starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2018-1002200 (published 2018-07-25T17:29Z)

plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/codehaus-plexus/plexus-archiver
commit_details: repo_url: https://github.com/codehaus-plexus/plexus-archiver
author: Karl Heinz Marbaise
author_date: 2018-05-06 13:43:08+02:00
msg: Merge pull request #87 from odinn1984/fix/fail_on_outside_target_files

fix: fail when trying to extract outside of dest dir
repository: repo_url: https://github.com/codehaus-plexus/plexus-archiver
repo_name: codehaus-plexus/plexus-archiver
repo_language: Java
owner: codehaus-plexus
CVE-2023-26483 (published 2023-03-03T23:15Z)

gosaml2 is a Pure Go implementation of SAML 2.0. SAML Service Providers using this library for SAML authentication support are likely susceptible to Denial of Service attacks. A bug in this library enables attackers to craft a `deflate`-compressed request which will consume significantly more memory during processing than the size of the original request. This may eventually lead to memory exhaustion and the process being killed. The maximum compression ratio achievable with `deflate` is 1032:1, so by limiting the size of bodies passed to gosaml2, limiting the rate and concurrency of calls, and ensuring that lots of memory is available to the process it _may_ be possible to help Go\'s garbage collector "keep up". Implementors are encouraged not to rely on this. This issue is fixed  in version 0.9.0.

CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/russellhaering/gosaml2
commit_details: repo_url: https://github.com/russellhaering/gosaml2
author: Russell Haering
author_date: 2023-03-01 13:48:05-08:00
msg: Merge pull request from GHSA-6gc3-crp7-25w5

Configurable deflate-bomb protection
repository: repo_url: https://github.com/russellhaering/gosaml2
repo_name: russellhaering/gosaml2
description: Pure Go implementation of SAML 2.0
repo_language: Go
owner: russellhaering
CVE-2017-18013 (published 2018-01-01T08:29Z)

In LibTIFF 4.0.9, there is a Null-Pointer Dereference in the tif_print.c TIFFPrintDirectory function, as demonstrated by a tiffinfo crash.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://gitlab.com/libtiff/libtiff
commit_details: repo_url: https://gitlab.com/libtiff/libtiff
author: Even Rouault
author_date: 2017-12-31 15:09:41+01:00
msg: libtiff/tif_print.c: TIFFPrintDirectory(): fix null pointer dereference on corrupted file. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2770
repository: repo_url: https://gitlab.com/libtiff/libtiff
repo_name: visit repo url
description: visit repo url
repo_language: visit repo url
owner: libtiff
file_changes: filename: tif_print.c
change_type: ModificationType.MODIFY
diff: @@ -665,13 +665,13 @@ TIFFPrintDirectory(TIFF* tif, FILE* fd, long flags)
 #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
 			fprintf(fd, "    %3lu: [%8I64u, %8I64u]\n",
 			    (unsigned long) s,
-			    (unsigned __int64) td->td_stripoffset[s],
-			    (unsigned __int64) td->td_stripbytecount[s]);
+			    td->td_stripoffset ? (unsigned __int64) td->td_stripoffset[s] : 0,
+			    td->td_stripbytecount ? (unsigned __int64) td->td_stripbytecount[s] : 0);
 #else
 			fprintf(fd, "    %3lu: [%8llu, %8llu]\n",
 			    (unsigned long) s,
-			    (unsigned long long) td->td_stripoffset[s],
-			    (unsigned long long) td->td_stripbytecount[s]);
+			    td->td_stripoffset ? (unsigned long long) td->td_stripoffset[s] : 0,
+			    td->td_stripbytecount ? (unsigned long long) td->td_stripbytecount[s] : 0);
 #endif
 	}
 }

programming_language: C
CVE-2014-9756 (published 2015-11-19T20:59Z)

The psf_fwrite function in file_io.c in libsndfile allows attackers to cause a denial of service (divide-by-zero error and application crash) via unspecified vectors related to the headindex variable.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)

Weakness information:
cwe_id: CWE-369
cwe_name: Divide By Zero
description: The product divides a value by zero.
extended_description: This weakness typically occurs when an unexpected value is provided to the product, or if an error occurs that is not properly detected. It frequently occurs in calculations involving physical dimensions such as size, length, width, and height.
         

Fix information:
repo_url: https://github.com/erikd/libsndfile
commit_details: repo_url: https://github.com/erikd/libsndfile
author: Erik de Castro Lopo
author_date: 2014-12-24 21:02:35+11:00
msg: src/file_io.c : Prevent potential divide-by-zero.

