starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2016-7538 (published 2017-04-20T18:59Z)

coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2016-03-12 08:05:31-05:00
msg: https://github.com/ImageMagick/ImageMagick/issues/148
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: psd.c
change_type: ModificationType.MODIFY
diff: @@ -2566,9 +2566,12 @@ static void RemoveICCProfileFromResourceBlock(StringInfo *bim_profile)
     p=PushLongPixel(MSBEndian,p,&count);
     if (id == 0x0000040f)
       {
-        (void) CopyMagickMemory(q,q+PSDQuantum(count)+12,length-
-          (PSDQuantum(count)+12)-(q-datum));
-        SetStringInfoLength(bim_profile,length-(PSDQuantum(count)+12));
+        if ((q+PSDQuantum(count)+12) < (datum+length-16))
+          {
+            (void) CopyMagickMemory(q,q+PSDQuantum(count)+12,length-
+              (PSDQuantum(count)+12)-(q-datum));
+            SetStringInfoLength(bim_profile,length-(PSDQuantum(count)+12));
+          }
         break;
       }
     p+=count;

programming_language: Objective-C
CVE-2019-15945 (published 2019-09-05T17:15Z)

OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in libopensc/asn1.c.

Severity: MEDIUM
CVSS v2 base score: 4.4 (AV:L/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 6.4, MEDIUM (CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/OpenSC/OpenSC
commit_details: repo_url: https://github.com/OpenSC/OpenSC
author: Frank Morgner
author_date: 2019-08-27 15:17:17+02:00
msg: fixed out of bounds access of ASN.1 Bitstring

Credit to OSS-Fuzz
repository: repo_url: https://github.com/OpenSC/OpenSC
repo_name: OpenSC/OpenSC
description: Open source smart card tools and middleware. PKCS#11/MiniDriver/Tokend
repo_language: C
owner: OpenSC
file_changes: filename: asn1.c
change_type: ModificationType.MODIFY
diff: @@ -570,16 +570,20 @@ static int decode_bit_string(const u8 * inbuf, size_t inlen, void *outbuf,
 {
 	const u8 *in = inbuf;
 	u8 *out = (u8 *) outbuf;
-	int zero_bits = *in & 0x07;
-	size_t octets_left = inlen - 1;
 	int i, count = 0;
+	int zero_bits;
+	size_t octets_left;
 
-	memset(outbuf, 0, outlen);
-	in++;
 	if (outlen < octets_left)
 		return SC_ERROR_BUFFER_TOO_SMALL;
 	if (inlen < 1)
 		return SC_ERROR_INVALID_ASN1_OBJECT;
+
+	zero_bits = *in & 0x07;
+	octets_left = inlen - 1;
+	in++;
+	memset(outbuf, 0, outlen);
+
 	while (octets_left) {
 		/* 1st octet of input:  ABCDEFGH, where A is the MSB */
 		/* 1st octet of output: HGFEDCBA, where A is the LSB */

programming_language: C
CVE-2017-5668 (published 2017-03-14T14:59Z)

bitlbee-libpurple before 3.5.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) and possibly execute arbitrary code via a file transfer request for a contact that is not in the contact list.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-10189.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/bitlbee/bitlbee
commit_details: repo_url: https://github.com/bitlbee/bitlbee
author: dequis
author_date: 2017-01-29 19:40:09-03:00
msg: purple: Fix crash on ft requests from unknown contacts

