starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2023-2674 (published 2023-05-12T08:15Z)

Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.

CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-284
cwe_name: Improper Access Control
description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
extended_description: 
            Access control involves the use of several protection mechanisms such as:
            
               Authentication (proving the identity of an actor)
               Authorization (ensuring that a given actor can access a resource), and
               Accountability (tracking of activities that were performed)
            
            When any mechanism is not applied or otherwise fails, attackers can compromise the security of the product by gaining privileges, reading sensitive information, executing commands, evading detection, etc.
            There are two distinct behaviors that can introduce access control weaknesses:
               
                  Specification: incorrect privileges, permissions, ownership, etc. are explicitly specified for either the user or the resource (for example, setting a password file to be world-writable, or giving administrator capabilities to a guest user). This action could be performed by the program or the administrator.
                  Enforcement: the mechanism contains errors that prevent it from properly enforcing the specified access control requirements (e.g., allowing the user to specify their own privileges, or allowing a syntactically-incorrect ACL to produce insecure settings). This problem occurs within the program itself, in that it does not actually enforce the intended security policy that the administrator specifies.
               
         
		 

Fix information:
repo_url: https://github.com/openemr/openemr
commit_details: repo_url: https://github.com/openemr/openemr
author: Brady Miller
author_date: 2023-01-15 17:18:37-08:00
msg: bug fix (#6098)
repository: repo_url: https://github.com/openemr/openemr
repo_name: openemr/openemr
description: The most popular open source electronic health records and medical practice management solution.
repo_language: PHP
owner: openemr
file_changes: filename: Controller.class.php
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,8 @@
 <?php
 
+use OpenEMR\Common\Acl\AclMain;
+use OpenEMR\Common\Twig\TwigContainer;
+
 // TODO: @adunsulag move these into src/
 class Controller extends Smarty
 {
@@ -73,6 +76,12 @@ class Controller extends Smarty
 
     public function act($qarray)
     {
+        if ((array_key_first($qarray) ?? '') == 'practice_settings') {
+            if (!AclMain::aclCheckCore('admin', 'practice')) {
+                echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Practice Settings")]);
+                exit;
+            }
+        }
 
         if (isset($_GET['process'])) {
             unset($_GET['process']);

programming_language: PHP
CVE-2022-0631 (published 2022-02-18T14:15Z)

Heap-based Buffer Overflow in Homebrew mruby prior to 3.2.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-122
cwe_name: Heap-based Buffer Overflow
description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/mruby/mruby
commit_details: repo_url: https://github.com/mruby/mruby
author: Yukihiro "Matz" Matsumoto
author_date: 2022-02-18 14:38:07+09:00
msg: vm.c: packed arguments length may be zero for `send` method.
repository: repo_url: https://github.com/mruby/mruby
repo_name: mruby/mruby
description: Lightweight Ruby
repo_language: C
owner: mruby
file_changes: filename: vm.c
change_type: ModificationType.MODIFY
diff: @@ -689,9 +689,11 @@ mrb_f_send(mrb_state *mrb, mrb_value self)
   regs = mrb->c->ci->stack+1;
 
   if (n == 0) {
+  argnum_error:
     mrb_argnum_error(mrb, 0, 1, -1);
   }
   else if (n == 15) {
+    if (RARRAY_LEN(regs[0]) == 0) goto argnum_error;
     name = mrb_obj_to_sym(mrb, RARRAY_PTR(regs[0])[0]);
   }
   else {

programming_language: C
CVE-2015-3220 (published 2017-06-13T16:29Z)

The tlslite library before 0.4.9 for Python allows remote attackers to trigger a denial of service (runtime exception and process crash).

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/trevp/tlslite
commit_details: repo_url: https://github.com/trevp/tlslite
author: Trevor Perrin
author_date: 2015-08-05 16:21:38-07:00
msg: Fix IndexError on junk message.
repository: repo_url: https://github.com/trevp/tlslite
repo_name: trevp/tlslite
description: TLS Library in python
repo_language: Python
owner: trevp
file_changes: filename: tlsrecordlayer.py
change_type: ModificationType.MODIFY
diff: @@ -970,6 +970,12 @@ class TLSRecordLayer(object):
                 if self.version >= (3,2): #For TLS 1.1, remove explicit IV
                     b = b[self._readState.encContext.block_size : ]
 
+                if len(b) == 0:
+                    for result in self._sendError(\
+                            AlertDescription.decryption_failed,
+                            "No data left after decryption and IV removal"):
+                        yield result
+
                 #Check padding
                 paddingGood = True
                 paddingLength = b[-1]

programming_language: Python
CVE-2018-19837 (published 2018-12-04T09:29Z)

