starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2013-4561 (published 2022-06-30T19:15Z)

In a openshift node, there is a cron job to update mcollective facts that mishandles a temporary file. This may lead to loss of confidentiality and integrity.

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N)
CVSS v3 base score: 9.1, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

Weakness information:
cwe_id: CWE-668
cwe_name: Exposure of Resource to Wrong Sphere
description: The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
extended_description: 
            Resources such as files and directories may be inadvertently exposed through mechanisms such as insecure permissions, or when a program accidentally operates on the wrong object. For example, a program may intend that private files can only be provided to a specific user. This effectively defines a control sphere that is intended to prevent attackers from accessing these private files. If the file permissions are insecure, then parties other than the user will be able to access those files.
            A separate control sphere might effectively require that the user can only access the private files, but not any other files on the system. If the program does not ensure that the user is only requesting private files, then the user might be able to access other files on the system.
            In either case, the end result is that a resource has been exposed to the wrong party.
         
         

Fix information:
repo_url: https://github.com/openshift/origin-server
commit_details: repo_url: https://github.com/openshift/origin-server
author: Brenton Leanhardt
author_date: 2013-11-12 14:20:58-05:00
msg: Bug 1022889 - AVC message is seen when mcolletive facts update cron job is running.

Looking back at the history showed that the switch to writing to /tmp/facts.log
was actually a mistake.  I'm reverting that change which will address this bug.
repository: repo_url: https://github.com/openshift/origin-server
repo_name: openshift/origin-server
description: OpenShift 2 (deprecated)
repo_language: Ruby
owner: openshift
file_changes: filename: openshift-facts
change_type: ModificationType.MODIFY
diff: @@ -6,4 +6,4 @@ if [ -f /opt/rh/ruby193/root/usr/libexec/mcollective/update_yaml.rb ]; then
   PREFIX="/opt/rh/ruby193/root"
 fi
 
-oo-exec-ruby ${PREFIX}/usr/libexec/mcollective/update_yaml.rb ${PREFIX}/etc/mcollective/facts.yaml &> /tmp/facts.log
+oo-exec-ruby ${PREFIX}/usr/libexec/mcollective/update_yaml.rb ${PREFIX}/etc/mcollective/facts.yaml &> /dev/null

programming_language: Shell
CVE-2023-34458 (published 2023-07-13T19:15Z)

mx-chain-go is the official implementation of the MultiversX blockchain protocol, written in golang. When executing a relayed transaction, if the inner transaction failed, it would have increased the inner transaction's sender account nonce. This could have contributed to a limited DoS attack on a targeted account. The fix is a breaking change so a new flag `RelayedNonceFixEnableEpoch` was needed. This was a strict processing issue while validating blocks on a chain. This vulnerability has been patched in version 1.4.17.

CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/multiversx/mx-chain-go
commit_details: repo_url: https://github.com/multiversx/mx-chain-go
author: Iulian Pascalau
author_date: 2023-05-28 18:51:48+03:00
msg: Merge pull request from GHSA-j494-7x2v-vvvp

Fix wrong nonce in relayed failed transaction
repository: repo_url: https://github.com/multiversx/mx-chain-go
repo_name: multiversx/mx-chain-go
description: ⚡ The official implementation of the MultiversX blockchain protocol, written in golang.
repo_language: Go
owner: multiversx
CVE-2019-3560 (published 2019-04-29T16:29Z)

An improperly performed length calculation on a buffer in PlaintextRecordLayer could lead to an infinite loop and denial-of-service based on user input. This issue affected versions of fizz prior to v2019.03.04.00.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-131
cwe_name: Incorrect Calculation of Buffer Size
description: The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
extended_description: 
            
            
             
			 
            
         
         
cwe_id: CWE-835
cwe_name: Loop with Unreachable Exit Condition ('Infinite Loop')
description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
extended_description: If the loop can be influenced by an attacker, this weakness could allow attackers to consume excessive resources such as CPU or memory.
         

Fix information:
repo_url: https://github.com/facebookincubator/fizz
commit_details: repo_url: https://github.com/facebookincubator/fizz
author: Kyle Nekritz
author_date: 2019-02-25 17:07:20-08:00
msg: Avoid arithmetic operation on uint16 read from the wire.

Summary:
This could overflow previously.