Followup to 701ab81 (included in 3.5) which was a partial fix which only
improved things for non-libpurple file transfers (that is, just jabber)
repository: repo_url: https://github.com/bitlbee/bitlbee
repo_name: bitlbee/bitlbee
description: An IRC to other chat networks gateway :bee:
repo_language: C
owner: bitlbee
file_changes: filename: ft.c
change_type: ModificationType.MODIFY
diff: @@ -145,6 +145,10 @@ static gboolean prplcb_xfer_new_send_cb(gpointer data, gint fd, b_input_conditio
 	/* TODO(wilmer): After spreading some more const goodness in BitlBee,
 	   remove the evil cast below. */
 	px->ft = imcb_file_send_start(ic, (char *) who, xfer->filename, xfer->size);
+
+	if (!px->ft) {
+		return FALSE;
+	}
 	px->ft->data = px;
 
 	px->ft->accept = prpl_xfer_accept;

programming_language: C
CVE-2013-1827 (published 2013-03-22T11:59Z)

net/dccp/ccid.h in the Linux kernel before 3.5.4 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) by leveraging the CAP_NET_ADMIN capability for a certain (1) sender or (2) receiver getsockopt call.

Severity: MEDIUM
CVSS v2 base score: 6.2 (AV:L/AC:H/Au:N/C:C/I:C/A:C)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Mathias Krause
author_date: 2012-08-15 11:31:54+00:00
msg: dccp: check ccid before dereferencing

ccid_hc_rx_getsockopt() and ccid_hc_tx_getsockopt() might be called with
a NULL ccid pointer leading to a NULL pointer dereference. This could
lead to a privilege escalation if the attacker is able to map page 0 and
prepare it with a fake ccid_ops pointer.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Cc: stable@vger.kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: ccid.h
change_type: ModificationType.MODIFY
diff: @@ -246,7 +246,7 @@ static inline int ccid_hc_rx_getsockopt(struct ccid *ccid, struct sock *sk,
 					u32 __user *optval, int __user *optlen)
 {
 	int rc = -ENOPROTOOPT;
-	if (ccid->ccid_ops->ccid_hc_rx_getsockopt != NULL)
+	if (ccid != NULL && ccid->ccid_ops->ccid_hc_rx_getsockopt != NULL)
 		rc = ccid->ccid_ops->ccid_hc_rx_getsockopt(sk, optname, len,
 						 optval, optlen);
 	return rc;
@@ -257,7 +257,7 @@ static inline int ccid_hc_tx_getsockopt(struct ccid *ccid, struct sock *sk,
 					u32 __user *optval, int __user *optlen)
 {
 	int rc = -ENOPROTOOPT;
-	if (ccid->ccid_ops->ccid_hc_tx_getsockopt != NULL)
+	if (ccid != NULL && ccid->ccid_ops->ccid_hc_tx_getsockopt != NULL)
 		rc = ccid->ccid_ops->ccid_hc_tx_getsockopt(sk, optname, len,
 						 optval, optlen);
 	return rc;

programming_language: C
CVE-2020-21048 (published 2021-09-14T16:15Z)

An issue in the dither.c component of libsixel prior to v1.8.4 allows attackers to cause a denial of service (DOS) via a crafted PNG file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/saitoha/libsixel
commit_details: repo_url: https://github.com/saitoha/libsixel
author: Hayaki Saito
author_date: 2019-12-15 21:56:23+09:00
msg: Avoid illegal memory access problem with 1 color paletted png(#73),
Thanks to HongxuChen.
repository: repo_url: https://github.com/saitoha/libsixel
repo_name: saitoha/libsixel
description: A SIXEL encoder/decoder implementation derived from kmiya's sixel (https://github.com/saitoha/sixel).
repo_language: C
owner: saitoha
file_changes: filename: dither.c
change_type: ModificationType.MODIFY
diff: @@ -284,9 +284,13 @@ sixel_dither_new(
         quality_mode = SIXEL_QUALITY_HIGHCOLOR;
     } else {
         if (ncolors > SIXEL_PALETTE_MAX) {
+            status = SIXEL_BAD_INPUT;
             ncolors = 256;
-        } else if (ncolors < 2) {
-            ncolors = 2;
+        } else if (ncolors < 1) {
+            status = SIXEL_BAD_INPUT;
+            sixel_helper_set_additional_message(
+                "sixel_dither_new: palette colors must be more than 0");
+            goto end;
         }
         quality_mode = SIXEL_QUALITY_LOW;
     }

programming_language: C
CVE-2021-3311 (published 2021-02-05T14:15Z)

