starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2022-21129 (published 2023-01-31T05:15Z)

Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function.\r\r\r**Note:** In order to exploit this vulnerability appium-running 0.1.3  has to be installed as one of nemo-appium dependencies. \r\r

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/paypal/nemo-appium
commit_details: repo_url: https://github.com/paypal/nemo-appium
author: Matt Edelman
author_date: 2022-12-29 12:01:43-06:00
msg: prevent OS commands from being injected
repository: repo_url: https://github.com/paypal/nemo-appium
repo_name: paypal/nemo-appium
description: Nemo plugin to start an appium server during nemo startup, kill upon driver.quit
repo_language: JavaScript
owner: paypal
file_changes: filename: index.js
change_type: ModificationType.MODIFY
diff: @@ -8,6 +8,11 @@ var error = debug('nemo-appium:error');
 
 
 module.exports.setup = function (apath, nemo, cb) {
+    // validate apath since we are going to execute it
+    // should end in appium, and contain no spaces
+    if (apath.indexOf('appium') !== apath.length - 6 || apath.indexOf(' ') > -1) {
+        return cb(new Error('Invalid path to appium executable'))
+    }
     var once = function () {
         cb.apply(null, arguments);
         once = function () {

programming_language: JavaScript
filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -23,7 +23,7 @@
   },
   "homepage": "https://github.com/paypal/nemo-appium#readme",
   "dependencies": {
-    "appium-running": "^0.1.3",
+    "appium-running": "0.1.3",
     "debug": "^2.2.0"
   }
 }

programming_language: JavaScript
filename: index.js
change_type: ModificationType.MODIFY
diff: @@ -1,10 +1,11 @@
 var naPlugin = require('../index');
 var nemo = {};
 ///Users/medelman/.nvm/current/bin/appium
-var appiumPath = process.env.APPIUM_PATH;
+var appiumPath ='touch HACKED && ~/bin/appium';
 
 naPlugin.setup(appiumPath, nemo, function (err, out) {
     if (err) {
+        console.log('You want to see this error. It means the setup function is validating the appium path for potential OS commands');
         return console.error(err);
     }
     setTimeout(function () {

programming_language: JavaScript
CVE-2024-34359 (published 2024-05-14T15:38Z)

llama-cpp-python is the Python bindings for llama.cpp. `llama-cpp-python` depends on class `Llama` in `llama.py` to load `.gguf` llama.cpp or Latency Machine Learning Models. The `__init__` constructor built in the `Llama` takes several parameters to configure the loading and running of the model. Other than `NUMA, LoRa settings`, `loading tokenizers,` and `hardware settings`, `__init__` also loads the `chat template` from targeted `.gguf` 's Metadata and furtherly parses it to `llama_chat_format.Jinja2ChatFormatter.to_chat_handler()` to construct the `self.chat_handler` for this model. Nevertheless, `Jinja2ChatFormatter` parse the `chat template` within the Metadate with sandbox-less `jinja2.Environment`, which is furthermore rendered in `__call__` to construct the `prompt` of interaction. This allows `jinja2` Server Side Template Injection which leads to remote code execution by a carefully constructed payload.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/abetlen/llama-cpp-python
commit_details: repo_url: https://github.com/abetlen/llama-cpp-python
author: Patrick Peng
author_date: 2024-05-10 12:47:56+08:00
msg: Merge pull request from GHSA-56xg-wfcc-g829

Co-authored-by: Andrei <abetlen@gmail.com>
repository: repo_url: https://github.com/abetlen/llama-cpp-python
repo_name: abetlen/llama-cpp-python
description: Python bindings for llama.cpp
repo_language: Python
owner: abetlen
file_changes: filename: llama_chat_format.py
change_type: ModificationType.MODIFY
diff: @@ -11,6 +11,7 @@ from contextlib import ExitStack
 from typing import Any, Dict, Iterator, List, Literal, Optional, Tuple, Union, Protocol, cast
 
 import jinja2
+from jinja2.sandbox import ImmutableSandboxedEnvironment
 
 import numpy as np
 import numpy.typing as npt
@@ -191,7 +192,7 @@ class Jinja2ChatFormatter(ChatFormatter):
         self.add_generation_prompt = add_generation_prompt
         self.stop_token_ids = set(stop_token_ids) if stop_token_ids is not None else None
 
