starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2020-5216 (published 2020-01-23T03:15Z)

In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection. Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy header with the remaining value of the original string. It will continue to create new headers for each newline. This has been fixed in 6.3.0, 5.2.0, and 3.9.0.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 5.8, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-74
cwe_name: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
extended_description: Software or other automated logic has certain assumptions about what constitutes data and control respectively. It is the lack of verification of these assumptions for user-controlled input that leads to injection problems. Injection problems encompass a wide variety of issues -- all mitigated in very different ways and usually attempted in order to alter the control flow of the process. For this reason, the most effective way to discuss these weaknesses is to note the distinct features that classify them as injection weaknesses. The most important issue to note is that all injection problems share one thing in common -- i.e., they allow for the injection of control plane data into the user-controlled data plane. This means that the execution of the process may be altered by sending code in through legitimate data channels, using no other mechanism. While buffer overflows, and many other flaws, involve the use of some further issue to gain execution, injection problems need only for the data to be parsed.
         

Fix information:
repo_url: https://github.com/twitter/secure_headers
commit_details: repo_url: https://github.com/twitter/secure_headers
author: Neil Matatall
author_date: 2020-01-21 13:03:11-10:00
msg: Merge pull request from GHSA-w978-rmpf-qmwg

Filter and warn on newlines in configurations
repository: repo_url: https://github.com/twitter/secure_headers
repo_name: github/secure_headers
description: Manages application of security headers with many safe defaults
repo_language: Ruby
owner: twitter
CVE-2022-23066 (published 2022-05-09T07:15Z)

In Solana rBPF versions 0.2.26 and 0.2.27 are affected by Incorrect Calculation which is caused by improper implementation of sdiv instruction. This can lead to the wrong execution path, resulting in huge loss in specific cases. For example, the result of a sdiv instruction may decide whether to transfer tokens or not. The vulnerability affects both integrity and may cause serious availability problems.

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:N/I:P/A:P)
CVSS v3 base score: 9.1, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)

Weakness information:
cwe_id: CWE-682
cwe_name: Incorrect Calculation
description: The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.
extended_description: When product performs a security-critical calculation incorrectly, it might lead to incorrect resource allocations, incorrect privilege assignments, or failed comparisons among other things. Many of the direct results of an incorrect calculation can lead to even larger problems such as failed protection mechanisms or even arbitrary code execution.
         

Fix information:
repo_url: https://github.com/solana-labs/rbpf
commit_details: repo_url: https://github.com/solana-labs/rbpf
author: Alessandro Decina
author_date: 2022-04-29 23:08:56+10:00
msg: jit: sign-extend the quotient register on sdiv32 (#310)
repository: repo_url: https://github.com/solana-labs/rbpf
repo_name: solana-labs/rbpf
description: Rust virtual machine and JIT compiler for eBPF programs
repo_language: Rust
owner: solana-labs
file_changes: filename: jit.rs
change_type: ModificationType.MODIFY
diff: @@ -913,7 +913,7 @@ fn emit_muldivmod<E: UserDefinedError>(jit: &mut JitCompiler, opc: u8, src: u8,
         X86Instruction::pop(RAX).emit(jit)?;
     }
 
-    if size == OperandSize::S32 && opc & ebpf::BPF_ALU_OP_MASK == ebpf::BPF_MUL {
+    if size == OperandSize::S32 && (mul || sdiv)  {
         X86Instruction::sign_extend_i32_to_i64(dst, dst).emit(jit)?;
     }
     Ok(())

programming_language: Rust
filename: ubpf_execution.rs
change_type: ModificationType.MODIFY
diff: @@ -838,6 +838,21 @@ fn test_sdiv32_imm() {
     );
 }
 
+#[test]
+fn test_sdiv32_neg_imm() {
+    test_interpreter_and_jit_asm!(
+        "
+        lddw r0, 0x10000000c
+        sdiv32 r0, -4
+        exit",
+        [],
+        (),
+        0,
+        { |_vm, res: Result| { res.unwrap() as i64 == -3 } },
+        3
+    );
+}
+
 #[test]
 fn test_sdiv32_reg() {
     test_interpreter_and_jit_asm!(
@@ -854,6 +869,22 @@ fn test_sdiv32_reg() {
     );
 }
 
