starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2022-0699 (published 2022-10-17T16:15Z)

A double-free condition exists in contrib/shpsort.c of shapelib 1.5.0 and older releases. This issue may allow an attacker to cause a denial of service or have other unspecified impact via control over malloc.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-415
cwe_name: Double Free
description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
extended_description: When a program calls free() twice with the same argument, the program's memory management data structures become corrupted. This corruption can cause the program to crash or, in some circumstances, cause two later calls to malloc() to return the same pointer. If malloc() returns the same value twice and the program later gives the attacker control over the data that is written into this doubly-allocated memory, the program becomes vulnerable to a buffer overflow attack.
         

Fix information:
repo_url: https://github.com/OSGeo/shapelib
commit_details: repo_url: https://github.com/OSGeo/shapelib
author: Albin Eldstål-Ahrens
author_date: 2022-01-03 12:34:41+01:00
msg: Remove double free() in contrib/shpsrt, issue #39

This fixes issue #39
repository: repo_url: https://github.com/OSGeo/shapelib
repo_name: OSGeo/shapelib
description: Official repository of shapelib
repo_language: C
owner: OSGeo
file_changes: filename: shpsort.c
change_type: ModificationType.MODIFY
diff: @@ -113,7 +113,6 @@ static char ** split(const char *arg, const char *delim) {
 	free(result[--i]);
       }
       free(result);
-      free(copy);
       return NULL;
     }
     result = tmp;

programming_language: C
CVE-2023-50251 (published 2023-12-12T21:15Z)

php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when parsing the attributes passed to a `use` tag inside an svg document, an attacker can cause the system to go to an infinite recursion. Depending on the system configuration and attack pattern this could exhaust the memory available to the executing process and/or to the server itself. An attacker sending multiple request to a system to render the above payload can potentially cause resource exhaustion to the point that the system is unable to handle incoming request. Version 0.5.1 contains a patch for this issue.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-674
cwe_name: Uncontrolled Recursion
description: The product does not properly control the amount of recursion that takes place,  consuming excessive resources, such as allocated memory or the program stack.
extended_description: 
        
      
      

Fix information:
repo_url: https://github.com/dompdf/php-svg-lib
commit_details: repo_url: https://github.com/dompdf/php-svg-lib
author: Brian Sweeney
author_date: 2023-11-20 16:06:30-05:00
msg: Prevent circular reference in use elements
repository: repo_url: https://github.com/dompdf/php-svg-lib
repo_name: dompdf/php-svg-lib
description: SVG file parsing / rendering library
repo_language: PHP
owner: dompdf
file_changes: filename: UseTag.php
change_type: ModificationType.MODIFY
diff: @@ -14,12 +14,19 @@ class UseTag extends AbstractTag
     protected $y = 0;
     protected $width;
     protected $height;
+    protected $instances = 0;
 
     /** @var AbstractTag */
     protected $reference;
 
     protected function before($attributes)
     {
+        $this->instances++;
+        if ($this->instances > 1) {
+            //TODO: log circular reference error state
+            return;
+        }
+
         if (isset($attributes['x'])) {
             $this->x = $attributes['x'];
         }
@@ -52,6 +59,9 @@ class UseTag extends AbstractTag
     }
 
     protected function after() {
+        if ($this->instances > 0) {
+            return;
+        }
         parent::after();
 
         if ($this->reference) {
@@ -63,6 +73,11 @@ class UseTag extends AbstractTag
 
     public function handle($attributes)
     {
+        if ($this->instances > 1) {
+            //TODO: log circular reference error state
+            return;
+        }
+
         parent::handle($attributes);
 
         if (!$this->reference) {
@@ -87,6 +102,11 @@ class UseTag extends AbstractTag
 
     public function handleEnd()
     {
+        $this->instances--;
+        if ($this->instances > 0) {
+            return;
+        }
+
         parent::handleEnd();
 
         if (!$this->reference) {

programming_language: PHP
CVE-2024-32005 (published 2024-04-12T21:15Z)

