starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2024-34349 (published 2024-05-14T15:38Z)

Sylius is an open source eCommerce platform. Prior to 1.12.16 and 1.13.1, there is a possibility to execute javascript code in the Admin panel. In order to perform an XSS attack input a script into Name field in which of the resources: Taxons, Products, Product Options or Product Variants. The code will be executed while using an autocomplete field with one of the listed entities in the Admin Panel. Also for the taxons in the category tree on the product form.The issue is fixed in versions: 1.12.16, 1.13.1.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/Sylius/Sylius
commit_details: repo_url: https://github.com/Sylius/Sylius
author: Grzegorz Sadowski
author_date: 2024-05-10 09:32:50+02:00
msg: bug #76 Fix potential xss in admin panel (mpysiak)

This PR was merged into the 1.12 branch.

Discussion
----------

| Q               | A
|-----------------|-----
| Branch?         | 1.12
| Bug fix?        | yes
| New feature?    | no
| BC breaks?      | no
| Deprecations?   | no
| Related tickets | n/a
| License         | MIT

Fixes potential xss in admin panel (Taxons and Products)

Commits
-------

d4812f9c14c7b2acc1f2f64cff363533e4c77b41 Fix potential xss in admin panel
29d18a39935e4d6e3d59bac5ebca798bfff00fe2 Use function from UIBundle
c11c424c1cd4918a71831152f69bc9b1915d542d Fix product-auto-complete
a17de6d1ed47155277732bcfab61fb491cac8cb6 Test adding new taxon
d25edf3ff097dbb704ecf4dc35b766526008516a Test adding new simple product
63c3cf7a12ff7e1471ef3af2e2141c474e42aa03 Test adding similar products
679e79352156f19e1747ab1d735070187b3788d7 Fixes after CR
repository: repo_url: https://github.com/Sylius/Sylius
repo_name: Sylius/Sylius
description: Open Source eCommerce Framework on Symfony
repo_language: PHP
owner: Sylius
CVE-2021-29606 (published 2021-05-14T20:15Z)

TensorFlow is an end-to-end open source platform for machine learning. A specially crafted TFLite model could trigger an OOB read on heap in the TFLite implementation of `Split_V`(https://github.com/tensorflow/tensorflow/blob/c59c37e7b2d563967da813fa50fe20b21f4da683/tensorflow/lite/kernels/split_v.cc#L99). If `axis_value` is not a value between 0 and `NumDimensions(input)`, then the `SizeOfDimension` function(https://github.com/tensorflow/tensorflow/blob/102b211d892f3abc14f845a72047809b39cc65ab/tensorflow/lite/kernels/kernel_util.h#L148-L150) will access data outside the bounds of the tensor shape array. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Mihai Maruseac
author_date: 2021-04-28 18:12:15-07:00
msg: Prevent array OOB read/write

PiperOrigin-RevId: 371026165
Change-Id: I26ac6372c87246e03c7eb8c94e84c84d86054b36
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: split_v.cc
change_type: ModificationType.MODIFY
diff: @@ -96,6 +96,8 @@ TfLiteStatus ResizeOutputTensors(TfLiteContext* context, TfLiteNode* node,
     }
   }
 
+  TF_LITE_ENSURE(context, axis_value >= 0);
+  TF_LITE_ENSURE(context, axis_value < NumDimensions(input));
   const int input_size = SizeOfDimension(input, axis_value);
 
   if (minus_one_index != -1) {

programming_language: C++
CVE-2022-33068 (published 2022-06-23T17:15Z)

An integer overflow in the component hb-ot-shape-fallback.cc of Harfbuzz v4.3.0 allows attackers to cause a Denial of Service (DoS) via unspecified vectors.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/harfbuzz/harfbuzz
commit_details: repo_url: https://github.com/harfbuzz/harfbuzz
author: Behdad Esfahbod
author_date: 2022-06-01 07:38:21-06:00
msg: [sbix] Limit glyph extents

Fixes https://github.com/harfbuzz/harfbuzz/issues/3557
repository: repo_url: https://github.com/harfbuzz/harfbuzz
repo_name: harfbuzz/harfbuzz
description: HarfBuzz text shaping engine
repo_language: C++
owner: harfbuzz
file_changes: filename: hb-ot-color-sbix-table.hh
change_type: ModificationType.MODIFY
diff: @@ -298,6 +298,12 @@ struct sbix
 
       const PNGHeader &png = *blob->as<PNGHeader>();
 
+      if (png.IHDR.height >= 65536 | png.IHDR.width >= 65536)
+      {
+	hb_blob_destroy (blob);
+	return false;
+      }
+
       extents->x_bearing = x_offset;
       extents->y_bearing = png.IHDR.height + y_offset;
       extents->width     = png.IHDR.width;

programming_language: C
CVE-2015-4425 (published 2015-08-18T17:59Z)