CVE-2019-3560

Reviewed By: yfeldblum

Differential Revision: D14152362

fbshipit-source-id: c0ebb3fc59b49c7c23e6bcb90458c19cd891be65
repository: repo_url: https://github.com/facebookincubator/fizz
repo_name: facebookincubator/fizz
description: C++14 implementation of the TLS-1.3 standard
repo_language: C++
owner: facebookincubator
file_changes: filename: PlaintextRecordLayer.cpp
change_type: ModificationType.MODIFY
diff: @@ -39,9 +39,7 @@ folly::Optional<TLSMessage> PlaintextReadRecordLayer::read(
         if (buf.chainLength() < (cursor - buf.front()) + length) {
           return folly::none;
         }
-        length +=
-            sizeof(ContentType) + sizeof(ProtocolVersion) + sizeof(uint16_t);
-        buf.trimStart(length);
+        buf.trimStart(static_cast<size_t>(kPlaintextHeaderSize) + length);
         continue;
       } else if (msg.type != ContentType::change_cipher_spec) {
         skipEncryptedRecords_ = false;

programming_language: C++
filename: PlaintextRecordTest.cpp
change_type: ModificationType.MODIFY
diff: @@ -115,6 +115,16 @@ TEST_F(PlaintextRecordTest, TestSkipAndWait) {
   EXPECT_TRUE(queue_.empty());
 }
 
+TEST_F(PlaintextRecordTest, TestSkipOversizedRecord) {
+  read_.setSkipEncryptedRecords(true);
+  addToQueue("170301fffb");
+  auto longBuf = IOBuf::create(0xfffb);
+  longBuf->append(0xfffb);
+  queue_.append(std::move(longBuf));
+  EXPECT_FALSE(read_.read(queue_).hasValue());
+  EXPECT_TRUE(queue_.empty());
+}
+
 TEST_F(PlaintextRecordTest, TestWaitBeforeSkip) {
   read_.setSkipEncryptedRecords(true);
   addToQueue("170301000501234567");

programming_language: C++
CVE-2015-5719 (published 2016-09-03T20:59Z)

app/Controller/TemplatesController.php in Malware Information Sharing Platform (MISP) before 2.3.92 does not properly restrict filenames under the tmp/files/ directory, which has unspecified impact and attack vectors.

Severity: HIGH
CVSS v2 base score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/MISP/MISP
commit_details: repo_url: https://github.com/MISP/MISP
author: Iglocska
author_date: 2015-07-01 11:06:11+02:00
msg: Fix to an incorrect validation of temporary filenames
repository: repo_url: https://github.com/MISP/MISP
repo_name: MISP/MISP
description: MISP (core software) - Open Source Threat Intelligence and Sharing Platform
repo_language: PHP
owner: MISP
file_changes: filename: VERSION.json
change_type: ModificationType.MODIFY
diff: @@ -1 +1 @@
-{"major":2, "minor":3, "hotfix":91}
\ No newline at end of file
+{"major":2, "minor":3, "hotfix":92}
\ No newline at end of file

programming_language: SQL
filename: TemplatesController.php
change_type: ModificationType.MODIFY
diff: @@ -334,7 +334,7 @@ class TemplatesController extends AppController {
 				$this->loadModel('Attribute');
 				$fails = 0;
 				foreach($attributes as $k => &$attribute) {
-					if (isset($attribute['data'])) {
+					if (isset($attribute['data']) && preg_match('/^[a-zA-Z0-9]{12}$/', $attribute['data'])) {
 						$file = new File(APP . 'tmp/files/' . $attribute['data']);
 						$content = $file->read();
 						$attribute['data'] = base64_encode($content);

programming_language: PHP
CVE-2024-31462 (published 2024-04-12T22:15Z)

stable-diffusion-webui is a web interface for Stable Diffusion, implemented using Gradio library. Stable-diffusion-webui 1.7.0 is vulnerable to a limited file write affecting Windows systems. The create_ui method (Backup/Restore tab) in modules/ui_extensions.py takes user input into the config_save_name variable on line 653. This user input is later used in the save_config_state method and used to create a file path on line 65, which is afterwards opened for writing on line 67, which leads to a limited file write exploitable on Windows systems. This issue may lead to limited file write. It allows for writing json files anywhere on the server where the web server has access.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/AUTOMATIC1111/stable-diffusion-webui
commit_details: repo_url: https://github.com/AUTOMATIC1111/stable-diffusion-webui
author: AUTOMATIC1111
author_date: 2024-04-08 16:15:25+03:00
msg: fix limited file write (thanks, Sylwia)
repository: repo_url: https://github.com/AUTOMATIC1111/stable-diffusion-webui
repo_name: AUTOMATIC1111/stable-diffusion-webui
description: Stable Diffusion web UI
repo_language: Python
owner: AUTOMATIC1111
file_changes: filename: ui_extensions.py
change_type: ModificationType.MODIFY
diff: @@ -58,8 +58,9 @@ def apply_and_restart(disable_list, update_list, disable_all):
 
