starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2021-41219 (published 2021-11-05T21:15Z)

TensorFlow is an open source platform for machine learning. In affected versions the code for sparse matrix multiplication is vulnerable to undefined behavior via binding a reference to `nullptr`. This occurs whenever the dimensions of `a` or `b` are 0 or less. In the case on one of these is 0, an empty output tensor should be allocated (to conserve the invariant that output tensors are always allocated when the operation is successful) but nothing should be written to it (that is, we should return early from the kernel implementation). Otherwise, attempts to write to this empty tensor would result in heap OOB access. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Penporn Koanantakool
author_date: 2021-10-05 21:54:15-07:00
msg: Validate that matrix dimension sizes in SparseMatMul are positive.

PiperOrigin-RevId: 401149683
Change-Id: Ib33eafc561a39c8741ece80b2edce6d4aae9a57d
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: sparse_matmul_op.cc
change_type: ModificationType.MODIFY
diff: @@ -32,6 +32,7 @@ limitations under the License.
 #include "tensorflow/core/kernels/fill_functor.h"
 #include "tensorflow/core/lib/core/blocking_counter.h"
 #include "tensorflow/core/lib/core/threadpool.h"
+#include "tensorflow/core/platform/errors.h"
 #include "tensorflow/core/platform/logging.h"
 #include "tensorflow/core/platform/macros.h"
 #include "tensorflow/core/platform/mutex.h"
@@ -980,9 +981,18 @@ class SparseMatMulOp : public OpKernel {
                 errors::InvalidArgument(
                     "Matrix size incompatible: a: ", a.shape().DebugString(),
                     ", b: ", b.shape().DebugString()));
+    OP_REQUIRES(ctx, m >= 0 && n >= 0 && k >= 0,
+                errors::InvalidArgument(
+                    "Matrix dimensions cannot be negative: a: ",
+                    a.shape().DebugString(), ", b: ", b.shape().DebugString()));
     Tensor* output = nullptr;
     OP_REQUIRES_OK(ctx, ctx->allocate_output(0, TensorShape({m, n}), &output));
 
+    // Return early if at least one of the output dimension size is 0.
+    if (m == 0 || n == 0) {
+      return;
+    }
+
     if (k == 0) {
       // If the inner dimension k in the matrix multiplication is zero, we fill
       // the output with zeros.

programming_language: C++
CVE-2021-41217 (published 2021-11-05T21:15Z)

TensorFlow is an open source platform for machine learning. In affected versions the process of building the control flow graph for a TensorFlow model is vulnerable to a null pointer exception when nodes that should be paired are not. This occurs because the code assumes that the first node in the pairing (e.g., an `Enter` node) always exists when encountering the second node (e.g., an `Exit` node). When this is not the case, `parent` is `nullptr` so dereferencing it causes a crash. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Xiao Yu
author_date: 2021-10-18 16:17:46-07:00
msg: Fix a NPE issue in invalid Exit op. Now it will report an error instead of crash.

PiperOrigin-RevId: 404089902
Change-Id: Ia6ec55445ea70ad045a4d339d354959ad0618f2a
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: immutable_executor_state.cc
change_type: ModificationType.MODIFY
diff: @@ -316,6 +316,10 @@ Status ImmutableExecutorState::BuildControlFlowInfo(const Graph* g,
     } else if (IsExit(curr_node)) {
       // Exit to the parent frame.
       parent = parent_nodes[curr_id];
+      if (!parent) {
+        return errors::InvalidArgument(
+            "Invalid Exit op: Cannot find a corresponding Enter op.");
+      }
       frame_name = cf_info->frame_names[parent->id()];
       parent = parent_nodes[parent->id()];
     } else {

programming_language: C++
CVE-2017-6429 (published 2017-03-15T15:59Z)

Buffer overflow in the tcpcapinfo utility in Tcpreplay before 4.2.0 Beta 1 allows remote attackers to have unspecified impact via a pcap file with an over-size packet.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/appneta/tcpreplay
commit_details: repo_url: https://github.com/appneta/tcpreplay
author: Fred Klassen
author_date: 2017-02-26 20:45:59-08:00
msg: #278 fail if capture has a packet that is too large (#286)