NiceGUI is an easy-to-use, Python-based UI framework. A local file inclusion is present in the NiceUI leaflet component when requesting resource files under the `/_nicegui/{__version__}/resources/{key}/{path:path}` route. As a result any file on the backend filesystem which the web server has access to can be read by an attacker with access to the NiceUI leaflet website. This vulnerability has been addressed in version 1.4.21. Users are advised to upgrade. There are no known workarounds for this vulnerability.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/zauberzeug/nicegui
commit_details: repo_url: https://github.com/zauberzeug/nicegui
author: Falko Schindler
author_date: 2024-04-12 14:27:19+02:00
msg: prevent local file access (see security advisory GHSA-mwc7-64wg-pgvj)
repository: repo_url: https://github.com/zauberzeug/nicegui
repo_name: zauberzeug/nicegui
description: Create web-based user interfaces with Python. The nice way.
repo_language: Python
owner: zauberzeug
file_changes: filename: nicegui.py
change_type: ModificationType.MODIFY
diff: @@ -96,6 +96,10 @@ def _get_component(key: str) -> FileResponse:
 def _get_resource(key: str, path: str) -> FileResponse:
     if key in resources:
         filepath = resources[key].path / path
+        try:
+            filepath.resolve().relative_to(resources[key].path.resolve())  # NOTE: use is_relative_to() in Python 3.9
+        except ValueError as e:
+            raise HTTPException(status_code=403, detail='forbidden') from e
         if filepath.exists():
             headers = {'Cache-Control': 'public, max-age=3600'}
             media_type, _ = mimetypes.guess_type(filepath)

programming_language: Python
CVE-2019-13299 (published 2019-07-05T01:15Z)

ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/pixel-accessor.h in GetPixelChannel.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2019-06-21 18:49:58-04:00
msg: https://github.com/ImageMagick/ImageMagick/issues/1610
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: pixel-accessor.h
change_type: ModificationType.MODIFY
diff: @@ -111,7 +111,7 @@ static inline PixelTrait GetPixelCbTraits(const Image *magick_restrict image)
 static inline Quantum GetPixelChannel(const Image *magick_restrict image,
   const PixelChannel channel,const Quantum *magick_restrict pixel)
 {
-  if (image->channel_map[channel].traits == UndefinedPixelTrait)
+  if (image->channel_map[image->channel_map[channel].offset].traits == UndefinedPixelTrait)
     return((Quantum) 0);
   return(pixel[image->channel_map[channel].offset]);
 }

programming_language: C
CVE-2023-49801 (published 2024-01-12T21:15Z)

Lif Auth Server is a server for validating logins, managing information, and account recovery for Lif Accounts. The issue relates to the `get_pfp` and `get_banner` routes on Auth Server. The issue is that there is no check to ensure that the file that Auth Server is receiving through these URLs is correct. This could allow an attacker access to files they shouldn't have access to. This issue has been patched in version 1.4.0.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/Lif-Platforms/Lif-Auth-Server
commit_details: repo_url: https://github.com/Lif-Platforms/Lif-Auth-Server
author: Superior125
author_date: 2023-12-09 20:10:23-05:00
msg: Merge pull request from GHSA-3v77-pvqq-qg3f

Fix security issue
repository: repo_url: https://github.com/Lif-Platforms/Lif-Auth-Server
repo_name: Lif-Platforms/Lif-Auth-Server
description: Lif Auth Server is a server for validating logins, managing information, and account recovery for Lif Accounts.
repo_language: Python
owner: Lif-Platforms
CVE-2020-35508 (published 2021-03-26T17:15Z)

A flaw possibility of race condition and incorrect initialization of the process id was found in the Linux kernel child/parent process identification handling while filtering signal handlers. A local attacker is able to abuse this flaw to bypass checks to send any signal to a privileged process.

Severity: MEDIUM
CVSS v2 base score: 4.4 (AV:L/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 4.5, MEDIUM (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L)

Weakness information:
cwe_id: CWE-665
cwe_name: Improper Initialization
description: The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
extended_description: This can have security implications when the associated resource is expected to have certain properties or values, such as a variable that determines whether a user has been authenticated or not.
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Eddy Wu
author_date: 2020-11-07 14:47:22+08:00
msg: fork: fix copy_process(CLONE_PARENT) race with the exiting ->real_parent

current->group_leader->exit_signal may change during copy_process() if
current->real_parent exits.

Move the assignment inside tasklist_lock to avoid the race.

Signed-off-by: Eddy Wu <eddy_wu@trendmicro.com>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: fork.c
change_type: ModificationType.MODIFY
diff: @@ -2167,14 +2167,9 @@ static __latent_entropy struct task_struct *copy_process(
 	/* ok, now we should be set up.. */
 	p->pid = pid_nr(pid);
 	if (clone_flags & CLONE_THREAD) {
-		p->exit_signal = -1;
 		p->group_leader = current->group_leader;
 		p->tgid = current->tgid;
 	} else {
-		if (clone_flags & CLONE_PARENT)
-			p->exit_signal = current->group_leader->exit_signal;
-		else
-			p->exit_signal = args->exit_signal;
 		p->group_leader = p;
 		p->tgid = p->pid;
 	}
@@ -2218,9 +2213,14 @@ static __latent_entropy struct task_struct *copy_process(
 	if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) {
 		p->real_parent = current->real_parent;
 		p->parent_exec_id = current->parent_exec_id;
+		if (clone_flags & CLONE_THREAD)
+			p->exit_signal = -1;
+		else
+			p->exit_signal = current->group_leader->exit_signal;
 	} else {
 		p->real_parent = current;
 		p->parent_exec_id = current->self_exec_id;
+		p->exit_signal = args->exit_signal;
 	}
 
 	klp_copy_process(p);

programming_language: C
CVE-2024-35194 (published 2024-05-20T21:15Z)

