starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2021-3325 (published 2021-01-27T19:15Z)

Monitorix 3.13.0 allows remote attackers to bypass Basic Authentication in a default installation (i.e., an installation without a hosts_deny option). This issue occurred because a new access-control feature was introduced without considering that some exiting installations became unsafe, upon an update to 3.13.0, unless the new feature was immediately configured.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/mikaku/Monitorix
commit_details: repo_url: https://github.com/mikaku/Monitorix
author: Jordi Sanfeliu
author_date: 2021-01-27 10:45:41+01:00
msg: fixed a security bug introduced in 3.13.0 version that lead the HTTP built-in server to bypass Basic Authentication when the option 'hosts_deny' is not defined #309
repository: repo_url: https://github.com/mikaku/Monitorix
repo_name: mikaku/Monitorix
description: Monitorix is a free, open source, lightweight system monitoring tool.
repo_language: Perl
owner: mikaku
file_changes: filename: HTTPServer.pm
change_type: ModificationType.MODIFY
diff: @@ -139,6 +139,10 @@ sub http_header {
 		# check if the IP address is forced to auth
 		my $denied;
 		my $allowed = ip_validity($ENV{REMOTE_ADDR}, $hosts_allow);
+
+		# specific behavior
+		$hosts_deny = "all" if !$hosts_deny;
+
 		$denied = ip_validity($ENV{REMOTE_ADDR}, $hosts_deny) if !$allowed;
 		if(!$allowed && $denied) {
 			my (undef, $encoded_str) = split(' ', $ENV{HTTP_AUTHORIZATION} || "");

programming_language: Perl
CVE-2023-4540 (published 2023-09-05T08:15Z)

Improper Handling of Exceptional Conditions vulnerability in Daurnimator lua-http library allows Excessive Allocation and a denial of service (DoS) attack to be executed by sending a properly crafted request to the server. \n\nThis issue affects lua-http: all versions before commit ddab283.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-755
cwe_name: Improper Handling of Exceptional Conditions
description: The product does not handle or incorrectly handles an exceptional condition.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/daurnimator/lua-http
commit_details: repo_url: https://github.com/daurnimator/lua-http
author: daurnimator
author_date: 2023-08-22 23:30:20+10:00
msg: http/h1_stream: handle EOF when `body_read_type==length`

If a client closes the connection before sending the expected number of bytes
then return `EPIPE`.
This fixes a potential infinite draining loop when trying to trying to
`:shutdown()` a stream.
repository: repo_url: https://github.com/daurnimator/lua-http
repo_name: daurnimator/lua-http
description: HTTP Library for Lua. Supports HTTP(S) 1.0, 1.1 and 2.0; client and server.
repo_language: Lua
owner: daurnimator
file_changes: filename: h1_stream.lua
change_type: ModificationType.MODIFY
diff: @@ -861,6 +861,8 @@ function stream_methods:read_next_chunk(timeout)
 			if chunk ~= nil then
 				self.body_read_left = length_n - #chunk
 				end_stream = (self.body_read_left == 0)
+			elseif err == nil then
+				return nil, ce.strerror(ce.EPIPE), ce.EPIPE
 			end
 		elseif length_n == 0 then
 			chunk = ""

programming_language: Lua
filename: h1_stream_spec.lua
change_type: ModificationType.MODIFY
diff: @@ -295,6 +295,33 @@ describe("http1 stream", function()
 		server:close()
 		client:close()
 	end)
+	it("Doesn't hang when a content-length delimited stream is closed", function()
+		local server, client = new_pair(1.1)
+		local cq = cqueues.new()
+		cq:wrap(function()
+			local stream = client:new_stream()
+			local headers = new_headers()
+			headers:append(":method", "GET")
+			headers:append(":scheme", "http")
+			headers:append(":authority", "myauthority")
+			headers:append(":path", "/a")
+			assert(stream:write_headers(headers, true))
+		end)
+		cq:wrap(function()
+			local stream = server:get_next_incoming_stream()
+			assert(stream:get_headers())
+			local res_headers = new_headers()
+			res_headers:append(":status", "200")
+			res_headers:append("content-length", "100")
+			assert(stream:write_headers(res_headers, false))
+			assert(stream:write_chunk("foo", false))
+			assert(stream:shutdown())
+		end)
+		assert_loop(cq, TEST_TIMEOUT)
+		assert.truthy(cq:empty())
+		server:close()
+		client:close()
+	end)
 	it("allows pipelining", function()
 		local server, client = new_pair(1.1)
 		local cq = cqueues.new()

programming_language: Lua
CVE-2022-27815 (published 2022-03-30T00:15Z)

SWHKD 1.1.5 unsafely uses the /tmp/swhkd.pid pathname. There can be an information leak or denial of service.