In LibSass prior to 3.5.5, Sass::Eval::operator()(Sass::Binary_Expression*) inside eval.cpp allows attackers to cause a denial-of-service resulting from stack consumption via a crafted sass file, because of certain incorrect parsing of '%' as a modulo operator in parser.cpp.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-400
cwe_name: Uncontrolled Resource Consumption
description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
extended_description: 
            Limited resources include memory, file system storage, database connection pool entries, and CPU. If an attacker can trigger the allocation of these limited resources, but the number or size of the resources is not controlled, then the attacker could cause a denial of service that consumes all available resources. This would prevent valid users from accessing the product, and it could potentially have an impact on the surrounding environment. For example, a memory exhaustion attack against an application could slow down the application as well as its host operating system.
            There are at least three distinct scenarios which can commonly lead to resource exhaustion:
               
                  Lack of throttling for the number of allocated resources
                  Losing all references to a resource before reaching the shutdown stage
                  Not closing/returning a resource after processing
               
            Resource exhaustion problems are often result due to an incorrect implementation of the following situations:
               
                  Error conditions and other exceptional circumstances.
                  Confusion over which part of the program is responsible for releasing the resource.
               
         
         

Fix information:
repo_url: https://github.com/sass/libsass
commit_details: repo_url: https://github.com/sass/libsass
author: xzyfer
author_date: 2018-06-21 20:10:55+10:00
msg: Remove legacy workaround for parsing modulo operator

Fixes #2659
repository: repo_url: https://github.com/sass/libsass
repo_name: sass/libsass
description: A C/C++ implementation of a Sass compiler
repo_language: C++
owner: sass
file_changes: filename: parser.cpp
change_type: ModificationType.MODIFY
diff: @@ -1723,10 +1723,6 @@ namespace Sass {
     if (lex< variable >())
     { return SASS_MEMORY_NEW(Variable, pstate, Util::normalize_underscores(lexed)); }
 
-    // Special case handling for `%` proceeding an interpolant.
-    if (lex< sequence< exactly<'%'>, optional< percentage > > >())
-    { return SASS_MEMORY_NEW(String_Constant, pstate, lexed); }
-
     css_error("Invalid CSS", " after ", ": expected expression (e.g. 1px, bold), was ");
 
     // unreachable statement

programming_language: C++
CVE-2014-4157 (published 2014-06-23T11:21Z)

arch/mips/include/asm/thread_info.h in the Linux kernel before 3.14.8 on the MIPS platform does not configure _TIF_SECCOMP checks on the fast system-call path, which allows local users to bypass intended PR_SET_SECCOMP restrictions by executing a crafted application without invoking a trace or audit subsystem.

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: CWE-264
cwe_name: Permissions, Privileges, and Access Controls
description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Markos Chandras
author_date: 2014-01-22 14:40:00+00:00
msg: MIPS: asm: thread_info: Add _TIF_SECCOMP flag

Add _TIF_SECCOMP flag to _TIF_WORK_SYSCALL_ENTRY to indicate
that the system call needs to be checked against a seccomp filter.

Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
Reviewed-by: Paul Burton <paul.burton@imgtec.com>
Reviewed-by: James Hogan <james.hogan@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/6405/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: thread_info.h
change_type: ModificationType.MODIFY
diff: @@ -136,7 +136,8 @@ static inline struct thread_info *current_thread_info(void)
 #define _TIF_SYSCALL_TRACEPOINT	(1<<TIF_SYSCALL_TRACEPOINT)
 
 #define _TIF_WORK_SYSCALL_ENTRY	(_TIF_NOHZ | _TIF_SYSCALL_TRACE |	\
-				 _TIF_SYSCALL_AUDIT | _TIF_SYSCALL_TRACEPOINT)
+				 _TIF_SYSCALL_AUDIT | \
+				 _TIF_SYSCALL_TRACEPOINT | _TIF_SECCOMP)
 
 /* work to do in syscall_trace_leave() */
 #define _TIF_WORK_SYSCALL_EXIT	(_TIF_NOHZ | _TIF_SYSCALL_TRACE |	\

programming_language: C
CVE-2020-4068 (published 2020-06-22T16:15Z)

In APNSwift 1.0.0, calling APNSwiftSigner.sign(digest:) is likely to result in a heap buffer overflow. This has been fixed in 1.0.1.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-122
cwe_name: Heap-based Buffer Overflow
description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/kylebrowning/APNSwift
commit_details: repo_url: https://github.com/kylebrowning/APNSwift
author: Kyle Browning
author_date: 2019-07-23 10:27:07-07:00
msg: Resolves memory issue (#32)

