starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2024-29186 (published 2024-03-22T17:15Z)

Bref is an open-source project that helps users go serverless on Amazon Web Services with PHP. When Bref prior to version 2.1.17 is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInterface`, then the Lambda event is converted to a PSR7 object. During the conversion process, if the request is a MultiPart, each part is parsed. In the parsing process, the `Content-Type` header of each part is read using the `Riverline/multipart-parser` library.\n\nThe library, in the `StreamedPart::parseHeaderContent` function, performs slow multi-byte string operations on the header value.\nPrecisely, the `mb_convert_encoding` function is used with the first (`$string`) and third (`$from_encoding`) parameters read from the header value.\n\nAn attacker could send specifically crafted requests which would force the server into performing long operations with a consequent long billed duration.\n\nThe attack has the following requirements and limitations: The Lambda should use the Event-Driven Function runtime and the `RequestHandlerInterface` handler and should implement at least an endpoint accepting POST requests; the attacker can send requests up to 6MB long (this is enough to cause a billed duration between 400ms and 500ms with the default 1024MB RAM Lambda image of Bref); and if the Lambda uses a PHP runtime <= php-82, the impact is higher as the billed duration in the default 1024MB RAM Lambda image of Bref could be brought to more than 900ms for each request. Notice that the vulnerability applies only to headers read from the request body as the request header has a limitation which allows a total maximum size of ~10KB.\n\nVersion 2.1.17 contains a fix for this issue.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/brefphp/bref
commit_details: repo_url: https://github.com/brefphp/bref
author: Matthieu Napoli
author_date: 2024-03-22 13:39:02+01:00
msg: Require `riverline/multipart-parser` 2.1.2 to fix security issue
repository: repo_url: https://github.com/brefphp/bref
repo_name: brefphp/bref
description: Serverless PHP on AWS Lambda
repo_language: PHP
owner: brefphp
file_changes: filename: composer.json
change_type: ModificationType.MODIFY
diff: @@ -29,7 +29,7 @@
         "psr/container": "^1.0|^2.0",
         "psr/http-message": "^1.0|^2.0",
         "psr/http-server-handler": "^1.0",
-        "riverline/multipart-parser": "^2.0.6",
+        "riverline/multipart-parser": "^2.1.2",
         "symfony/process": "^4.4|^5.0|^6.0|^7.0"
     },
     "require-dev": {

programming_language: Jupyter Notebook
CVE-2024-0321 (published 2024-01-08T13:15Z)

Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.3-DEV.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: Aurelien David
author_date: 2023-10-17 16:32:29+02:00
msg: gf_text_get_utf8_line: add dest buffer len check (fixes #2647)
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: load_text.c
change_type: ModificationType.MODIFY
diff: @@ -377,6 +377,10 @@ char *gf_text_get_utf8_line(char *szLine, u32 lineSize, FILE *txt_in, s32 unicod
 			GF_LOG(GF_LOG_DEBUG, GF_LOG_PARSER, ("[TXTIn] Line too long to convert to utf8 (len: %d)\n", len));
 			j = GF_ARRAY_LENGTH(szLineConv) -1 ;
 		}
+		if ( j >= lineSize ) {
+			GF_LOG(GF_LOG_DEBUG, GF_LOG_PARSER, ("[TXTIn] UT8 converted line too long for buffer (len: %d, buffer: %d)\n", j, lineSize));
+			j = lineSize-1 ;
+		}
 		szLineConv[j] = 0;
 		strcpy(szLine, szLineConv);
 		return sOK;

programming_language: C
CVE-2007-6762 (published 2019-07-27T22:15Z)

In the Linux kernel before 2.6.20, there is an off-by-one bug in net/netlabel/netlabel_cipso_v4.c where it is possible to overflow the doi_def->tags[] array.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Paul Moore
author_date: 2007-01-05 15:08:22-05:00
msg: NetLabel: correct CIPSO tag handling when adding new DOI definitions

The current netlbl_cipsov4_add_common() function has two problems which are
fixed with this patch.  The first is an off-by-one bug where it is possibile to
overflow the doi_def->tags[] array.  The second is a bug where the same
doi_def->tags[] array was not always fully initialized, which caused sporadic
failures.

