_VERSION:
 			return size;
 		case NT_NETBSD_MARCH:
 			if (*flags & FLAGS_DID_NETBSD_MARCH)
 				return size;
-			if (file_printf(ms, ", compiled for: %.*s", (int)descsz,
-			    (const char *)&nbuf[doff]) == -1)
+			*flags |= FLAGS_DID_NETBSD_MARCH;
+			if (file_printf(ms, ", compiled for: %.*s",
+			    (int)descsz, (const char *)&nbuf[doff]) == -1)
 				return size;
 			break;
 		case NT_NETBSD_CMODEL:
 			if (*flags & FLAGS_DID_NETBSD_CMODEL)
 				return size;
+			*flags |= FLAGS_DID_NETBSD_CMODEL;
 			if (file_printf(ms, ", compiler model: %.*s",
 			    (int)descsz, (const char *)&nbuf[doff]) == -1)
 				return size;
@@ -920,6 +924,7 @@ donote(struct magic_set *ms, void *vbuf, size_t offset, size_t size,
 		default:
 			if (*flags & FLAGS_DID_NETBSD_UNKNOWN)
 				return size;
+			*flags |= FLAGS_DID_NETBSD_UNKNOWN;
 			if (file_printf(ms, ", note=%u", xnh_type) == -1)
 				return size;
 			break;

programming_language: C
CVE-2022-45474 (published 2022-11-18T18:15Z)

drachtio-server 0.8.18 has a request-handler.cpp event_cb use-after-free for any request.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/drachtio/drachtio-server
commit_details: repo_url: https://github.com/drachtio/drachtio-server
author: Dave Horton
author_date: 2022-11-23 15:24:44-05:00
msg: fix for use-after-free (#240)
repository: repo_url: https://github.com/drachtio/drachtio-server
repo_name: drachtio/drachtio-server
description: A SIP call processing server that can be controlled via nodejs applications
repo_language: C++
owner: drachtio
file_changes: filename: request-handler.cpp
change_type: ModificationType.MODIFY
diff: @@ -267,6 +267,7 @@ namespace drachtio {
   void event_cb(drachtio::RequestHandler::GlobalInfo *g, curl_socket_t s,
                        int action, const boost::system::error_code & error,
                        int *fdp) {
+    int f = *fdp;
     std::shared_ptr<RequestHandler> p = RequestHandler::getInstance() ;
     std::map<curl_socket_t, boost::asio::ip::tcp::socket *>& socket_map = p->getSocketMap() ;
     boost::asio::deadline_timer& timer = p->getTimer() ;
@@ -277,7 +278,7 @@ namespace drachtio {
     }
 
     /* make sure the event matches what are wanted */
-    if(*fdp == action || *fdp == CURL_POLL_INOUT) {
+    if(f == action || f == CURL_POLL_INOUT) {
       CURLMcode rc;
       if(error)
         action = CURL_CSELECT_ERR;
@@ -294,7 +295,7 @@ namespace drachtio {
        * the socket may have been closed and/or fdp may have been changed
        * in curl_multi_socket_action(), so check them both */
       if(!error && socket_map.find(s) != socket_map.end() &&
-         (*fdp == action || *fdp == CURL_POLL_INOUT)) {
+         (f == action || f == CURL_POLL_INOUT)) {
         boost::asio::ip::tcp::socket *tcp_socket = socket_map.find(s)->second;
 
         if(action == CURL_POLL_IN) {
@@ -476,7 +477,6 @@ namespace drachtio {
     DR_LOG(log_info) << "RequestHandler::startRequest: sending http " << httpMethod << ": " << url ;
 
     conn = m_pool.malloc() ;
-
     CURL* easy = NULL ;
     {
       //alloc and free happen in the same thread
@@ -498,6 +498,7 @@ namespace drachtio {
     strncpy(conn->body, body.c_str(), HTTP_BODY_LEN);
     strncpy(conn->transactionId, transactionId.c_str(), TXNID_LEN);
     conn->hdr_list = NULL ;
+    *conn->response = '\0' ;
 
     curl_easy_setopt(easy, CURLOPT_URL, conn->url);
     curl_easy_setopt(easy, CURLOPT_WRITEFUNCTION, write_cb);

programming_language: C++
CVE-2022-4594 (published 2022-12-18T08:15Z)