Minder is a software supply chain security platform. Prior to version 0.0.50, Minder engine is susceptible to a denial of service from memory exhaustion that can be triggered from maliciously created templates. Minder engine uses templating to generate strings for various use cases such as URLs, messages for pull requests, descriptions for advisories. In some cases can the user control both the template and the params for it, and in a subset of these cases, Minder reads the generated template entirely into memory. When Minders templating meets both of these conditions, an attacker is able to generate large enough templates that Minder will exhaust memory and crash. This vulnerability is fixed in 0.0.50.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/stacklok/minder
commit_details: repo_url: https://github.com/stacklok/minder
author: Juan Antonio Osorio
author_date: 2024-05-20 10:52:50-06:00
msg: Merge pull request from GHSA-8fmj-33gw-g7pw

Similarly to other readers, this also limits the size. In this case, it
was set to 10MB, since attestations can get pretty big.

Signed-off-by: Juan Antonio Osorio <ozz@stacklok.com>
repository: repo_url: https://github.com/stacklok/minder
repo_name: stacklok/minder
description: Software Supply Chain Security Platform
repo_language: Go
owner: stacklok
file_changes: filename: container.go
change_type: ModificationType.MODIFY
diff: @@ -24,6 +24,7 @@ import (
 	"encoding/pem"
 	"errors"
 	"fmt"
+	"io"
 	"net/http"
 	"strings"
 
@@ -49,6 +50,10 @@ var (
 	// ErrProvenanceNotFoundOrIncomplete is returned when there's no provenance info (missing .sig or attestation) or
 	// has incomplete data
 	ErrProvenanceNotFoundOrIncomplete = errors.New("provenance not found or incomplete")
+
+	// MaxAttestationsBytesLimit is the maximum number of bytes we're willing to read from the attestation endpoint
+	// We'll limit this to 10mb for now
+	MaxAttestationsBytesLimit int64 = 10 * 1024 * 1024
 )
 
 const (
@@ -291,8 +296,9 @@ func getAttestationReply(
 	}
 	defer resp.Body.Close()
 
+	lr := io.LimitReader(resp.Body, MaxAttestationsBytesLimit)
 	var attestationReply AttestationReply
-	if err := json.NewDecoder(resp.Body).Decode(&attestationReply); err != nil {
+	if err := json.NewDecoder(lr).Decode(&attestationReply); err != nil {
 		return nil, fmt.Errorf("error decoding response: %w", err)
 	}
 
@@ -446,7 +452,8 @@ func getSimpleSigningLayersFromSignatureManifest(manifestRef string, auth authn.
 	}
 
 	// Parse the manifest
-	manifest, err := v1.ParseManifest(bytes.NewReader(mf))
+	r := io.LimitReader(bytes.NewReader(mf), MaxAttestationsBytesLimit)
+	manifest, err := v1.ParseManifest(r)
 	if err != nil {
 		return nil, fmt.Errorf("error parsing signature manifest: %w", err)
 	}

programming_language: Go
CVE-2022-0712 (published 2022-02-22T18:15Z)

NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.4.

Severity: HIGH
CVSS v2 base score: 7.1 (AV:N/AC:M/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/radareorg/radare2
commit_details: repo_url: https://github.com/radareorg/radare2
author: pancake
author_date: 2022-02-21 18:45:06+01:00
msg: Fix null deref in bin.symbols ##crash

* Reported by cnitlrt via huntr.dev
repository: repo_url: https://github.com/radareorg/radare2
repo_name: radareorg/radare2
description: UNIX-like reverse engineering framework and command-line toolset
repo_language: C
owner: radareorg
file_changes: filename: bin_symbols.c
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,4 @@
-/* radare - LGPL - Copyright 2018 - pancake */
+/* radare - LGPL - Copyright 2018-2022 - pancake */
 