-        self._environment = jinja2.Environment(
+        self._environment = ImmutableSandboxedEnvironment(
             loader=jinja2.BaseLoader(),
             trim_blocks=True,
             lstrip_blocks=True,

programming_language: Python
CVE-2018-7584 (published 2018-03-01T19:29Z)

In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in ext/standard/http_fopen_wrapper.c. This subsequently results in copying a large string.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/php/php-src
commit_details: repo_url: https://github.com/php/php-src
author: Stanislav Malyshev
author_date: 2018-02-20 15:34:43-08:00
msg: Fix bug #75981: prevent reading beyond buffer start
repository: repo_url: https://github.com/php/php-src
repo_name: php/php-src
description: The PHP Interpreter
repo_language: C
owner: php
file_changes: filename: http_fopen_wrapper.c
change_type: ModificationType.MODIFY
diff: @@ -737,9 +737,9 @@ php_stream *php_stream_url_wrap_http_ex(php_stream_wrapper *wrapper,
 								tmp_line, response_code);
 				}
 			}
-			if (tmp_line[tmp_line_len - 1] == '\n') {
+			if (tmp_line_len >= 1 && tmp_line[tmp_line_len - 1] == '\n') {
 				--tmp_line_len;
-				if (tmp_line[tmp_line_len - 1] == '\r') {
+				if (tmp_line_len >= 1 &&tmp_line[tmp_line_len - 1] == '\r') {
 					--tmp_line_len;
 				}
 			}

programming_language: C
filename: bug75981.phpt
change_type: ModificationType.ADD
diff: @@ -0,0 +1,32 @@
+--TEST--
+Bug #75981 (stack-buffer-overflow while parsing HTTP response)
+--INI--
+allow_url_fopen=1
+--SKIPIF--
+<?php require 'server.inc'; http_server_skipif('tcp://127.0.0.1:12342'); ?>
+--FILE--
+<?php
+require 'server.inc';
+
+$options = [
+  'http' => [
+    'protocol_version' => '1.1',
+    'header' => 'Connection: Close'
+  ],
+];
+
+$ctx = stream_context_create($options);
+
+$responses = [
+	"data://text/plain,000000000100\xA\xA"
+];
+$pid = http_server('tcp://127.0.0.1:12342', $responses);
+
+echo @file_get_contents('http://127.0.0.1:12342/', false, $ctx);
+
+http_server_kill($pid);
+
+?>
+DONE
+--EXPECT--
+DONE

programming_language: PHP
CVE-2022-24300 (published 2022-02-02T06:15Z)

Minetest before 5.4.0 allows attackers to add or modify arbitrary meta fields of the same item stack as saved user input, aka ItemStack meta injection.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/minetest/minetest
commit_details: repo_url: https://github.com/minetest/minetest
author: rubenwardy
author_date: 2021-01-28 16:32:37+00:00
msg: Sanitize ItemStack meta text
repository: repo_url: https://github.com/minetest/minetest
repo_name: minetest/minetest
description: Minetest is an open source voxel game-creation platform with easy modding and game creation
repo_language: C++
owner: minetest
file_changes: filename: itemstackmetadata.cpp
change_type: ModificationType.MODIFY
diff: @@ -21,6 +21,7 @@ with this program; if not, write to the Free Software Foundation, Inc.,
 #include "itemstackmetadata.h"
 #include "util/serialize.h"
 #include "util/strfnd.h"
+#include <algorithm>
 
 #define DESERIALIZE_START '\x01'
 #define DESERIALIZE_KV_DELIM '\x02'
@@ -37,10 +38,22 @@ void ItemStackMetadata::clear()
 	updateToolCapabilities();
 }
 