Signed-off-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: James Morris <jmorris@namei.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: netlabel_cipso_v4.c
change_type: ModificationType.MODIFY
diff: @@ -130,12 +130,12 @@ static int netlbl_cipsov4_add_common(struct genl_info *info,
 
 	nla_for_each_nested(nla, info->attrs[NLBL_CIPSOV4_A_TAGLST], nla_rem)
 		if (nla->nla_type == NLBL_CIPSOV4_A_TAG) {
-			if (iter > CIPSO_V4_TAG_MAXCNT)
+			if (iter >= CIPSO_V4_TAG_MAXCNT)
 				return -EINVAL;
 			doi_def->tags[iter++] = nla_get_u8(nla);
 		}
-	if (iter < CIPSO_V4_TAG_MAXCNT)
-		doi_def->tags[iter] = CIPSO_V4_TAG_INVALID;
+	while (iter < CIPSO_V4_TAG_MAXCNT)
+		doi_def->tags[iter++] = CIPSO_V4_TAG_INVALID;
 
 	return 0;
 }

programming_language: C
CVE-2015-8947 (published 2016-07-19T10:59Z)

hb-ot-layout-gpos-table.hh in HarfBuzz before 1.0.5 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted data, a different vulnerability than CVE-2016-2052.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.6, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/behdad/harfbuzz
commit_details: repo_url: https://github.com/behdad/harfbuzz
author: Behdad Esfahbod
author_date: 2015-10-13 00:30:50-04:00
msg: Fix another memory access issue discovered by libFuzzer

Fixes https://github.com/behdad/harfbuzz/issues/139#issuecomment-146984679
repository: repo_url: https://github.com/behdad/harfbuzz
repo_name: harfbuzz/harfbuzz
description: HarfBuzz text shaping engine
repo_language: C++
owner: behdad
file_changes: filename: hb-ot-layout-gpos-table.hh
change_type: ModificationType.MODIFY
diff: @@ -704,6 +704,8 @@ struct PairPosFormat1
   {
     TRACE_SANITIZE (this);
 
+    if (!c->check_struct (this)) return_trace (false);
+
     unsigned int len1 = valueFormat1.get_len ();
     unsigned int len2 = valueFormat2.get_len ();
     PairSet::sanitize_closure_t closure = {
@@ -713,7 +715,7 @@ struct PairPosFormat1
       1 + len1 + len2
     };
 
-    return_trace (c->check_struct (this) && coverage.sanitize (c, this) && pairSet.sanitize (c, this, &closure));
+    return_trace (coverage.sanitize (c, this) && pairSet.sanitize (c, this, &closure));
   }
 
   protected:

programming_language: C++
CVE-2021-38173 (published 2021-08-07T19:15Z)

Btrbk before 0.31.2 allows command execution because of the mishandling of remote hosts filtering SSH commands using ssh_filter_btrbk.sh in authorized_keys.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-77
cwe_name: Improper Neutralization of Special Elements used in a Command ('Command Injection')
description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
extended_description: 
            Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
         
         

Fix information:
repo_url: https://github.com/digint/btrbk
commit_details: repo_url: https://github.com/digint/btrbk
author: Axel Burri
author_date: 2021-03-21 12:53:22+01:00
msg: ssh_filter_btrbk.sh: fix alternation regex

Security vulnerability fixed in alternation regex. Specialy crafted
commands may be executed without being propely checked.

Affects all versions >= btrbk-v0.23.0

Regression from:

   ccb5ed5e71 ssh_filter_btrbk: allow "realpath" and "cat /proc/self/mounts" on targets

Reported by: @protree (responsible disclosure)
repository: repo_url: https://github.com/digint/btrbk
repo_name: digint/btrbk
description: Tool for creating snapshots and remote backups of btrfs subvolumes
repo_language: Perl
owner: digint
file_changes: filename: ssh_filter_btrbk.sh
change_type: ModificationType.MODIFY
diff: @@ -86,7 +86,7 @@ reject_filtered_cmd()
         return 0
     fi
 
-    exact_cmd_match="^${allow_exact_list}$";
+    exact_cmd_match="^(${allow_exact_list})$";
     if [[ $SSH_ORIGINAL_COMMAND =~ $exact_cmd_match ]] ; then
         return 0
     fi

programming_language: Shell
CVE-2020-15181 (published 2020-09-18T18:15Z)

The Alfresco Reset Password add-on before version 1.2.0 relies on untrusted inputs in a security decision. Intruders can get admin's access to the system using the vulnerability in the project. Impacts all servers where this add-on is installed. The problem is fixed in version 1.2.0

Severity: HIGH
CVSS v2 base score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/FlexSolution/AlfrescoResetPassword
commit_details: repo_url: https://github.com/FlexSolution/AlfrescoResetPassword
author: Mykhail DIachenko
author_date: 2020-09-16 14:25:28+03:00
msg: Merge remote-tracking branch 'remotes/origin/candidate' into release

