starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2018-8088 (published 2018-03-20T16:29Z)

org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 later and in the 2.0.x series.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/qos-ch/slf4j
commit_details: repo_url: https://github.com/qos-ch/slf4j
author: Ceki Gulcu
author_date: 2018-03-14 01:09:26+01:00
msg: fix SLF4J-431
repository: repo_url: https://github.com/qos-ch/slf4j
repo_name: qos-ch/slf4j
description: Simple Logging Facade for Java
repo_language: Java
owner: qos-ch
file_changes: filename: EventData.java
change_type: ModificationType.MODIFY
diff: @@ -40,6 +40,8 @@ import java.beans.ExceptionListener;
  * event. Users may extend this class for each EventType they want to log.
  * 
  * @author Ralph Goers
+ * 
+ * @deprecated Due to a security vulnerability, this class will be removed without replacement.
  */
 public class EventData implements Serializable {
 

programming_language: Java
CVE-2021-42917 (published 2021-11-01T19:15Z)

Buffer overflow vulnerability in Kodi xbmc up to 19.0, allows attackers to cause a denial of service due to improper length of values passed to istream.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-120
cwe_name: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
extended_description: A buffer overflow condition exists when a product attempts to put more data in a buffer than it can hold, or when it attempts to put data in a memory area outside of the boundaries of a buffer. The simplest type of error, and the most common cause of buffer overflows, is the "classic" case in which the product copies the buffer without restricting how much is copied. Other variants exist, but the existence of a classic overflow strongly suggests that the programmer is not considering even the most basic of security protections.
         

Fix information:
repo_url: https://github.com/fuzzard/xbmc
commit_details: repo_url: https://github.com/fuzzard/xbmc
author: fuzzard
author_date: 2021-10-12 17:38:30+10:00
msg: [Playlist] dont use istream directly to a tinyxml structure

Turn istream into a std::string to handle large buffers (#20305)
repository: repo_url: https://github.com/fuzzard/xbmc
repo_name: fuzzard/xbmc
description: Kodi Main Repository - By using this code you agree with our policy and will follow the GPLv2 license as included
repo_language: C++
owner: fuzzard
file_changes: filename: PlayListPLS.cpp
change_type: ModificationType.MODIFY
diff: @@ -289,8 +289,9 @@ bool CPlayListASX::LoadData(std::istream& stream)
   }
   else
   {
+    std::string asxstream(std::istreambuf_iterator<char>(stream), {});
     CXBMCTinyXML xmlDoc;
-    stream >> xmlDoc;
+    xmlDoc.Parse(asxstream, TIXML_DEFAULT_ENCODING);
 
     if (xmlDoc.Error())
     {
@@ -300,6 +301,9 @@ bool CPlayListASX::LoadData(std::istream& stream)
 
     TiXmlElement *pRootElement = xmlDoc.RootElement();
 
+    if (!pRootElement)
+      return false;
+
     // lowercase every element
     TiXmlNode *pNode = pRootElement;
     TiXmlNode *pChild = NULL;

programming_language: C++
repo_url: https://github.com/xbmc/xbmc
commit_details: repo_url: https://github.com/xbmc/xbmc
author: fuzzard
author_date: 2021-10-20 12:54:32+10:00
msg: Merge pull request #20306 from fuzzard/fix_20305

[Playlist] dont use istream directly to a tinyxml structure
repository: repo_url: https://github.com/xbmc/xbmc
repo_name: xbmc/xbmc
description: Kodi is an award-winning free and open source home theater/media center software and entertainment hub for digital media. With its beautiful interface and powerful skinning engine, it's available for Android, BSD, Linux, macOS, iOS, tvOS and Windows.
repo_language: C++
owner: xbmc
CVE-2017-6074 (published 2017-02-18T21:59Z)

The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel through 4.9.11 mishandles DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allows local users to obtain root privileges or cause a denial of service (double free) via an application that makes an IPV6_RECVPKTINFO setsockopt system call.

Severity: HIGH
CVSS v2 base score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-415
cwe_name: Double Free
description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
extended_description: When a program calls free() twice with the same argument, the program's memory management data structures become corrupted. This corruption can cause the program to crash or, in some circumstances, cause two later calls to malloc() to return the same pointer. If malloc() returns the same value twice and the program later gives the attacker control over the data that is written into this doubly-allocated memory, the program becomes vulnerable to a buffer overflow attack.
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Andrey Konovalov
author_date: 2017-02-16 17:22:46+01:00
msg: dccp: fix freeing skb too early for IPV6_RECVPKTINFO

In the current DCCP implementation an skb for a DCCP_PKT_REQUEST packet
is forcibly freed via __kfree_skb in dccp_rcv_state_process if
dccp_v6_conn_request successfully returns.

