starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2017-15367 (published 2018-03-07T20:29Z)

Bacula-web before 8.0.0-rc2 is affected by multiple SQL Injection vulnerabilities that could allow an attacker to access the Bacula database and, depending on configuration, escalate privileges on the server.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/bacula-web/bacula-web
commit_details: repo_url: https://github.com/bacula-web/bacula-web
author: Davide Franco
author_date: 2017-09-25 08:58:16+02:00
msg: Ensure provided period is a valid integer and a known value

  - if provided period is not an integer or a known value, we
    raise an exception
repository: repo_url: https://github.com/bacula-web/bacula-web
repo_name: bacula-web/bacula-web
description: Open source web based reporting and monitoring tool for Bacula
repo_language: PHP
owner: bacula-web
file_changes: filename: client-report.php
change_type: ModificationType.MODIFY
diff: @@ -64,6 +64,15 @@
 
        $period = CHttpRequest::get_Value('period');
 
+       // Check if period is an integer and listed in known periods
+       if(!array_key_exists( $period, $periods_list)) {
+          throw new Exception('Critical: provided value for (period) is unknown or not valid');
+       }
+
+       if(!filter_var($period, FILTER_VALIDATE_INT)) {
+          throw new Exception('Critical: provided value for (period) is unknown or not valid');
+       }
+
        $view->assign( 'no_report_options', 'false');
        
        // Client informations

programming_language: PHP
CVE-2021-36219 (published 2021-09-27T14:15Z)

An issue was discovered in SKALE sgxwallet 1.58.3. The provided input for ECALL 14 triggers a branch in trustedEcdsaSign that frees a non-initialized pointer from the stack. An attacker can chain multiple enclave calls to prepare a stack that contains a valid address. This address is then freed, resulting in compromised integrity of the enclave. This was resolved after v1.58.3 and not reproducible in sgxwallet v1.77.0.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-824
cwe_name: Access of Uninitialized Pointer
description: The product accesses or uses a pointer that has not been initialized.
extended_description: 
            If the pointer contains an uninitialized value, then the value might not point to a valid memory location. This could cause the product to read from or write to unexpected memory locations, leading to a denial of service. If the uninitialized pointer is used as a function call, then arbitrary functions could be invoked. If an attacker can influence the portion of uninitialized memory that is contained in the pointer, this weakness could be leveraged to execute code or perform other attacks.
            Depending on memory layout, associated memory management behaviors, and product operation, the attacker might be able to influence the contents of the uninitialized pointer, thus gaining more fine-grained control of the memory location to be accessed.
         
         

Fix information:
repo_url: https://github.com/skalenetwork/sgxwallet
commit_details: repo_url: https://github.com/skalenetwork/sgxwallet
author: kladko
author_date: 2020-05-19 21:36:19+03:00
msg: Merge branch 'develop' into SKALE-1180-VERIFY-ECDSA

# Conflicts:
#	SGXWALLET_VERSION
repository: repo_url: https://github.com/skalenetwork/sgxwallet
repo_name: skalenetwork/sgxwallet
description: sgxwallet is the first-ever opensource high-performance hardware secure crypto wallet that is based on Intel SGX technology.  First opensource product on Intel SGX whitelist. Scales to 100,000+ transactions per second. Currently supports ETH and SKALE, and will support BTC in the future.  Sgxwallet is under heavy development and use by SKALE network.
repo_language: Shell
owner: skalenetwork
CVE-2022-31072 (published 2022-06-15T23:15Z)

Octokit is a Ruby toolkit for the GitHub API. Versions 4.23.0 and 4.24.0 of the octokit gem were published containing world-writeable files. Specifically, the gem was packed with files having their permissions set to `-rw-rw-rw-` (i.e. 0666) instead of `rw-r--r--` (i.e. 0644). This means everyone who is not the owner (Group and Public) with access to the instance where this release had been installed could modify the world-writable files from this gem. This issue is patched in Octokit 4.25.0. Two workarounds are available. Users can use the previous version of the gem, v4.22.0. Alternatively, users can modify the file permissions manually until they are able to upgrade to the latest version.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 3.3, LOW (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-276
cwe_name: Incorrect Default Permissions
description: During installation, installed file permissions are set to allow anyone to modify those files.
extended_description: 
      
      
     
     

Fix information:
repo_url: https://github.com/octokit/octokit.rb
commit_details: repo_url: https://github.com/octokit/octokit.rb
author: Nick Floyd
author_date: 2022-06-15 15:40:51-05:00
msg: Merge pull request #1446 from octokit/updates-release-steps-ic

Adds details on how to run a manual file integrity check
repository: repo_url: https://github.com/octokit/octokit.rb
repo_name: octokit/octokit.rb
description: Ruby toolkit for the GitHub API
repo_language: Ruby
owner: octokit
CVE-2016-2041 (published 2016-02-20T01:59Z)

libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not use a constant-time algorithm for comparing CSRF tokens, which makes it easier for remote attackers to bypass intended access restrictions by measuring time differences.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-254
cwe_name: 7PK - Security Features
description: Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.

