starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2021-37638 (published 2021-08-12T19:15Z)

TensorFlow is an end-to-end open source platform for machine learning. Sending invalid argument for `row_partition_types` of `tf.raw_ops.RaggedTensorToTensor` API results in a null pointer dereference and undefined behavior. The [implementation](https://github.com/tensorflow/tensorflow/blob/47a06f40411a69c99f381495f490536972152ac0/tensorflow/core/kernels/ragged_tensor_to_tensor_op.cc#L328) accesses the first element of a user supplied list of values without validating that the provided list is not empty. We have patched the issue in GitHub commit 301ae88b331d37a2a16159b65b255f4f9eb39314. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Laura Pak
author_date: 2021-07-12 09:59:54-07:00
msg: Fix null ptr deref in tf.raw_ops.RaggedTensorToTensor

PiperOrigin-RevId: 384257511
Change-Id: I0484ad285039d132d6c41b284a7fcdd2b774a38e
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: ragged_tensor_to_tensor_op.cc
change_type: ModificationType.MODIFY
diff: @@ -348,6 +348,9 @@ class RaggedTensorToTensorBaseOp : public OpKernel {
   Status GetFirstDimensionSize(OpKernelContext* context, INDEX_TYPE* result) {
     const Tensor first_partition_tensor =
         context->input(kFirstPartitionInputIndex);
+    if (row_partition_types_.empty()) {
+      return errors::InvalidArgument("No row_partition_types given.");
+    }
     const RowPartitionType first_partition_type = row_partition_types_[0];
     switch (first_partition_type) {
       case RowPartitionType::FIRST_DIM_SIZE:

programming_language: C++
CVE-2021-43852 (published 2022-01-04T20:15Z)

OroPlatform is a PHP Business Application Platform. In affected versions by sending a specially crafted request, an attacker could inject properties into existing JavaScript language construct prototypes, such as objects. Later this injection may lead to JS code execution by libraries that are vulnerable to Prototype Pollution. This issue has been patched in version 4.2.8. Users unable to upgrade may configure a firewall to drop requests containing next strings: `__proto__` , `constructor[prototype]`, and `constructor.prototype` to mitigate this issue.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-1321
cwe_name: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
extended_description: 
				By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the product depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf).
				This weakness is usually exploited by using a special attribute of objects called proto,  constructor or prototype. Such attributes give access to the object prototype. This weakness is often found in code that assigns object attributes based on user input, or merges or clones objects recursively.
			
			

Fix information:
repo_url: https://github.com/oroinc/platform
commit_details: repo_url: https://github.com/oroinc/platform
author: Hryhorii Hrebiniuk
author_date: 2021-12-24 17:40:19+02:00
msg: BAP-21092: JavaScript Prototype Pollution (#31464)
repository: repo_url: https://github.com/oroinc/platform
repo_name: oroinc/platform
description: Main OroPlatform package with core functionality.
repo_language: PHP
owner: oroinc
file_changes: filename: tools.js
change_type: ModificationType.MODIFY
diff: @@ -85,6 +85,10 @@ define(function(require) {
                 query = query.slice(1);
             }
             const setValue = function(root, path, value) {
+                if (path[0] === '__proto__') {
+                    // Prevent Object.prototype pollution
+                    return;
+                }
                 if (path.length > 1) {
                     const dir = path.shift();
                     if (typeof root[dir] === 'undefined') {

programming_language: JavaScript
CVE-2023-48221 (published 2023-11-20T18:15Z)

wire-avs provides Audio, Visual, and Signaling (AVS) functionality sure the secure messaging software Wire. Prior to versions 9.2.22 and 9.3.5, a remote format string vulnerability could potentially allow an attacker to cause a denial of service or possibly execute arbitrary code. The issue has been fixed in wire-avs 9.2.22 & 9.3.5 and is already included on all Wire products. No known workarounds are available.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-134
cwe_name: Use of Externally-Controlled Format String
description: The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
extended_description: 
            When an attacker can modify an externally-controlled format string, this can lead to buffer overflows, denial of service, or data representation problems.
            It should be noted that in some circumstances, such as internationalization, the set of format strings is externally controlled by design. If the source of these format strings is trusted (e.g. only contained in library files that are only modifiable by the system administrator), then the external control might not itself pose a vulnerability.
         