However, if IPV6_RECVPKTINFO is set on a socket, the address of the skb
is saved to ireq->pktopts and the ref count for skb is incremented in
dccp_v6_conn_request, so skb is still in use. Nevertheless, it gets freed
in dccp_rcv_state_process.

Fix by calling consume_skb instead of doing goto discard and therefore
calling __kfree_skb.

Similar fixes for TCP:

fb7e2399ec17f1004c0e0ccfd17439f8759ede01 [TCP]: skb is unexpectedly freed.
0aea76d35c9651d55bbaf746e7914e5f9ae5a25d tcp: SYN packets are now
simply consumed

Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: input.c
change_type: ModificationType.MODIFY
diff: @@ -606,7 +606,8 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
 			if (inet_csk(sk)->icsk_af_ops->conn_request(sk,
 								    skb) < 0)
 				return 1;
-			goto discard;
+			consume_skb(skb);
+			return 0;
 		}
 		if (dh->dccph_type == DCCP_PKT_RESET)
 			goto discard;

programming_language: C
CVE-2020-36646 (published 2023-01-07T20:15Z)

A vulnerability classified as problematic has been found in MediaArea ZenLib up to 0.4.38. This affects the function Ztring::Date_From_Seconds_1970_Local of the file Source/ZenLib/Ztring.cpp. The manipulation of the argument Value leads to unchecked return value to null pointer dereference. Upgrading to version 0.4.39 is able to address this issue. The identifier of the patch is 6475fcccd37c9cf17e0cfe263b5fe0e2e47a8408. It is recommended to upgrade the affected component. The identifier VDB-217629 was assigned to this vulnerability.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/MediaArea/ZenLib
commit_details: repo_url: https://github.com/MediaArea/ZenLib
author: Pave Pimenov
author_date: 2020-09-12 07:46:47+03:00
msg: fix V522 [CWE-690] There might be dereferencing of a potential null pointer 'Gmt'.
repository: repo_url: https://github.com/MediaArea/ZenLib
repo_name: MediaArea/ZenLib
repo_language: C++
owner: MediaArea
file_changes: filename: Ztring.cpp
change_type: ModificationType.MODIFY
diff: @@ -1364,6 +1364,8 @@ Ztring& Ztring::Date_From_Seconds_1970_Local (const int32u Value)
     #endif
     Ztring DateT;
     Ztring Date;
+    if (Gmt)
+    {
     Date+=Ztring::ToZtring((Gmt->tm_year+1900));
     Date+=__T("-");
     DateT.From_Number(Gmt->tm_mon+1); if (DateT.size()<2){DateT=Ztring(__T("0"))+Ztring::ToZtring(Gmt->tm_mon+1);}
@@ -1381,6 +1383,7 @@ Ztring& Ztring::Date_From_Seconds_1970_Local (const int32u Value)
     DateT.From_Number(Gmt->tm_sec); if (DateT.size()<2){DateT=Ztring(__T("0"))+Ztring::ToZtring(Gmt->tm_sec);}
     Date+=DateT;
     assign (Date.c_str());
+    }
     return *this;
 }
 

programming_language: C++
CVE-2021-43257 (published 2022-04-14T20:15Z)

Lack of Neutralization of Formula Elements in the CSV API of MantisBT before 2.25.3 allows an unprivileged attacker to execute code or gain access to information when a user opens the csv_export.php generated CSV file in Excel.

Severity: MEDIUM
CVSS v2 base score: 6.0 (AV:N/AC:M/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-1236
cwe_name: Improper Neutralization of Formula Elements in a CSV File
description: The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
extended_description: User-provided data is often saved to traditional databases.  This data can be exported to a CSV file, which allows users to read the data using spreadsheet software such as Excel, Numbers, or Calc.  This software interprets entries beginning with '=' as formulas, which are then executed by the spreadsheet software.  The software's formula language often allows methods to access hyperlinks or the local command line, and frequently allows enough characters to invoke an entire script. Attackers can populate data fields which, when saved to a CSV file, may attempt information exfiltration or other malicious activity when automatically executed by the spreadsheet software.
			

Fix information:
repo_url: https://github.com/mantisbt/mantisbt
commit_details: repo_url: https://github.com/mantisbt/mantisbt
author: Damien Regad
author_date: 2021-10-29 12:33:51+02:00
msg: Escape strings to prevent CSV injection

Prefixing the string with a tab when it starts with =, -, + or @.