 def save_config_state(name):
     current_config_state = config_states.get_config()
-    if not name:
-        name = "Config"
+
+    name = os.path.basename(name or "Config")
+
     current_config_state["name"] = name
     timestamp = datetime.now().strftime('%Y_%m_%d-%H_%M_%S')
     filename = os.path.join(config_states_dir, f"{timestamp}_{name}.json")

programming_language: Python
CVE-2022-39261 (published 2022-09-28T14:15Z)

Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the `source` or `include` statement to read arbitrary files from outside the templates' directory when using a namespace like `@somewhere/../some.file`. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/twigphp/Twig
commit_details: repo_url: https://github.com/twigphp/Twig
author: Fabien Potencier
author_date: 2022-09-28 10:36:08+02:00
msg: security #cve- Fix a security issue on filesystem loader (possibility to load a template outside a configured directory) (fabpot)

This PR was merged into the 1.x branch.
repository: repo_url: https://github.com/twigphp/Twig
repo_name: twigphp/Twig
description: Twig, the flexible, fast, and secure template language for PHP
repo_language: PHP
owner: twigphp
CVE-2017-11176 (published 2017-07-11T23:29Z)

The mq_notify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. During a user-space close of a Netlink socket, it allows attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact.

Severity: HIGH
CVSS v2 base score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Cong Wang
author_date: 2017-07-09 13:19:55-07:00
msg: mqueue: fix a use-after-free in sys_mq_notify()

The retry logic for netlink_attachskb() inside sys_mq_notify()
is nasty and vulnerable:

1) The sock refcnt is already released when retry is needed
2) The fd is controllable by user-space because we already
   release the file refcnt

so we when retry but the fd has been just closed by user-space
during this small window, we end up calling netlink_detachskb()
on the error path which releases the sock again, later when
the user-space closes this socket a use-after-free could be
triggered.

Setting 'sock' to NULL here should be sufficient to fix it.

Reported-by: GeneBlue <geneblue.mail@gmail.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Manfred Spraul <manfred@colorfullife.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: mqueue.c
change_type: ModificationType.MODIFY
diff: @@ -1270,8 +1270,10 @@ static int do_mq_notify(mqd_t mqdes, const struct sigevent *notification)
 
 			timeo = MAX_SCHEDULE_TIMEOUT;
 			ret = netlink_attachskb(sock, nc, &timeo, NULL);
-			if (ret == 1)
+			if (ret == 1) {
+				sock = NULL;
 				goto retry;
+			}
 			if (ret) {
 				sock = NULL;
 				nc = NULL;

programming_language: C
CVE-2017-9059 (published 2017-05-18T06:29Z)

The NFSv4 implementation in the Linux kernel through 4.11.1 allows local users to cause a denial of service (resource consumption) by leveraging improper channel callback shutdown when unmounting an NFSv4 filesystem, aka a "module reference and kernel daemon" leak.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-404
cwe_name: Improper Resource Shutdown or Release
description: The product does not release or incorrectly releases a resource before it is made available for re-use.
extended_description: When a resource is created or allocated, the developer is responsible for properly releasing the resource as well as accounting for all potential paths of expiration or invalidation, such as a set period of time or revocation.
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Linus Torvalds
author_date: 2017-05-10 13:29:23-07:00
msg: Merge tag 'nfsd-4.12' of git://linux-nfs.org/~bfields/linux

Pull nfsd updates from Bruce Fields:
 "Another RDMA update from Chuck Lever, and a bunch of miscellaneous
  bugfixes"