         

Fix information:
repo_url: https://github.com/wireapp/wire-avs
commit_details: repo_url: https://github.com/wireapp/wire-avs
author: Dusan Stevanovic
author_date: 2023-07-14 17:24:28+02:00
msg: Merge branch 'release-9.2' into release-9.3
repository: repo_url: https://github.com/wireapp/wire-avs
repo_name: wireapp/wire-avs
description: Audio Video Signaling (AVS)
repo_language: C
owner: wireapp
CVE-2020-36281 (published 2021-03-12T01:15Z)

Leptonica before 1.80.0 allows a heap-based buffer over-read in pixFewColorsOctcubeQuantMixed in colorquant1.c.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/DanBloomberg/leptonica
commit_details: repo_url: https://github.com/DanBloomberg/leptonica
author: Dan Bloomberg
author_date: 2020-05-11 11:17:30-07:00
msg: Fixed issue 22140 in oss-fuzz: Heap-buffer-overflow
* color quantized pix must be 8 bpp before extra colors are added.
repository: repo_url: https://github.com/DanBloomberg/leptonica
repo_name: DanBloomberg/leptonica
description: Leptonica is an open source library containing software that is broadly useful for image processing and image analysis applications. The official github repository for Leptonica is: danbloomberg/leptonica.  See leptonica.org for more documentation.
repo_language: C
owner: DanBloomberg
file_changes: filename: colorquant1.c
change_type: ModificationType.MODIFY
diff: @@ -3315,7 +3315,7 @@ l_int32    i, j, w, h, wplc, wplm, wpld, ncolors, index;
 l_int32    rval, gval, bval, val, minval, maxval;
 l_int32   *lut;
 l_uint32  *datac, *datam, *datad, *linec, *linem, *lined;
-PIX       *pixc, *pixm, *pixg, *pixd;
+PIX       *pix1, *pixc, *pixm, *pixg, *pixd;
 PIXCMAP   *cmap, *cmapd;
 
     PROCNAME("pixFewColorsOctcubeQuantMixed");
@@ -3332,8 +3332,10 @@ PIXCMAP   *cmap, *cmapd;
     if (maxspan <= 2) maxspan = 15;
 
         /* Start with a simple fixed octcube quantizer. */
-    if ((pixc = pixFewColorsOctcubeQuant1(pixs, level)) == NULL)
+    if ((pix1 = pixFewColorsOctcubeQuant1(pixs, level)) == NULL)
         return (PIX *)ERROR_PTR("too many colors", procName, NULL);
+    pixc = pixConvertTo8(pix1, 1);  /* must be 8 bpp */
+    pixDestroy(&pix1);
 
         /* Identify and save color entries in the colormap.  Set up a LUT
          * that returns -1 for any gray pixel. */

programming_language: C
CVE-2020-27678 (published 2020-10-26T12:17Z)

An issue was discovered in illumos before 2020-10-22, as used in OmniOS before r151030by, r151032ay, and r151034y and SmartOS before 20201022. There is a buffer overflow in parse_user_name in lib/libpam/pam_framework.c.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-120
cwe_name: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
extended_description: A buffer overflow condition exists when a product attempts to put more data in a buffer than it can hold, or when it attempts to put data in a memory area outside of the boundaries of a buffer. The simplest type of error, and the most common cause of buffer overflows, is the "classic" case in which the product copies the buffer without restricting how much is copied. Other variants exist, but the existence of a classic overflow strongly suggests that the programmer is not considering even the most basic of security protections.
         

Fix information:
repo_url: https://github.com/illumos/illumos-gate
commit_details: repo_url: https://github.com/illumos/illumos-gate
author: Dan McDonald
author_date: 2020-10-22 08:34:07-04:00
msg: 13242 parse_user_name in PAM is sloppy
Reviewed by: Alex Wilson <alex@cooperi.net>
Approved by: Gordon Ross <gordon.w.ross@gmail.com>
repository: repo_url: https://github.com/illumos/illumos-gate
repo_name: illumos/illumos-gate
description: An open-source Unix operating system
repo_language: C
owner: illumos
file_changes: filename: pam_framework.c
change_type: ModificationType.MODIFY
diff: @@ -24,7 +24,7 @@
  */
 
 /*
- * Copyright (c) 2019, Joyent, Inc.
+ * Copyright 2020, Joyent, Inc.
  */
 
 #include <syslog.h>
@@ -656,9 +656,10 @@ parse_user_name(char *user_input, char **ret_username)
 	 * - we skip leading whitespaces and ignore trailing whitespaces
 	 */
 	while (*ptr != '\0') {
-		if ((*ptr == ' ') || (*ptr == '\t'))
+		if ((*ptr == ' ') || (*ptr == '\t') ||
+		    (index >= PAM_MAX_RESP_SIZE)) {
 			break;
-		else {
+		} else {
 			username[index] = *ptr;
 			index++;
 			ptr++;
@@ -666,9 +667,9 @@ parse_user_name(char *user_input, char **ret_username)
 	}
 