* Resolves #31
repository: repo_url: https://github.com/kylebrowning/APNSwift
repo_name: swift-server-community/APNSwift
description: 📱HTTP/2 Apple Push Notification Service built with swift - send push notifications to iOS, iPadOS, tvOS, macOS, watchOS, visionOS, and Safari!
repo_language: Swift
owner: kylebrowning
file_changes: filename: APNSwiftSigner.swift
change_type: ModificationType.MODIFY
diff: @@ -36,9 +36,9 @@ public struct APNSwiftSigner {
         let bio = BIO_new(BIO_s_mem())
         defer { BIO_free(bio) }
         let res = buffer.withUnsafeReadableBytes { ptr in
-            Int(BIO_puts(bio, ptr.baseAddress?.assumingMemoryBound(to: Int8.self)))
+            BIO_write(bio, ptr.baseAddress, CInt(ptr.count))
         }
-        assert(res >= 0, "BIO_puts failed")
+        assert(res >= 0, "BIO_write failed")
 
         guard let opaquePointer = OpaquePointer.make(optional: PEM_read_bio_ECPrivateKey(bio!, nil, nil, nil)) else {
             throw APNSwiftError.SigningError.invalidAuthKey
@@ -50,17 +50,14 @@ public struct APNSwiftSigner {
         }
         defer { ECDSA_SIG_free(sig) }
 
-        var derEncodedSignature: UnsafeMutablePointer<UInt8>?
+        var derEncodedSignature: UnsafeMutablePointer<CUnsignedChar>?
         let derLength = i2d_ECDSA_SIG(sig, &derEncodedSignature)
         guard let derCopy = derEncodedSignature, derLength > 0 else {
             throw APNSwiftError.SigningError.invalidASN1
         }
 
         var derBytes = ByteBufferAllocator().buffer(capacity: Int(derLength))
-        for b in 0 ..< Int(derLength) {
-            derBytes.writeBytes([derCopy[b]])
-        }
-
+        derBytes.writeBytes(UnsafeBufferPointer<CUnsignedChar>(start: derCopy, count: Int(derLength)))
         return derBytes
     }
 }

programming_language: Swift
CVE-2022-1771 (published 2022-05-18T20:15Z)

Uncontrolled Recursion in GitHub repository vim/vim prior to 8.2.4975.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-674
cwe_name: Uncontrolled Recursion
description: The product does not properly control the amount of recursion that takes place,  consuming excessive resources, such as allocated memory or the program stack.
extended_description: 
        
      
      

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Bram Moolenaar
author_date: 2022-05-17 20:11:02+01:00
msg: patch 8.2.4975: recursive command line loop may cause a crash

Problem:    Recursive command line loop may cause a crash.
Solution:   Limit recursion of getcmdline().
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: ex_getln.c
change_type: ModificationType.MODIFY
diff: @@ -1581,6 +1581,7 @@ getcmdline_int(
     int		indent,		// indent for inside conditionals
     int		clear_ccline)	// clear ccline first
 {
+    static int	depth = 0;	    // call depth
     int		c;
     int		i;
     int		j;
@@ -1611,6 +1612,9 @@ getcmdline_int(
     int		cmdline_type;
     int		wild_type;
 
+    // one recursion level deeper
+    ++depth;
+
     if (ccline.cmdbuff != NULL)
     {
 	// Being called recursively.  Since ccline is global, we need to save
@@ -1641,6 +1645,13 @@ getcmdline_int(
     if (init_ccline(firstc, indent) != OK)
 	goto theend;	// out of memory
 
+    if (depth == 50)
+    {
+	// Somehow got into a loop recursively calling getcmdline(), bail out.
+	emsg(_(e_command_too_recursive));
+	goto theend;
+    }
+
     ExpandInit(&xpc);
     ccline.xpc = &xpc;
 
@@ -2576,6 +2587,7 @@ theend:
     {
 	char_u *p = ccline.cmdbuff;
 
+	--depth;
 	if (did_save_ccline)
 	    restore_cmdline(&save_ccline);
 	else

programming_language: C
filename: test_cmdline.vim
change_type: ModificationType.MODIFY
diff: @@ -3392,4 +3392,16 @@ func Test_screenpos_and_completion()
   call feedkeys(":let a\<C-R>=Check_completion()\<CR>\<Esc>", "xt")
 endfunc
 
+func Test_recursive_register()
+  let @= = ''
+  silent! ?e/
+  let caught = 'no'
+  try
+    normal // 
+  catch /E169:/
+    let caught = 'yes'
+  endtry
+  call assert_equal('yes', caught)
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab

programming_language: Lua
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -746,6 +746,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    4975,
 /**/
     4974,
 /**/

programming_language: Ruby
CVE-2016-10011 (published 2017-01-05T02:59Z)

authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer contents, which might allow local users to obtain sensitive private-key information by leveraging access to a privilege-separated child process.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-320
cwe_name: Key Management Errors
description: Weaknesses in this category are related to errors in the management of cryptographic keys.