Closes: https://github.com/erikd/libsndfile/issues/92
repository: repo_url: https://github.com/erikd/libsndfile
repo_name: libsndfile/libsndfile
description: A C library for reading and writing sound files containing sampled audio data.
repo_language: C
owner: erikd
file_changes: filename: file_io.c
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,5 @@
 /*
-** Copyright (C) 2002-2013 Erik de Castro Lopo <erikd@mega-nerd.com>
+** Copyright (C) 2002-2014 Erik de Castro Lopo <erikd@mega-nerd.com>
 ** Copyright (C) 2003 Ross Bencina <rbencina@iprimus.com.au>
 **
 ** This program is free software; you can redistribute it and/or modify
@@ -358,6 +358,9 @@ psf_fwrite (const void *ptr, sf_count_t bytes, sf_count_t items, SF_PRIVATE *psf
 {	sf_count_t total = 0 ;
 	ssize_t	count ;
 
+	if (bytes == 0 || items == 0)
+		return 0 ;
+
 	if (psf->virtual_io)
 		return psf->vio.write (ptr, bytes*items, psf->vio_user_data) / bytes ;
 

programming_language: C
CVE-2017-11310 (published 2017-07-13T18:29Z)

The read_user_chunk_callback function in coders\\png.c in ImageMagick 7.0.6-1 Q16 2017-06-21 (beta) has memory leak vulnerabilities via crafted PNG files.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-772
cwe_name: Missing Release of Resource after Effective Lifetime
description: The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
extended_description: When a resource is not released after use, it can allow attackers to cause a denial of service by causing the allocation of resources without triggering their release. Frequently-affected resources include memory, CPU, disk space, power or battery, etc.
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Glenn Randers-Pehrson
author_date: 2017-06-22 13:05:22-04:00
msg: coders/png.c: Stop a memory leak in read_user_chunk_callback() (reference

https://github.com/ImageMagick/ImageMagick/issues/517).
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: ChangeLog
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,7 @@
+2017-06-10  7.0.6-0 Glenn Randers-Pehrson <glennrp@image...>
+  * Stop a memory leak in read_user_chunk_callback() (reference
+    https://github.com/ImageMagick/ImageMagick/issues/517).
+
 2017-06-10  7.0.6-0 Cristy  <quetzlzacatenango@image...>
   * Release ImageMagick version 7.0.6-0, GIT revision 20194:b0c0d00:20170611.
 

programming_language: Markdown
filename: png.c
change_type: ModificationType.MODIFY
diff: @@ -1904,6 +1904,7 @@ static int read_user_chunk_callback(png_struct *ping, png_unknown_chunkp chunk)
               p[4] != '\0' || p[5] != '\0')
             {
               /* Chunk is malformed */
+              profile=DestroyStringInfo(profile);
               return(-1);
             }
          }
@@ -1917,6 +1918,8 @@ static int read_user_chunk_callback(png_struct *ping, png_unknown_chunkp chunk)
       (void) SetImageProfile(image,"exif",profile,
         error_info->exception);
 
+      profile=DestroyStringInfo(profile);
+
       return(1);
     }
 
@@ -2290,6 +2293,7 @@ static Image *ReadOnePNGImage(MngInfo *mng_info,
       /*
         PNG image is corrupt.
       */
+      printf("  destroy_read_struct\n");
       png_destroy_read_struct(&ping,&ping_info,&end_info);
 
 #ifdef IMPNG_SETJMP_NOT_THREAD_SAFE

programming_language: C
CVE-2019-13173 (published 2019-07-02T20:15Z)

fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted file. The fstream.DirWriter() function is vulnerable.

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:N/I:P/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-59
cwe_name: Improper Link Resolution Before File Access ('Link Following')
description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/npm/fstream
commit_details: repo_url: https://github.com/npm/fstream
author: isaacs
author_date: 2019-05-14 17:37:57-07:00
msg: Clobber a Link if it's in the way of a File

Fixes https://github.com/npm/node-tar/issues/212
repository: repo_url: https://github.com/npm/fstream
repo_name: npm/fstream
description: Advanced FS Streaming for Node
repo_language: JavaScript
owner: npm
file_changes: filename: writer.js
change_type: ModificationType.MODIFY
diff: @@ -147,7 +147,7 @@ Writer.prototype._stat = function (current) {
 
