starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2018-5387 (published 2018-07-24T15:29Z)

Wizkunde SAMLBase may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-347
cwe_name: Improper Verification of Cryptographic Signature
description: The product does not verify, or incorrectly verifies, the cryptographic signature for data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/GoGentoOSS/SAMLBase
commit_details: repo_url: https://github.com/GoGentoOSS/SAMLBase
author: Ron van der Molen
author_date: 2018-04-03 12:53:53+02:00
msg: Fixed comment vulnerability in verifying signatures
repository: repo_url: https://github.com/GoGentoOSS/SAMLBase
repo_name: GoGentoOSS/SAMLBase
description: Single Sign-On Support using SAML as protocol within PHP. Separate codebases will be built on top of this library
repo_language: PHP
owner: GoGentoOSS
file_changes: filename: Signature.php
change_type: ModificationType.MODIFY
diff: @@ -32,7 +32,7 @@ class Signature extends XMLSecurityDSig implements SignatureInterface
         }
 
         $this->add509Cert($this->getCertificate()->getPublicKey()->getX509Certificate());
-        $this->setCanonicalMethod(XMLSecurityDSig::EXC_C14N);
+        $this->setCanonicalMethod(XMLSecurityDSig::EXC_C14N_COMMENTS);
         $this->addReference($document->documentElement, XMLSecurityDSig::SHA1, array('http://www.w3.org/2000/09/xmldsig#enveloped-signature', XMLSecurityDSig::EXC_C14N), array('id_name' => 'ID'));
 
         return $this->verify($this->getCertificate()->getPublicKey());
@@ -94,7 +94,7 @@ class Signature extends XMLSecurityDSig implements SignatureInterface
     protected function signDocument(\DOMDocument $document, $node)
     {
         $this->add509Cert($this->getCertificate()->getPublicKey()->getX509Certificate());
-        $this->setCanonicalMethod(XMLSecurityDSig::EXC_C14N);
+        $this->setCanonicalMethod(XMLSecurityDSig::EXC_C14N_COMMENTS);
         $this->addReference($document->documentElement, XMLSecurityDSig::SHA1, array('http://www.w3.org/2000/09/xmldsig#enveloped-signature', XMLSecurityDSig::EXC_C14N), array('id_name' => 'ID'));
 
         $this->sign($this->getCertificate()->getPrivateKey());

programming_language: PHP
CVE-2021-29515 (published 2021-05-14T20:15Z)

TensorFlow is an end-to-end open source platform for machine learning. The implementation of `MatrixDiag*` operations(https://github.com/tensorflow/tensorflow/blob/4c4f420e68f1cfaf8f4b6e8e3eb857e9e4c3ff33/tensorflow/core/kernels/linalg/matrix_diag_op.cc#L195-L197) does not validate that the tensor arguments are non-empty. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Mihai Maruseac
author_date: 2021-04-17 20:55:53-07:00
msg: Validate `MatrixDiagV{2,3}` arguments to prevent breakage.

PiperOrigin-RevId: 369056033
Change-Id: Ic2018c297d3dd6f252dc1dd3667f1ed5cb1eaa42
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: matrix_diag_op.cc
change_type: ModificationType.MODIFY
diff: @@ -192,9 +192,22 @@ class MatrixDiagOp : public OpKernel {
           upper_diag_index = diag_index.flat<int32>()(1);
         }
       }
-      num_rows = context->input(2).flat<int32>()(0);
-      num_cols = context->input(3).flat<int32>()(0);
-      padding_value = context->input(4).flat<T>()(0);
+
+      auto& num_rows_tensor = context->input(2);
+      OP_REQUIRES(context, TensorShapeUtils::IsScalar(num_rows_tensor.shape()),
+                  errors::InvalidArgument("num_rows must be a scalar"));
+      num_rows = num_rows_tensor.flat<int32>()(0);
+
+      auto& num_cols_tensor = context->input(3);
+      OP_REQUIRES(context, TensorShapeUtils::IsScalar(num_cols_tensor.shape()),
+                  errors::InvalidArgument("num_cols must be a scalar"));
+      num_cols = num_cols_tensor.flat<int32>()(0);
+
+      auto& padding_value_tensor = context->input(4);
+      OP_REQUIRES(context,
+                  TensorShapeUtils::IsScalar(padding_value_tensor.shape()),
+                  errors::InvalidArgument("padding_value must be a scalar"));
+      padding_value = padding_value_tensor.flat<T>()(0);
     }
 