+#[test]
+fn test_sdiv32_neg_reg() {
+    test_interpreter_and_jit_asm!(
+        "
+        lddw r0, 0x10000000c
+        mov r1, -4
+        sdiv32 r0, r1
+        exit",
+        [],
+        (),
+        0,
+        { |_vm, res: Result| { res.unwrap() as i64 == -0x3 } },
+        4
+    );
+}
+
 #[test]
 fn test_div64_imm() {
     test_interpreter_and_jit_asm!(

programming_language: Rust
CVE-2021-3839 (published 2022-08-23T16:15Z)

A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate `msg->payload.inflight.num_queues`, possibly causing out-of-bounds memory read/write. Any software using DPDK vhost library may crash as a result of this vulnerability.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/DPDK/dpdk
commit_details: repo_url: https://github.com/DPDK/dpdk
author: Chenbo Xia
author_date: 2022-02-14 16:32:37+08:00
msg: vhost: fix queue number check when setting inflight FD

In function vhost_user_set_inflight_fd, queue number in inflight
message is used to access virtqueue. However, queue number could
be larger than VHOST_MAX_VRING and cause write OOB as this number
will be used to write inflight info in virtqueue structure. This
patch checks the queue number to avoid the issue and also make
sure virtqueues are allocated before setting inflight information.

Fixes: ad0a4ae491fe ("vhost: checkout resubmit inflight information")
Cc: stable@dpdk.org

Reported-by: Wenxiang Qian <leonwxqian@gmail.com>
Signed-off-by: Chenbo Xia <chenbo.xia@intel.com>
Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>
repository: repo_url: https://github.com/DPDK/dpdk
repo_name: DPDK/dpdk
description: Data Plane Development Kit
repo_language: C
owner: DPDK
file_changes: filename: vhost_user.c
change_type: ModificationType.MODIFY
diff: @@ -2883,6 +2883,9 @@ vhost_user_check_and_alloc_queue_pair(struct virtio_net *dev,
 	case VHOST_USER_SET_VRING_ADDR:
 		vring_idx = ctx->msg.payload.addr.index;
 		break;
+	case VHOST_USER_SET_INFLIGHT_FD:
+		vring_idx = ctx->msg.payload.inflight.num_queues - 1;
+		break;
 	default:
 		return 0;
 	}

programming_language: C
CVE-2022-28071 (published 2023-08-22T19:16Z)

A use after free in r_reg_get_name_idx function in radare2 5.4.2 and 5.4.0.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/radareorg/radare2
commit_details: repo_url: https://github.com/radareorg/radare2
author: Sergi Àlvarez i Capilla
author_date: 2021-10-29 23:59:54+02:00
msg: Fix UAF in aaft (tests_64923) ##crash

Reported by giantbranch of NSFOCUS TIANJI Lab
repository: repo_url: https://github.com/radareorg/radare2
repo_name: radareorg/radare2
description: UNIX-like reverse engineering framework and command-line toolset
repo_language: C
owner: radareorg
file_changes: filename: anal_tp.c
change_type: ModificationType.MODIFY
diff: @@ -504,11 +504,12 @@ R_API void r_core_anal_type_match(RCore *core, RAnalFunction *fcn) {
 	char prev_type[256] = {0};
 	const char *prev_dest = NULL;
 	char *ret_reg = NULL;
-	const char *pc = r_reg_get_name (core->dbg->reg, R_REG_NAME_PC);
-	if (!pc) {
-        free (buf);
+	const char *_pc = r_reg_get_name (core->dbg->reg, R_REG_NAME_PC);
+	if (!_pc) {
+		free (buf);
 		return;
 	}
+	char *pc = strdup (_pc);
 	RRegItem *r = r_reg_get (core->dbg->reg, pc, -1);
 	if (!r) {
 		free (buf);
@@ -778,4 +779,5 @@ out_function:
 	free (buf);
 	r_cons_break_pop();
 	anal_emul_restore (core, hc, dt, et);
+	free (pc);
 }

programming_language: C
CVE-2011-5098 (published 2012-08-08T10:26Z)

chef-server-api/app/controllers/clients.rb in Chef Server in Chef before 0.9.20, and 0.10.x before 0.10.6, does not require administrative privileges for creating admin clients, which allows remote authenticated users to bypass intended access restrictions by leveraging read permission for the validation key and executing a knife client create command with the --admin option.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)

