starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2024-38522 (published 2024-06-28T17:15Z)

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The CSP policy applied on the `tips.hushline.app` website and bundled by default in this repository is trivial to bypass. This vulnerability has been patched in version 0.1.0.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/scidsg/hushline
commit_details: repo_url: https://github.com/scidsg/hushline
author: Micah Lee
author_date: 2024-06-20 11:17:20-07:00
msg: Remove unpkg.com from the CSP header
repository: repo_url: https://github.com/scidsg/hushline
repo_name: scidsg/hushline
description: A lightweight, secure, and anonymous whistleblowing platform.
repo_language: Python
owner: scidsg
file_changes: filename: SECURITY.md
change_type: ModificationType.MODIFY
diff: @@ -46,7 +46,7 @@ Hush Line implements a series of HTTP security headers to protect our users and
 The Content-Security-Policy (CSP) header is a powerful tool used by web applications to mitigate the risk of Cross-Site Scripting (XSS) attacks and other types of code injection attacks. By specifying which content sources are trustworthy, CSP prevents the browser from loading malicious assets. Here's a breakdown of the CSP directive used:
 
 - `default-src 'self';` Only allow content from the site's own origin. This is the default policy for loading resources such as JavaScript, images, CSS, fonts, AJAX requests, frames, HTML5 media, and other data.
-- `script-src 'self' https://js.stripe.com https://unpkg.com;` Allow scripts to be loaded from the site's own origin, Stripe (for payment processing), and unpkg (a content delivery network for npm packages).
+- `script-src 'self' https://js.stripe.com;` Allow scripts to be loaded from the site's own origin and Stripe (for payment processing).
 - `img-src 'self' data: https:;` Allow images from the site's origin, inline images using data URIs, and images loaded over HTTPS from any origin.
 - `style-src 'self';` Only allow stylesheets from the site's own origin.
 - `frame-ancestors 'none';` Prevent the site from being framed (embedded within an <iframe>) by other sites, mitigating Clickjacking attacks.

programming_language: Markdown
CVE-2024-24267 (published 2024-02-05T18:15Z)

gpac v2.2.1 was discovered to contain a memory leak via the gfio_blob variable in the gf_fileio_from_blob function.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-401
cwe_name: Missing Release of Memory after Effective Lifetime
description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
extended_description: This is often triggered by improper handling of malformed data or unexpectedly interrupted sessions.  In some languages, developers are responsible for tracking memory allocation and releasing the memory.  If there are no more pointers or references to the memory, then it can no longer be tracked and identified for release.
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: Aurelien David
author_date: 2023-08-29 14:19:22+02:00
msg: fix #2571
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: os_file.c
change_type: ModificationType.MODIFY
diff: @@ -1426,12 +1426,12 @@ static GF_FileIO *gf_fileio_from_blob(const char *file_name)
 	GF_Err e = gf_blob_get(file_name, &blob_data, &blob_size, &flags);
 	if (e || !blob_data) return NULL;
     gf_blob_release(file_name);
-    
+
     if (flags) {
         GF_LOG(GF_LOG_ERROR, GF_LOG_CORE, ("[Core] Attempt at creating a GFIO object on blob corrupted or in transfer, not supported !"));
         return NULL;
     }
-    
+
 	GF_SAFEALLOC(gfio_blob, GF_FileIOBlob);
 	if (!gfio_blob) return NULL;
 	gfio_blob->data = blob_data;
@@ -1452,7 +1452,10 @@ GF_FileIO *gf_fileio_from_mem(const char *URL, const u8 *data, u32 size)
 	gfio_blob->data = (u8 *) data;
 	gfio_blob->size = size;
 	GF_FileIO *res = gf_fileio_new((char *) URL, gfio_blob, gfio_blob_open, gfio_blob_seek, gfio_blob_read, NULL, gfio_blob_tell, gfio_blob_eof, NULL);
-	if (!res) return NULL;
+	if (!res)  {
+		gf_free(gfio_blob);
+		return NULL;
+	}
 	res->gets = gfio_blob_gets;
 	if (URL)
 		gfio_blob->url_crc = gf_crc_32(URL, (u32) strlen(URL) );
@@ -1969,4 +1972,3 @@ char* gf_url_colon_suffix(const char *path, char assign_sep)
 	}
 	return sep;
 }
-

programming_language: C
CVE-2022-4398 (published 2022-12-10T20:15Z)