# Conflicts:
#	resetPassword-share/pom.xml
#	resetPassword/pom.xml
repository: repo_url: https://github.com/FlexSolution/AlfrescoResetPassword
repo_name: FlexSolution/AlfrescoResetPassword
description: Reset Password add-on for Alfresco
repo_language: Java
owner: FlexSolution
CVE-2020-35769 (published 2020-12-29T06:15Z)

miniserv.pl in Webmin 1.962 on Windows mishandles special characters in query arguments to the CGI program.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/webmin/webmin
commit_details: repo_url: https://github.com/webmin/webmin
author: Jamie Cameron
author_date: 2020-12-28 14:03:41-08:00
msg: Always use IPv6 if a v6 address was given https://github.com/webmin/webmin/issues/1420
repository: repo_url: https://github.com/webmin/webmin
repo_name: webmin/webmin
description: Powerful and flexible web-based server management control panel
repo_language: HTML
owner: webmin
file_changes: filename: miniserv.pl
change_type: ModificationType.MODIFY
diff: @@ -2603,8 +2603,9 @@ if (&get_type($full) eq "internal/cgi" && $validated != 4) {
 		if ($on_windows) {
 			# Run the CGI program, and feed it input
 			chdir($ENV{"PWD"});
-			local $qqueryargs = join(" ", map { "\"$_\"" }
-						 split(/\s+/, $queryargs));
+			local $qqueryargs = join(" ",
+				map { s/([<>|&"^])/^$1/g; "\"$_\"" }
+				    split(/\s+/, $queryargs));
 			if ($first =~ /(perl|perl.exe)$/i) {
 				# On Windows, run with Perl
 				open(CGIOUTr, "$perl_path \"$full\" $qqueryargs <$infile |");

programming_language: Perl
filename: ping-monitor.pl
change_type: ModificationType.MODIFY
diff: @@ -10,7 +10,8 @@ local $wait = defined($_[0]->{'wait'}) ? $_[0]->{'wait'} : 5;
 local $ip = &to_ipaddress($_[0]->{'host'}) ||
 	    &to_ip6address($_[0]->{'host'});
 return { 'up' => 0 } if (!$ip);
-local $ipv6 = &to_ip6address($_[0]->{'host'}) &&
+local $ipv6 = &check_ip6address($_[0]->{'host'}) ||
+	      &to_ip6address($_[0]->{'host'}) &&
 	      !&to_ipaddress($_[0]->{'host'});
 if ($config{'pinger'} || $ipv6) {
 	# Call a ping command if configured, or if using IPv6 since the built-

programming_language: Perl
CVE-2021-45943 (published 2022-01-01T01:15Z)

GDAL 3.3.0 through 3.4.0 has a heap-based buffer overflow in PCIDSK::CPCIDSKFile::ReadFromFile (called from PCIDSK::CPCIDSKSegment::ReadFromFile and PCIDSK::CPCIDSKBinarySegment::CPCIDSKBinarySegment).

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/OSGeo/gdal
commit_details: repo_url: https://github.com/OSGeo/gdal
author: Even Rouault
author_date: 2021-12-05 00:26:39+01:00
msg: Merge pull request #4944 from rouault/fix_ossfuzz_41993

PCIDSK: fix write heap-buffer-overflow. Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41993
repository: repo_url: https://github.com/OSGeo/gdal
repo_name: OSGeo/gdal
description: GDAL is an open source MIT licensed translator library for raster and vector geospatial data formats.
repo_language: C++
owner: OSGeo
CVE-2016-10700 (published 2017-11-24T05:29Z)

auth_login.php in Cacti before 1.0.0 allows remote authenticated users who use web authentication to bypass intended access restrictions by logging in as a user not in the cacti database, because the guest user is not considered. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-2313.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-264
cwe_name: Permissions, Privileges, and Access Controls
description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Fix information:
repo_url: https://github.com/Cacti/cacti
commit_details: repo_url: https://github.com/Cacti/cacti
author: cigamit
author_date: 2016-08-14 14:21:11-05:00
msg: fixing bug #2697

web basic for guest accounts
repository: repo_url: https://github.com/Cacti/cacti
repo_name: Cacti/cacti
description: Cacti ™
repo_language: PHP
owner: Cacti
file_changes: filename: auth_login.php
change_type: ModificationType.MODIFY
diff: @@ -91,10 +91,10 @@ if (get_nfilter_request_var('action') == 'login') {
 		/* Locate user in database */
 		$user = db_fetch_row_prepared('SELECT * FROM user_auth WHERE username = ? AND realm = 2', array($username));
 
-		if (!$user && read_config_option('user_template') == '0') {
-			cacti_log("ERROR: User '" . $username . "' authenticated by Web Server, but a Template User is not defined in Cacti.  Exiting.", false, 'AUTH');
+		if (!$user && read_config_option('user_template') == '0' && read_config_option('guest_user') == '0') {
+			cacti_log("ERROR: User '" . $username . "' authenticated by Web Server, but both Template and Guest Users are not defined in Cacti.  Exiting.", false, 'AUTH');
 			$username = htmlspecialchars($username);
-			auth_display_custom_error_message( __('%s authenticated by Web Server, but a Template User is not defined in Cacti.', $username) );
+			auth_display_custom_error_message( __('%s authenticated by Web Server, but both Template and Guest Users are not defined in Cacti.', $username) );
 			exit;			
 		}
 

programming_language: PHP
CVE-2023-23618 (published 2023-02-14T21:15Z)

Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, when `gitk` is run on Windows, it potentially runs executables from the current directory inadvertently, which can be exploited with some social engineering to trick users into running untrusted code. A patch is available in version 2.39.2. As a workaround, avoid using `gitk` (or Git GUI\'s "Visualize History" functionality) in clones of untrusted repositories.\n

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-426
cwe_name: Untrusted Search Path
description: The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
extended_description: 
            This might allow attackers to execute their own programs, access unauthorized data files, or modify configuration in unexpected ways. If the product uses a search path to locate critical resources such as programs, then an attacker could modify that search path to point to a malicious program, which the targeted product would then execute. The problem extends to any type of critical resource that the product trusts.
            Some of the most common variants of untrusted search path are:
               
                  In various UNIX and Linux-based systems, the PATH environment variable may be consulted to locate executable programs, and LD_PRELOAD may be used to locate a separate library.
                  In various Microsoft-based systems, the PATH environment variable is consulted to locate a DLL, if the DLL is not found in other paths that appear earlier in the search order.
               
         
         

Fix information:
repo_url: https://github.com/git-for-windows/git
commit_details: repo_url: https://github.com/git-for-windows/git
author: Derrick Stolee
author_date: 2023-02-14 13:19:10-05:00
msg: Merge pull request from GHSA-wxwv-49qw-35pm

Safe path lookup in gitk on windows
repository: repo_url: https://github.com/git-for-windows/git
repo_name: git-for-windows/git
description: A fork of Git containing Windows-specific patches.
repo_language: C
owner: git-for-windows
CVE-2017-18120 (published 2018-02-02T09:29Z)

A double-free bug in the read_gif function in gifread.c in gifsicle 1.90 allows a remote attacker to cause a denial-of-service attack or unspecified other impact via a maliciously crafted file, because last_name is mishandled, a different vulnerability than CVE-2017-1000421.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-415
cwe_name: Double Free
description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
extended_description: When a program calls free() twice with the same argument, the program's memory management data structures become corrupted. This corruption can cause the program to crash or, in some circumstances, cause two later calls to malloc() to return the same pointer. If malloc() returns the same value twice and the program later gives the attacker control over the data that is written into this doubly-allocated memory, the program becomes vulnerable to a buffer overflow attack.
         

Fix information:
repo_url: https://github.com/kohler/gifsicle
commit_details: repo_url: https://github.com/kohler/gifsicle
author: Eddie Kohler
author_date: 2017-12-02 23:08:51-05:00
msg: gif_read: Set last_name = NULL unconditionally.

With a non-malicious GIF, last_name is set to NULL when a name
extension is followed by an image. Reported in #117, via
Debian, via a KAIST fuzzing program.
repository: repo_url: https://github.com/kohler/gifsicle
repo_name: kohler/gifsicle
description: Create, manipulate, and optimize GIF images and animations
repo_language: C
owner: kohler
file_changes: filename: gifread.c
change_type: ModificationType.MODIFY
diff: @@ -900,6 +900,7 @@ read_gif(Gif_Reader *grr, int read_flags,
   Gif_DeleteArray(gfc.suffix);
   Gif_DeleteArray(gfc.length);
   gfc.gfi = 0;
+  last_name = 0;
 
   if (gfs)
     gfs->errors = gfc.errors[1];

programming_language: C