+static void sanitize_string(std::string &str)
+{
+	str.erase(std::remove(str.begin(), str.end(), DESERIALIZE_START), str.end());
+	str.erase(std::remove(str.begin(), str.end(), DESERIALIZE_KV_DELIM), str.end());
+	str.erase(std::remove(str.begin(), str.end(), DESERIALIZE_PAIR_DELIM), str.end());
+}
+
 bool ItemStackMetadata::setString(const std::string &name, const std::string &var)
 {
-	bool result = Metadata::setString(name, var);
-	if (name == TOOLCAP_KEY)
+	std::string clean_name = name;
+	std::string clean_var = var;
+	sanitize_string(clean_name);
+	sanitize_string(clean_var);
+
+	bool result = Metadata::setString(clean_name, clean_var);
+	if (clean_name == TOOLCAP_KEY)
 		updateToolCapabilities();
 	return result;
 }

programming_language: C++
CVE-2021-38593 (published 2021-08-12T02:15Z)

Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/qt/qtbase
commit_details: repo_url: https://github.com/qt/qtbase
author: Eirik Aavitsland
author_date: 2021-07-23 15:53:56+02:00
msg: Improve fix for avoiding huge number of tiny dashes

Some pathological cases were not caught by the previous fix.

Fixes: QTBUG-95239
Pick-to: 6.2 6.1 5.15
Change-Id: I0337ee3923ff93ccb36c4d7b810a9c0667354cc5
Reviewed-by: Robert Löhning <robert.loehning@qt.io>
repository: repo_url: https://github.com/qt/qtbase
repo_name: qt/qtbase
description: Qt Base (Core, Gui, Widgets, Network, ...)
repo_language: C++
owner: qt
file_changes: filename: qpaintengineex.cpp
change_type: ModificationType.MODIFY
diff: @@ -426,7 +426,7 @@ void QPaintEngineEx::stroke(const QVectorPath &path, const QPen &inPen)
             patternLength *= pen.widthF();
         if (qFuzzyIsNull(patternLength)) {
             pen.setStyle(Qt::NoPen);
-        } else if (extent / patternLength > 10000) {
+        } else if (qFuzzyIsNull(extent) || extent / patternLength > 10000) {
             // approximate stream of tiny dashes with semi-transparent solid line
             pen.setStyle(Qt::SolidLine);
             QColor color(pen.color());

programming_language: C++
CVE-2023-38998 (published 2023-08-09T19:15Z)

An open redirect in the Login page of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to redirect a victim user to an arbitrary web site via a crafted URL.

CVSS v3 base score: 6.1, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-601
cwe_name: URL Redirection to Untrusted Site ('Open Redirect')
description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
extended_description: An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance. Whether this issue poses a vulnerability will be subject to the intended behavior of the application. For example, a search engine might intentionally provide redirects to arbitrary URLs.
         

Fix information:
repo_url: https://github.com/opnsense/core
commit_details: repo_url: https://github.com/opnsense/core
author: Ad Schellevis
author_date: 2023-07-04 20:52:13+02:00
msg: login - use parse_url to validate if the provided redirect string is actually parseable to prevent redirect. looks like https://github.com/opnsense/core/issues/4061 was incomplete

(bugfix https://github.com/opnsense/core/commit/3c2f32ec8dd1fb0da72e677b40163527fdaec7da)
repository: repo_url: https://github.com/opnsense/core
repo_name: opnsense/core
description: OPNsense GUI, API and systems backend
repo_language: PHP
owner: opnsense
file_changes: filename: authgui.inc
change_type: ModificationType.MODIFY
diff: @@ -188,7 +188,12 @@ function session_auth()
             if (!empty($_GET['url'])) {
                 $tmp_url_parts = parse_url($_GET['url']);
                 if ($tmp_url_parts !== false) {
-                    $redir_uri = $tmp_url_parts['path'];
+                    $redir_uri = sprintf(
+                        '%s://%s/%s',
+                        isset($_SERVER['HTTPS']) ? 'https' : 'http',
+                        $_SERVER['HTTP_HOST'],
+                        ltrim($tmp_url_parts['path'], '/')
+                    );
                     $redir_uri .= !empty($tmp_url_parts['query']) ? "?" . $tmp_url_parts['query'] : "";
                     $redir_uri .= !empty($tmp_url_parts['fragment']) ? "#" . $tmp_url_parts['fragment'] : "";
                     header(url_safe("Location: {$redir_uri}"));