Fix information:
repo_url: https://github.com/openbsd/src
commit_details: repo_url: https://github.com/openbsd/src
author: djm
author_date: 2016-11-25 23:24:45+00:00
msg: use sshbuf_allocate() to pre-allocate the buffer used for loading
keys. This avoids implicit realloc inside the buffer code, which
might theoretically leave fragments of the key on the heap. This
doesn't appear to happen in practice for normal sized keys, but
was observed for novelty oversize ones.

Pointed out by Jann Horn of Project Zero; ok markus@
repository: repo_url: https://github.com/openbsd/src
repo_name: openbsd/src
description: Read-only git conversion of OpenBSD's official CVS src repository. Pull requests not accepted - send diffs to the tech@ mailing list.
repo_language: C
owner: openbsd
file_changes: filename: authfile.c
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,4 @@
-/* $OpenBSD: authfile.c,v 1.121 2016/04/09 12:39:30 djm Exp $ */
+/* $OpenBSD: authfile.c,v 1.122 2016/11/25 23:24:45 djm Exp $ */
 /*
  * Copyright (c) 2000, 2013 Markus Friedl.  All rights reserved.
  *
@@ -98,13 +98,25 @@ sshkey_load_file(int fd, struct sshbuf *blob)
 	u_char buf[1024];
 	size_t len;
 	struct stat st;
-	int r;
+	int r, dontmax = 0;
 
 	if (fstat(fd, &st) < 0)
 		return SSH_ERR_SYSTEM_ERROR;
 	if ((st.st_mode & (S_IFSOCK|S_IFCHR|S_IFIFO)) == 0 &&
 	    st.st_size > MAX_KEY_FILE_SIZE)
 		return SSH_ERR_INVALID_FORMAT;
+	/*
+	 * Pre-allocate the buffer used for the key contents and clamp its
+	 * maximum size. This ensures that key contents are never leaked via
+	 * implicit realloc() in the sshbuf code.
+	 */
+	if ((st.st_mode & S_IFREG) == 0 || st.st_size <= 0) {
+		st.st_size = 64*1024; /* 64k should be enough for anyone :) */
+		dontmax = 1;
+	}
+	if ((r = sshbuf_allocate(blob, st.st_size)) != 0 ||
+	    (dontmax && (r = sshbuf_set_max_size(blob, st.st_size)) != 0))
+		return r;
 	for (;;) {
 		if ((len = atomicio(read, fd, buf, sizeof(buf))) == 0) {
 			if (errno == EPIPE)

programming_language: C
CVE-2021-41560 (published 2021-12-15T07:15Z)

OpenCATS through 0.9.6 allows remote attackers to execute arbitrary code by uploading an executable file via lib/FileUtility.php.

Severity: HIGH
CVSS v2 base score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/opencats/OpenCATS
commit_details: repo_url: https://github.com/opencats/OpenCATS
author: Nicholas Ferreira
author_date: 2021-11-10 06:10:49-03:00
msg: Fixed critical upload vulnerability (#552)

Co-authored-by: Nicholas Ferreira <nickguitar.dll@hotmail.com>
repository: repo_url: https://github.com/opencats/OpenCATS
repo_name: opencats/OpenCATS
description: Applicant Tracking System (maintained code base)
repo_language: PHP
owner: opencats
file_changes: filename: FileUtility.php
change_type: ModificationType.MODIFY
diff: @@ -184,11 +184,17 @@ class FileUtility
 
         /* Is the file extension safe? */
         $fileExtension = self::getFileExtension($filename);
-        if (in_array($fileExtension, $GLOBALS['badFileExtensions']))
+        
+        /* Use a whitelist instead of a blacklist to prevent possible bypasses */
+        if (!preg_match("/(?i)\.(pdf|docx?|rtf|odt?g?|txt|wpd|jpe?g|png|csv|xlsx?|ppt|msg|heic|tiff?|html?|bmp|wps|xps)$/i", $fileExtension))
+        {
+            $filename .= ".txt";
+        }
+/*        if (in_array($fileExtension, $GLOBALS['badFileExtensions']))
         {
             $filename .= '.txt';
         }
-
+*/
         return $filename;
     }
 
@@ -563,7 +569,7 @@ class FileUtility
             if (!eval(Hooks::get('FILE_UTILITY_SPACE_CHECK'))) return;
 
             $uploadPath = FileUtility::getUploadPath($siteID, $subDirectory);
-            $newFileName = $_FILES[$id]['name'];
+            $newFileName = FileUtility::makeSafeFilename($_FILES[$id]['name']);
 
             // Could just while(file_exists) it, but I'm paranoid of infinate loops
             // Shouldn't have 1000 files of the same name anyway

programming_language: PHP