starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2017-9051 (published 2017-05-18T06:29Z)

libav before 12.1 is vulnerable to an invalid read of size 1 due to NULL pointer dereferencing in the nsv_read_chunk function in libavformat/nsvdec.c.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/libav/libav
commit_details: repo_url: https://github.com/libav/libav
author: Sean McGovern
author_date: 2017-03-24 13:36:51-04:00
msg: nsvdec: don't ignore the return value of av_get_packet()

Fixes invalid reads with corrupted files.

CC: libav-stable@libav.org
Bug-Id: 1039
repository: repo_url: https://github.com/libav/libav
repo_name: libav/libav
description: Libav github mirror, clone of git://git.libav.org/libav
repo_language: C
owner: libav
file_changes: filename: nsvdec.c
change_type: ModificationType.MODIFY
diff: @@ -520,6 +520,7 @@ static int nsv_read_chunk(AVFormatContext *s, int fill_header)
     uint32_t vsize;
     uint16_t asize;
     uint16_t auxsize;
+    int ret;
 
     if (nsv->ahead[0].data || nsv->ahead[1].data)
         return 0; //-1; /* hey! eat what you've in your plate first! */
@@ -571,7 +572,8 @@ null_chunk_retry:
     if (vsize && st[NSV_ST_VIDEO]) {
         nst = st[NSV_ST_VIDEO]->priv_data;
         pkt = &nsv->ahead[NSV_ST_VIDEO];
-        av_get_packet(pb, pkt, vsize);
+        if ((ret = av_get_packet(pb, pkt, vsize)) < 0)
+            return ret;
         pkt->stream_index = st[NSV_ST_VIDEO]->index;//NSV_ST_VIDEO;
         pkt->dts = nst->frame_offset;
         pkt->flags |= nsv->state == NSV_HAS_READ_NSVS ? AV_PKT_FLAG_KEY : 0; /* keyframe only likely on a sync frame */
@@ -615,7 +617,8 @@ null_chunk_retry:
                        bps, channels, samplerate);
             }
         }
-        av_get_packet(pb, pkt, asize);
+        if ((ret = av_get_packet(pb, pkt, asize)) < 0)
+            return ret;
         pkt->stream_index = st[NSV_ST_AUDIO]->index;//NSV_ST_AUDIO;
         pkt->flags |= nsv->state == NSV_HAS_READ_NSVS ? AV_PKT_FLAG_KEY : 0; /* keyframe only likely on a sync frame */
         if( nsv->state == NSV_HAS_READ_NSVS && st[NSV_ST_VIDEO] ) {

programming_language: C
CVE-2019-10678 (published 2019-03-31T21:29Z)

Domoticz before 4.10579 neglects to categorize \\n and \\r as insecure argument options.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-93
cwe_name: Improper Neutralization of CRLF Sequences ('CRLF Injection')
description: The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/domoticz/domoticz
commit_details: repo_url: https://github.com/domoticz/domoticz
author: Rob Peters
author_date: 2019-03-29 15:23:06+01:00
msg: Do not allow enters/returns in arguments (thanks to Fabio Carretto)
repository: repo_url: https://github.com/domoticz/domoticz
repo_name: domoticz/domoticz
description: Open source Home Automation System
repo_language: C++
owner: domoticz
file_changes: filename: Helper.cpp
change_type: ModificationType.MODIFY
diff: @@ -1014,6 +1014,8 @@ const char *szInsecureArgumentOptions[] = {
 	"$",
 	"<",
 	">",
+	"\n",
+	"\r",
 	NULL
 };
 

programming_language: C++
CVE-2017-5609 (published 2017-01-28T18:59Z)

SQL injection vulnerability in include/functions_entries.inc.php in Serendipity 2.0.5 allows remote authenticated users to execute arbitrary SQL commands via the cat parameter.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/s9y/Serendipity
commit_details: repo_url: https://github.com/s9y/Serendipity
author: Garvin Hicking
author_date: 2017-01-16 11:29:15+01:00
msg: * [Security] Fix missing integer casting for inserting new categories
    (thanks to cdxy)
repository: repo_url: https://github.com/s9y/Serendipity
repo_name: s9y/Serendipity
description: A PHP blog software
repo_language: PHP
owner: s9y
file_changes: filename: NEWS
change_type: ModificationType.MODIFY
diff: @@ -20,6 +20,9 @@ Version 2.1 ()
       
     * [Security] Redirection of comment.php now checks the referrer
       and only allows the blog's host (thanks to Lee Sheldon Victor)
+      
+    * [Security] Fix missing integer casting for inserting new categories
+      (thanks to cdxy)
 
     * Disabled Selenium test files unless enabled
 

programming_language: Markdown
filename: functions_entries.inc.php
change_type: ModificationType.MODIFY
diff: @@ -1523,7 +1523,7 @@ function serendipity_updertEntry($entry) {
         if (is_array($categories)) {
             serendipity_db_query("DELETE FROM {$serendipity['dbPrefix']}entrycat WHERE entryid={$entry['id']}");
             foreach ($categories as $cat) {
-                serendipity_db_query("INSERT INTO {$serendipity['dbPrefix']}entrycat (entryid, categoryid) VALUES ({$entry['id']}, {$cat})");
+                serendipity_db_query("INSERT INTO {$serendipity['dbPrefix']}entrycat (entryid, categoryid) VALUES ({$entry['id']}, " . (int)$cat . ")");
             }
         } elseif ($had_categories) {
             // This case actually only happens if an existing entry is edited, and its category assignments are all removed.

programming_language: PHP
CVE-2020-26222 (published 2020-11-13T16:15Z)

Dependabot is a set of packages for automated dependency management for Ruby, JavaScript, Python, PHP, Elixir, Rust, Java, .NET, Elm and Go. In Dependabot-Core from version 0.119.0.beta1 before version 0.125.1, there is a remote code execution vulnerability in dependabot-common and dependabot-go_modules when a source branch name contains malicious injectable bash code. For example, if Dependabot is configured to use the following source branch name: "/$({curl,127.0.0.1})", Dependabot will make a HTTP request to the following URL: 127.0.0.1 when cloning the source repository. The fix was applied to version 0.125.1. As a workaround, one can escape the branch name prior to passing it to the Dependabot::Source class.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-74
cwe_name: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
extended_description: Software or other automated logic has certain assumptions about what constitutes data and control respectively. It is the lack of verification of these assumptions for user-controlled input that leads to injection problems. Injection problems encompass a wide variety of issues -- all mitigated in very different ways and usually attempted in order to alter the control flow of the process. For this reason, the most effective way to discuss these weaknesses is to note the distinct features that classify them as injection weaknesses. The most important issue to note is that all injection problems share one thing in common -- i.e., they allow for the injection of control plane data into the user-controlled data plane. This means that the execution of the process may be altered by sending code in through legitimate data channels, using no other mechanism. While buffer overflows, and many other flaws, involve the use of some further issue to gain execution, injection problems need only for the data to be parsed.
         

Fix information:
repo_url: https://github.com/dependabot/dependabot-core
commit_details: repo_url: https://github.com/dependabot/dependabot-core
author: Philip Harrison
author_date: 2020-11-05 16:45:57+01:00
msg: Merge pull request #2727 from dependabot/v0.125.1-release-notes

v0.125.1
repository: repo_url: https://github.com/dependabot/dependabot-core
repo_name: dependabot/dependabot-core
description: 🤖 Dependabot's core logic for creating update PRs.
repo_language: Ruby
owner: dependabot
CVE-2017-12893 (published 2017-09-14T06:29Z)

The SMB/CIFS parser in tcpdump before 4.9.2 has a buffer over-read in smbutil.c:name_len().

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/the-tcpdump-group/tcpdump
commit_details: repo_url: https://github.com/the-tcpdump-group/tcpdump
author: Guy Harris
author_date: 2017-02-03 16:56:57-08:00
msg: CVE-2017-12893/SMB/CIFS: Add a bounds check in name_len().

After we advance the pointer by the length value in the buffer, make
sure it points to something in the captured data.

This fixes a buffer over-read discovered by Forcepoint's security
researchers Otto Airamo & Antti Levomäki.

Add a test using the capture file supplied by the reporter(s).
repository: repo_url: https://github.com/the-tcpdump-group/tcpdump
repo_name: the-tcpdump-group/tcpdump
description: the TCPdump network dissector
repo_language: C
owner: the-tcpdump-group
file_changes: filename: smbutil.c
change_type: ModificationType.MODIFY
diff: @@ -237,6 +237,7 @@ name_len(netdissect_options *ndo,
 	    return(-1);	/* name goes past the end of the buffer */
 	ND_TCHECK2(*s, 1);
 	s += (*s) + 1;
+	ND_TCHECK2(*s, 1);
     }
     return(PTR_DIFF(s, s0) + 1);
 

programming_language: C
filename: TESTLIST
change_type: ModificationType.MODIFY
diff: @@ -449,6 +449,9 @@ decnet-oobr		decnet-oobr.pcap		decnet-oobr.out
 # bad packets from Wilfried Kirsch
 slip-bad-direction	slip-bad-direction.pcap		slip-bad-direction.out	-ve
 
+# bad packets from Otto Airamo and Antti Levomäki
+nbns-valgrind		nbns-valgrind.pcap		nbns-valgrind.out	-vvv -e
+
 # RTP tests
 # fuzzed pcap
 rtp-seg-fault-1  rtp-seg-fault-1.pcap  rtp-seg-fault-1.out  -v -T rtp

programming_language: Shell
filename: nbns-valgrind.out
change_type: ModificationType.ADD
diff: @@ -0,0 +1,16 @@
+00:0c:85:0e:a5:ff > 00:00:0c:07:ac:f0, ethertype IPv4 (0x0800), length 92: (tos 0x0, ttl 127, id 38615, offset 0, flags [none], proto UDP (17), length 78)
+    10.49.248.228.137 > 10.48.161.241.137: 
+>>> NBT UDP PACKET(137): QUERY; REQUEST; UNICAST
+TrnID=0x8D40
+OpCode=0
+NmFlags=0x10
+Rcode=0
+QueryCount=1
+AnswerCount=0
+AuthorityCount=0
+AddressRecCount=0
+QuestionRecords:
+Name=
+WARNING: Short packet. Try increasing the snap length
+
+

programming_language: Batchfile
CVE-2018-8828 (published 2018-03-20T20:29Z)

A Buffer Overflow issue was discovered in Kamailio before 4.4.7, 5.0.x before 5.0.6, and 5.1.x before 5.1.2. A specially crafted REGISTER message with a malformed branch or From tag triggers an off-by-one heap-based buffer overflow in the tmx_check_pretran function in modules/tmx/tmx_pretran.c.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         
cwe_id: CWE-193
cwe_name: Off-by-one Error
description: A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/kamailio/kamailio
commit_details: repo_url: https://github.com/kamailio/kamailio
author: Daniel-Constantin Mierla
author_date: 2018-02-10 22:05:42+01:00
msg: tmx: allocate space to store ending 0 for branch value

- reported by Alfred Farrugia and Sandro Gauci
repository: repo_url: https://github.com/kamailio/kamailio
repo_name: kamailio/kamailio
description: Kamailio - The Open Source SIP Server for large VoIP and real-time communication platforms -
repo_language: C
owner: kamailio
file_changes: filename: tmx_pretran.c
change_type: ModificationType.MODIFY
diff: @@ -260,7 +260,7 @@ int tmx_check_pretran(sip_msg_t *msg)
 	if(likely(vbr!=NULL)) {
 		svbranch = vbr->value;
 		trim(&svbranch);
-		dsize += svbranch.len;
+		dsize += svbranch.len + 1;
 	}
 	if(dsize<256) dsize = 256;
 

programming_language: C
CVE-2016-2188 (published 2016-05-02T10:59Z)

The iowarrior_probe function in drivers/usb/misc/iowarrior.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 4.6, MEDIUM (CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Josh Boyer
author_date: 2016-03-14 10:42:38-04:00
msg: USB: iowarrior: fix oops with malicious USB descriptors

The iowarrior driver expects at least one valid endpoint.  If given
malicious descriptors that specify 0 for the number of endpoints,
it will crash in the probe function.  Ensure there is at least
one endpoint on the interface before using it.

The full report of this issue can be found here:
http://seclists.org/bugtraq/2016/Mar/87

Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: iowarrior.c
change_type: ModificationType.MODIFY
diff: @@ -787,6 +787,12 @@ static int iowarrior_probe(struct usb_interface *interface,
 	iface_desc = interface->cur_altsetting;
 	dev->product_id = le16_to_cpu(udev->descriptor.idProduct);
 
+	if (iface_desc->desc.bNumEndpoints < 1) {
+		dev_err(&interface->dev, "Invalid number of endpoints\n");
+		retval = -EINVAL;
+		goto error;
+	}
+
 	/* set up the endpoint information */
 	for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
 		endpoint = &iface_desc->endpoint[i].desc;

programming_language: C
CVE-2023-25565 (published 2023-02-14T18:15Z)

GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, an incorrect free when decoding target information can trigger a denial of service. The error condition incorrectly assumes the `cb` and `sh` buffers contain a copy of the data that needs to be freed. However, that is not the case. This vulnerability can be triggered via the main `gss_accept_sec_context` entry point. This will likely trigger an assertion failure in `free`, causing a denial-of-service. This issue is fixed in version 1.2.0.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-763
cwe_name: Release of Invalid Pointer or Reference
description: The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.
extended_description: 
            This weakness can take several forms, such as:
               
                  The memory was allocated, explicitly or implicitly, via one memory management method and deallocated using a different, non-compatible function (CWE-762).
                  The function calls or memory management routines chosen are appropriate, however they are used incorrectly, such as in CWE-761.
               