Weakness information:
cwe_id: CWE-264
cwe_name: Permissions, Privileges, and Access Controls
description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Fix information:
repo_url: https://github.com/opscode/chef
commit_details: repo_url: https://github.com/opscode/chef
author: Bryan McLellan
author_date: 2011-10-29 19:08:47-07:00
msg: CHEF-2649: Only allow admin clients to create admins (not validators)
repository: repo_url: https://github.com/opscode/chef
repo_name: chef/chef
description: Chef Infra, a powerful automation platform that transforms infrastructure into code automating how infrastructure is configured, deployed and managed across any environment, at any scale
repo_language: Ruby
owner: opscode
file_changes: filename: clients.rb
change_type: ModificationType.MODIFY
diff: @@ -49,13 +49,13 @@ class Clients < Application
     exists = true 
     if params.has_key?(:inflated_object)
       params[:name] ||= params[:inflated_object].name
-      # We can only get here if we're admin or the validator. Only
-      # allow creating admin clients if we're already an admin.
-      if @auth_user.admin
-        params[:admin] ||= params[:inflated_object].admin
-      else
-        params[:admin] = false
-      end
+      params[:admin] ||= params[:inflated_object].admin
+    end
+
+    # We can only create clients if we're the admin or the validator.
+    # But only allow creating admin clients if we're already an admin.
+    if params[:admin] == true && @auth_user.admin != true
+      raise Forbidden, "You are not allowed to take this action."
     end
 
     begin

programming_language: Ruby
CVE-2020-36639 (published 2023-01-04T10:15Z)

A vulnerability has been found in AlliedModders AMX Mod X on Windows and classified as critical. This vulnerability affects the function cmdVoteMap of the file plugins/adminvote.sma of the component Console Command Handler. The manipulation of the argument amx_votemap leads to path traversal. The patch is identified as a5f2b5539f6d61050b68df8b22ebb343a2862681. It is recommended to apply a patch to fix this issue. VDB-217354 is the identifier assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/alliedmodders/amxmodx
commit_details: repo_url: https://github.com/alliedmodders/amxmodx
author: Juice
author_date: 2020-05-29 02:04:16+03:00
msg: adminvote.sma exploit fix (#823)

* Restrict having ".." character sequence in amx_votemap command arguments

Fixes exploit on Windows servers that allows executing potentially dangerous console commands

* Fix typo

containi -> contain
repository: repo_url: https://github.com/alliedmodders/amxmodx
repo_name: alliedmodders/amxmodx
description: AMX Mod X - Half-Life 1 Scripting and Administration
repo_language: C
owner: alliedmodders
file_changes: filename: adminvote.sma
change_type: ModificationType.MODIFY
diff: @@ -238,7 +238,10 @@ public cmdVoteMap(id, level, cid)
 	for (new i = 1; i < argc; ++i)
 	{
 		read_argv(i, g_optionName[g_validMaps], 31)
-		
+
+		if (contain(g_optionName[g_validMaps], "..") != -1)
+			continue
+
 		if (is_map_valid(g_optionName[g_validMaps]))
 			g_validMaps++
 	}

programming_language: Lua
CVE-2012-2983 (published 2012-09-11T18:55Z)

file/edit_html.cgi in Webmin 1.590 and earlier does not perform an authorization check before showing a file's unedited contents, which allows remote attackers to read arbitrary files via the file field.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/webmin/webmin
commit_details: repo_url: https://github.com/webmin/webmin
author: Jamie Cameron
author_date: 2012-07-10 11:01:59-07:00
msg: Add access control check when reading HTML file https://sourceforge.net/tracker/index.php?func=detail&aid=3542038&group_id=17457&atid=117457#
repository: repo_url: https://github.com/webmin/webmin
repo_name: webmin/webmin
description: Powerful and flexible web-based server management control panel
repo_language: HTML
owner: webmin
file_changes: filename: edit_html.cgi
change_type: ModificationType.MODIFY
diff: @@ -12,6 +12,11 @@ if ($in{'text'} || $in{'file'} && !&is_html_file($in{'file'})) {
 	$text_mode = 1;
 	}
 
+if (!&can_access($in{'file'})) {
+	# ACL rules prevent access to file
+	&error_exit(&text('view_eaccess', &html_escape($in{'file'})));
+	}
+
 &popup_header($in{'file'} ? $text{'html_title'} : $text{'html_title2'},
 	      undef, $text_mode ? undef : "onload='xinha_init()'");
 

programming_language: Perl
CVE-2015-5219 (published 2017-07-21T14:29Z)