 	/* ret_username will be freed in pam_get_user(). */
-	if ((*ret_username = malloc(index + 1)) == NULL)
+	if (index >= PAM_MAX_RESP_SIZE ||
+	    (*ret_username = strdup(username)) == NULL)
 		return (PAM_BUF_ERR);
-	(void) strcpy(*ret_username, username);
 	return (PAM_SUCCESS);
 }
 

programming_language: C
CVE-2020-35460 (published 2020-12-14T23:15Z)

common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/joniles/mpxj
commit_details: repo_url: https://github.com/joniles/mpxj
author: Jon Iles
author_date: 2020-12-14 12:13:14+00:00
msg: zip slip fix
repository: repo_url: https://github.com/joniles/mpxj
repo_name: joniles/mpxj
description: Primary repository for MPXJ library
repo_language: Java
owner: joniles
file_changes: filename: InputStreamHelper.java
change_type: ModificationType.MODIFY
diff: @@ -114,6 +114,7 @@ public class InputStreamHelper
     */
    private static void processZipStream(File dir, InputStream inputStream) throws IOException
    {
+      String canonicalDestinationDirPath = dir.getCanonicalPath();
       ZipInputStream zip = new ZipInputStream(inputStream);
       while (true)
       {
@@ -124,6 +125,14 @@ public class InputStreamHelper
          }
 
          File file = new File(dir, entry.getName());
+
+         // https://snyk.io/research/zip-slip-vulnerability
+         String canonicalDestinationFile = file.getCanonicalPath();
+         if (!canonicalDestinationFile.startsWith(canonicalDestinationDirPath + File.separator))
+         {
+            throw new IOException("Entry is outside of the target dir: " + entry.getName());
+         }
+
          if (entry.isDirectory())
          {
             FileHelper.mkdirsQuietly(file);

programming_language: Java
CVE-2023-3820 (published 2023-07-21T15:15Z)

 SQL Injection in GitHub repository pimcore/pimcore prior to 10.6.4.

CVSS v3 base score: 7.2, HIGH (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/pimcore/pimcore
commit_details: repo_url: https://github.com/pimcore/pimcore
author: JiaJia Ji
author_date: 2023-07-13 12:50:59+02:00
msg: [Bug]: Quote sorting key (#15523)

* quote sorting key

* add quoting to order key with `?` case too

* refactor, no need to get Db

* break line to fix codesmell

* improve spacing

* remove trailing space
repository: repo_url: https://github.com/pimcore/pimcore
repo_name: pimcore/pimcore
description: Core Framework for the Open Source Data & Experience Management Platform (PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce)
repo_language: PHP
owner: pimcore
file_changes: filename: GridHelperService.php
change_type: ModificationType.MODIFY
diff: @@ -571,15 +571,16 @@ class GridHelperService
                     if (strpos($orderKey, '?') !== false) {
                         $brickDescriptor = substr($orderKeyParts[0], 1);
                         $brickDescriptor = json_decode($brickDescriptor, true);
-                        $db = Db::get();
-                        $orderKey = $db->quoteIdentifier($brickDescriptor['containerKey'] . '_localized') . '.' . $db->quoteIdentifier($brickDescriptor['brickfield']);
+                        $orderKey = $list->quoteIdentifier($brickDescriptor['containerKey'] . '_localized')
+                            . '.' . $list->quoteIdentifier($brickDescriptor['brickfield']);
                         $doNotQuote = true;
                     } elseif (count($orderKeyParts) === 2) {
-                        $orderKey = $orderKeyParts[0].'.'.$orderKeyParts[1];
+                        $orderKey = $list->quoteIdentifier($orderKeyParts[0])
+                            . '.' . $list->quoteIdentifier($orderKeyParts[1]);
                         $doNotQuote = true;
                     }
                 } else {
-                    $orderKey = $list->getDao()->getTableName().'.'.$orderKey;
+                    $orderKey = $list->getDao()->getTableName() . '.' . $list->quoteIdentifier($orderKey);
                     $doNotQuote = true;
                 }
             }

programming_language: PHP
CVE-2015-0796 (published 2018-03-02T20:29Z)

In open buildservice 2.6 before 2.6.3, 2.5 before 2.5.7 and 2.4 before 2.4.8 the source service patch application could generate non-standard files like symlinks or device nodes, which could allow buildservice users to break of confinement or cause denial of service attacks on the source service.