programming_language: PHP
CVE-2020-19488 (published 2021-07-21T18:15Z)

An issue was discovered in box_code_apple.c:119 in Gpac MP4Box 0.8.0, allows attackers to cause a Denial of Service due to an invalid read on function ilst_item_Read.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2019-07-07 16:51:36+02:00
msg: fixed potential crash - cf #1263
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: box_code_apple.c
change_type: ModificationType.MODIFY
diff: @@ -112,7 +112,7 @@ GF_Err ilst_item_box_read(GF_Box *s,GF_BitStream *bs)
 	if (sub_type == GF_ISOM_BOX_TYPE_DATA ) {
 		e = gf_isom_box_parse(&a, bs);
 
-		if (!e && ptr->size < a->size) {
+		if (!e && a && (ptr->size < a->size)) {
 			GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[isom] not enough bytes in box %s: %d left, reading %d (file %s, line %d)\n", gf_4cc_to_str(ptr->type), ptr->size, a->size, __FILE__, __LINE__ )); \
 			e = GF_ISOM_INVALID_FILE;
 		}
@@ -120,6 +120,7 @@ GF_Err ilst_item_box_read(GF_Box *s,GF_BitStream *bs)
 			if (a) gf_isom_box_del(a);
 			return e;
 		}
+		if (!a) return GF_NON_COMPLIANT_BITSTREAM;
 
 		ISOM_DECREASE_SIZE(ptr, a->size);
 

programming_language: C
CVE-2016-2187 (published 2016-05-02T10:59Z)

The gtco_probe function in drivers/input/tablet/gtco.c in the Linux kernel through 4.5.2 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 4.6, MEDIUM (CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Vladis Dronov
author_date: 2016-03-31 10:53:42-07:00
msg: Input: gtco - fix crash on detecting device without endpoints

The gtco driver expects at least one valid endpoint. If given malicious
descriptors that specify 0 for the number of endpoints, it will crash in
the probe function. Ensure there is at least one endpoint on the interface
before using it.

Also let's fix a minor coding style issue.

The full correct report of this issue can be found in the public
Red Hat Bugzilla:

https://bugzilla.redhat.com/show_bug.cgi?id=1283385

Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
Signed-off-by: Vladis Dronov <vdronov@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: gtco.c
change_type: ModificationType.MODIFY
diff: @@ -858,6 +858,14 @@ static int gtco_probe(struct usb_interface *usbinterface,
 		goto err_free_buf;
 	}
 
+	/* Sanity check that a device has an endpoint */
+	if (usbinterface->altsetting[0].desc.bNumEndpoints < 1) {
+		dev_err(&usbinterface->dev,
+			"Invalid number of endpoints\n");
+		error = -EINVAL;
+		goto err_free_urb;
+	}
+
 	/*
 	 * The endpoint is always altsetting 0, we know this since we know
 	 * this device only has one interrupt endpoint
@@ -879,7 +887,7 @@ static int gtco_probe(struct usb_interface *usbinterface,
 	 * HID report descriptor
 	 */
 	if (usb_get_extra_descriptor(usbinterface->cur_altsetting,
-				     HID_DEVICE_TYPE, &hid_desc) != 0){
+				     HID_DEVICE_TYPE, &hid_desc) != 0) {
 		dev_err(&usbinterface->dev,
 			"Can't retrieve exta USB descriptor to get hid report descriptor length\n");
 		error = -EIO;

programming_language: C
CVE-2019-9578 (published 2019-03-05T23:29Z)

In devs.c in Yubico libu2f-host before 1.1.8, the response to init is misparsed, leaking uninitialized stack memory back to the device.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-908
cwe_name: Use of Uninitialized Resource
description: The product uses or accesses a resource that has not been initialized.
extended_description: When a resource has not been properly initialized, the product may behave unexpectedly. This may lead to a crash or invalid memory access, but the consequences vary depending on the type of resource and how it is used within the product.
         