* #278 fail if capture has a packet that is too large

* Update CHANGELOG
repository: repo_url: https://github.com/appneta/tcpreplay
repo_name: appneta/tcpreplay
description: Pcap editing and replay tools for *NIX and Windows - Users please download source from
repo_language: C
owner: appneta
file_changes: filename: CHANGELOG
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,5 @@
 02/26/2017 Version 4.2.0beta1
+    - tcpcapinfo buffer overflow vulnerablily (#278)
     - Update git-clone instructions by Kyle McDonald (#277) 
     - Add protection against packet drift by Guillaume Scott (#268)
     - Include Travis-CI build support by Ilya Shipitsin (#264) (#285)

programming_language: Markdown
filename: tcpcapinfo.c
change_type: ModificationType.MODIFY
diff: @@ -281,6 +281,15 @@ main(int argc, char *argv[])
                 caplen = pcap_ph.caplen;
             }
 
+            if (caplentoobig) {
+                printf("\n\nCapture file appears to be damaged or corrupt.\n"
+                        "Contains packet of size %u, bigger than snap length %u\n",
+                        caplen, pcap_fh.snaplen);
+
+                close(fd);
+                break;
+            }
+
             /* check to make sure timestamps don't go backwards */
             if (last_sec > 0 && last_usec > 0) {
                 if ((pcap_ph.ts.tv_sec == last_sec) ? 
@@ -306,7 +315,7 @@ main(int argc, char *argv[])
                 }
 
                 close(fd);
-                continue;
+                break;
             }
 
             /* print the frame checksum */

programming_language: C
CVE-2021-32696 (published 2021-06-18T20:15Z)

The npm package "striptags" is an implementation of PHP\'s strip_tags in Typescript. In striptags before version 3.2.0, a type-confusion vulnerability can cause `striptags` to concatenate unsanitized strings when an array-like object is passed in as the `html` parameter. This can be abused by an attacker who can control the shape of their input, e.g. if query parameters are passed directly into the function. This can lead to a XSS.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-843
cwe_name: Access of Resource Using Incompatible Type ('Type Confusion')
description: The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
extended_description: 
            When the product accesses the resource using an incompatible type, this could trigger logical errors because the resource does not have expected properties. In languages without memory safety, such as C and C++, type confusion can lead to out-of-bounds memory access.
            While this weakness is frequently associated with unions when parsing data with many different embedded object types in C, it can be present in any application that can interpret the same variable or memory location in multiple ways.
            This weakness is not unique to C and C++. For example, errors in PHP applications can be triggered by providing array parameters when scalars are expected, or vice versa. Languages such as Perl, which perform automatic conversion of a variable of one type when it is accessed as if it were another type, can also contain these issues.
         
         

Fix information:
repo_url: https://github.com/ericnorris/striptags
commit_details: repo_url: https://github.com/ericnorris/striptags
author: Eric Norris
author_date: 2021-06-18 13:01:52-04:00
msg: Merge pull request from GHSA-qxg5-2qff-p49r

fix: throw TypeError if 'html' is non-string argument
repository: repo_url: https://github.com/ericnorris/striptags
repo_name: ericnorris/striptags
description: An implementation of PHP's strip_tags in Typescript.
repo_language: TypeScript
owner: ericnorris
CVE-2021-4313 (published 2023-01-16T12:15Z)

A vulnerability was found in NethServer phonenehome. It has been rated as critical. This issue affects the function get_info/get_country_coor of the file server/index.php. The manipulation leads to sql injection. The identifier of the patch is 759c30b0ddd7d493836bbdf695cf71624b377391. It is recommended to apply a patch to fix this issue. The identifier VDB-218393 was assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/NethServer/nethserver-phonehome
commit_details: repo_url: https://github.com/NethServer/nethserver-phonehome
author: BlackBeanie21
author_date: 2021-09-27 11:37:25-04:00
msg: fix sql-injection
repository: repo_url: https://github.com/NethServer/nethserver-phonehome
repo_name: NethServer/nethserver-phonehome
repo_language: PHP
owner: NethServer
file_changes: filename: index.php
change_type: ModificationType.MODIFY
diff: @@ -92,7 +92,7 @@
                             FROM phone_home_tb ";
 
         if ($interval!=='1') {
-          $sql .= " WHERE reg_date >= DATE_SUB(CURDATE(), INTERVAL $interval DAY)";
+          $sql .= " WHERE reg_date >= DATE_SUB(CURDATE(), INTERVAL :interval DAY)";
         }
 