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-59
cwe_name: Improper Link Resolution Before File Access ('Link Following')
description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/openSUSE/open-build-service
commit_details: repo_url: https://github.com/openSUSE/open-build-service
author: Michael Schroeder
author_date: 2015-08-10 13:05:34+02:00
msg: [backend] sanity check the result of the external patch command

Simple files only, please.
repository: repo_url: https://github.com/openSUSE/open-build-service
repo_name: openSUSE/open-build-service
description: Build and distribute Linux packages from sources in an automatic, consistent and reproducible way #obs
repo_language: Ruby
owner: openSUSE
file_changes: filename: bs_srcserver
change_type: ModificationType.MODIFY
diff: @@ -1979,10 +1979,28 @@ sub applylink {
       die("/usr/bin/patch: $!\n");
     }
     waitpid($pid, 0) == $pid || die("waitpid $pid: $!\n");
-    if ($?) {
-      $failed = "could not apply patch '$pn'";
-      last;
+    $failed = "could not apply patch '$pn'" if $?;
+    # clean up patch fallout...
+    for my $f (ls($tmpdir)) {
+      my @s = lstat("$tmpdir/$f");
+      die("$tmpdir/$f: $!\n") unless @s;
+      if (-l _ || ! -f _) {
+        unlink("$tmpdir/$f");
+	$failed = "patch created a non-file";
+	next;
+      }
+      eval {
+	die("cannot create a link from a patch") if $f eq '_link';
+	BSVerify::verify_filename($f) unless $f eq '.log';
+      };
+      if ($@) {
+        unlink("$tmpdir/$f");
+	$failed = "patch created an illegal file";
+	next;
+      }
+      chmod(($s[2] & 077) | 0600, "$tmpdir/$f") if ($s[2] & 07700) != 0600;
     }
+    last if $failed;
   }
   if ($failed) {
     local *F;

programming_language: Perl
CVE-2021-31606 (published 2021-09-27T06:15Z)

furlongm openvpn-monitor through 1.1.3 allows Authorization Bypass to disconnect arbitrary clients.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/furlongm/openvpn-monitor
commit_details: repo_url: https://github.com/furlongm/openvpn-monitor
author: Marcus Furlong
author_date: 2021-07-01 15:44:59-04:00
msg: only allow disconnect if feature is enabled and sanitize args (#204)
repository: repo_url: https://github.com/furlongm/openvpn-monitor
repo_name: furlongm/openvpn-monitor
description: openvpn-monitor is a web based OpenVPN monitor, that shows current connection information, such as users, location and data transferred.
repo_language: Python
owner: furlongm
file_changes: filename: openvpn-monitor.py
change_type: ModificationType.MODIFY
diff: @@ -180,18 +180,26 @@ class OpenvpnMgmtInterface(object):
 
         if kwargs.get('vpn_id'):
             vpn = self.vpns[kwargs['vpn_id']]
-            self._socket_connect(vpn)
-            if vpn['socket_connected']:
-                release = self.send_command('version\n')
-                version = semver(self.parse_version(release).split(' ')[1])
-                if version.major == 2 and \
-                        version.minor >= 4 and \
-                        kwargs.get('client_id'):
-                    command = 'client-kill {0!s}\n'.format(kwargs['client_id'])
-                else:
-                    command = 'kill {0!s}:{1!s}\n'.format(kwargs['ip'], kwargs['port'])
-                self.send_command(command)
-                self._socket_disconnect()
+            disconnection_allowed = vpn['show_disconnect']
+            if disconnection_allowed:
+                self._socket_connect(vpn)
+                if vpn['socket_connected']:
+                    release = self.send_command('version\n')
+                    version = semver(self.parse_version(release).split(' ')[1])
+                    command = False
+                    client_id = int(kwargs.get('client_id'))
+                    if version.major == 2 and \
+                            version.minor >= 4 and \
+                            client_id:
+                        command = 'client-kill {0!s}\n'.format(client_id)
+                    else:
+                        ip = ip_address(kwargs['ip'])
+                        port = int(kwargs['port'])
+                        if ip and port:
+                            command = 'kill {0!s}:{1!s}\n'.format(ip, port)
+                    if command:
+                        self.send_command(command)
+                    self._socket_disconnect()
 
         geoip_data = cfg.settings['geoip_data']
         self.geoip_version = None

programming_language: Python