Integer Overflow or Wraparound in GitHub repository radareorg/radare2 prior to 5.8.0.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/radareorg/radare2
commit_details: repo_url: https://github.com/radareorg/radare2
author: pancake
author_date: 2022-12-01 13:57:46+01:00
msg: Fix integer overflow in fuzzed dwarf rendering in graphs ##crash

* Reported by @solid-snail via huntrdev
* BountyID: c6f8d3ef-5420-4eba-9a5f-aba5e2b5fea2/
* Reproducer: `intof_mod`
repository: repo_url: https://github.com/radareorg/radare2
repo_name: radareorg/radare2
description: UNIX-like reverse engineering framework and command-line toolset
repo_language: C
owner: radareorg
file_changes: filename: Dockerfile
change_type: ModificationType.MODIFY
diff: @@ -70,6 +70,9 @@ RUN DEBIAN_FRONTEND=noninteractive dpkg --add-architecture i386 && \
   bison \
   pkg-config \
   make \
+  python3 \
+  python3-pip \
+  sudo \
   glib-2.0 \
   libc6:i386 \
   libncurses5:i386 \

programming_language: Shell
filename: canal.c
change_type: ModificationType.MODIFY
diff: @@ -1390,6 +1390,10 @@ static char *core_anal_graph_label(RCore *core, RAnalBlock *bb, int opts) {
 				filestr = r_file_slurp_line (file, line, 0);
 				if (filestr) {
 					int flen = strlen (filestr);
+					if (idx < 0 || ST32_ADD_OVFCHK (idx, flen + 8)) {
+						R_LOG_WARN ("integer overflow detected");
+						break;
+					}
 					cmdstr = realloc (cmdstr, idx + flen + 8);
 					memcpy (cmdstr + idx, filestr, flen);
 					idx += flen;

programming_language: C
CVE-2019-13045 (published 2019-06-29T14:15Z)

Irssi before 1.0.8, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, when SASL is enabled, has a use after free when sending SASL login to the server.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.1, HIGH (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/irssi/irssi
commit_details: repo_url: https://github.com/irssi/irssi
author: ailin-nemui
author_date: 2019-06-28 11:28:30+02:00
msg: Merge pull request #1058 from ailin-nemui/sasl-reconnect

copy sasl username and password values
repository: repo_url: https://github.com/irssi/irssi
repo_name: irssi/irssi
description: The client of the future
repo_language: C
owner: irssi
CVE-2020-28446 (published 2022-07-25T14:15Z)

The package ntesseract before 0.2.9 are vulnerable to Command Injection via lib/tesseract.js.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-77
cwe_name: Improper Neutralization of Special Elements used in a Command ('Command Injection')
description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
extended_description: 
            Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
         
         

Fix information:
repo_url: https://github.com/taoyuan/ntesseract
commit_details: repo_url: https://github.com/taoyuan/ntesseract
author: ty
author_date: 2020-12-14 23:29:05+08:00
msg: fix: vulnerable to command injection
repository: repo_url: https://github.com/taoyuan/ntesseract
repo_name: taoyuan/ntesseract
description: A simple wrapper for the Tesseract OCR package
repo_language: JavaScript
owner: taoyuan
file_changes: filename: tesseract.js
change_type: ModificationType.MODIFY
diff: @@ -36,6 +36,10 @@ const Tesseract = {
   outputEncoding: 'UTF-8',
 
   command: function (image, options) {
+    if (image.startsWith('"')) {
+      image = '"' + image + '"';
+    }
+
     // assemble tesseract command
     const command = [options.binary, image, options.output];
 

programming_language: JavaScript
filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -30,6 +30,6 @@
   },
   "license": "MIT",
   "engine": {
-    "node": ">=0.6"
+    "node": ">=8.0"
   }
 }

programming_language: JavaScript
CVE-2022-29693 (published 2022-06-02T14:15Z)

Unicorn Engine v2.0.0-rc7 and below was discovered to contain a memory leak via the function uc_close at /my/unicorn/uc.c.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-401
cwe_name: Missing Release of Memory after Effective Lifetime
description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
extended_description: This is often triggered by improper handling of malformed data or unexpectedly interrupted sessions.  In some languages, developers are responsible for tracking memory allocation and releasing the memory.  If there are no more pointers or references to the memory, then it can no longer be tracked and identified for release.
         