An issue was discovered in October through build 471. It reactivates an old session ID (which had been invalid after a logout) once a new login occurs. NOTE: this violates the intended Auth/Manager.php authentication behavior but, admittedly, is only relevant if an old session ID is known to an attacker.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-613
cwe_name: Insufficient Session Expiration
description: According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/octobercms/library
commit_details: repo_url: https://github.com/octobercms/library
author: Samuel Georges
author_date: 2021-01-30 11:47:39+11:00
msg: Invalidate the session ID to prevent reuse

1. Good logs in
2. Bad captures Good's session cookie
3. Good logs out
4. Session cookie no longer works
5. Good logs in a second time
6. ORIGINAL session cookie works (Bad is also signed in)
repository: repo_url: https://github.com/octobercms/library
repo_name: octobercms/library
description: October Rain Library
repo_language: PHP
owner: octobercms
file_changes: filename: Manager.php
change_type: ModificationType.MODIFY
diff: @@ -686,7 +686,7 @@ class Manager implements \Illuminate\Contracts\Auth\StatefulGuard
 
         $this->user = null;
 
-        Session::flush();
+        Session::invalidate();
         Cookie::queue(Cookie::forget($this->sessionKey));
     }
 

programming_language: PHP
CVE-2016-7530 (published 2017-04-20T18:59Z)

The quantum handling code in ImageMagick allows remote attackers to cause a denial of service (divide-by-zero error or out-of-bounds write) via a crafted file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-369
cwe_name: Divide By Zero
description: The product divides a value by zero.
extended_description: This weakness typically occurs when an unexpected value is provided to the product, or if an error occurs that is not properly detected. It frequently occurs in calculations involving physical dimensions such as size, length, width, and height.
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2016-01-30 09:37:10-05:00
msg: https://github.com/ImageMagick/ImageMagick/issues/105
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: quantum.c
change_type: ModificationType.MODIFY
diff: @@ -304,6 +304,7 @@ MagickExport size_t GetQuantumExtent(const Image *image,
   const QuantumInfo *quantum_info,const QuantumType quantum_type)
 {
   size_t
+    extent,
     packet_size;
 
   assert(quantum_info != (QuantumInfo *) NULL);
@@ -322,9 +323,10 @@ MagickExport size_t GetQuantumExtent(const Image *image,
     case CMYKAQuantum: packet_size=5; break;
     default: break;
   }
+  extent=MagickMax(image->columns,image->rows);
   if (quantum_info->pack == MagickFalse)
-    return((size_t) (packet_size*image->columns*((quantum_info->depth+7)/8)));
-  return((size_t) ((packet_size*image->columns*quantum_info->depth+7)/8));
+    return((size_t) (packet_size*extent*((quantum_info->depth+7)/8)));
+  return((size_t) ((packet_size*extent*quantum_info->depth+7)/8));
 }
 
 /*
@@ -683,8 +685,9 @@ MagickExport MagickBooleanType SetQuantumDepth(const Image *image,
   if (quantum_info->pixels != (unsigned char **) NULL)
     DestroyQuantumPixels(quantum_info);
   quantum=(quantum_info->pad+6)*(quantum_info->depth+7)/8;
-  extent=image->columns*quantum;
-  if ((image->columns != 0) && (quantum != (extent/image->columns)))
+  extent=MagickMax(image->columns,image->rows)*quantum;
+  if ((MagickMax(image->columns,image->rows) != 0) &&
+      (quantum != (extent/MagickMax(image->columns,image->rows))))
     return(MagickFalse);
   return(AcquireQuantumPixels(quantum_info,extent));
 }

programming_language: Objective-C
CVE-2024-24539 (published 2024-03-18T03:15Z)