Directory traversal vulnerability in pimcore before build 3473 allows remote authenticated users with the "assets" permission to create or write to arbitrary files via a .. (dot dot) in the dir parameter to admin/asset/add-asset-compatibility.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:N/AC:M/Au:S/C:N/I:P/A:P)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/pimcore/pimcore
commit_details: repo_url: https://github.com/pimcore/pimcore
author: memleak
author_date: 2015-04-20 07:54:08+00:00
msg: AssetController: directory traversal vulnerability issue

git-svn-id: http://www.pimcore.org/svn/pimcore/private/core/trunk@6458 1f8fe7d8-47f0-464c-8d0a-336f4953ab05
repository: repo_url: https://github.com/pimcore/pimcore
repo_name: pimcore/pimcore
description: Core Framework for the Open Source Data & Experience Management Platform (PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce)
repo_language: PHP
owner: pimcore
file_changes: filename: AssetController.php
change_type: ModificationType.MODIFY
diff: @@ -210,6 +210,13 @@ class Admin_AssetController extends \Pimcore\Controller\Action\Admin\Element
             $parent = Asset::getById($this->getParam("parentId"));
             $newPath = $parent->getFullPath() . "/" . trim($this->getParam("dir"), "/ ");
 
+            // check if the path is outside of the asset directory
+            $newRealPath = PIMCORE_ASSET_DIRECTORY . $newPath;
+            $newRealPath= realpath($newRealPath);
+            if (strpos($newRealPath, PIMCORE_ASSET_DIRECTORY) !== 0) {
+                throw new Exception("not allowed");
+            }
+
             $maxRetries = 5;
             for ($retries=0; $retries<$maxRetries; $retries++) {
                 try {

programming_language: PHP
CVE-2016-8692 (published 2017-02-15T19:59Z)

The jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.4 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted YRsiz value in a BMP image to the imginfo command.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-369
cwe_name: Divide By Zero
description: The product divides a value by zero.
extended_description: This weakness typically occurs when an unexpected value is provided to the product, or if an error occurs that is not properly detected. It frequently occurs in calculations involving physical dimensions such as size, length, width, and height.
         

Fix information:
repo_url: https://github.com/mdadams/jasper
commit_details: repo_url: https://github.com/mdadams/jasper
author: Michael Adams
author_date: 2016-10-15 12:22:28-07:00
msg: Added range check on XRsiz and YRsiz fields of SIZ marker segment.
repository: repo_url: https://github.com/mdadams/jasper
repo_name: jasper-software/jasper
description: Official Repository for the JasPer Image Coding Toolkit
repo_language: C
owner: mdadams
file_changes: filename: jpc_cs.c
change_type: ModificationType.MODIFY
diff: @@ -512,6 +512,16 @@ static int jpc_siz_getparms(jpc_ms_t *ms, jpc_cstate_t *cstate,
 			jas_free(siz->comps);
 			return -1;
 		}
+		if (siz->comps[i].hsamp == 0 || siz->comps[i].hsamp > 255) {
+			jas_eprintf("invalid XRsiz value %d\n", siz->comps[i].hsamp);
+			jas_free(siz->comps);
+			return -1;
+		}
+		if (siz->comps[i].vsamp == 0 || siz->comps[i].vsamp > 255) {
+			jas_eprintf("invalid YRsiz value %d\n", siz->comps[i].vsamp);
+			jas_free(siz->comps);
+			return -1;
+		}
 		siz->comps[i].sgnd = (tmp >> 7) & 1;
 		siz->comps[i].prec = (tmp & 0x7f) + 1;
 	}

programming_language: C
CVE-2014-8884 (published 2014-11-30T01:59Z)

Stack-based buffer overflow in the ttusbdecfe_dvbs_diseqc_send_master_cmd function in drivers/media/usb/ttusb-dec/ttusbdecfe.c in the Linux kernel before 3.17.4 allows local users to cause a denial of service (system crash) or possibly gain privileges via a large message length in an ioctl call.

Severity: MEDIUM
CVSS v2 base score: 6.1 (AV:L/AC:L/Au:N/C:P/I:P/A:C)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Dan Carpenter
author_date: 2014-09-05 09:09:28-03:00
msg: [media] ttusb-dec: buffer overflow in ioctl

We need to add a limit check here so we don't overflow the buffer.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: ttusbdecfe.c
change_type: ModificationType.MODIFY
diff: @@ -156,6 +156,9 @@ static int ttusbdecfe_dvbs_diseqc_send_master_cmd(struct dvb_frontend* fe, struc
 		   0x00, 0x00, 0x00, 0x00,
 		   0x00, 0x00 };
 