Fix information:
repo_url: https://github.com/phpmyadmin/phpmyadmin
commit_details: repo_url: https://github.com/phpmyadmin/phpmyadmin
author: Michal Čihař
author_date: 2016-01-18 09:49:15+01:00
msg: Use hash_equals for comparing token

Signed-off-by: Michal Čihař <michal@cihar.com>
repository: repo_url: https://github.com/phpmyadmin/phpmyadmin
repo_name: phpmyadmin/phpmyadmin
description: A web interface for MySQL and MariaDB
repo_language: PHP
owner: phpmyadmin
file_changes: filename: common.inc.php
change_type: ModificationType.MODIFY
diff: @@ -474,7 +474,7 @@
 $token_provided = false;
 if (PMA_isValid($_REQUEST['token'])) {
     $token_provided = true;
-    $token_mismatch = ($_SESSION[' PMA_token '] != $_REQUEST['token']);
+    $token_mismatch = ! hash_equals($_SESSION[' PMA_token '], $_REQUEST['token']);
 }
 
 if ($token_mismatch) {

programming_language: PHP
filename: core.lib.php
change_type: ModificationType.MODIFY
diff: @@ -998,3 +998,12 @@ function PMA_setGlobalDbOrTable($param)
         $GLOBALS['url_params'][$param] = $GLOBALS[$param];
     }
 }
+
+/* Compatibility with PHP < 5.6 */
+if(! function_exists('hash_equals')) {
+    function hash_equals($a, $b) {
+        $ret = strlen($a) ^ strlen($b);
+        $ret |= array_sum(unpack("C*", $a ^ $b));
+        return ! $ret;
+    }
+}

programming_language: PHP
CVE-2023-1655 (published 2023-03-27T15:15Z)

Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.4.0.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-122
cwe_name: Heap-based Buffer Overflow
description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2023-03-27 10:33:12+02:00
msg: fixed #2425
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: reframe_rawpcm.c
change_type: ModificationType.MODIFY
diff: @@ -250,6 +250,7 @@ GF_Err pcmreframe_process(GF_Filter *filter)
 
 	if (ctx->probe_wave==1) {
 		Bool wav_ok = GF_TRUE;
+		Bool hdr_found = GF_FALSE;
 		GF_BitStream *bs;
 		if (ctx->probe_data) {
 			ctx->probe_data = gf_realloc(ctx->probe_data, ctx->probe_data_size+pck_size);
@@ -280,6 +281,7 @@ GF_Err pcmreframe_process(GF_Filter *filter)
 				continue;
 			}
 			//parse fmt
+			hdr_found = GF_TRUE;
 			u16 atype = gf_bs_read_u16_le(bs);
 			ctx->ch = gf_bs_read_u16_le(bs);
 			ctx->sr = gf_bs_read_u32_le(bs);
@@ -312,11 +314,13 @@ GF_Err pcmreframe_process(GF_Filter *filter)
 				memcpy(ctx->probe_data, data, pck_size);
 				ctx->probe_data_size = pck_size;
 			}
-			if (ctx->probe_data_size<=10000) {
-				gf_filter_pid_drop_packet(ctx->ipid);
-				return GF_OK;
+			if (!hdr_found) {
+				if (ctx->probe_data_size<=10000) {
+					gf_filter_pid_drop_packet(ctx->ipid);
+					return GF_OK;
+				}
+				GF_LOG(GF_LOG_WARNING, GF_LOG_MEDIA, ("[PCMReframe] Cannot find wave data chunk after %d bytes, aborting\n", ctx->probe_data_size));
 			}
-			GF_LOG(GF_LOG_WARNING, GF_LOG_MEDIA, ("[PCMReframe] Cannot find wave data chink afetr %d bytes, aborting\n", ctx->probe_data_size));
 			wav_ok = GF_FALSE;
 		}
 

programming_language: C
filename: bitstream.c
change_type: ModificationType.MODIFY
diff: @@ -1266,6 +1266,10 @@ void gf_bs_skip_bytes(GF_BitStream *bs, u64 nbBytes)
 			}
 		} else {
 			bs->position += nbBytes;
+			if (bs->position>bs->size) {
+				bs->position = bs->size;
+				bs->overflow_state = 1;
+			}
 		}
 		return;
 	}

programming_language: C
CVE-2018-19841 (published 2018-12-04T09:29Z)

The function WavpackVerifySingleBlock in open_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service (out-of-bounds read and application crash) via a crafted WavPack Lossless Audio file, as demonstrated by wvunpack.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/dbry/WavPack
commit_details: repo_url: https://github.com/dbry/WavPack
author: David Bryant
author_date: 2018-11-29 21:53:51-08:00
msg: issue #54: fix potential out-of-bounds heap read
repository: repo_url: https://github.com/dbry/WavPack
repo_name: dbry/WavPack
description: WavPack encode/decode library, command-line programs, and several plugins
repo_language: C
owner: dbry
file_changes: filename: open_utils.c
change_type: ModificationType.MODIFY
diff: @@ -1258,13 +1258,13 @@ int WavpackVerifySingleBlock (unsigned char *buffer, int verify_checksum)
 #endif
 
             if (meta_bc == 4) {
-                if (*dp++ != (csum & 0xff) || *dp++ != ((csum >> 8) & 0xff) || *dp++ != ((csum >> 16) & 0xff) || *dp++ != ((csum >> 24) & 0xff))
+                if (*dp != (csum & 0xff) || dp[1] != ((csum >> 8) & 0xff) || dp[2] != ((csum >> 16) & 0xff) || dp[3] != ((csum >> 24) & 0xff))
                     return FALSE;
             }
             else {
                 csum ^= csum >> 16;
 
-                if (*dp++ != (csum & 0xff) || *dp++ != ((csum >> 8) & 0xff))
+                if (*dp != (csum & 0xff) || dp[1] != ((csum >> 8) & 0xff))
                     return FALSE;
             }
 

programming_language: C
CVE-2021-4286 (published 2022-12-27T11:15Z)

A vulnerability, which was classified as problematic, has been found in cocagne pysrp up to 1.0.16. This issue affects the function calculate_x of the file srp/_ctsrp.py. The manipulation leads to information exposure through discrepancy. Upgrading to version 1.0.17 is able to address this issue. The name of the patch is dba52642f5e95d3da7af1780561213ee6053195f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216875.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-203
cwe_name: Observable Discrepancy
description: The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
extended_description: Discrepancies can take many forms, and variations may be detectable in timing, control flow, communications such as replies or requests, or general behavior. These discrepancies can reveal information about the product's operation or internal state to an unauthorized actor. In some cases, discrepancies can be used by attackers to form a side channel.
         

Fix information:
repo_url: https://github.com/cocagne/pysrp
commit_details: repo_url: https://github.com/cocagne/pysrp
author: Tom Cocagne
author_date: 2021-02-01 10:15:45-06:00
msg: Merge pull request #43 from ddealmei/fix-srp-vuln

Fix side channel leaks
repository: repo_url: https://github.com/cocagne/pysrp
repo_name: cocagne/pysrp
description: Python implementation of the Secure Remote Password protocol (SRP)
repo_language: Python
owner: cocagne
CVE-2022-36013 (published 2022-09-16T23:15Z)

TensorFlow is an open source platform for machine learning. When `mlir::tfg::GraphDefImporter::ConvertNodeDef` tries to convert NodeDefs without an op name, it crashes. We have patched the issue in GitHub commit a0f0b9a21c9270930457095092f558fbad4c03e5. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: A. Unique TensorFlower
author_date: 2022-06-08 10:27:21-07:00
msg: [TF] NodeDefs without an op name are invalid, return error on import

PiperOrigin-RevId: 453711926
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: graphdef_import.cc
change_type: ModificationType.MODIFY
diff: @@ -746,6 +746,9 @@ StatusOr<unsigned> GraphDefImporter::ArgNumType(const NamedAttrList &attrs,
 Status GraphDefImporter::ConvertNodeDef(OpBuilder &builder, ConversionState &s,
                                         const NodeDef &node) {
   VLOG(4) << "Importing: " << node.name();
+  if (node.op().empty())
+    return InvalidArgument("Node ", node.name(), " has an empty op name");
+
   OperationState state(ConvertLocation(node), absl::StrCat("tfg.", node.op()));
 
   // The GraphImporter does light shape inference, but here we will defer all of

programming_language: C++
filename: invalid_op_name.pbtxt
change_type: ModificationType.ADD
diff: @@ -0,0 +1,20 @@
+# RUN: not tfg-translate -graphdef-to-mlir %s 2>&1 | FileCheck %s
+
+# CHECK: Node  has an empty op name
+
+library {
+  function {
+    signature {
+      name: "\\344\\264\\264"
+      description: "value"
+      is_distributed_communication: true
+    }
+    node_def {
+      input: "|"
+    }
+    control_ret {
+      key: ""
+      value: ""
+    }
+  }
+}
\ No newline at end of file

programming_language: JavaScript
CVE-2019-19049 (published 2019-11-18T06:15Z)

