starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2016-5728 (published 2016-06-27T10:59Z)

Race condition in the vop_ioctl function in drivers/misc/mic/vop/vop_vringh.c in the MIC VOP driver in the Linux kernel before 4.6.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (memory corruption and system crash) by changing a certain header, aka a "double fetch" vulnerability.

Severity: MEDIUM
CVSS v2 base score: 5.4 (AV:L/AC:M/Au:N/C:P/I:N/A:C)
CVSS v3 base score: 6.3, MEDIUM (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Ashutosh Dixit
author_date: 2016-04-27 14:36:05-07:00
msg: misc: mic: Fix for double fetch security bug in VOP driver

The MIC VOP driver does two successive reads from user space to read a
variable length data structure. Kernel memory corruption can result if
the data structure changes between the two reads. This patch disallows
the chance of this happening.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=116651
Reported by: Pengfei Wang <wpengfeinudt@gmail.com>
Reviewed-by: Sudeep Dutt <sudeep.dutt@intel.com>
Signed-off-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: vop_vringh.c
change_type: ModificationType.MODIFY
diff: @@ -945,6 +945,11 @@ static long vop_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
 			ret = -EFAULT;
 			goto free_ret;
 		}
+		/* Ensure desc has not changed between the two reads */
+		if (memcmp(&dd, dd_config, sizeof(dd))) {
+			ret = -EINVAL;
+			goto free_ret;
+		}
 		mutex_lock(&vdev->vdev_mutex);
 		mutex_lock(&vi->vop_mutex);
 		ret = vop_virtio_add_device(vdev, dd_config);

programming_language: C
CVE-2013-4701 (published 2013-08-21T16:55Z)

Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/openid/php-openid
commit_details: repo_url: https://github.com/openid/php-openid
author: Will Norris
author_date: 2013-08-11 18:41:28-07:00
msg: disable external XML entities and libxml errors

thanks to Kousuke Ebihara for the report and patch.
repository: repo_url: https://github.com/openid/php-openid
repo_name: openid/php-openid
description: OpenID library for PHP5
repo_language: PHP
owner: openid
file_changes: filename: XML.php
change_type: ModificationType.MODIFY
diff: @@ -234,7 +234,14 @@ class Auth_Yadis_dom extends Auth_Yadis_XMLParser {
             return false;
         }
 
-        if (!@$this->doc->loadXML($xml_string)) {
+        // disable external entities and libxml errors
+        $loader = libxml_disable_entity_loader(true);
+        $errors = libxml_use_internal_errors(true);
+        $parse_result = @$this->doc->loadXML($xml_string);
+        libxml_disable_entity_loader($loader);
+        libxml_use_internal_errors($errors);
+
+        if (!$parse_result) {
             return false;
         }
 

programming_language: PHP
CVE-2022-2287 (published 2022-07-02T22:15Z)

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 7.1, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Bram Moolenaar
author_date: 2022-07-01 22:26:20+01:00
msg: patch 9.0.0021: invalid memory access when adding word to spell word list

Problem:    Invalid memory access when adding word with a control character to
            the internal spell word list.
Solution:   Disallow adding a word with control characters or a trailing
            slash.
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: spellfile.c
change_type: ModificationType.MODIFY
diff: @@ -4366,6 +4366,23 @@ wordtree_alloc(spellinfo_T *spin)
     return (wordnode_T *)getroom(spin, sizeof(wordnode_T), TRUE);
 }
 
+/*
+ * Return TRUE if "word" contains valid word characters.
+ * Control characters and trailing '/' are invalid.  Space is OK.
+ */
+    static int
+valid_spell_word(char_u *word)
+{
+    char_u *p;
+
+    if (enc_utf8 && !utf_valid_string(word, NULL))
+	return FALSE;
+    for (p = word; *p != NUL; p += mb_ptr2len(p))
+	if (*p < ' ' || (p[0] == '/' && p[1] == NUL))
+	    return FALSE;
+    return TRUE;
+}
+
 /*
  * Store a word in the tree(s).
  * Always store it in the case-folded tree.  For a keep-case word this is
@@ -4391,7 +4408,7 @@ store_word(
     char_u	*p;
 
     // Avoid adding illegal bytes to the word tree.
-    if (enc_utf8 && !utf_valid_string(word, NULL))
+    if (!valid_spell_word(word))
 	return FAIL;
 
     (void)spell_casefold(curwin, word, len, foldword, MAXWLEN);
@@ -6194,7 +6211,7 @@ spell_add_word(
     int		i;
     char_u	*spf;
 
-    if (enc_utf8 && !utf_valid_string(word, NULL))
+    if (!valid_spell_word(word))
     {
 	emsg(_(e_illegal_character_in_word));
 	return;

programming_language: Scala
filename: test_spell.vim
change_type: ModificationType.MODIFY
diff: @@ -854,6 +854,21 @@ func Test_spellsuggest_too_deep()
   bwipe!
 endfunc
 
+func Test_spell_good_word_invalid()
+  " This was adding a word with a 0x02 byte, which causes havoc.
+  enew
+  norm o0
+  sil! norm rzzWs00/
+  2
+  sil! norm VzGprzzW
+  sil! norm z=
+
+  bwipe!
+  " clear the internal word list
+  set enc=latin1
+  set enc=utf-8
+endfunc
+
 func LoadAffAndDic(aff_contents, dic_contents)
   set enc=latin1
   set spellfile=

programming_language: Lua
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -735,6 +735,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    21,
 /**/
     20,
 /**/

programming_language: Ruby
CVE-2024-34341 (published 2024-05-07T16:15Z)

Trix is a rich text editor. The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary code execution when copying and pasting content from the web or other documents with markup into the editor. The vulnerability stems from improper sanitization of pasted content, allowing an attacker to embed malicious scripts which are executed within the context of the application. Users should upgrade to Trix editor version 2.1.1 or later, which incorporates proper sanitization of input from copied content.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/basecamp/trix
commit_details: repo_url: https://github.com/basecamp/trix
author: Alberto Fernández-Capel
author_date: 2024-05-01 15:22:41+01:00
msg: Merge pull request #1149 from basecamp/paste-html-sanitize

Sanitize HTML content in data-trix-* attributes
repository: repo_url: https://github.com/basecamp/trix
repo_name: basecamp/trix
description: A rich text editor for everyday writing
repo_language: JavaScript
owner: basecamp
repo_url: https://github.com/basecamp/trix
commit_details: repo_url: https://github.com/basecamp/trix
author: Alberto Fernández-Capel
author_date: 2024-04-26 16:10:14+01:00
msg: Merge pull request #1147 from basecamp/sanitize-noscript

Sanitize noscript to prevent copy and paste XSS
repository: repo_url: https://github.com/basecamp/trix
repo_name: basecamp/trix
description: A rich text editor for everyday writing
repo_language: JavaScript
owner: basecamp
CVE-2022-41903 (published 2023-01-17T23:15Z)

Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the padding operators, there is a integer overflow in `pretty.c::format_and_pad_commit()` where a `size_t` is stored improperly as an `int`, and then added as an offset to a `memcpy()`. This overflow can be triggered directly by a user running a command which invokes the commit formatting machinery (e.g., `git log --format=...`). It may also be triggered indirectly through git archive via the export-subst mechanism, which expands format specifiers inside of files within the repository during a git archive. This integer overflow can result in arbitrary heap writes, which may result in arbitrary code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. Users who are unable to upgrade should disable `git archive` in untrusted repositories. If you expose git archive via `git daemon`, disable it by running `git config --global daemon.uploadArch false`.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/git/git
commit_details: repo_url: https://github.com/git/git
author: Junio C Hamano
author_date: 2023-01-16 12:11:58-08:00
msg: Sync with 2.39.1
repository: repo_url: https://github.com/git/git
repo_name: git/git
description: Git Source Code Mirror - This is a publish-only repository but pull requests can be turned into patches to the mailing list via GitGitGadget (https://gitgitgadget.github.io/). Please follow Documentation/SubmittingPatches procedure for any of your improvements.
repo_language: C
owner: git
CVE-2020-7758 (published 2020-11-02T22:15Z)

This affects versions of package browserless-chrome before 1.40.2-chrome-stable. User input flowing from the workspace endpoint gets used to create a file path filePath and this is fetched and then sent back to a user. This can be escaped to fetch arbitrary files from a server.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/browserless/chrome
commit_details: repo_url: https://github.com/browserless/chrome
author: Joel Griffith
author_date: 2020-10-26 10:28:01-07:00
msg: Ensure workspace files are _in_ the workspace DIR
repository: repo_url: https://github.com/browserless/chrome
repo_name: browserless/browserless
description: Deploy headless browsers in Docker. Run on our cloud or bring your own. Free for non-commercial uses.
repo_language: TypeScript
owner: browserless
file_changes: filename: routes.ts
change_type: ModificationType.MODIFY
diff: @@ -157,9 +157,12 @@ export const getRoutes = ({
       }
 
       const filePath = path.join(workspaceDir, file);
-
       const hasFile = await exists(filePath);
 