     // if it's a type change, then we need to clobber or error.
     // if it's not a type change, then let the impl take care of it.
-    if (currentType !== self.type) {
+    if (currentType !== self.type || self.type === 'File' && current.nlink > 1) {
       return rimraf(self._path, function (er) {
         if (er) return self.error(er)
         self._old = null

programming_language: JavaScript
CVE-2022-4927 (published 2023-03-05T20:15Z)

A vulnerability was found in ualbertalib NEOSDiscovery 1.0.70 and classified as problematic. This issue affects some unknown processing of the file app/views/bookmarks/_refworks.html.erb. The manipulation leads to use of web link to untrusted target with window.opener access. The attack may be initiated remotely. Upgrading to version 1.0.71 is able to address this issue. The patch is named abe9f57123e0c278ae190cd7402a623d66c51375. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-222287.

CVSS v3 base score: 6.1, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/ualbertalib/NEOSDiscovery
commit_details: repo_url: https://github.com/ualbertalib/NEOSDiscovery
author: Tricia Jenkins
author_date: 2022-01-04 14:58:27-07:00
msg: Reverse Tabnabbing

When opening a link in a new tab without setting rel: "noopener noreferrer", the new tab can control the parent tab's location. For example, an attacker could redirect to a phishing page.
repository: repo_url: https://github.com/ualbertalib/NEOSDiscovery
repo_name: ualbertalib/NEOSDiscovery
description: Blacklight instance for the NEOS library consortium retired December 22, 2022
repo_language: Ruby
owner: ualbertalib
file_changes: filename: _refworks.html.erb
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,10 @@
 <% if @document_list.any? {|d| d.exports_as? :refworks_marc_txt } %>
   <li class="refworks">
-    <%= link_to t('blacklight.tools.refworks'), refworks_export_url(url: bookmarks_export_url(:refworks_marc_txt, search_state.params_for_search)), :class => "btn btn-default", :id => "refworksLink", :target => "_blank" %>
+    <%= link_to t('blacklight.tools.refworks'), 
+                refworks_export_url(url: bookmarks_export_url(:refworks_marc_txt, search_state.params_for_search)), 
+                class: "btn btn-default", 
+                id: "refworksLink", 
+                rel: 'noopener noreferrer',
+                target: "_blank" %>
   </li>
 <% end %>

programming_language: Erlang
CVE-2023-33955 (published 2023-05-30T07:15Z)

Minio Console is the UI for MinIO Object Storage. Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename. This issue has been patched in version 0.28.0.\n\n

CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/minio/console
commit_details: repo_url: https://github.com/minio/console
author: Daniel Valdivia
author_date: 2023-05-23 08:47:12-07:00
msg: Replace RIGHT-TO-LEFT OVERRIDE unicode (#2828)

Signed-off-by: Daniel Valdivia <18384552+dvaldivia@users.noreply.github.com>
repository: repo_url: https://github.com/minio/console
repo_name: minio/console
description: Simple UI for MinIO Object Storage :abacus:
repo_language: JavaScript
owner: minio
file_changes: filename: utils.ts
change_type: ModificationType.MODIFY
diff: @@ -712,3 +712,9 @@ export const getRandomString = function (length = 16): string {
   }
   return retval;
 };
+
+// replaces bad unicode characters
+export const replaceUnicodeChar = (inputString: string): string => {
+  let unicodeChar = "\u202E";
+  return inputString.split(unicodeChar).join("<�202e>");
+};

programming_language: TypeScript
filename: IconWithLabel.tsx
change_type: ModificationType.MODIFY
diff: @@ -2,6 +2,7 @@ import React from "react";
 import createStyles from "@mui/styles/createStyles";
 import withStyles from "@mui/styles/withStyles";
 import { Theme } from "@mui/material/styles";
+import { replaceUnicodeChar } from "../../../../../../common/utils";
 
 interface IIconWithLabel {
   classes: any;
@@ -34,7 +35,7 @@ const IconWithLabel = ({ classes, icon, strings }: IIconWithLabel) => {
     <div className={classes.fileName}>
       {icon}
       <span className={classes.fileNameText}>
-        {strings[strings.length - 1]}
+        {replaceUnicodeChar(strings[strings.length - 1])}
       </span>
     </div>
   );

programming_language: TypeScript
CVE-2023-0057 (published 2023-01-05T01:15Z)

Improper Restriction of Rendered UI Layers or Frames in GitHub repository pyload/pyload prior to 0.5.0b3.dev33.