Fix information:
repo_url: https://github.com/unicorn-engine/unicorn
commit_details: repo_url: https://github.com/unicorn-engine/unicorn
author: lazymio
author_date: 2022-04-11 10:44:10+02:00
msg: Merge pull request #1587 from liyansong2018/dev

Fix https://github.com/unicorn-engine/unicorn/issues/1586
repository: repo_url: https://github.com/unicorn-engine/unicorn
repo_name: unicorn-engine/unicorn
description: Unicorn CPU emulator framework (ARM, AArch64, M68K, Mips, Sparc, PowerPC, RiscV, S390x, TriCore, X86)
repo_language: C
owner: unicorn-engine
CVE-2019-19069 (published 2019-11-18T06:15Z)

A memory leak in the fastrpc_dma_buf_attach() function in drivers/misc/fastrpc.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering dma_get_sgtable() failures, aka CID-fc739a058d99.

Severity: HIGH
CVSS v2 base score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-401
cwe_name: Missing Release of Memory after Effective Lifetime
description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
extended_description: This is often triggered by improper handling of malformed data or unexpectedly interrupted sessions.  In some languages, developers are responsible for tracking memory allocation and releasing the memory.  If there are no more pointers or references to the memory, then it can no longer be tracked and identified for release.
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Navid Emamdoost
author_date: 2019-09-25 10:27:41-05:00
msg: misc: fastrpc: prevent memory leak in fastrpc_dma_buf_attach

In fastrpc_dma_buf_attach if dma_get_sgtable fails the allocated memory
for a should be released.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Link: https://lore.kernel.org/r/20190925152742.16258-1-navid.emamdoost@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: fastrpc.c
change_type: ModificationType.MODIFY
diff: @@ -527,6 +527,7 @@ static int fastrpc_dma_buf_attach(struct dma_buf *dmabuf,
 			      FASTRPC_PHYS(buffer->phys), buffer->size);
 	if (ret < 0) {
 		dev_err(buffer->dev, "failed to get scatterlist from DMA API\n");
+		kfree(a);
 		return -EINVAL;
 	}
 

programming_language: C
CVE-2019-18809 (published 2019-11-07T16:15Z)

A memory leak in the af9005_identify_state() function in drivers/media/usb/dvb-usb/af9005.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-2289adbfa559.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 4.6, MEDIUM (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-401
cwe_name: Missing Release of Memory after Effective Lifetime
description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
extended_description: This is often triggered by improper handling of malformed data or unexpectedly interrupted sessions.  In some languages, developers are responsible for tracking memory allocation and releasing the memory.  If there are no more pointers or references to the memory, then it can no longer be tracked and identified for release.
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Navid Emamdoost
author_date: 2019-10-09 12:01:47-03:00
msg: media: usb: fix memory leak in af9005_identify_state

In af9005_identify_state when returning -EIO the allocated buffer should
be released. Replace the "return -EIO" with assignment into ret and move
deb_info() under a check.

Fixes: af4e067e1dcf ("V4L/DVB (5625): Add support for the AF9005 demodulator from Afatech")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: af9005.c
change_type: ModificationType.MODIFY
diff: @@ -976,8 +976,9 @@ static int af9005_identify_state(struct usb_device *udev,
 	else if (reply == 0x02)
 		*cold = 0;
 	else
-		return -EIO;
-	deb_info("Identify state cold = %d\n", *cold);
+		ret = -EIO;
+	if (!ret)
+		deb_info("Identify state cold = %d\n", *cold);
 
 err:
 	kfree(buf);

programming_language: C
CVE-2015-10023 (published 2023-01-07T12:15Z)

A vulnerability classified as critical has been found in Fumon trello-octometric. This affects the function main of the file metrics-ui/server/srv.go. The manipulation of the argument num leads to sql injection. The patch is named a1f1754933fbf21e2221fbc671c81a47de6a04ef. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217611.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/Fumon/trello-octometric
commit_details: repo_url: https://github.com/Fumon/trello-octometric
author: Jade Bilkey
author_date: 2015-01-25 13:04:04-05:00
msg: Fixed sql injection
repository: repo_url: https://github.com/Fumon/trello-octometric
repo_name: Fumon/trello-octometric
description: A small project to perform metrics on trello boards over time.
repo_language: Go
owner: Fumon
file_changes: filename: srv.go
change_type: ModificationType.MODIFY
diff: @@ -55,8 +55,8 @@ func main() {
 