     // Size validations.

programming_language: C++
CVE-2023-2251 (published 2023-04-24T15:15Z)

Uncaught Exception in GitHub repository eemeli/yaml prior to 2.0.0-5.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-248
cwe_name: Uncaught Exception
description: An exception is thrown from a function, but it is not caught.
extended_description: When an exception is not caught, it may cause the program to crash or expose sensitive information.
         

Fix information:
repo_url: https://github.com/eemeli/yaml
commit_details: repo_url: https://github.com/eemeli/yaml
author: Eemeli Aro
author_date: 2023-04-24 15:43:50+03:00
msg: fix: Corner case failure in error pretty-printer
repository: repo_url: https://github.com/eemeli/yaml
repo_name: eemeli/yaml
description: YAML parser and stringifier for JavaScript
repo_language: TypeScript
owner: eemeli
file_changes: filename: errors.ts
change_type: ModificationType.MODIFY
diff: @@ -91,7 +91,7 @@ export const prettifyError =
       let count = 1
       const end = error.linePos[1]
       if (end && end.line === line && end.col > col) {
-        count = Math.min(end.col - col, 80 - ci)
+        count = Math.max(1, Math.min(end.col - col, 80 - ci))
       }
       const pointer = ' '.repeat(ci) + '^'.repeat(count)
       error.message += `:\n\n${lineStr}\n${pointer}\n`

programming_language: CoffeeScript
filename: errors.js
change_type: ModificationType.MODIFY
diff: @@ -341,6 +341,12 @@ describe('pretty errors', () => {
     const doc = YAML.parseDocument(src, { prettyErrors: true })
     expect(doc.warnings).toMatchObject([{ name: 'YAMLWarning' }])
   })
+
+  test('repeated CR', () => {
+    const src = '[' + '\r'.repeat(80)
+    const doc = YAML.parseDocument(src, { prettyErrors: true })
+    expect(doc.errors[0]).not.toHaveProperty('source')
+  })
 })
 
 describe('tags on invalid nodes', () => {

programming_language: JavaScript
CVE-2024-1394 (published 2024-03-21T13:00Z)

A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs?. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey? and ctx?. That function uses named return parameters to free pkey? and ctx? if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey? and ctx? will be nil inside the deferred function that should free them.


Weakness information:
cwe_id: CWE-401
cwe_name: Missing Release of Memory after Effective Lifetime
description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
extended_description: This is often triggered by improper handling of malformed data or unexpectedly interrupted sessions.  In some languages, developers are responsible for tracking memory allocation and releasing the memory.  If there are no more pointers or references to the memory, then it can no longer be tracked and identified for release.
         

Fix information:
repo_url: https://github.com/golang-fips/openssl
commit_details: repo_url: https://github.com/golang-fips/openssl
author: George Adams
author_date: 2024-03-20 17:30:05+00:00
msg: Merge pull request from GHSA-78hx-gp6g-7mj6

