starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2022-23574 (published 2022-02-04T23:15Z)

Tensorflow is an Open Source Machine Learning Framework. There is a typo in TensorFlow's `SpecializeType` which results in heap OOB read/write. Due to a typo, `arg` is initialized to the `i`th mutable argument in a loop where the loop index is `j`. Hence it is possible to assign to `arg` from outside the vector of arguments. Since this is a mutable proto value, it allows both read and write to outside of bounds data. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, and TensorFlow 2.6.3, as these are also affected and still in supported range.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Mihai Maruseac
author_date: 2021-11-09 04:44:43-08:00
msg: Fix heap OOB read/write due to incorrect indexing.

PiperOrigin-RevId: 408578046
Change-Id: Ifc9ffea49e5890f55fcb2c27568611052c3ddcfa
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: full_type_util.cc
change_type: ModificationType.MODIFY
diff: @@ -100,7 +100,7 @@ StatusOr<FullTypeDef> SpecializeType(const AttrSlice& attrs,
     // verifications are needed, they should be done by separately, and in a
     // way that can be reused for type inference.
     for (int j = 0; j < t->args_size(); j++) {
-      auto* arg = t->mutable_args(i);
+      auto* arg = t->mutable_args(j);
       if (arg->type_id() == TFT_VAR) {
         const auto* attr = attrs.Find(arg->s());
         if (attr == nullptr) {

programming_language: C++
CVE-2011-4611 (published 2012-05-17T11:00Z)

Integer overflow in the perf_event_interrupt function in arch/powerpc/kernel/perf_event.c in the Linux kernel before 2.6.39 on powerpc platforms allows local users to cause a denial of service (unhandled performance monitor exception) via vectors that trigger certain outcomes of performance events.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)

Weakness information:
cwe_id: CWE-189
cwe_name: Numeric Errors
description: Weaknesses in this category are related to improper calculation or conversion of numbers.

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Anton Blanchard
author_date: 2011-03-09 14:38:42+11:00
msg: perf, powerpc: Handle events that raise an exception without overflowing

Events on POWER7 can roll back if a speculative event doesn't
eventually complete. Unfortunately in some rare cases they will
raise a performance monitor exception. We need to catch this to
ensure we reset the PMC. In all cases the PMC will be 256 or less
cycles from overflow.

Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: <stable@kernel.org> # as far back as it applies cleanly
LKML-Reference: <20110309143842.6c22845e@kryten>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: reg.h
change_type: ModificationType.MODIFY
diff: @@ -880,6 +880,7 @@
 #define PV_970		0x0039
 #define PV_POWER5	0x003A
 #define PV_POWER5p	0x003B
+#define PV_POWER7	0x003F
 #define PV_970FX	0x003C
 #define PV_630		0x0040
 #define PV_630p	0x0041

programming_language: C
filename: perf_event.c
change_type: ModificationType.MODIFY
diff: @@ -1269,6 +1269,28 @@ unsigned long perf_instruction_pointer(struct pt_regs *regs)
 	return ip;
 }
 
+static bool pmc_overflow(unsigned long val)
+{
+	if ((int)val < 0)
+		return true;
+
+	/*
+	 * Events on POWER7 can roll back if a speculative event doesn't
+	 * eventually complete. Unfortunately in some rare cases they will
+	 * raise a performance monitor exception. We need to catch this to
+	 * ensure we reset the PMC. In all cases the PMC will be 256 or less
+	 * cycles from overflow.
+	 *
+	 * We only do this if the first pass fails to find any overflowing
+	 * PMCs because a user might set a period of less than 256 and we
+	 * don't want to mistakenly reset them.
+	 */
+	if (__is_processor(PV_POWER7) && ((0x80000000 - val) <= 256))
+		return true;
+
+	return false;
+}
+
 /*
  * Performance monitor interrupt stuff
  */
@@ -1316,7 +1338,7 @@ static void perf_event_interrupt(struct pt_regs *regs)
 			if (is_limited_pmc(i + 1))
 				continue;
 			val = read_pmc(i + 1);
-			if ((int)val < 0)
+			if (pmc_overflow(val))
 				write_pmc(i + 1, 0);
 		}
 	}

programming_language: C
CVE-2024-30187 (published 2024-03-25T08:15Z)

Anope before 2.0.15 does not prevent resetting the password of a suspended account.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/anope/anope
commit_details: repo_url: https://github.com/anope/anope
author: Sadie Powell
author_date: 2024-02-17 19:31:38+00:00
msg: Prevent resetting the password of suspended accounts.

Closes #351.
repository: repo_url: https://github.com/anope/anope
repo_name: anope/anope
description: Anope IRC Services
repo_language: C++
owner: anope
file_changes: filename: ns_resetpass.cpp
change_type: ModificationType.MODIFY
diff: @@ -29,6 +29,8 @@ class CommandNSResetPass : public Command
 
 		if (!(na = NickAlias::Find(params[0])))
 			source.Reply(NICK_X_NOT_REGISTERED, params[0].c_str());
+		else if (na->nc->HasExt("NS_SUSPENDED"))
+			source.Reply(NICK_X_SUSPENDED, na->nc->display.c_str());
 		else if (!na->nc->email.equals_ci(params[1]))
 			source.Reply(_("Incorrect email address."));
 		else
@@ -89,6 +91,12 @@ class NSResetPass : public Module
 			if (na && ri)
 			{
 				NickCore *nc = na->nc;
+				if (nc->HasExt("NS_SUSPENDED"))
+				{
+					source.Reply(NICK_X_SUSPENDED, nc->display.c_str());
+					return EVENT_STOP;
+				}
+
 				const Anope::string &passcode = params[1];
 				if (ri->time < Anope::CurTime - 3600)
 				{

programming_language: C++
CVE-2024-38514 (published 2024-06-28T19:15Z)

NextChat is a cross-platform ChatGPT/Gemini UI. There is a Server-Side Request Forgery (SSRF) vulnerability due to a lack of validation of the `endpoint` GET parameter on the WebDav API endpoint. This SSRF can be used to perform arbitrary HTTPS request from the vulnerable instance (MKCOL, PUT and GET methods supported), or to target NextChat users and make them execute arbitrary JavaScript code in their browser. This vulnerability has been patched in version 2.12.4.\n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/ChatGPTNextWeb/ChatGPT-Next-Web
commit_details: repo_url: https://github.com/ChatGPTNextWeb/ChatGPT-Next-Web
author: fred-bf
author_date: 2024-06-24 14:33:31+08:00
msg: Merge pull request from GHSA-gph5-rx77-3pjg

fix: validate the url to avoid SSRF
repository: repo_url: https://github.com/ChatGPTNextWeb/ChatGPT-Next-Web
repo_name: ChatGPTNextWeb/ChatGPT-Next-Web
description: A cross-platform ChatGPT/Gemini UI (Web / PWA / Linux / Win / MacOS). 一键拥有你自己的跨平台 ChatGPT/Gemini 应用。
repo_language: TypeScript
owner: ChatGPTNextWeb