Severity: MEDIUM
CVSS v2 base score: 6.2 (AV:L/AC:H/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-59
cwe_name: Improper Link Resolution Before File Access ('Link Following')
description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/waycrate/swhkd
commit_details: repo_url: https://github.com/waycrate/swhkd
author: Shinyzenith
author_date: 2022-03-25 20:55:28+05:30
msg: [patch] CVE-2022-27815
repository: repo_url: https://github.com/waycrate/swhkd
repo_name: waycrate/swhkd
description: Sxhkd clone for Wayland (works on TTY and X11 too)
repo_language: Rust
owner: waycrate
file_changes: filename: Makefile
change_type: ModificationType.MODIFY
diff: @@ -21,6 +21,9 @@ install:
 	@mkdir -p $(TARGET_DIR)
 	@mkdir -p $(POLKIT_DIR)
 	@mkdir -p /etc/$(DAEMON_BINARY)
+	@mkdir -p /etc/$(DAEMON_BINARY)/runtime
+	@sudo chown root:root /etc/$(DAEMON_BINARY)/runtime
+	@sudo chmod 700 /etc/$(DAEMON_BINARY)/runtime
 	@touch /etc/$(DAEMON_BINARY)/$(DAEMON_BINARY)rc
 	@cp ./bin/$(DAEMON_BINARY) $(TARGET_DIR)
 	@cp ./bin/$(SERVER_BINARY) $(TARGET_DIR)

programming_language: Shell
filename: daemon.rs
change_type: ModificationType.MODIFY
diff: @@ -39,6 +39,7 @@ impl KeyboardState {
 #[tokio::main]
 async fn main() -> Result<(), Box<dyn std::error::Error>> {
     let args = set_command_line_args().get_matches();
+    let invoking_uid = env::var("PKEXEC_UID").unwrap().parse::<u32>().unwrap();
     env::set_var("RUST_LOG", "swhkd=warn");
 
     if args.is_present("debug") {
@@ -48,7 +49,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
     env_logger::init();
     log::trace!("Logger initialized.");
 
-    let pidfile: String = String::from("/tmp/swhkd.pid");
+    let pidfile: String = String::from(format!("/etc/swhkd/runtime/swhkd_{}.pid", invoking_uid));
     if Path::new(&pidfile).exists() {
         log::trace!("Reading {} file and checking for running instances.", pidfile);
         let swhkd_pid = match fs::read_to_string(&pidfile) {
@@ -85,7 +86,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
     }
 
     let load_config = || {
-        seteuid(env::var("PKEXEC_UID").unwrap().parse::<u32>().unwrap()); // Dropping privileges to invoking user.
+        seteuid(invoking_uid); // Dropping privileges to invoking user.
         let config_file_path: std::path::PathBuf = if args.is_present("config") {
             Path::new(args.value_of("config").unwrap()).to_path_buf()
         } else {

programming_language: Rust
CVE-2021-40348 (published 2021-11-01T05:15Z)

Spacewalk 2.10, and derivatives such as Uyuni 2021.08, allows code injection. rhn-config-satellite.pl doesn't sanitize the configuration filename used to append Spacewalk-specific key-value pair. The script is intended to be run by the tomcat user account with Sudo, according to the installation setup. This can lead to the ability of an attacker to use --option to append arbitrary code to a root-owned file that eventually will be executed by the system. This is fixed in Uyuni spacewalk-admin 4.3.2-1.

Severity: HIGH
CVSS v2 base score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-94
cwe_name: Improper Control of Generation of Code ('Code Injection')
description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
extended_description: 
            When a product allows a user's input to contain code syntax, it might be possible for an attacker to craft the code in such a way that it will alter the intended control flow of the product. Such an alteration could lead to arbitrary code execution.
            Injection problems encompass a wide variety of issues -- all mitigated in very different ways. For this reason, the most effective way to discuss these weaknesses is to note the distinct features which classify them as injection weaknesses. The most important issue to note is that all injection problems share one thing in common -- i.e., they allow for the injection of control plane data into the user-controlled data plane. This means that the execution of the process may be altered by sending code in through legitimate data channels, using no other mechanism. While buffer overflows, and many other flaws, involve the use of some further issue to gain execution, injection problems need only for the data to be parsed. The most classic instantiations of this category of weakness are SQL injection and format string vulnerabilities.
         