Fix memory leak in setupEVP and newCipherCtx
repository: repo_url: https://github.com/golang-fips/openssl
repo_name: golang-fips/openssl
repo_language: Go
owner: golang-fips
repo_url: https://github.com/microsoft/go-crypto-openssl
commit_details: repo_url: https://github.com/microsoft/go-crypto-openssl
author: qmuntal
author_date: 2024-02-08 09:25:43+01:00
msg: Fix memory leak in setupEVP
repository: repo_url: https://github.com/microsoft/go-crypto-openssl
repo_name: microsoft/go-crypto-openssl
description: Go crypto backend for Linux using OpenSSL
repo_language: Go
owner: microsoft
file_changes: filename: evpkey.go
change_type: ModificationType.MODIFY
diff: @@ -101,7 +101,15 @@ type verifyFunc func(C.GO_EVP_PKEY_CTX_PTR, *C.uchar, C.size_t, *C.uchar, C.size
 
 func setupEVP(withKey withKeyFunc, padding C.int,
 	h, mgfHash hash.Hash, label []byte, saltLen C.int, ch crypto.Hash,
-	init initFunc) (ctx C.GO_EVP_PKEY_CTX_PTR, err error) {
+	init initFunc) (_ C.GO_EVP_PKEY_CTX_PTR, err error) {
+	var ctx C.GO_EVP_PKEY_CTX_PTR
+	withKey(func(pkey C.GO_EVP_PKEY_PTR) C.int {
+		ctx = C.go_openssl_EVP_PKEY_CTX_new(pkey, nil)
+		return 1
+	})
+	if ctx == nil {
+		return nil, newOpenSSLError("EVP_PKEY_CTX_new failed")
+	}
 	defer func() {
 		if err != nil {
 			if ctx != nil {
@@ -110,14 +118,6 @@ func setupEVP(withKey withKeyFunc, padding C.int,
 			}
 		}
 	}()
-
-	withKey(func(pkey C.GO_EVP_PKEY_PTR) C.int {
-		ctx = C.go_openssl_EVP_PKEY_CTX_new(pkey, nil)
-		return 1
-	})
-	if ctx == nil {
-		return nil, newOpenSSLError("EVP_PKEY_CTX_new failed")
-	}
 	if err := init(ctx); err != nil {
 		return nil, err
 	}

programming_language: Go
CVE-2011-0716 (published 2012-06-21T23:55Z)

The br_multicast_add_group function in net/bridge/br_multicast.c in the Linux kernel before 2.6.38, when a certain Ethernet bridge configuration is used, allows local users to cause a denial of service (memory corruption and system crash) by sending IGMP packets to a local interface.

Severity: MEDIUM
CVSS v2 base score: 4.7 (AV:L/AC:M/Au:N/C:N/I:N/A:C)

Weakness information:
cwe_id: CWE-399
cwe_name: Resource Management Errors
description: Weaknesses in this category are related to improper management of system resources.

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Herbert Xu
author_date: 2011-02-11 12:36:55+00:00
msg: bridge: Fix mglist corruption that leads to memory corruption

The list mp->mglist is used to indicate whether a multicast group
is active on the bridge interface itself as opposed to one of the
constituent interfaces in the bridge.

Unfortunately the operation that adds the mp->mglist node to the
list neglected to check whether it has already been added.  This
leads to list corruption in the form of nodes pointing to itself.

Normally this would be quite obvious as it would cause an infinite
loop when walking the list.  However, as this list is never actually
walked (which means that we don't really need it, I'll get rid of
it in a subsequent patch), this instead is hidden until we perform
a delete operation on the affected nodes.

As the same node may now be pointed to by more than one node, the
delete operations can then cause modification of freed memory.

This was observed in practice to cause corruption in 512-byte slabs,
most commonly leading to crashes in jbd2.

Thanks to Josef Bacik for pointing me in the right direction.