         $sql .= " GROUP BY release_tag, country_code
@@ -103,7 +103,7 @@
         $stmt = $conn->prepare($sql);
 
         // execute query
-        $stmt->execute();
+        $stmt->execute(array(':interval' => intval($interval)));
 
         // create new empty array
         $infos = array();
@@ -148,8 +148,8 @@
 
                 FROM country_name_map
 
-                WHERE code = '$country_code'";
-        }
+                WHERE code = ':country_code'";
+}
         catch(PDOException $e) {
           echo $e->getMessage();
         }
@@ -158,7 +158,7 @@
         $stmt = $conn->prepare($sql);
 
         // execute query
-        $stmt->execute();
+        $stmt->execute(array(':country_code' => $country_code));
 
         // create new empty array
         $infos = array();

programming_language: PHP
CVE-2012-1584 (published 2012-09-06T18:55Z)

Integer overflow in the mid function in toolkit/tbytevector.cpp in TagLib 1.7 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a crafted file header field in a media file, which triggers a large memory allocation.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)

Weakness information:
cwe_id: CWE-189
cwe_name: Numeric Errors
description: Weaknesses in this category are related to improper calculation or conversion of numbers.

Fix information:
repo_url: https://github.com/taglib/taglib
commit_details: repo_url: https://github.com/taglib/taglib
author: Lukáš Lalinský
author_date: 2012-03-10 08:46:20+01:00
msg: Avoid uint overflow in case the length + index is over UINT_MAX
repository: repo_url: https://github.com/taglib/taglib
repo_name: taglib/taglib
description: TagLib Audio Meta-Data Library
repo_language: C++
owner: taglib
file_changes: filename: tbytevector.cpp
change_type: ModificationType.MODIFY
diff: @@ -363,7 +363,7 @@ ByteVector ByteVector::mid(uint index, uint length) const
 
   ConstIterator endIt;
 
-  if(length < 0xffffffff && length + index < size())
+  if(length < size() - index)
     endIt = d->data.begin() + index + length;
   else
     endIt = d->data.end();

programming_language: C++
CVE-2016-10128 (published 2017-03-24T15:59Z)

Buffer overflow in the git_pkt_parse_line function in transports/smart_pkt.c in the Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to have unspecified impact via a crafted non-flush packet.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/libgit2/libgit2
commit_details: repo_url: https://github.com/libgit2/libgit2
author: Patrick Steinhardt
author_date: 2016-11-15 11:36:27+01:00
msg: smart_pkt: verify packet length exceeds PKT_LEN_SIZE

Each packet line in the Git protocol is prefixed by a four-byte
length of how much data will follow, which we parse in
`git_pkt_parse_line`. The transmitted length can either be equal
to zero in case of a flush packet or has to be at least of length
four, as it also includes the encoded length itself. Not
checking this may result in a buffer overflow as we directly pass
the length to functions which accept a `size_t` length as
parameter.

Fix the issue by verifying that non-flush packets have at least a
length of `PKT_LEN_SIZE`.
repository: repo_url: https://github.com/libgit2/libgit2
repo_name: libgit2/libgit2
description: A cross-platform, linkable library implementation of Git that you can use in your application.
repo_language: C
owner: libgit2
file_changes: filename: smart_pkt.c
change_type: ModificationType.MODIFY
diff: @@ -427,6 +427,14 @@ int git_pkt_parse_line(
 	if (bufflen > 0 && bufflen < (size_t)len)
 		return GIT_EBUFS;
 
+	/*
+	 * The length has to be exactly 0 in case of a flush
+	 * packet or greater than PKT_LEN_SIZE, as the decoded
+	 * length includes its own encoded length of four bytes.
+	 */
+	if (len != 0 && len < PKT_LEN_SIZE)
+		return GIT_ERROR;
+
 	line += PKT_LEN_SIZE;
 	/*
 	 * TODO: How do we deal with empty lines? Try again? with the next

programming_language: C
CVE-2020-27638 (published 2020-10-22T13:15Z)

receive.c in fastd before v21 allows denial of service (assertion failure) when receiving packets with an invalid type code.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-617
cwe_name: Reachable Assertion
description: The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
extended_description: 
            While assertion is good for catching logic errors and reducing the chances of reaching more serious vulnerability conditions, it can still lead to a denial of service.
            For example, if a server handles multiple simultaneous connections, and an assert() occurs in one single connection that causes all other connections to be dropped, this is a reachable assertion that leads to a denial of service.
         
         

Fix information:
repo_url: https://github.com/NeoRaider/fastd
commit_details: repo_url: https://github.com/NeoRaider/fastd
author: Matthias Schiffer
author_date: 2020-10-19 21:08:16+02:00
msg: receive: fix buffer leak when receiving invalid packets

For fastd versions before v20, this was just a memory leak (which could
still be used for DoS, as it's remotely triggerable). With the new
buffer management of fastd v20, this will trigger an assertion failure
instead as soon as the buffer pool is empty.
repository: repo_url: https://github.com/NeoRaider/fastd
repo_name: visit repo url
description: visit repo url
repo_language: visit repo url
owner: NeoRaider
file_changes: filename: receive.c
change_type: ModificationType.MODIFY
diff: @@ -169,6 +169,11 @@ static inline void handle_socket_receive_known(
 
 	case PACKET_HANDSHAKE:
 		fastd_handshake_handle(sock, local_addr, remote_addr, peer, buffer);
+		break;
+
+	default:
+		fastd_buffer_free(buffer);
+		pr_debug("received packet with invalid type from %P[%I]", peer, remote_addr);
 	}
 }
 
@@ -195,6 +200,11 @@ static inline void handle_socket_receive_unknown(
 
 	case PACKET_HANDSHAKE:
 		fastd_handshake_handle(sock, local_addr, remote_addr, NULL, buffer);
+		break;
+
+	default:
+		fastd_buffer_free(buffer);
+		pr_debug("received packet with invalid type from unknown address %I", remote_addr);
 	}
 }
 

programming_language: C
CVE-2022-1034 (published 2022-03-22T08:15Z)

There is a Unrestricted Upload of File vulnerability in ShowDoc v2.10.3 in GitHub repository star7th/showdoc prior to 2.10.4.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 7.2, HIGH (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/star7th/showdoc
commit_details: repo_url: https://github.com/star7th/showdoc
author: star7th
author_date: 2022-03-20 16:07:48+08:00
msg: Security update / 安全性更新
repository: repo_url: https://github.com/star7th/showdoc
repo_name: star7th/showdoc
description: ShowDoc is a tool greatly applicable for an IT team to share documents online一个非常适合IT团队的在线API文档、技术文档工具
repo_language: JavaScript
owner: star7th
file_changes: filename: AdminUpdateController.class.php
change_type: ModificationType.MODIFY
diff: @@ -28,8 +28,21 @@ class AdminUpdateController extends BaseController {
         $this->checkAdmin();
         set_time_limit(1000);
         ini_set('memory_limit','500M');
-        $new_version = I("new_version") ;
-        $file_url = I("file_url") ;
+        //获取当前版本
+        $text = file_get_contents("../composer.json");
+        $composer = json_decode($text, true);
+        $version = $composer['version'] ;
+        $url = "https://www.showdoc.cc/server/api/open/checkUpdate";
+        $res = http_post($url , array("version"=>$version));
+        $res_array = json_decode($res,true);
+        $new_version =$res_array['data']['new_version'] ;
+        $file_url =$res_array['data']['file_url'] ;
+
+        if(!$file_url){
+            $this->sendError(10101,'检测更新时异常');
+            return ;
+        }
+
         $version_num = str_replace("v","",$new_version) ;
 
         $showdoc_path = "../" ;

programming_language: PHP
filename: Index.vue
change_type: ModificationType.MODIFY
diff: @@ -65,8 +65,7 @@ export default {
       isUpdate: false,
       cur_version: '',
       new_version: '',
-      url: '',
-      file_url: ''
+      url: ''
     }
   },
   methods: {
@@ -81,7 +80,6 @@ export default {
       this.request('/api/adminUpdate/checkUpdate', {}).then(data => {
         if (data && data.data && data.data.url) {
           this.url = data.data.url
-          this.file_url = data.data.file_url
           this.new_version = data.data.new_version
           this.cur_version = data.data.version
           this.isUpdate = true
@@ -92,10 +90,7 @@ export default {
       let loading = this.$loading({
         text: '正在下载更新包...'
       })
-      this.request('/api/adminUpdate/download', {
-        new_version: this.new_version,
-        file_url: this.file_url
-      }).then(
+      this.request('/api/adminUpdate/download', {}).then(
         data => {
           loading.close()
           loading = this.$loading({

programming_language: JavaScript