CVSS v3 base score: 6.1, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-1021
cwe_name: Improper Restriction of Rendered UI Layers or Frames
description: The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.
extended_description: A web application is expected to place restrictions on whether it is allowed to be rendered within frames, iframes, objects, embed or applet elements. Without the restrictions, users can be tricked into interacting with the application when they were not intending to.
         

Fix information:
repo_url: https://github.com/pyload/pyload
commit_details: repo_url: https://github.com/pyload/pyload
author: GammaC0de
author_date: 2023-01-05 01:28:27+02:00
msg: Add X-Frame-Options: DENY header
repository: repo_url: https://github.com/pyload/pyload
repo_name: pyload/pyload
description: The free and open-source Download Manager written in pure Python
repo_language: Python
owner: pyload
file_changes: filename: __init__.py
change_type: ModificationType.MODIFY
diff: @@ -60,11 +60,16 @@ class App:
     @classmethod
     def _configure_handlers(cls, app):
         """
-        Register error handlers.
+        Register app handlers.
         """
         for exc, fn in cls.FLASK_ERROR_HANDLERS:
             app.register_error_handler(exc, fn)
 
+        @app.after_request
+        def deny_iframe(response):
+            response.headers["X-Frame-Options"] = "DENY"
+            return response
+
     @classmethod
     def _configure_json_encoding(cls, app):
         app.json_encoder = JSONEncoder

programming_language: Python
CVE-2018-0500 (published 2018-07-11T13:29Z)

Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that might be exploitable by an attacker who can control the data that curl transmits over SMTP with certain settings (i.e., use of a nonstandard --limit-rate argument or CURLOPT_BUFFERSIZE value).

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/curl/curl
commit_details: repo_url: https://github.com/curl/curl
author: Daniel Stenberg
author_date: 2018-06-13 12:24:40+02:00
msg: smtp: use the upload buffer size for scratch buffer malloc

... not the read buffer size, as that can be set smaller and thus cause
a buffer overflow! CVE-2018-0500

Reported-by: Peter Wu
Bug: https://curl.haxx.se/docs/adv_2018-70a2.html
repository: repo_url: https://github.com/curl/curl
repo_name: curl/curl
description: A command line tool and library for transferring data with URL syntax, supporting DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS, MQTT, POP3, POP3S, RTMP, RTMPS, RTSP, SCP, SFTP, SMB, SMBS, SMTP, SMTPS, TELNET, TFTP, WS and WSS. libcurl offers a myriad of powerful features
repo_language: C
owner: curl
file_changes: filename: smtp.c
change_type: ModificationType.MODIFY
diff: @@ -1563,13 +1563,14 @@ CURLcode Curl_smtp_escape_eob(struct connectdata *conn, const ssize_t nread)
   if(!scratch || data->set.crlf) {
     oldscratch = scratch;
 
-    scratch = newscratch = malloc(2 * data->set.buffer_size);
+    scratch = newscratch = malloc(2 * UPLOAD_BUFSIZE);
     if(!newscratch) {
       failf(data, "Failed to alloc scratch buffer!");
 
       return CURLE_OUT_OF_MEMORY;
     }
   }
+  DEBUGASSERT(UPLOAD_BUFSIZE >= nread);
 
   /* Have we already sent part of the EOB? */
   eob_sent = smtp->eob;

programming_language: C
CVE-2022-29209 (published 2022-05-21T00:15Z)

TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the macros that TensorFlow uses for writing assertions (e.g., `CHECK_LT`, `CHECK_GT`, etc.) have an incorrect logic when comparing `size_t` and `int` values. Due to type conversion rules, several of the macros would trigger incorrectly. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-843
cwe_name: Access of Resource Using Incompatible Type ('Type Confusion')
description: The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
extended_description: 
            When the product accesses the resource using an incompatible type, this could trigger logical errors because the resource does not have expected properties. In languages without memory safety, such as C and C++, type confusion can lead to out-of-bounds memory access.
            While this weakness is frequently associated with unions when parsing data with many different embedded object types in C, it can be present in any application that can interpret the same variable or memory location in multiple ways.
            This weakness is not unique to C and C++. For example, errors in PHP applications can be triggered by providing array parameters when scalars are expected, or vice versa. Languages such as Perl, which perform automatic conversion of a variable of one type when it is accessed as if it were another type, can also contain these issues.
         
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: TensorFlower Gardener
author_date: 2022-04-28 14:41:18-07:00
msg: Merge pull request #55730 from graphcore:awf/issue-55530

PiperOrigin-RevId: 445252025
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow