starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2021-3749 (published 2021-08-31T11:15Z)

axios is vulnerable to Inefficient Regular Expression Complexity

Severity: HIGH
CVSS v2 base score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-1333
cwe_name: Inefficient Regular Expression Complexity
description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
extended_description: Some regular expression engines have a feature called "backtracking". If the token cannot match, the engine "backtracks" to a position that may result in a different token that can match.
                Backtracking becomes a weakness if all of these conditions are met:
                
                    The number of possible backtracking attempts are exponential relative to the length of the input.
                    The input can fail to match the regular expression.
                    The input can be long enough.
                
		
		  Attackers can create crafted inputs that
		  intentionally cause the regular expression to use
		  excessive backtracking in a way that causes the CPU
		  consumption to spike.
		
            
            

Fix information:
repo_url: https://github.com/axios/axios
commit_details: repo_url: https://github.com/axios/axios
author: ready-research
author_date: 2021-08-30 18:03:43+05:30
msg: Security fix for ReDoS (#3980)
repository: repo_url: https://github.com/axios/axios
repo_name: axios/axios
description: Promise based HTTP client for the browser and node.js
repo_language: JavaScript
owner: axios
file_changes: filename: utils.js
change_type: ModificationType.MODIFY
diff: @@ -185,7 +185,7 @@ function isURLSearchParams(val) {
  * @returns {String} The String freed of excess whitespace
  */
 function trim(str) {
-  return str.replace(/^\s*/, '').replace(/\s*$/, '');
+  return str.trim ? str.trim() : str.replace(/^\s+|\s+$/g, '');
 }
 
 /**

programming_language: JavaScript
CVE-2020-11940 (published 2020-04-23T15:15Z)

In nDPI through 3.2 Stable, an out-of-bounds read in concat_hash_string in ssh.c can be exploited by a network-positioned attacker that can send malformed SSH protocol messages on a network segment monitored by nDPI's library.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/ntop/nDPI
commit_details: repo_url: https://github.com/ntop/nDPI
author: Philippe Antoine
author_date: 2020-04-02 16:35:10+02:00
msg: ssh: adds systematic bounds checks in concat_hash_string

cf GHSL-2020-052
repository: repo_url: https://github.com/ntop/nDPI
repo_name: ntop/nDPI
description: Open Source Deep Packet Inspection Software Toolkit
repo_language: C
owner: ntop
file_changes: filename: ssh.c
change_type: ModificationType.MODIFY
diff: @@ -110,10 +110,14 @@ static u_int16_t concat_hash_string(struct ndpi_packet_struct *packet,
   buf[buf_out_len++] = ';';
   offset += len;
 
+  if(offset+sizeof(u_int32_t) >= packet->payload_packet_len)
+    goto invalid_payload;
   /* ssh.server_host_key_algorithms [None] */
   len = ntohl(*(u_int32_t*)&packet->payload[offset]);
   offset += 4 + len;
 
+  if(offset+sizeof(u_int32_t) >= packet->payload_packet_len)
+    goto invalid_payload;
   /* ssh.encryption_algorithms_client_to_server [C] */
   len = ntohl(*(u_int32_t*)&packet->payload[offset]);
 
@@ -130,6 +134,8 @@ static u_int16_t concat_hash_string(struct ndpi_packet_struct *packet,
   } else
     offset += 4 + len;
 
+  if(offset+sizeof(u_int32_t) >= packet->payload_packet_len)
+    goto invalid_payload;
   /* ssh.encryption_algorithms_server_to_client [S] */
   len = ntohl(*(u_int32_t*)&packet->payload[offset]);
 
@@ -146,6 +152,8 @@ static u_int16_t concat_hash_string(struct ndpi_packet_struct *packet,
   } else
     offset += 4 + len;
 
+  if(offset+sizeof(u_int32_t) >= packet->payload_packet_len)
+    goto invalid_payload;
   /* ssh.mac_algorithms_client_to_server [C] */
   len = ntohl(*(u_int32_t*)&packet->payload[offset]);
 
@@ -162,6 +170,8 @@ static u_int16_t concat_hash_string(struct ndpi_packet_struct *packet,
   } else
     offset += 4 + len;
 
+  if(offset+sizeof(u_int32_t) >= packet->payload_packet_len)
+    goto invalid_payload;
   /* ssh.mac_algorithms_server_to_client [S] */
   len = ntohl(*(u_int32_t*)&packet->payload[offset]);
 
@@ -195,6 +205,8 @@ static u_int16_t concat_hash_string(struct ndpi_packet_struct *packet,
   } else
     offset += 4 + len;
 
+  if(offset+sizeof(u_int32_t) >= packet->payload_packet_len)
+    goto invalid_payload;
   /* ssh.compression_algorithms_server_to_client [S] */
   len = ntohl(*(u_int32_t*)&packet->payload[offset]);
 

programming_language: C
CVE-2020-36278 (published 2021-03-12T00:15Z)