         

Fix information:
repo_url: https://github.com/uyuni-project/uyuni
commit_details: repo_url: https://github.com/uyuni-project/uyuni
author: Julio González Gil
author_date: 2021-10-28 12:28:24+02:00
msg: Merge pull request #4414 from uyuni-project/Uyuni-2021.09

Backport #4413 and tagging to master
repository: repo_url: https://github.com/uyuni-project/uyuni
repo_name: uyuni-project/uyuni
description: Source code for Uyuni
repo_language: Java
owner: uyuni-project
CVE-2019-19055 (published 2019-11-18T06:15Z)

A memory leak in the nl80211_get_ftm_responder_stats() function in net/wireless/nl80211.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering nl80211hdr_put() failures, aka CID-1399c59fa929. NOTE: third parties dispute the relevance of this because it occurs on a code path where a successful allocation has already occurred

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-401
cwe_name: Missing Release of Memory after Effective Lifetime
description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
extended_description: This is often triggered by improper handling of malformed data or unexpectedly interrupted sessions.  In some languages, developers are responsible for tracking memory allocation and releasing the memory.  If there are no more pointers or references to the memory, then it can no longer be tracked and identified for release.
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Navid Emamdoost
author_date: 2019-10-04 14:42:19-05:00
msg: nl80211: fix memory leak in nl80211_get_ftm_responder_stats

In nl80211_get_ftm_responder_stats, a new skb is created via nlmsg_new
named msg. If nl80211hdr_put() fails, then msg should be released. The
return statement should be replace by goto to error handling code.

Fixes: 81e54d08d9d8 ("cfg80211: support FTM responder configuration/statistics")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Link: https://lore.kernel.org/r/20191004194220.19412-1-navid.emamdoost@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: nl80211.c
change_type: ModificationType.MODIFY
diff: @@ -13682,7 +13682,7 @@ static int nl80211_get_ftm_responder_stats(struct sk_buff *skb,
 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
 			     NL80211_CMD_GET_FTM_RESPONDER_STATS);
 	if (!hdr)
-		return -ENOBUFS;
+		goto nla_put_failure;
 
 	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
 		goto nla_put_failure;

programming_language: C
CVE-2020-15244 (published 2020-10-21T20:15Z)

In Magento (rubygems openmage/magento-lts package) before versions 19.4.8 and 20.0.4, an admin user can generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product. The issue is patched in versions 19.4.8 and 20.0.4.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 7.2, HIGH (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-502
cwe_name: Deserialization of Untrusted Data
description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
extended_description: 
            It is often convenient to serialize objects for communication or to save them for later use. However, deserialized data or code can often be modified without using the provided accessor functions if it does not use cryptography to protect itself. Furthermore, any cryptography would still be client-side security -- which is a dangerous security assumption.
            Data that is untrusted can not be trusted to be well-formed.
            When developers place no restrictions on "gadget chains," or series of instances and method invocations that can self-execute during the deserialization process (i.e., before the object is returned to the caller), it is sometimes possible for attackers to leverage them to perform unauthorized actions, like generating a shell.
         
         

Fix information:
repo_url: https://github.com/OpenMage/magento-lts
commit_details: repo_url: https://github.com/OpenMage/magento-lts
author: Mark Lewis
author_date: 2020-10-20 17:19:07-04:00
msg: Merge pull request from GHSA-jrgf-vfw2-hj26
repository: repo_url: https://github.com/OpenMage/magento-lts
repo_name: OpenMage/magento-lts
description: Official OpenMage LTS codebase | Migrate easily from Magento Community Edition in minutes! Download the source code for free or contribute to OpenMage LTS | Security vulnerability patches, bug fixes, performance improvements and more.
repo_language: PHP
owner: OpenMage
file_changes: filename: Api.php
change_type: ModificationType.MODIFY
diff: @@ -236,6 +236,10 @@ class Mage_Catalog_Model_Product_Attribute_Api extends Mage_Catalog_Model_Api_Re
             $this->_fault('can_not_delete');
         }
 
+        if (!$model->getIsUserDefined()) {
+            $this->_fault('can_not_delete');
+        }
+
         try {
             $model->delete();
             return true;

programming_language: PHP
filename: Collection.php
change_type: ModificationType.MODIFY
diff: @@ -542,7 +542,7 @@ class Mage_Catalog_Model_Resource_Product_Collection extends Mage_Catalog_Model_
 
         foreach ($this as $product) {
             if ($product->isRecurring() && $profile = $product->getRecurringProfile()) {
-                $product->setRecurringProfile(unserialize($profile));
+                $product->setRecurringProfile(Mage::helper('core/unserializeArray')->unserialize($profile));
             }
         }
 

programming_language: PHP
CVE-2020-36647 (published 2023-01-08T10:15Z)

A vulnerability classified as critical has been found in YunoHost-Apps transmission_ynh. Affected is an unknown function of the file conf/nginx.conf. The manipulation leads to path traversal. The patch is identified as f136dfd44eda128129e5fd2d850a3a3c600e6a4a. It is recommended to apply a patch to fix this issue. VDB-217638 is the identifier assigned to this vulnerability.

CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/YunoHost-Apps/transmission_ynh
commit_details: repo_url: https://github.com/YunoHost-Apps/transmission_ynh
author: Alexandre Aubin
author_date: 2020-10-25 11:49:27+01:00
msg: Update nginx.conf to protect against path traversal issue
repository: repo_url: https://github.com/YunoHost-Apps/transmission_ynh
repo_name: YunoHost-Apps/transmission_ynh
description: Transmission package for YunoHost
repo_language: Shell
owner: YunoHost-Apps
file_changes: filename: nginx.conf
change_type: ModificationType.MODIFY
diff: @@ -12,7 +12,7 @@ location __PATH__/ {
     proxy_pass http://127.0.0.1:__PORT__/;
 }
 
-location __PATH__/downloads {
+location __PATH__/downloads/ {
     alias /home/yunohost.transmission/completed/;
     autoindex on;
     autoindex_exact_size off;

programming_language: C++
CVE-2017-12667 (published 2017-08-07T21:29Z)

ImageMagick 7.0.6-1 has a memory leak vulnerability in ReadMATImage in coders\\mat.c.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-772
cwe_name: Missing Release of Resource after Effective Lifetime
description: The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
extended_description: When a resource is not released after use, it can allow attackers to cause a denial of service by causing the allocation of resources without triggering their release. Frequently-affected resources include memory, CPU, disk space, power or battery, etc.
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2017-07-09 08:24:18-04:00
msg: https://github.com/ImageMagick/ImageMagick/issues/553
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: mat.c
change_type: ModificationType.MODIFY
diff: @@ -931,7 +931,11 @@ static Image *ReadMATImage(const ImageInfo *image_info,ExceptionInfo *exception)
     goto MATLAB_KO;    /* unsupported endian */
 
   if (strncmp(MATLAB_HDR.identific, "MATLAB", 6))
-MATLAB_KO: ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+    {
+MATLAB_KO:
+      clone_info=DestroyImageInfo(clone_info);
+      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+    }
 
   filepos = TellBlob(image);
   while(!EOFBlob(image)) /* object parser loop */

programming_language: C
CVE-2018-14353 (published 2018-07-17T17:29Z)

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap_quote_string in imap/util.c has an integer underflow.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-191
cwe_name: Integer Underflow (Wrap or Wraparound)
description: The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
extended_description: This can happen in signed and unsigned cases.
         

Fix information:
repo_url: https://gitlab.com/muttmua/mutt
commit_details: repo_url: https://gitlab.com/muttmua/mutt
author: Kevin McCarthy
author_date: 2018-07-12 20:46:37-07:00
msg: Fix imap_quote_string() length check errors.

The function wasn't properly checking for dlen<2 before quoting, and
wasn't properly pre-adjusting dlen to include the initial quote.

Thanks to Jeriko One for reporting these issues.
repository: repo_url: https://gitlab.com/muttmua/mutt
repo_name: visit repo url
description: visit repo url
repo_language: visit repo url
owner: muttmua
file_changes: filename: util.c
change_type: ModificationType.MODIFY
diff: @@ -614,20 +614,29 @@ static void _imap_quote_string (char *dest, size_t dlen, const char *src,
   char *pt;
   const char *s;
 
+  if (!(dest && dlen && src && to_quote))
+    return;
+
+  if (dlen < 3)
+  {
+    *dest = 0;
+    return;
+  }
+
   pt = dest;
   s  = src;
 
-  *pt++ = '"';
-  /* save room for trailing quote-char */
-  dlen -= 2;
+  /* save room for pre/post quote-char and trailing null */
+  dlen -= 3;
 
+  *pt++ = '"';
   for (; *s && dlen; s++)
   {
     if (strchr (to_quote, *s))
     {
+      if (dlen < 2)
+        break;
       dlen -= 2;
-      if (!dlen)
-	break;
       *pt++ = '\\';
       *pt++ = *s;
     }

programming_language: C
repo_url: https://github.com/neomutt/neomutt
commit_details: repo_url: https://github.com/neomutt/neomutt
author: JerikoOne
author_date: 2018-07-07 16:20:56-05:00
msg: Check for int underflow in imap_quote_string
repository: repo_url: https://github.com/neomutt/neomutt
repo_name: neomutt/neomutt
description: ✉️ Teaching an Old Dog New Tricks -- IRC: #neomutt on irc.libera.chat
repo_language: C
owner: neomutt
file_changes: filename: util.c
change_type: ModificationType.MODIFY
diff: @@ -821,9 +821,9 @@ void imap_quote_string(char *dest, size_t dlen, const char *src, bool quote_back
   {
     if (strchr(quote, *s))
     {
-      dlen -= 2;
-      if (dlen == 0)
+      if (dlen < 2)
         break;
+      dlen -= 2;
       *pt++ = '\\';
       *pt++ = *s;
     }

programming_language: C