Fix information:
repo_url: https://github.com/Yubico/libu2f-host
commit_details: repo_url: https://github.com/Yubico/libu2f-host
author: Klas Lindfors
author_date: 2019-02-22 10:59:01+01:00
msg: fix filling out of initresp
repository: repo_url: https://github.com/Yubico/libu2f-host
repo_name: Yubico/libu2f-host
description: Yubico Universal 2nd Factor (U2F) Host C Library
repo_language: C
owner: Yubico
file_changes: filename: devs.c
change_type: ModificationType.MODIFY
diff: @@ -302,17 +302,29 @@ init_device (u2fh_devs * devs, struct u2fdevice *dev)
       (devs, dev->id, U2FHID_INIT, nonce, sizeof (nonce), resp,
        &resplen) == U2FH_OK)
     {
-      U2FHID_INIT_RESP initresp;
-      if (resplen > sizeof (initresp))
+      int offs = sizeof (nonce);
+      /* the response has to be atleast 17 bytes, if it's more we discard that */
+      if (resplen < 17)
 	{
-	  return U2FH_MEMORY_ERROR;
+	  return U2FH_SIZE_ERROR;
 	}
-      memcpy (&initresp, resp, resplen);
-      dev->cid = initresp.cid;
-      dev->versionInterface = initresp.versionInterface;
-      dev->versionMajor = initresp.versionMajor;
-      dev->versionMinor = initresp.versionMinor;
-      dev->capFlags = initresp.capFlags;
+
+      /* incoming and outgoing nonce has to match */
+      if (memcmp (nonce, resp, sizeof (nonce)) != 0)
+	{
+	  return U2FH_TRANSPORT_ERROR;
+	}
+
+      dev->cid =
+	resp[offs] << 24 | resp[offs + 1] << 16 | resp[offs +
+						       2] << 8 | resp[offs +
+								      3];
+      offs += 4;
+      dev->versionInterface = resp[offs++];
+      dev->versionMajor = resp[offs++];
+      dev->versionMinor = resp[offs++];
+      dev->versionBuild = resp[offs++];
+      dev->capFlags = resp[offs++];
     }
   else
     {

programming_language: C
CVE-2022-23521 (published 2023-01-17T23:15Z)

Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a `.gitattributes` file to the repository, which contains a set of file patterns and the attributes that should be set for paths matching this pattern. When parsing gitattributes, multiple integer overflows can occur when there is a huge number of path patterns, a huge number of attributes for a single pattern, or when the declared attribute names are huge. These overflows can be triggered via a crafted `.gitattributes` file that may be part of the commit history. Git silently splits lines longer than 2KB when parsing gitattributes from a file, but not when parsing them from the index. Consequentially, the failure mode depends on whether the file exists in the working tree, the index or both. This integer overflow can result in arbitrary heap reads and writes, which may result in remote code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. There are no known workarounds for this issue.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/git/git
commit_details: repo_url: https://github.com/git/git
author: Junio C Hamano
author_date: 2023-01-16 12:11:58-08:00
msg: Sync with 2.39.1
repository: repo_url: https://github.com/git/git
repo_name: git/git
description: Git Source Code Mirror - This is a publish-only repository but pull requests can be turned into patches to the mailing list via GitGitGadget (https://gitgitgadget.github.io/). Please follow Documentation/SubmittingPatches procedure for any of your improvements.
repo_language: C
owner: git