         
         

Fix information:
repo_url: https://github.com/gssapi/gss-ntlmssp
commit_details: repo_url: https://github.com/gssapi/gss-ntlmssp
author: Simo Sorce
author_date: 2023-02-07 12:04:11-05:00
msg: GHSL-2023-012: Incorrect free when decoding target

Incorrect free when decoding target information (GHSL-2023-012)

Fixes defect GHSL-2023-012 found by the GitHub Security Lab team via
oss-fuzz.

The error condition incorrectly assumed the cb and sh buffers would
contain a copy of the data that needed to freed. However that is not the
case.

This will generally cause an assertion when trying to free a pointer
that was never allocated, and potentially memory corruption depending on
the contents fo the target_info buffer.

This may cause a DoS condition.

Signed-off-by: Simo Sorce <simo@redhat.com>
repository: repo_url: https://github.com/gssapi/gss-ntlmssp
repo_name: gssapi/gss-ntlmssp
description: A complete implementation of the MS-NLMP documents as a GSSAPI mechanism
repo_language: C
owner: gssapi
file_changes: filename: ntlm.c
change_type: ModificationType.MODIFY
diff: @@ -731,8 +731,6 @@ int ntlm_decode_target_info(struct ntlm_ctx *ctx, struct ntlm_buffer *buffer,
 
 done:
     if (ret) {
-        ntlm_free_buffer_data(&sh);
-        ntlm_free_buffer_data(&cb);
         safefree(nb_computer);
         safefree(nb_domain);
         safefree(dns_computer);

programming_language: C
CVE-2021-33473 (published 2022-06-02T20:15Z)

An argument injection vulnerability in Dragonfly Ruby Gem v1.3.0 allows attackers to read and write arbitrary files when the verify_url option is disabled. This vulnerability is exploited via a crafted URL.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:N/AC:M/Au:S/C:P/I:P/A:N)
CVSS v3 base score: 9.1, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

Weakness information:
cwe_id: CWE-88
cwe_name: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
description: The product constructs a string for a command to be executed by a separate component
in another control sphere, but it does not properly delimit the
intended arguments, options, or switches within that command string.
extended_description: 
            When creating commands using interpolation into a string, developers may assume that only the arguments/options that they specify will be processed.  This assumption may be even stronger when the programmer has encoded the command in a way that prevents separate commands from being provided maliciously, e.g. in the case of shell metacharacters.  When constructing the command, the developer may use whitespace or other delimiters that are required to separate arguments when the command. However, if an attacker can provide an untrusted input that contains argument-separating delimiters, then the resulting command will have more arguments than intended by the developer.  The attacker may then be able to change the behavior of the command.  Depending on the functionality supported by the extraneous arguments, this may have security-relevant consequences.
         
         

Fix information:
repo_url: https://github.com/markevans/dragonfly
commit_details: repo_url: https://github.com/markevans/dragonfly
author: Mark Evans
author_date: 2021-05-19 09:49:04+01:00
msg: Merge branch 'better-security'
repository: repo_url: https://github.com/markevans/dragonfly
repo_name: markevans/dragonfly
description: A Ruby gem for on-the-fly processing - suitable for image uploading in Rails, Sinatra and much more!
repo_language: Ruby
owner: markevans
CVE-2021-41087 (published 2021-09-21T21:15Z)

in-toto-golang is a go implementation of the in-toto framework to protect software supply chain integrity. In affected versions authenticated attackers posing as functionaries (i.e., within a trusted set of users for a layout) are able to create attestations that may bypass DISALLOW rules in the same layout. An attacker with access to trusted private keys, may issue an attestation that contains a disallowed artifact by including path traversal semantics (e.g., foo vs dir/../foo). Exploiting this vulnerability is dependent on the specific policy applied. The problem has been fixed in version 0.3.0.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:N/I:P/A:N)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/in-toto/in-toto-golang
commit_details: repo_url: https://github.com/in-toto/in-toto-golang
author: Aditya Sirish
author_date: 2021-09-21 16:50:06-04:00
msg: Merge pull request from GHSA-vrxp-mg9f-hwf3

Fix handling of wildcards and relative paths
repository: repo_url: https://github.com/in-toto/in-toto-golang
repo_name: in-toto/in-toto-golang
description: A Go implementation of in-toto. in-toto is a framework to protect software supply chain integrity.
repo_language: Go
owner: in-toto