+      if (!filePath.includes(workspaceDir)) {
+        return res.sendStatus(404);
+      }
+
       if (!hasFile) {
         return res.sendStatus(404);
       }
@@ -185,6 +188,10 @@ export const getRoutes = ({
       const filePath = path.join(workspaceDir, file);
       const hasFile = await exists(filePath);
 
+      if (!filePath.includes(workspaceDir)) {
+        return res.sendStatus(404);
+      }
+
       if (!hasFile) {
         return res.sendStatus(404);
       }

programming_language: TypeScript
CVE-2016-5314 (published 2018-03-12T02:29Z)

Buffer overflow in the PixarLogDecode function in tif_pixarlog.c in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted TIFF image, as demonstrated by overwriting the vgetparent function pointer with rgb2ycbcr.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/vadz/libtiff
commit_details: repo_url: https://github.com/vadz/libtiff
author: erouault
author_date: 2016-06-28 15:12:19+00:00
msg: * libtiff/tif_pixarlog.c: fix potential buffer write overrun in
PixarLogDecode() on corrupted/unexpected images (reported by Mathias Svensson)
repository: repo_url: https://github.com/vadz/libtiff
repo_name: vadz/libtiff
description: OBSOLETE and not updated any more libtiff mirror, see website for the new one
repo_language: C
owner: vadz
file_changes: filename: ChangeLog
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,8 @@
+2016-06-28  Even Rouault <even.rouault at spatialys.com>
+
+	* libtiff/tif_pixarlog.c: fix potential buffer write overrun in
+	PixarLogDecode() on corrupted/unexpected images (reported by Mathias Svensson)
+
 2016-06-15  Bob Friesenhahn  <bfriesen@simple.dallas.tx.us>
 
 	* libtiff/libtiff.def: Added _TIFFMultiply32 and _TIFFMultiply64

programming_language: Markdown
filename: tif_pixarlog.c
change_type: ModificationType.MODIFY
diff: @@ -459,6 +459,7 @@ horizontalAccumulate8abgr(uint16 *wp, int n, int stride, unsigned char *op,
 typedef	struct {
 	TIFFPredictorState	predict;
 	z_stream		stream;
+	tmsize_t		tbuf_size; /* only set/used on reading for now */
 	uint16			*tbuf; 
 	uint16			stride;
 	int			state;
@@ -694,6 +695,7 @@ PixarLogSetupDecode(TIFF* tif)
 	sp->tbuf = (uint16 *) _TIFFmalloc(tbuf_size);
 	if (sp->tbuf == NULL)
 		return (0);
+	sp->tbuf_size = tbuf_size;
 	if (sp->user_datafmt == PIXARLOGDATAFMT_UNKNOWN)
 		sp->user_datafmt = PixarLogGuessDataFmt(td);
 	if (sp->user_datafmt == PIXARLOGDATAFMT_UNKNOWN) {
@@ -783,6 +785,12 @@ PixarLogDecode(TIFF* tif, uint8* op, tmsize_t occ, uint16 s)
 		TIFFErrorExt(tif->tif_clientdata, module, "ZLib cannot deal with buffers this size");
 		return (0);
 	}
+	/* Check that we will not fill more than what was allocated */
+	if (sp->stream.avail_out > sp->tbuf_size)
+	{
+		TIFFErrorExt(tif->tif_clientdata, module, "sp->stream.avail_out > sp->tbuf_size");
+		return (0);
+	}
 	do {
 		int state = inflate(&sp->stream, Z_PARTIAL_FLUSH);
 		if (state == Z_STREAM_END) {

programming_language: C
CVE-2023-1211 (published 2023-03-07T00:15Z)

SQL Injection in GitHub repository phpipam/phpipam prior to v1.5.2.