Thanks to Devendra Bhatla for reporting the issue.

Fixes #29130, CVE-2021-43257
repository: repo_url: https://github.com/mantisbt/mantisbt
repo_name: mantisbt/mantisbt
description: Mantis Bug Tracker (MantisBT)
repo_language: PHP
owner: mantisbt
file_changes: filename: csv_api.php
change_type: ModificationType.MODIFY
diff: @@ -116,6 +116,13 @@ function csv_get_default_filename() {
  * @access public
  */
 function csv_escape_string( $p_string ) {
+	# Prevent CSV injection by escaping text that could be interpreted as a formula
+	if( $p_string && strpos( '=-+@', $p_string[0] ) !== false ) {
+		# Prefixing with a tab rather than single quote, as Excel does not show
+		# the tab visually in the cell.
+		$p_string = "\t" . $p_string;
+	}
+
 	$t_escaped = str_split( '"' . csv_get_separator() . csv_get_newline() );
 	$t_must_escape = false;
 	while( ( $t_char = current( $t_escaped ) ) !== false && !$t_must_escape ) {

programming_language: PHP
CVE-2019-14459 (published 2019-07-31T21:15Z)

nfdump 1.6.17 and earlier is affected by an integer overflow in the function Process_ipfix_template_withdraw in ipfix.c that can be abused in order to crash the process remotely (denial of service).

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/phaag/nfdump
commit_details: repo_url: https://github.com/phaag/nfdump
author: Peter Haag
author_date: 2019-07-27 15:20:30+02:00
msg: Fix potential unsigned integer underflow
repository: repo_url: https://github.com/phaag/nfdump
repo_name: phaag/nfdump
description: Netflow processing tools
repo_language: C
owner: phaag
file_changes: filename: ChangeLog
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,7 @@
 2019-07-25
 - Rework nfpcapd and add it officially to the nfdump collection.
 - Add nfpcapd man page
+- Fix potential unsigned integer underflow #171
 
 2019-07-16
 - Add latency extension if dumping flowcache

programming_language: Markdown
filename: ipfix.c
change_type: ModificationType.MODIFY
diff: @@ -1247,7 +1247,7 @@ int i;
 		uint32_t table_id, count, size_required;
 		uint32_t num_extensions = 0;
 
-		if ( size_left && size_left < 4 ) {
+		if ( size_left < 4 ) {
 			LogError("Process_ipfix [%u] Template size error at %s line %u" , 
 				exporter->info.id, __FILE__, __LINE__, strerror (errno));
 			size_left = 0;
@@ -1426,6 +1426,14 @@ ipfix_template_record_t *ipfix_template_record;
 	while ( size_left ) {
 		uint32_t id;
 
+		if ( size_left < 4 ) {
+			LogError("Process_ipfix [%u] Template withdraw size error at %s line %u" , 
+				exporter->info.id, __FILE__, __LINE__, strerror (errno));
+			size_left = 0;
+			continue;
+		}
+
+
 		// map next record.
 		ipfix_template_record = (ipfix_template_record_t *)DataPtr;
 		size_left 		-= 4;

programming_language: C
CVE-2020-36406 (published 2021-07-01T03:15Z)

uWebSockets 18.11.0 and 18.12.0 has a stack-based buffer overflow in uWS::TopicTree::trimTree (called from uWS::TopicTree::unsubscribeAll). NOTE: the vendor\'s position is that this is "a minor issue or not even an issue at all" because the developer of an application (that uses uWebSockets) should not be allowing the large number of triggered topics to accumulate

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/uNetworking/uWebSockets
commit_details: repo_url: https://github.com/uNetworking/uWebSockets
author: Alex Hultman
author_date: 2020-09-06 13:05:13+02:00
msg: Fix overflow of triggered topics
repository: repo_url: https://github.com/uNetworking/uWebSockets
repo_name: uNetworking/uWebSockets
description: Simple, secure & standards compliant web server for the most demanding of applications
repo_language: C++
owner: uNetworking
file_changes: filename: TopicTree.h
change_type: ModificationType.MODIFY
diff: @@ -124,10 +124,6 @@ private:
 
     /* Should be getData and commit? */
     void publish(Topic *iterator, size_t start, size_t stop, std::string_view topic, std::pair<std::string_view, std::string_view> message) {
-        /* If we already have 64 triggered topics make sure to drain it here */
-        if (numTriggeredTopics == 64) {
-            drain();
-        }
 
         /* Iterate over all segments in given topic */
         for (; stop != std::string::npos; start = stop + 1) {
@@ -151,6 +147,11 @@ private:
 