FusionPBX before 5.2.0 does not validate a session.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/fusionpbx/fusionpbx
commit_details: repo_url: https://github.com/fusionpbx/fusionpbx
author: FusionPBX
author_date: 2024-01-22 14:20:28-07:00
msg: Security - validate session
repository: repo_url: https://github.com/fusionpbx/fusionpbx
repo_name: fusionpbx/fusionpbx
description: Official FusionPBX - A full-featured domain based multi-tenant PBX and voice switch for FreeSwitch.
repo_language: PHP
owner: fusionpbx
file_changes: filename: authentication.php
change_type: ModificationType.MODIFY
diff: @@ -229,6 +229,9 @@ class authentication {
 					$_SESSION["user_uuid"] = $result["user_uuid"];
 					$_SESSION["context"] = $result['domain_name'];
 
+				//used to validate the session
+					$_SESSION["user_hash"] = hash('sha256', $_SERVER['REMOTE_ADDR'].$_SERVER['HTTP_USER_AGENT']);
+
 				//user session array
 					$_SESSION["user"]["domain_uuid"] = $result["domain_uuid"];
 					$_SESSION["user"]["domain_name"] = $result["domain_name"];
@@ -236,7 +239,7 @@ class authentication {
 					$_SESSION["user"]["username"] = $result["username"];
 					$_SESSION["user"]["contact_uuid"] = $result["contact_uuid"];
 
-				//get the groups assigned to the user 
+				//get the groups assigned to the user
 					$group = new groups;
 					$group->session($result["domain_uuid"], $result["user_uuid"]);
 

programming_language: PHP
filename: check_auth.php
change_type: ModificationType.MODIFY
diff: @@ -37,7 +37,7 @@
 	}
 
 //start the session
-	if (function_exists('session_start')) { 
+	if (function_exists('session_start')) {
 		if (!isset($_SESSION)) {
 			session_start();
 		}
@@ -70,8 +70,19 @@
 //define variables
 	if (!isset($_SESSION['template_content'])) { $_SESSION["template_content"] = null; }
 
+//if session authorized is not set then set the default value to false
+	if (!isset($_SESSION['authorized'])) {
+		$_SESSION['authorized'] = false;
+	}
+
+//validate the session address
+	if ($_SESSION['authorized'] && $_SESSION["user_hash"] !== hash('sha256', $_SERVER['REMOTE_ADDR'].$_SERVER['HTTP_USER_AGENT'])) {
+		session_destroy();
+		header("Location: ".PROJECT_PATH."/?path=".urlencode($target_path));
+	}
+
 //if the session is not authorized then verify the identity
-	if (!isset($_SESSION['authorized']) || (isset($_SESSION['authorized']) && !$_SESSION['authorized'])) {
+	if (!$_SESSION['authorized']) {
 
 		//clear the menu
 			unset($_SESSION["menu"]);

programming_language: PHP
CVE-2018-10199 (published 2018-04-18T15:29Z)

In versions of mruby up to and including 1.4.0, a use-after-free vulnerability exists in src/io.c::File#initilialize_copy(). An attacker that can cause Ruby code to be run can possibly use this to execute arbitrary code.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/mruby/mruby
commit_details: repo_url: https://github.com/mruby/mruby
author: Yukihiro "Matz" Matsumoto
author_date: 2018-04-17 09:57:41+09:00
msg: Fix `use after free in File#initilialize_copy`; fix #4001