Reported-by: Ian Page Hands <ihands@redhat.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: br_multicast.c
change_type: ModificationType.MODIFY
diff: @@ -719,7 +719,8 @@ static int br_multicast_add_group(struct net_bridge *br,
 		goto err;
 
 	if (!port) {
-		hlist_add_head(&mp->mglist, &br->mglist);
+		if (hlist_unhashed(&mp->mglist))
+			hlist_add_head(&mp->mglist, &br->mglist);
 		mod_timer(&mp->timer, now + br->multicast_membership_interval);
 		goto out;
 	}

programming_language: C
CVE-2018-14345 (published 2018-07-17T14:29Z)

An issue was discovered in SDDM through 0.17.0. If configured with ReuseSession=true, the password is not checked for users with an already existing session. Any user with access to the system D-Bus can therefore unlock any graphical session. This is related to daemon/Display.cpp and helper/backend/PamBackend.cpp.

Severity: MEDIUM
CVSS v2 base score: 6.0 (AV:N/AC:M/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         
cwe_id: CWE-613
cwe_name: Insufficient Session Expiration
description: According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/sddm/sddm
commit_details: repo_url: https://github.com/sddm/sddm
author: Fabian Vogt
author_date: 2018-07-11 19:45:40+02:00
msg: Fix authentication when reusing an existing session

- Check the success value before unlocking the session
- Don't attempt to use the nonexistant "sddm-check" PAM service
repository: repo_url: https://github.com/sddm/sddm
repo_name: sddm/sddm
description: QML based X11 and Wayland display manager
repo_language: C++
owner: sddm
file_changes: filename: Display.cpp
change_type: ModificationType.MODIFY
diff: @@ -339,7 +339,9 @@ namespace SDDM {
         } else {
             //we only want to unlock the session if we can lock in, so we want to go via PAM auth, but not start a new session
             //by not setting the session and the helper will emit authentication and then quit
-            connect(m_auth, &Auth::authentication, this, [=](){
+            connect(m_auth, &Auth::authentication, this, [=](const QString &, bool success){
+                if(!success)
+                    return;
                 qDebug() << "activating existing seat";
                 OrgFreedesktopLogin1ManagerInterface manager(Logind::serviceName(), Logind::managerPath(), QDBusConnection::systemBus());
                 manager.UnlockSession(existingSessionId);

programming_language: C++
filename: PamBackend.cpp
change_type: ModificationType.MODIFY
diff: @@ -219,8 +219,6 @@ namespace SDDM {
 
         if (user == QStringLiteral("sddm") && m_greeter)
             service = QStringLiteral("sddm-greeter");
-        else if (m_app->session()->path().isEmpty())
-            service = QStringLiteral("sddm-check");
         else if (m_autologin)
             service = QStringLiteral("sddm-autologin");
         result = m_pam->start(service, user);

programming_language: C++
CVE-2019-20479 (published 2020-02-20T06:15Z)

A flaw was found in mod_auth_openidc before version 2.4.1. An open redirect issue exists in URLs with a slash and backslash at the beginning.

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v3 base score: 6.1, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-601
cwe_name: URL Redirection to Untrusted Site ('Open Redirect')
description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
extended_description: An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance. Whether this issue poses a vulnerability will be subject to the intended behavior of the application. For example, a search engine might intentionally provide redirects to arbitrary URLs.
         

Fix information:
repo_url: https://github.com/zmartzone/mod_auth_openidc
commit_details: repo_url: https://github.com/zmartzone/mod_auth_openidc
author: Hans Zandbelt
author_date: 2019-11-12 14:23:58+01:00
msg: Merge pull request #453 from oss-aimoto/fix_openredirect_starting_slash_backslash

Fix open redirect starting with a slash and backslash
repository: repo_url: https://github.com/zmartzone/mod_auth_openidc
repo_name: OpenIDC/mod_auth_openidc
description: OpenID Certified™ OpenID Connect Relying Party implementation for Apache HTTP Server 2.x
repo_language: C
owner: zmartzone
CVE-2013-10009 (published 2023-01-07T20:15Z)