A vulnerability was found in drogatkin TJWS2. It has been declared as critical. Affected by this vulnerability is the function deployWar of the file 1.x/src/rogatkin/web/WarRoller.java. The manipulation leads to path traversal. The attack can be launched remotely. The name of the patch is 1bac15c496ec54efe21ad7fab4e17633778582fc. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216187.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/drogatkin/TJWS2
commit_details: repo_url: https://github.com/drogatkin/TJWS2
author: dmitriy
author_date: 2022-05-24 18:04:48-07:00
msg: the a Path Traversal vulnerability reported by Google
repository: repo_url: https://github.com/drogatkin/TJWS2
repo_name: drogatkin/TJWS2
description: Tiny Java Web and App server second generation
repo_language: Java
owner: drogatkin
file_changes: filename: WarRoller.java
change_type: ModificationType.MODIFY
diff: @@ -131,6 +131,8 @@ public class WarRoller implements WarDeployer {
 		    String en = ze.getName();
 		    if (File.separatorChar == '/')
 			en = en.replace('\\', File.separatorChar);
+		    if (en.contains("../") || en.contains("/..")) 
+		    	throw new IOException("The file name " + en + " contains .. which can lead to a Path Traversal vulnerability");
 		    File outFile = new File(deployDir, en);
 		    if (ze.isDirectory()) {
 			outFile.mkdirs();

programming_language: Java
CVE-2022-29162 (published 2022-05-17T21:15Z)

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set. This bug has been fixed in runc 1.1.2. This fix changes `runc exec --cap` behavior such that the additional capabilities granted to the process being executed (as specified via `--cap` arguments) do not include inheritable capabilities. In addition, `runc spec` is changed to not set any inheritable capabilities in the created example OCI spec (`config.json`) file.

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-276
cwe_name: Incorrect Default Permissions
description: During installation, installed file permissions are set to allow anyone to modify those files.
extended_description: 
      
      
     
     

Fix information:
repo_url: https://github.com/opencontainers/runc
commit_details: repo_url: https://github.com/opencontainers/runc
author: Aleksa Sarai
author_date: 2022-05-12 08:15:42+10:00
msg: Merge pull request from GHSA-f3fp-gc8g-vw66

runc: do not set inheritable capabilities
repository: repo_url: https://github.com/opencontainers/runc
repo_name: opencontainers/runc
description: CLI tool for spawning and running containers according to the OCI specification
repo_language: Go
owner: opencontainers
CVE-2023-3106 (published 2023-07-12T09:15Z)

A NULL pointer dereference vulnerability was found in netlink_dump. This issue can occur when the Netlink socket receives the message(sendmsg) for the XFRM_MSG_GETSA, XFRM_MSG_GETPOLICY type message, and the DUMP flag is set and can cause a denial of service or possibly another unspecified impact. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although it is unlikely.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Vegard Nossum
author_date: 2016-07-05 10:18:08+02:00
msg: xfrm: fix crash in XFRM_MSG_GETSA netlink handler

If we hit any of the error conditions inside xfrm_dump_sa(), then
xfrm_state_walk_init() never gets called. However, we still call
xfrm_state_walk_done() from xfrm_dump_sa_done(), which will crash
because the state walk was never initialized properly.

We can fix this by setting cb->args[0] only after we've processed the
first element and checking this before calling xfrm_state_walk_done().

Fixes: d3623099d3 ("ipsec: add support of limited SA dump")
Cc: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: xfrm_user.c
change_type: ModificationType.MODIFY
diff: @@ -896,7 +896,8 @@ static int xfrm_dump_sa_done(struct netlink_callback *cb)
 	struct sock *sk = cb->skb->sk;
 	struct net *net = sock_net(sk);
 
-	xfrm_state_walk_done(walk, net);
+	if (cb->args[0])
+		xfrm_state_walk_done(walk, net);
 	return 0;
 }
 
@@ -921,8 +922,6 @@ static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb)
 		u8 proto = 0;
 		int err;
 
-		cb->args[0] = 1;
-
 		err = nlmsg_parse(cb->nlh, 0, attrs, XFRMA_MAX,
 				  xfrma_policy);
 		if (err < 0)
@@ -939,6 +938,7 @@ static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb)
 			proto = nla_get_u8(attrs[XFRMA_PROTO]);
 
 		xfrm_state_walk_init(walk, proto, filter);
+		cb->args[0] = 1;
 	}
 
 	(void) xfrm_state_walk(net, walk, dump_one_state, &info);

programming_language: C
CVE-2022-23579 (published 2022-02-04T23:15Z)

Tensorflow is an Open Source Machine Learning Framework. The Grappler optimizer in TensorFlow can be used to cause a denial of service by altering a `SavedModel` such that `SafeToRemoveIdentity` would trigger `CHECK` failures. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-617
cwe_name: Reachable Assertion
description: The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
extended_description: 
            While assertion is good for catching logic errors and reducing the chances of reaching more serious vulnerability conditions, it can still lead to a denial of service.
            For example, if a server handles multiple simultaneous connections, and an assert() occurs in one single connection that causes all other connections to be dropped, this is a reachable assertion that leads to a denial of service.
         