                 /* Add this topic to triggered */
                 if (!iterator->terminatingWildcardChild->triggered) {
+                    /* If we already have 64 triggered topics make sure to drain it here */
+                    if (numTriggeredTopics == 64) {
+                        drain();
+                    }
+
                     triggeredTopics[numTriggeredTopics++] = iterator->terminatingWildcardChild;
                     iterator->terminatingWildcardChild->triggered = true;
                 }
@@ -175,6 +176,11 @@ private:
 
         /* Add this topic to triggered */
         if (!iterator->triggered) {
+            /* If we already have 64 triggered topics make sure to drain it here */
+            if (numTriggeredTopics == 64) {
+                drain();
+            }
+
             triggeredTopics[numTriggeredTopics++] = iterator;
             iterator->triggered = true;
         }

programming_language: C++
CVE-2017-2604 (published 2018-05-15T21:29Z)

In Jenkins before versions 2.44, 2.32.2 low privilege users were able to act on administrative monitors due to them not being consistently protected by permission checks (SECURITY-371).

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:N/I:P/A:N)
CVSS v3 base score: 4.3, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/jenkinsci/jenkins
commit_details: repo_url: https://github.com/jenkinsci/jenkins
author: Jesse Glick
author_date: 2016-12-20 15:16:05-05:00
msg: Merge pull request #85 from jenkinsci-cert/security-371-staplerproxy

[SECURITY-371] Secure all administrative monitors
repository: repo_url: https://github.com/jenkinsci/jenkins
repo_name: jenkinsci/jenkins
description: Jenkins automation server
repo_language: Java
owner: jenkinsci
CVE-2020-16589 (published 2020-12-09T21:15Z)

A head-based buffer overflow exists in Academy Software Foundation OpenEXR 2.3.0 in writeTileData in ImfTiledOutputFile.cpp that can cause a denial of service via a crafted EXR file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/AcademySoftwareFoundation/openexr
commit_details: repo_url: https://github.com/AcademySoftwareFoundation/openexr
author: Peter Hillman
author_date: 2019-07-25 19:23:37+12:00
msg: Fix for #494: validate tile coordinates when doing copyPixels
repository: repo_url: https://github.com/AcademySoftwareFoundation/openexr
repo_name: AcademySoftwareFoundation/openexr
description: The OpenEXR project provides the specification and reference implementation of the EXR file format, the professional-grade image storage format of the motion picture industry.
repo_language: C
owner: AcademySoftwareFoundation
file_changes: filename: ImfTiledInputFile.cpp
change_type: ModificationType.MODIFY
diff: @@ -1313,6 +1313,13 @@ TiledInputFile::rawTileData (int &dx, int &dy,
                 throw IEX_NAMESPACE::ArgExc ("rawTileData read the wrong tile");
             }
         }
+        else
+        {
+             if(!isValidTile (dx, dy, lx, ly) )
+             {
+                 throw IEX_NAMESPACE::IoExc ("rawTileData read an invalid tile");
+             }
+        }
         pixelData = tileBuffer->buffer;
     }
     catch (IEX_NAMESPACE::BaseExc &e)

programming_language: C++
CVE-2021-23386 (published 2021-05-20T17:15Z)

This affects the package dns-packet before 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets. This can expose internal application memory over unencrypted network when querying crafted invalid domain names.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-909
cwe_name: Missing Initialization of Resource
description: The product does not initialize a critical resource.
extended_description: Many resources require initialization before they can be properly used. If a resource is not initialized, it could contain unpredictable or expired data, or it could be initialized to defaults that are invalid. This can have security implications when the resource is expected to have certain properties or values.
         

Fix information:
repo_url: https://github.com/mafintosh/dns-packet
commit_details: repo_url: https://github.com/mafintosh/dns-packet
author: Mathias Buus
author_date: 2021-05-19 19:59:39+02:00
msg: do trim on encodingLength as well
repository: repo_url: https://github.com/mafintosh/dns-packet
repo_name: mafintosh/dns-packet
description: An abstract-encoding compliant module for encoding / decoding DNS packets
repo_language: JavaScript
owner: mafintosh
file_changes: filename: index.js
change_type: ModificationType.MODIFY
diff: @@ -78,7 +78,7 @@ name.decode.bytes = 0
 
 name.encodingLength = function (n) {
   if (n === '.') return 1
-  return Buffer.byteLength(n) + 2
+  return Buffer.byteLength(n.replace(/^\.|\.$/gm, '')) + 2
 }
 
 const string = {}

programming_language: CoffeeScript