CVSS v3 base score: 7.2, HIGH (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/phpipam/phpipam
commit_details: repo_url: https://github.com/phpipam/phpipam
author: Gary Allan
author_date: 2023-03-05 22:32:48+00:00
msg: Bugfix: SQL injection in custom field enum/set types

Reported by Peng Zhou @zpbrent
repository: repo_url: https://github.com/phpipam/phpipam
repo_name: phpipam/phpipam
description: phpipam development repository
repo_language: PHP
owner: phpipam
file_changes: filename: class.Admin.php
change_type: ModificationType.MODIFY
diff: @@ -673,7 +673,7 @@ class Admin extends Common_functions {
 
 	    # set type definition and size of needed
 	    if($field['fieldType']=="bool" || $field['fieldType']=="text" || $field['fieldType']=="date" || $field['fieldType']=="datetime")	{ $field['ftype'] = $field['fieldType']; }
-	    else																																{ $field['ftype'] = $field['fieldType']."(".$field['fieldSize'].")"; }
+	    else																																{ $field['ftype'] = $field['fieldType']."( :enumset )"; }
 
 	    # default value null
 	    $field['fieldDefault'] = is_blank($field['fieldDefault']) ? NULL : $field['fieldDefault'];
@@ -709,6 +709,7 @@ class Admin extends Common_functions {
 	    $params = array();
 	    if (strpos($query, ":default")>0)	$params['default'] = $field['fieldDefault'];
 	    if (strpos($query, ":comment")>0)	$params['comment'] = $field['Comment'];
+	    if (strpos($query, ":enumset")>0)	$params['enumset'] = $field['fieldSize'];
 
 		# execute
 		try { $res = $this->Database->runQuery($query, $params); }

programming_language: PHP
filename: CHANGELOG
change_type: ModificationType.MODIFY
diff: @@ -7,6 +7,7 @@
 
     Security Fixes:
     ----------------------------
+    + SQL injection in custom field enum/set types;
     + XSS (reflected) in 'bw-calulator-result.php';
     + XSS (reflected) by invalid email address response;
     + XSS (reflected) by /app/tools/subnet-masks/popup.php (#3738);

programming_language: TypeScript
CVE-2015-1839 (published 2017-04-13T14:59Z)

modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)

Weakness information:
cwe_id: CWE-19
cwe_name: Data Processing Errors
description: Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.

Fix information:
repo_url: https://github.com/saltstack/salt
commit_details: repo_url: https://github.com/saltstack/salt
author: Colton Myers
author_date: 2015-03-25 14:29:26-06:00
msg: Create randomized logfile name in windows for chef.py
repository: repo_url: https://github.com/saltstack/salt
repo_name: saltstack/salt
description: Software to automate the management and configuration of any infrastructure or application at scale. Get access to the Salt software package repository here: 
repo_language: Python
owner: saltstack
file_changes: filename: chef.py
change_type: ModificationType.MODIFY
diff: @@ -6,6 +6,7 @@ Execute chef in server or solo mode
 # Import Python libs
 import logging
 import os
+import tempfile
 
 # Import Salt libs
 import salt.utils
@@ -24,12 +25,16 @@ def __virtual__():
 
 
 def _default_logfile(exe_name):
-
+    '''
+    Retrieve the logfile name
+    '''
     if salt.utils.is_windows():
-        logfile = salt.utils.path_join(
-            os.environ['TMP'],
-            '{0}.log'.format(exe_name)
-        )
+        logfile_tmp = tempfile.NamedTemporaryFile(dir=os.environ['TMP'],
+                                                  prefix=exe_name,
+                                                  suffix='.log',
+                                                  delete=False)
+        logfile = logfile_tmp.name
+        logfile_tmp.close()
     else:
         logfile = salt.utils.path_join(
             '/var/log',

programming_language: Python
repo_url: https://github.com/saltstack/salt
commit_details: repo_url: https://github.com/saltstack/salt
author: Colton Myers
author_date: 2015-03-25 16:01:20-06:00
msg: Use cachedir
repository: repo_url: https://github.com/saltstack/salt
repo_name: saltstack/salt
description: Software to automate the management and configuration of any infrastructure or application at scale. Get access to the Salt software package repository here: 
repo_language: Python
owner: saltstack
file_changes: filename: chef.py
change_type: ModificationType.MODIFY
diff: @@ -29,7 +29,10 @@ def _default_logfile(exe_name):
     Retrieve the logfile name
     '''
     if salt.utils.is_windows():
-        logfile_tmp = tempfile.NamedTemporaryFile(dir=os.environ['TMP'],
+        tmp_dir = os.path.join(__opts__['cachedir'], 'tmp')
+        if not os.path.isdir(tmp_dir):
+            os.mkdir(tmp_dir)
+        logfile_tmp = tempfile.NamedTemporaryFile(dir=tmp_dir,
                                                   prefix=exe_name,
                                                   suffix='.log',
                                                   delete=False)

programming_language: Python