 #include <r_types.h>
 #include <r_util.h>
@@ -361,6 +361,9 @@ static RList *symbols(RBinFile *bf) {
 	bool found = false;
 	for (i = 0; i < element->hdr->n_lined_symbols; i++) {
 		RCoreSymCacheElementSymbol *sym = (RCoreSymCacheElementSymbol *)&element->lined_symbols[i];
+		if (!sym) {
+			break;
+		}
 		ht_uu_find (hash, sym->paddr, &found);
 		if (found) {
 			continue;

programming_language: C
CVE-2022-0570 (published 2022-02-14T12:15Z)

Heap-based Buffer Overflow in Homebrew mruby prior to 3.2.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-122
cwe_name: Heap-based Buffer Overflow
description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/mruby/mruby
commit_details: repo_url: https://github.com/mruby/mruby
author: Yukihiro "Matz" Matsumoto
author_date: 2022-02-12 12:39:35+09:00
msg: codegen.c: fix a bug in `gen_values()`.

- Fix limit handling that fails 15 arguments method calls.
- Fix too early argument packing in arrays.
repository: repo_url: https://github.com/mruby/mruby
repo_name: mruby/mruby
description: Lightweight Ruby
repo_language: C
owner: mruby
file_changes: filename: codegen.c
change_type: ModificationType.MODIFY
diff: @@ -1551,7 +1551,7 @@ gen_values(codegen_scope *s, node *t, int val, int limit)
   while (t) {
     int is_splat = nint(t->car->car) == NODE_SPLAT;
 
-    if (is_splat || n > limit || cursp() >= slimit) { /* flush stack */
+    if (is_splat || cursp() >= slimit) { /* flush stack */
       pop_n(n);
       if (first) {
         if (n == 0) {
@@ -1590,6 +1590,11 @@ gen_values(codegen_scope *s, node *t, int val, int limit)
     }
     return -1;                  /* variable length */
   }
+  else if (n > limit) {
+    pop_n(n);
+    genop_2(s, OP_ARRAY, cursp(), n);
+    return -1;
+  }
   return n;
 }
 

programming_language: C
CVE-2020-1893 (published 2020-03-03T15:15Z)

Insufficient boundary checks when decoding JSON in TryParse reads out of bounds memory, potentially leading to DOS. This issue affects HHVM 4.45.0, 4.44.0, 4.43.0, 4.42.0, 4.41.0, 4.40.0, 4.39.0, versions between 4.33.0 and 4.38.0 (inclusive), versions between 4.9.0 and 4.32.0 (inclusive), and versions prior to 4.8.7.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/facebook/hhvm
commit_details: repo_url: https://github.com/facebook/hhvm
author: Mark Williams
author_date: 2020-02-20 15:41:33-08:00
msg: Fix a buffer-overrun in SimpleParser

Summary: In the failure case, we might have already consumed the entire string.

Reviewed By: binliu19, ottoni

Differential Revision: D19610775

fbshipit-source-id: d387df15994a310f5a31cfbb5fa11679997f7ae7
repository: repo_url: https://github.com/facebook/hhvm
repo_name: facebook/hhvm
description: A virtual machine for executing programs written in Hack.
repo_language: Hack
owner: facebook
file_changes: filename: JSON_parser.cpp
change_type: ModificationType.MODIFY
diff: @@ -342,8 +342,8 @@ struct SimpleParser {
                        JSONContainerType container_type, bool is_tsimplejson) {
     SimpleParser parser(inp, length, buf, container_type, is_tsimplejson);
     bool ok = parser.parseValue();
-    parser.skipSpace();
-    if (!ok || parser.p != inp + length) {
+    if (!ok ||
+        (parser.skipSpace(), parser.p != inp + length)) {
       // Unsupported, malformed, or trailing garbage. Release entire stack.
       tvDecRefRange(buf, parser.top);
       return false;

programming_language: C++
CVE-2021-29439 (published 2021-04-13T20:15Z)

The Grav admin plugin prior to version 1.10.11 does not correctly verify caller's privileges. As a consequence, users with the permission `admin.login` can install third-party plugins and their dependencies. By installing the right plugin, an attacker can obtain an arbitrary code execution primitive and elevate their privileges on the instance. The vulnerability has been addressed in version 1.10.11. As a mitigation blocking access to the `/admin` path from untrusted sources will reduce the probability of exploitation. 

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 7.2, HIGH (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-863
cwe_name: Incorrect Authorization
description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are incorrectly applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/getgrav/grav-plugin-admin
commit_details: repo_url: https://github.com/getgrav/grav-plugin-admin
author: Andy Miller
author_date: 2021-04-13 12:21:55-06:00
msg: Merge branch 'release/1.10.11'
repository: repo_url: https://github.com/getgrav/grav-plugin-admin
repo_name: getgrav/grav-plugin-admin
description: Grav Admin Plugin
repo_language: PHP
owner: getgrav