+	if (cmd->msg_len > sizeof(b) - 4)
+		return -EINVAL;
+
 	memcpy(&b[4], cmd->msg, cmd->msg_len);
 
 	state->config->send_command(fe, 0x72,

programming_language: C
CVE-2016-2533 (published 2016-04-13T16:59Z)

Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PhotoCD file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/python-pillow/Pillow
commit_details: repo_url: https://github.com/python-pillow/Pillow
author: wiredfool
author_date: 2016-02-02 05:46:26-08:00
msg: PCD decoder overruns the shuffle buffer, Fixes #568
repository: repo_url: https://github.com/python-pillow/Pillow
repo_name: python-pillow/Pillow
description: Python Imaging Library (Fork)
repo_language: Python
owner: python-pillow
file_changes: filename: test_file_pcd.py
change_type: ModificationType.ADD
diff: @@ -0,0 +1,18 @@
+from helper import unittest, PillowTestCase, hopper
+from PIL import Image
+
+class TestFilePcd(PillowTestCase):
+
+    def test_load_raw(self):
+        im = Image.open('Tests/images/hopper.pcd')
+        im.load() # should not segfault.
+
+        # Note that this image was created with a resized hopper
+        # image, which was then converted to pcd with imagemagick
+        # and the colors are wonky in Pillow.  It's unclear if this
+        # is a pillow or a convert issue, as other images not generated
+        # from convert look find on pillow and not imagemagick.
+        
+        #target = hopper().resize((768,512))
+        #self.assert_image_similar(im, target, 10)
+

programming_language: Python
filename: PcdDecode.c
change_type: ModificationType.MODIFY
diff: @@ -47,7 +47,7 @@ ImagingPcdDecode(Imaging im, ImagingCodecState state, UINT8* buf, int bytes)
 	    out[0] = ptr[x];
 	    out[1] = ptr[(x+4*state->xsize)/2];
 	    out[2] = ptr[(x+5*state->xsize)/2];
-	    out += 4;
+	    out += 3;
 	}
 
 	state->shuffle((UINT8*) im->image[state->y],
@@ -62,7 +62,7 @@ ImagingPcdDecode(Imaging im, ImagingCodecState state, UINT8* buf, int bytes)
 	    out[0] = ptr[x+state->xsize];
 	    out[1] = ptr[(x+4*state->xsize)/2];
 	    out[2] = ptr[(x+5*state->xsize)/2];
-	    out += 4;
+	    out += 3;
 	}
 
 	state->shuffle((UINT8*) im->image[state->y],

programming_language: C
CVE-2023-37270 (published 2023-07-07T22:15Z)

Piwigo is open source photo gallery software. Prior to version 13.8.0, there is a SQL Injection vulnerability in the login of the administrator screen. The SQL statement that acquires the HTTP Header `User-Agent` is vulnerable at the endpoint that records user information when logging in to the administrator screen. It is possible to execute arbitrary SQL statements. Someone who wants to exploit the vulnerability must be log in to the administrator screen, even with low privileges. Any SQL statement can be executed. Doing so may leak information from the database. Version 13.8.0 contains a fix for this issue. As another mitigation, those who want to execute a SQL statement verbatim with user-enterable parameters should be sure to escape the parameter contents appropriately.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/Piwigo/Piwigo
commit_details: repo_url: https://github.com/Piwigo/Piwigo
author: Pierrick Le Gall
author_date: 2023-07-07 16:23:49+02:00
msg: Merge pull request from GHSA-934w-qj9p-3qcx
repository: repo_url: https://github.com/Piwigo/Piwigo
repo_name: Piwigo/Piwigo
description: Manage your photos with Piwigo, a full featured open source photo gallery application for the web. Star us on Github! More than 200 plugins and themes available. Join us and contribute!
repo_language: PHP
owner: Piwigo
file_changes: filename: functions.inc.php
change_type: ModificationType.MODIFY
diff: @@ -618,7 +618,7 @@ function pwg_activity($object, $object_id, $action, $details=array())
       'session_idx' => $session_id,
       'ip_address' => $ip_address,
       'details' => $details_insert,
-      'user_agent' => $user_agent,
+      'user_agent' => pwg_db_real_escape_string($user_agent),
     );
   }
 

programming_language: PHP
CVE-2024-29862 (published 2024-03-21T04:15Z)

The Kerlink firewall in ChirpStack chirpstack-mqtt-forwarder before 4.2.1 and chirpstack-gateway-bridge before 4.0.11 wrongly accepts certain TCP packets when a connection is not in the ESTABLISHED state.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/chirpstack/chirpstack-mqtt-forwarder
commit_details: repo_url: https://github.com/chirpstack/chirpstack-mqtt-forwarder
author: Orne Brocaar
author_date: 2024-03-11 09:56:42+00:00
msg: Fix Kerlink firewall rule security issue.