A memory leak in the unittest_data_add() function in drivers/of/unittest.c in the Linux kernel before 5.3.10 allows attackers to cause a denial of service (memory consumption) by triggering of_fdt_unflatten_tree() failures, aka CID-e13de8fe0d6a. NOTE: third parties dispute the relevance of this because unittest.c can only be reached during boot

Severity: HIGH
CVSS v2 base score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-401
cwe_name: Missing Release of Memory after Effective Lifetime
description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
extended_description: This is often triggered by improper handling of malformed data or unexpectedly interrupted sessions.  In some languages, developers are responsible for tracking memory allocation and releasing the memory.  If there are no more pointers or references to the memory, then it can no longer be tracked and identified for release.
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Navid Emamdoost
author_date: 2019-10-04 13:58:43-05:00
msg: of: unittest: fix memory leak in unittest_data_add

In unittest_data_add, a copy buffer is created via kmemdup. This buffer
is leaked if of_fdt_unflatten_tree fails. The release for the
unittest_data buffer is added.

Fixes: b951f9dc7f25 ("Enabling OF selftest to run without machine's devicetree")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Reviewed-by: Frank Rowand <frowand.list@gmail.com>
Signed-off-by: Rob Herring <robh@kernel.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: unittest.c
change_type: ModificationType.MODIFY
diff: @@ -1207,6 +1207,7 @@ static int __init unittest_data_add(void)
 	of_fdt_unflatten_tree(unittest_data, NULL, &unittest_data_node);
 	if (!unittest_data_node) {
 		pr_warn("%s: No tree to attach; not running tests\n", __func__);
+		kfree(unittest_data);
 		return -ENODATA;
 	}
 

programming_language: C
CVE-2016-3132 (published 2016-08-07T10:59Z)

Double free vulnerability in the SplDoublyLinkedList::offsetSet function in ext/spl/spl_dllist.c in PHP 7.x before 7.0.6 allows remote attackers to execute arbitrary code via a crafted index.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-415
cwe_name: Double Free
description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
extended_description: When a program calls free() twice with the same argument, the program's memory management data structures become corrupted. This corruption can cause the program to crash or, in some circumstances, cause two later calls to malloc() to return the same pointer. If malloc() returns the same value twice and the program later gives the attacker control over the data that is written into this doubly-allocated memory, the program becomes vulnerable to a buffer overflow attack.
         

Fix information:
repo_url: https://github.com/php/php-src
commit_details: repo_url: https://github.com/php/php-src
author: Stanislav Malyshev
author_date: 2016-03-20 22:29:08-07:00
msg: Fix bug #71735: Double-free in SplDoublyLinkedList::offsetSet
repository: repo_url: https://github.com/php/php-src
repo_name: php/php-src
description: The PHP Interpreter
repo_language: C
owner: php
file_changes: filename: NEWS
change_type: ModificationType.MODIFY
diff: @@ -30,6 +30,7 @@ PHP                                                                        NEWS
   . Fixed bug #52339 (SPL autoloader breaks class_exists()). (Nikita)
   . Fixed bug #67582 (Cloned SplObjectStorage with overwritten getHash fails
     offsetExists()). (Nikita)
+  . Fixed bug #71735 (Double-free in SplDoublyLinkedList::offsetSet). (Stas)
 
 - Standard:
   . Fixed bug #71837 (Wrong arrays behaviour). (Laruence)

programming_language: Markdown
filename: spl_dllist.c
change_type: ModificationType.MODIFY
diff: @@ -830,7 +830,6 @@ SPL_METHOD(SplDoublyLinkedList, offsetSet)
 		index = spl_offset_convert_to_long(zindex);
 
 		if (index < 0 || index >= intern->llist->count) {
-			zval_ptr_dtor(value);
 			zend_throw_exception(spl_ce_OutOfRangeException, "Offset invalid or out of range", 0);
 			return;
 		}

programming_language: C
filename: bug71735.phpt
change_type: ModificationType.ADD
diff: @@ -0,0 +1,15 @@
+--TEST--
+Bug #71735 (Double-free in SplDoublyLinkedList::offsetSet)
+--FILE--
+<?php
+try {
+$var_1=new SplStack();
+$var_1->offsetSet(100,new DateTime('2000-01-01'));
+} catch(OutOfRangeException $e) {
+	print $e->getMessage()."\n";
+}
+?>
+===DONE===
+--EXPECT--
+Offset invalid or out of range
+===DONE===
\ No newline at end of file

programming_language: PHP