The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which allows remote attackers to cause a denial of service (infinite loop) via a crafted NTP packet.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-704
cwe_name: Incorrect Type Conversion or Cast
description: The product does not correctly convert an object, resource, or structure from one type to a different type.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/ntp-project/ntp
commit_details: repo_url: https://github.com/ntp-project/ntp
author_date: 2013-04-24 19:13:53-04:00
msg: [Bug 2382] Implement LOGTOD using ldexp() instead of shifting
repository: repo_url: https://github.com/ntp-project/ntp
repo_name: ntp-project/ntp
description: The full and complete NTP Reference Implementation from the Network Time Protocol Project at Network Time Foundation.
repo_language: C
owner: ntp-project
file_changes: filename: ChangeLog
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,5 @@
 * [Bug 1485] Sometimes ntpd crashes
+* [Bug 2382] Implement LOGTOD using ldexp() instead of shifting.
 (4.2.7p366) 2013/04/17 Released by Harlan Stenn <stenn@ntp.org>
 * [Bug 1866] Disable some debugging output in refclock_oncore.
 (4.2.7p365) 2013/04/16 Released by Harlan Stenn <stenn@ntp.org>

programming_language: Markdown
filename: ntp.h
change_type: ModificationType.MODIFY
diff: @@ -156,10 +156,9 @@ typedef char s_char;
 #define SQUARE(x) ((x) * (x))
 #define SQRT(x) (sqrt(x))
 #define DIFF(x, y) (SQUARE((x) - (y)))
-#define LOGTOD(a)	((a) < 0 ? 1. / (1L << -(a)) : \
-			    1L << (int)(a)) /* log2 to double */
+#define LOGTOD(a)	ldexp(1., (int)(a)) /* log2 to double */
 #define UNIVAR(x)	(SQUARE(.28867513 * LOGTOD(x))) /* std uniform distr */
-#define ULOGTOD(a)	(1L << (int)(a)) /* ulog2 to double */
+#define ULOGTOD(a)	ldexp(1., (int)(a)) /* ulog2 to double */
 
 #define	EVENT_TIMEOUT	0	/* one second, that is */
 

programming_language: C
CVE-2024-26129 (published 2024-02-19T22:15Z)

PrestaShop is an open-source e-commerce platform. Starting in version 8.1.0 and prior to version 8.1.4, PrestaShop is vulnerable to path disclosure in a JavaScript variable. A patch is available in version 8.1.4.


Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/PrestaShop/PrestaShop
commit_details: repo_url: https://github.com/PrestaShop/PrestaShop
author: Mathieu Ferment
author_date: 2024-02-19 11:32:50+01:00
msg: Merge pull request from GHSA-3366-9287-7qpr

Fix theme_dir tpl variable
repository: repo_url: https://github.com/PrestaShop/PrestaShop
repo_name: PrestaShop/PrestaShop
description: PrestaShop is the universal open-source software platform to build your e-commerce solution.
repo_language: PHP
owner: PrestaShop
CVE-2017-5510 (published 2017-03-24T15:59Z)

coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted PSD file, which triggers an out-of-bounds write.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2017-01-08 08:37:32-05:00
msg: https://github.com/ImageMagick/ImageMagick/issues/348
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: psd.c
change_type: ModificationType.MODIFY
diff: @@ -2511,7 +2511,7 @@ static size_t WritePSDChannel(const PSDInfo *psd_info,
     next_image->depth=16;
   monochrome=IsImageMonochrome(image) && (image->depth == 1) ?
     MagickTrue : MagickFalse;
-  quantum_info=AcquireQuantumInfo(image_info,image);
+  quantum_info=AcquireQuantumInfo(image_info,next_image);
   if (quantum_info == (QuantumInfo *) NULL)
     return(0);
   pixels=(unsigned char *) GetQuantumPixels(quantum_info);

programming_language: Objective-C
CVE-2022-2454 (published 2022-07-19T14:15Z)

Integer Overflow or Wraparound in GitHub repository gpac/gpac prior to 2.1-DEV.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2022-07-12 18:00:35+02:00
msg: fixed #2213
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: lsr_dec.c
change_type: ModificationType.MODIFY
diff: @@ -838,6 +838,8 @@ static void lsr_read_id(GF_LASeRCodec *lsr, GF_Node *n)
 
 static Fixed lsr_translate_coords(GF_LASeRCodec *lsr, u32 val, u32 nb_bits)
 {
+	if (!nb_bits) return 0;
+	
 #ifdef GPAC_FIXED_POINT
 	if (val >> (nb_bits-1) ) {
 		s32 neg = (s32) val - (1<<nb_bits);

programming_language: C