The bug and the fix were reported by https://hackerone.com/pnoltof
repository: repo_url: https://github.com/mruby/mruby
repo_name: mruby/mruby
description: Lightweight Ruby
repo_language: C
owner: mruby
file_changes: filename: io.c
change_type: ModificationType.MODIFY
diff: @@ -561,13 +561,13 @@ mrb_io_initialize_copy(mrb_state *mrb, mrb_value copy)
   mrb_bool failed = TRUE;
 
   mrb_get_args(mrb, "o", &orig);
+  fptr_orig = io_get_open_fptr(mrb, orig);
   fptr_copy = (struct mrb_io *)DATA_PTR(copy);
   if (fptr_copy != NULL) {
     fptr_finalize(mrb, fptr_copy, FALSE);
     mrb_free(mrb, fptr_copy);
   }
   fptr_copy = (struct mrb_io *)mrb_io_alloc(mrb);
-  fptr_orig = io_get_open_fptr(mrb, orig);
 
   DATA_TYPE(copy) = &mrb_io_type;
   DATA_PTR(copy) = fptr_copy;

programming_language: C
CVE-2019-19065 (published 2019-11-18T06:15Z)

A memory leak in the sdma_init() function in drivers/infiniband/hw/hfi1/sdma.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering rhashtable_init() failures, aka CID-34b3be18a04e. NOTE: This has been disputed as not a vulnerability because "rhashtable_init() can only fail if it is passed invalid values in the second parameter\'s struct, but when invoked from sdma_init() that is a pointer to a static const struct, so an attacker could only trigger failure if they could corrupt kernel memory (in which case a small memory leak is not a significant problem).

Severity: MEDIUM
CVSS v2 base score: 4.7 (AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 4.7, MEDIUM (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-401
cwe_name: Missing Release of Memory after Effective Lifetime
description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
extended_description: This is often triggered by improper handling of malformed data or unexpectedly interrupted sessions.  In some languages, developers are responsible for tracking memory allocation and releasing the memory.  If there are no more pointers or references to the memory, then it can no longer be tracked and identified for release.
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Navid Emamdoost
author_date: 2019-09-25 09:45:42-05:00
msg: RDMA/hfi1: Prevent memory leak in sdma_init

In sdma_init if rhashtable_init fails the allocated memory for
tmp_sdma_rht should be released.

Fixes: 5a52a7acf7e2 ("IB/hfi1: NULL pointer dereference when freeing rhashtable")
Link: https://lore.kernel.org/r/20190925144543.10141-1-navid.emamdoost@gmail.com
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Acked-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: sdma.c
change_type: ModificationType.MODIFY
diff: @@ -1526,8 +1526,11 @@ int sdma_init(struct hfi1_devdata *dd, u8 port)
 	}
 
 	ret = rhashtable_init(tmp_sdma_rht, &sdma_rht_params);
-	if (ret < 0)
+	if (ret < 0) {
+		kfree(tmp_sdma_rht);
 		goto bail;
+	}
+
 	dd->sdma_rht = tmp_sdma_rht;
 
 	dd_dev_info(dd, "SDMA num_sdma: %u\n", dd->num_sdma);

programming_language: C
CVE-2016-10189 (published 2017-03-14T14:59Z)

BitlBee before 3.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) and possibly execute arbitrary code via a file transfer request for a contact that is not in the contact list.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/bitlbee/bitlbee
commit_details: repo_url: https://github.com/bitlbee/bitlbee
author: dequis
author_date: 2016-11-13 16:52:43-03:00
msg: imcb_file_send_start: handle ft attempts from non-existing users
repository: repo_url: https://github.com/bitlbee/bitlbee
repo_name: bitlbee/bitlbee
description: An IRC to other chat networks gateway :bee:
repo_language: C
owner: bitlbee
file_changes: filename: bee_ft.c
change_type: ModificationType.MODIFY
diff: @@ -30,7 +30,7 @@ file_transfer_t *imcb_file_send_start(struct im_connection *ic, char *handle, ch
 	bee_t *bee = ic->bee;
 	bee_user_t *bu = bee_user_by_handle(bee, ic, handle);
 
-	if (bee->ui->ft_in_start) {
+	if (bee->ui->ft_in_start && bu) {
 		return bee->ui->ft_in_start(bee, bu, file_name, file_size);
 	} else {
 		return NULL;

programming_language: C