 		var output string
 		// This is bad... don't do this.... omg
-		query := fmt.Sprintf(`SELECT json_agg(r) FROM (select EXTRACT(epoch FROM day) as day, end_of_day_total from trello.dailytallies order by day DESC limit %s) r;`, vars["num"])
-		err := db.QueryRow(query).Scan(&output)
+		query := `SELECT json_agg(r) FROM (select EXTRACT(epoch FROM day) as day, end_of_day_total from trello.dailytallies order by day DESC limit $1) r;`
+		err := db.QueryRow(query, vars["num"]).Scan(&output)
 
 		if err != nil {
 			log.Println("Error retriving from DB, ", err)
@@ -76,8 +76,8 @@ func main() {
 
 		var output string
 		// This is bad... don't do this.... omg
-		query := fmt.Sprintf(`SELECT json_agg(r) FROM (select EXTRACT(epoch FROM day) as day, up_count, down_count, finished_count from trello.dailytallies order by day DESC limit %s) r;`, vars["num"])
-		err := db.QueryRow(query).Scan(&output)
+		query := `SELECT json_agg(r) FROM (select EXTRACT(epoch FROM day) as day, up_count, down_count, finished_count from trello.dailytallies order by day DESC limit $1) r;`
+		err := db.QueryRow(query, vars["num"]).Scan(&output)
 
 		if err != nil {
 			log.Println("Error retriving from DB, ", err)

programming_language: Go
CVE-2016-7906 (published 2017-01-18T17:59Z)

magick/attribute.c in ImageMagick 7.0.3-2 allows remote attackers to cause a denial of service (use-after-free) via a crafted file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2016-10-01 11:18:08-04:00
msg: https://github.com/ImageMagick/ImageMagick/issues/281
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: attribute.c
change_type: ModificationType.MODIFY
diff: @@ -1264,7 +1264,7 @@ MagickExport MagickBooleanType SetImageType(Image *image,const ImageType type,
           status=QuantizeImage(quantize_info,image,exception);
           quantize_info=DestroyQuantizeInfo(quantize_info);
         }
-      image->colors=2;
+      status=AcquireImageColormap(image,2,exception);
       image->alpha_trait=UndefinedPixelTrait;
       break;
     }

programming_language: Objective-C
CVE-2016-10172 (published 2017-03-14T14:59Z)

The read_new_config_info function in open_utils.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/dbry/WavPack
commit_details: repo_url: https://github.com/dbry/WavPack
author: David Bryant
author_date: 2016-12-21 22:18:36-08:00
msg: fixes for 4 fuzz failures posted to SourceForge mailing list
repository: repo_url: https://github.com/dbry/WavPack
repo_name: dbry/WavPack
description: WavPack encode/decode library, command-line programs, and several plugins
repo_language: C
owner: dbry
file_changes: filename: open_utils.c
change_type: ModificationType.MODIFY
diff: @@ -560,7 +560,7 @@ static int read_new_config_info (WavpackContext *wpc, WavpackMetadata *wpmd)
 
     // if there's any data, the first two bytes are file_format and qmode flags
 
-    if (bytecnt) {
+    if (bytecnt >= 2) {
         wpc->file_format = *byteptr++;
         wpc->config.qmode = (wpc->config.qmode & ~0xff) | *byteptr++;
         bytecnt -= 2;
@@ -593,6 +593,10 @@ static int read_new_config_info (WavpackContext *wpc, WavpackMetadata *wpmd)
                         for (i = 0; i < nchans; ++i)
                             if (bytecnt) {
                                 wpc->channel_reordering [i] = *byteptr++;
+
+                                if (wpc->channel_reordering [i] >= nchans)  // make sure index is in range
+                                    wpc->channel_reordering [i] = 0;
+
                                 bytecnt--;
                             }
                             else

programming_language: C
filename: read_words.c
change_type: ModificationType.MODIFY
diff: @@ -288,6 +288,10 @@ int32_t FASTCALL get_word (WavpackStream *wps, int chan, int32_t *correction)
 
     low &= 0x7fffffff;
     high &= 0x7fffffff;
+
+    if (low > high)         // make sure high and low make sense
+        high = low;
+
     mid = (high + low + 1) >> 1;
 
     if (!c->error_limit)

programming_language: C++