* tag 'nfsd-4.12' of git://linux-nfs.org/~bfields/linux: (26 commits)
  nfsd: Fix up the "supattr_exclcreat" attributes
  nfsd: encoders mustn't use unitialized values in error cases
  nfsd: fix undefined behavior in nfsd4_layout_verify
  lockd: fix lockd shutdown race
  NFSv4: Fix callback server shutdown
  SUNRPC: Refactor svc_set_num_threads()
  NFSv4.x/callback: Create the callback service through svc_create_pooled
  lockd: remove redundant check on block
  svcrdma: Clean out old XDR encoders
  svcrdma: Remove the req_map cache
  svcrdma: Remove unused RDMA Write completion handler
  svcrdma: Reduce size of sge array in struct svc_rdma_op_ctxt
  svcrdma: Clean up RPC-over-RDMA backchannel reply processing
  svcrdma: Report Write/Reply chunk overruns
  svcrdma: Clean up RDMA_ERROR path
  svcrdma: Use rdma_rw API in RPC reply path
  svcrdma: Introduce local rdma_rw API helpers
  svcrdma: Clean up svc_rdma_get_inv_rkey()
  svcrdma: Add helper to save pages under I/O
  svcrdma: Eliminate RPCRDMA_SQ_DEPTH_MULT
  ...
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
CVE-2021-39230 (published 2021-09-21T17:15Z)

Butter is a system usability utility. Due to a kernel error the JPNS kernel is being discontinued. Affected users are recommend to update to the Trinity kernel. There are no workarounds.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/FrankEnderman/Butter
commit_details: repo_url: https://github.com/FrankEnderman/Butter
author: FrankEnderman
author_date: 2021-09-21 07:57:35+05:30
msg: refined broken mode
repository: repo_url: https://github.com/FrankEnderman/Butter
repo_name: FrankEnderman/Butter
description: a little playground program where I test some stuff
repo_language: Batchfile
owner: FrankEnderman
file_changes: filename: Trinity.bat
change_type: ModificationType.MODIFY
diff: @@ -358,6 +358,7 @@ if %FD% == 2 goto menu
 start iexplore "https://www.youtube.com/watch?v=-345VbbYTN8"
 :ctrlPanel
 cls
+timeout /T 1 /NOBREAK >nul
 echo 1.power options 2.productivity 3.menu 4.BROKEN MODE (DANGER)
 set /p DFF= select:
 if %DFF% == 1 goto powerOptions
@@ -370,7 +371,7 @@ echo %random%
 timeout /T 2 /NOBREAK >nul
 echo %random%%random%%random%%random%%random%%random%%random%
 timeout /T 4 /NOBREAK >nul
-echo %random%%random%%random%%random%%random%%random%%random%
+echo %random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%
 timeout /T 3 /NOBREAK >nul
 echo DRIVE CORRUPT
 timeout /T 1 /NOBREAK >nul
@@ -385,6 +386,6 @@ timeout /T 3 /NOBREAK >nul
 echo restarting....
 timeout /T 2 /NOBREAK >nul
 echo BOOTING INTO TRINITY RRBI
-timeout /T 2 /NOBREAK >nul
+timeout /T 5 /NOBREAK >nul
 pause
 goto boot

programming_language: Batchfile
CVE-2014-9904 (published 2016-06-27T10:59Z)

The snd_compress_check_input function in sound/core/compress_offload.c in the ALSA subsystem in the Linux kernel before 3.17 does not properly check for an integer overflow, which allows local users to cause a denial of service (insufficient memory allocation) or possibly have unspecified other impact via a crafted SNDRV_COMPRESS_SET_PARAMS ioctl call.

Severity: HIGH
CVSS v2 base score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Dan Carpenter
author_date: 2014-07-16 09:37:04+03:00
msg: ALSA: compress: fix an integer overflow check

I previously added an integer overflow check here but looking at it now,
it's still buggy.

The bug happens in snd_compr_allocate_buffer().  We multiply
".fragments" and ".fragment_size" and that doesn't overflow but then we
save it in an unsigned int so it truncates the high bits away and we
allocate a smaller than expected size.

Fixes: b35cc8225845 ('ALSA: compress_core: integer overflow in snd_compr_allocate_buffer()')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: compress_offload.c
change_type: ModificationType.MODIFY
diff: @@ -491,7 +491,7 @@ static int snd_compress_check_input(struct snd_compr_params *params)
 {
 	/* first let's check the buffer parameter's */
 	if (params->buffer.fragment_size == 0 ||
-			params->buffer.fragments > SIZE_MAX / params->buffer.fragment_size)
+	    params->buffer.fragments > INT_MAX / params->buffer.fragment_size)
 		return -EINVAL;
 
 	/* now codec parameters */

programming_language: C