A vulnerability was found in DrAzraelTod pyChao and classified as critical. Affected by this issue is the function klauen/lesen of the file mod_fun/__init__.py. The manipulation leads to sql injection. The patch is identified as 9d8adbc07c384ba51c2583ce0819c9abb77dc648. It is recommended to apply a patch to fix this issue. VDB-217634 is the identifier assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/DrAzraelTod/pyChao
commit_details: repo_url: https://github.com/DrAzraelTod/pyChao
author: Sandra Thieme
author_date: 2013-11-03 13:57:36+01:00
msg: fix sql injections
repository: repo_url: https://github.com/DrAzraelTod/pyChao
repo_name: DrAzraelTod/pyChao
description: mostly sequential IRC-Bot in python, mainly for Facts and Newsfeeds, interacts with "WebChao"-Blog
repo_language: Python
owner: DrAzraelTod
file_changes: filename: __init__.py
change_type: ModificationType.MODIFY
diff: @@ -71,7 +71,7 @@ class mod_fun(object):
             self.parent.privmsg(u'hast du nicht was vergessen?', params.channel)
     
     def aendern(self, name, amount, item):
-        keks = self.DBcursor.execute(u"SELECT nickname, count from kekse WHERE nickname like '%s' AND item =='%s' LIMIT 1" % (name, item)).fetchall()
+        keks = self.DBcursor.execute(u"SELECT nickname, count from kekse WHERE nickname like ? AND item ==? LIMIT 1", (name, item)).fetchall()
         if(len(keks)>0 and len(keks[0]) > 1):
             keks = keks[0][1]
             if amount == 0:
@@ -106,7 +106,7 @@ class mod_fun(object):
                 anrede=u"%s hat" % params.args[0]
             self.parent.privmsg(u"%s %i %s." % (anrede, keks, words['plural']), params.channel)
         elif len(params.args) == 0:
-            keks = self.DBcursor.execute(u"SELECT `nickname`, `count` from kekse WHERE item=='%s' AND `count`>=1 ORDER BY `count` DESC LIMIT 10" % (name)).fetchall()
+            keks = self.DBcursor.execute(u"SELECT `nickname`, `count` from kekse WHERE item==? AND `count`>=1 ORDER BY `count` DESC LIMIT 10", (name)).fetchall()
             if len(keks) <= 0:
                 self.parent.privmsg(u"Es gibt noch keine %s?" % words['plural'], params.channel)
                 return

programming_language: Python
CVE-2021-4019 (published 2021-12-01T10:15Z)

vim is vulnerable to Heap-based Buffer Overflow

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-122
cwe_name: Heap-based Buffer Overflow
description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Bram Moolenaar
author_date: 2021-11-25 10:50:12+00:00
msg: patch 8.2.3669: buffer overflow with long help argument

Problem:    Buffer overflow with long help argument.
Solution:   Use snprintf().
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: help.c
change_type: ModificationType.MODIFY
diff: @@ -422,8 +422,7 @@ find_help_tags(
 		    || (vim_strchr((char_u *)"%_z@", arg[1]) != NULL
 							   && arg[2] != NUL)))
 	{
-	    STRCPY(d, "/\\\\");
-	    STRCPY(d + 3, arg + 1);
+	    vim_snprintf((char *)d, IOSIZE, "/\\\\%s", arg + 1);
 	    // Check for "/\\_$", should be "/\\_\$"
 	    if (d[3] == '_' && d[4] == '$')
 		STRCPY(d + 4, "\\$");

programming_language: C++
filename: test_help.vim
change_type: ModificationType.MODIFY
diff: @@ -134,4 +134,13 @@ func Test_help_window_height()
   close
 endfunc
 
+func Test_help_long_argument()
+  try
+    exe 'help \%' .. repeat('0', 1021)
+  catch
+    call assert_match("E149:", v:exception)
+  endtry
+endfunc
+
+
 " vim: shiftwidth=2 sts=2 expandtab

programming_language: Lua
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -757,6 +757,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    3669,
 /**/
     3668,
 /**/

programming_language: Ruby