This limits accepting incoming TCP packets from the --sport for
ESTABLISHED connections only.
repository: repo_url: https://github.com/chirpstack/chirpstack-mqtt-forwarder
repo_name: chirpstack/chirpstack-mqtt-forwarder
description: ChirpStack MQTT Forwarder is a forwarder which can be installed on the gateway to forward LoRa data over MQTT.
repo_language: Rust
owner: chirpstack
file_changes: filename: chirpstack-mqtt-forwarder.init
change_type: ModificationType.MODIFY
diff: @@ -10,7 +10,7 @@ function iptables_accept {
     [ -n "${1}" ] || exit 1
     local RULE="OUTPUT -t filter -p tcp --dport ${1} -j ACCEPT"
     iptables -C ${RULE} 2> /dev/null || iptables -I ${RULE}
-    local RULE="INPUT -t filter -p tcp --sport ${1} -j ACCEPT"
+    local RULE="INPUT -t filter -p tcp --sport ${1} -m conntrack --ctstate ESTABLISHED -j ACCEPT"
     iptables -C ${RULE} 2> /dev/null || iptables -I ${RULE}
 }
 

programming_language: Shell
repo_url: https://github.com/chirpstack/chirpstack-gateway-bridge
commit_details: repo_url: https://github.com/chirpstack/chirpstack-gateway-bridge
author: Orne Brocaar
author_date: 2024-03-11 11:52:12+00:00
msg: Fix Kerlink firewall rule security issue.

This limits accepting incoming TCP packets from the --sport for
ESTABLISHED connections only.
repository: repo_url: https://github.com/chirpstack/chirpstack-gateway-bridge
repo_name: chirpstack/chirpstack-gateway-bridge
description: ChirpStack Gateway Bridge abstracts Packet Forwarder protocols into Protobuf or JSON over MQTT.
repo_language: Go
owner: chirpstack
file_changes: filename: chirpstack-gateway-bridge.init
change_type: ModificationType.MODIFY
diff: @@ -10,7 +10,7 @@ function iptables_accept {
     [ -n "${1}" ] || exit 1
     local RULE="OUTPUT -t filter -p tcp --dport ${1} -j ACCEPT"
     iptables -C ${RULE} 2> /dev/null || iptables -I ${RULE}
-    local RULE="INPUT -t filter -p tcp --sport ${1} -j ACCEPT"
+    local RULE="INPUT -t filter -p tcp --sport ${1} -m conntrack --ctstate ESTABLISHED -j ACCEPT"
     iptables -C ${RULE} 2> /dev/null || iptables -I ${RULE}
 }
 

programming_language: Shell
CVE-2023-39150 (published 2023-09-12T13:15Z)

ConEmu before commit 230724 does not sanitize title responses correctly for control characters, potentially leading to arbitrary code execution. This is related to an incomplete fix for CVE-2022-46387.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/Maximus5/ConEmu
commit_details: repo_url: https://github.com/Maximus5/ConEmu
author: Maximus5
author_date: 2023-07-24 01:00:49+02:00
msg: gh-2536: Do not emit control characters in title reports (capability fix).
repository: repo_url: https://github.com/Maximus5/ConEmu
repo_name: Maximus5/ConEmu
description: Customizable Windows terminal with tabs, splits, quake-style, hotkeys and more
repo_language: C++
owner: Maximus5
file_changes: filename: ConAnsiImpl.cpp
change_type: ModificationType.MODIFY
diff: @@ -985,7 +985,7 @@ bool SrvAnsiImpl::ReportString(LPCWSTR asRet)
 	LPCWSTR pc = asRet;
 	for (int i = 0; i < nLen; i++, p++, pc++)
 	{
-		const char ch = *pc >= 0x20 ? *pc : L' ';
+		const char ch = (*pc == 0x1B || *pc >= 0x20) ? *pc : L' ';
 		p->EventType = KEY_EVENT;
 		p->Event.KeyEvent.bKeyDown = TRUE;
 		p->Event.KeyEvent.wRepeatCount = 1;
@@ -2474,4 +2474,3 @@ void SrvAnsiImpl::XTermAltBuffer(bool bSetAltBuffer/*, condata::TablePtr& table*
 
 	}
 }
-

programming_language: C++
filename: Ansi.cpp
change_type: ModificationType.MODIFY
diff: @@ -2505,7 +2505,7 @@ BOOL CEAnsi::ReportString(LPCWSTR asRet)
 	LPCWSTR pc = asRet;
 	for (size_t i = 0; i < nLen; i++, p++, pc++)
 	{
-		const char ch = *pc >= 0x20 ? *pc : L' ';
+		const char ch = (*pc == 0x1B || *pc >= 0x20) ? *pc : L' ';
 		p->EventType = KEY_EVENT;
 		p->Event.KeyEvent.bKeyDown = TRUE;
 		p->Event.KeyEvent.wRepeatCount = 1;

programming_language: C++