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Mihai Maruseac
author_date: 2021-11-11 10:43:29-08:00
msg: Prevent a null-pointer dereference / `CHECK`-fail in grappler.

PiperOrigin-RevId: 409187354
Change-Id: I369c249cca32e6c56ec193f0ebbf2f2768fc7d43
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: dependency_optimizer.cc
change_type: ModificationType.MODIFY
diff: @@ -75,8 +75,10 @@ bool DependencyOptimizer::SafeToRemoveIdentity(const NodeDef& node) const {
   }
 
   const NodeDef* input = node_map_->GetNode(NodeName(node.input(0)));
-  CHECK(input != nullptr) << "node = " << node.name()
-                          << " input = " << node.input(0);
+  if (input == nullptr) {
+    VLOG(1) << "node = " << node.name() << " input = " << node.input(0);
+    return false;
+  }
   // Don't remove Identity nodes corresponding to Variable reads or following
   // Recv.
   if (IsVariable(*input) || IsRecv(*input)) {

programming_language: C++
CVE-2019-16236 (published 2019-09-11T19:15Z)

Dino before 2019-09-10 does not check roster push authorization in module/roster/module.vala.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-862
cwe_name: Missing Authorization
description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are not applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/dino/dino
commit_details: repo_url: https://github.com/dino/dino
author: Marvin W
author_date: 2019-09-10 21:58:12+02:00
msg: Check roster push authorization
repository: repo_url: https://github.com/dino/dino
repo_name: dino/dino
description: Modern XMPP ("Jabber") Chat Client using GTK+/Vala
repo_language: Vala
owner: dino
file_changes: filename: module.vala
change_type: ModificationType.MODIFY
diff: @@ -47,6 +47,10 @@ public class Module : XmppStreamModule, Iq.Handler {
     public void on_iq_set(XmppStream stream, Iq.Stanza iq) {
         StanzaNode? query_node = iq.stanza.get_subnode("query", NS_URI);
         if (query_node == null) return;
+        if (!iq.from.equals(stream.get_flag(Bind.Flag.IDENTITY).my_jid.bare_jid)) {
+            warning("Received alledged roster push from %s, ignoring", iq.from.to_string());
+            return;
+        }
 
         Flag flag = stream.get_flag(Flag.IDENTITY);
         Item item = new Item.from_stanza_node(query_node.get_subnode("item", NS_URI));

programming_language: Java
CVE-2021-32847 (published 2023-02-20T17:15Z)

HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior, a malicious guest can trigger a vulnerability in the host by abusing the disk driver that may lead to the disclosure of the host memory into the virtualized guest. This issue is fixed in commit cf60095a4d8c3cb2e182a14415467afd356e982f.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/moby/hyperkit
commit_details: repo_url: https://github.com/moby/hyperkit
author: Frederic Dalleau
author_date: 2021-09-14 16:38:23+02:00
msg: Fix assertion turned into assignment

The qassertion is supposed to check the value but the typo makes it
an assignment. Hence it is always true,

Signed-off-by: Frederic Dalleau <frederic.dalleau@docker.com>
repository: repo_url: https://github.com/moby/hyperkit
repo_name: moby/hyperkit
description: A toolkit for embedding hypervisor capabilities in your application
repo_language: C
owner: moby
file_changes: filename: pci_virtio_block.c
change_type: ModificationType.MODIFY
diff: @@ -316,7 +316,7 @@ pci_vtblk_proc(struct pci_vtblk_softc *sc, struct vqueue_info *vq)
 	case VBH_OP_DISCARD:
 		/* We currently limit the discard to one segment in the initial negotiation
 		   so expect exactly one correctly-sized payload descriptor. */
-		assert(iov[1].iov_len = sizeof(struct virtio_blk_discard_write_zeroes));
+		assert(iov[1].iov_len == sizeof(struct virtio_blk_discard_write_zeroes));
 		assert(n == 2);
 		vbdiscard = iov[1].iov_base;
 		io->io_req.br_offset = (off_t) vbdiscard->sector * DEV_BSIZE;

programming_language: C