Leptonica before 1.80.0 allows a heap-based buffer over-read in findNextBorderPixel in ccbord.c.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/DanBloomberg/leptonica
commit_details: repo_url: https://github.com/DanBloomberg/leptonica
author: Dan Bloomberg
author_date: 2020-06-14 22:52:40-07:00
msg: Issue 23433 in oss-fuzz: Heap-buffer-overflow in findNextBorderPixel()
* Check pix boundary when looking for the next pixel.
repository: repo_url: https://github.com/DanBloomberg/leptonica
repo_name: DanBloomberg/leptonica
description: Leptonica is an open source library containing software that is broadly useful for image processing and image analysis applications. The official github repository for Leptonica is: danbloomberg/leptonica.  See leptonica.org for more documentation.
repo_language: C
owner: DanBloomberg
file_changes: filename: ccbord.c
change_type: ModificationType.MODIFY
diff: @@ -1080,6 +1080,8 @@ l_uint32  *line;
         pos = (qpos + i) % 8;
         npx = px + xpostab[pos];
         npy = py + ypostab[pos];
+        if (npx < 0 || npx >= w || npy < 0 || npy >= h)
+            continue;
         line = data + npy * wpl;
         val = GET_DATA_BIT(line, npx);
         if (val) {

programming_language: C
CVE-2021-3888 (published 2021-10-19T13:15Z)

libmobi is vulnerable to Use of Out-of-range Pointer Offset

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 8.1, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/bfabiszewski/libmobi
commit_details: repo_url: https://github.com/bfabiszewski/libmobi
author: Bartek Fabiszewski
author_date: 2021-09-18 21:56:15+02:00
msg: Fix potential out-of-buffer read while parsing corrupt file, closes #38
repository: repo_url: https://github.com/bfabiszewski/libmobi
repo_name: bfabiszewski/libmobi
description: C library for handling Kindle (MOBI) formats of ebook documents
repo_language: C
owner: bfabiszewski
file_changes: filename: read.c
change_type: ModificationType.MODIFY
diff: @@ -752,6 +752,10 @@ MOBI_RET mobi_parse_huffdic(const MOBIData *m, MOBIHuffCdic *huffcdic) {
         }
         curr = curr->next;
     }
+    if (huffcdic->index_count != huffcdic->index_read) {
+        debug_print("CDIC: wrong read index count: %zu, total: %zu\n", huffcdic->index_read, huffcdic->index_count);
+        return MOBI_DATA_CORRUPT;
+    }
     return MOBI_SUCCESS;
 }
 

programming_language: C
CVE-2024-31209 (published 2024-04-04T16:15Z)

oidcc is the OpenID Connect client library for Erlang. Denial of Service (DoS) by Atom exhaustion is possible by calling `oidcc_provider_configuration_worker:get_provider_configuration/1` or `oidcc_provider_configuration_worker:get_jwks/1`. This issue has been patched in version(s)`3.1.2` & `3.2.0-beta.3`.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/erlef/oidcc
commit_details: repo_url: https://github.com/erlef/oidcc
author: Jonatan Männchen
author_date: 2024-04-03 16:47:54+02:00
msg: Merge pull request from GHSA-mj35-2rgf-cv8p
repository: repo_url: https://github.com/erlef/oidcc
repo_name: erlef/oidcc
description: OpenId Connect client library in Erlang & Elixir
repo_language: Erlang
owner: erlef
file_changes: filename: oidcc_provider_configuration_worker.erl
change_type: ModificationType.MODIFY
diff: @@ -382,16 +382,15 @@ lookup_in_ets_or_call(Name, Key, Call) ->
 
 -spec get_ets_table_name(WorkerRef :: gen_server:server_ref()) ->
     {ok, gen_server:server_ref()} | error.
-get_ets_table_name(WorkerName) when is_atom(WorkerName) ->
-    {ok, erlang:list_to_atom(erlang:atom_to_list(WorkerName) ++ "_table")};
+get_ets_table_name(Name) when is_atom(Name) ->
+    {ok, Name};
 get_ets_table_name(_Ref) ->
     error.
 
 -spec register_ets_table(Opts :: opts()) -> ets:table() | undefined.
 register_ets_table(Opts) ->
     case maps:get(name, Opts, undefined) of
-        {local, WorkerName} ->
-            Name = erlang:list_to_atom(erlang:atom_to_list(WorkerName) ++ "_table"),
+        {local, Name} ->
             ets:new(Name, [named_table, bag, protected, {read_concurrency, true}]);
         _OtherName ->
             undefined

programming_language: Erlang
CVE-2017-14642 (published 2017-09-21T17:29Z)

A NULL pointer dereference was discovered in the AP4_HdlrAtom class in Bento4 version 1.5.0-617. The vulnerability causes a segmentation fault and application crash in AP4_StdcFileByteStream::ReadPartial in System/StdC/Ap4StdCFileByteStream.cpp, which leads to remote denial of service.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/axiomatic-systems/Bento4
commit_details: repo_url: https://github.com/axiomatic-systems/Bento4
author: Gilles Boccon-Gibod
author_date: 2017-09-09 10:56:33-07:00
msg: fix for #185
repository: repo_url: https://github.com/axiomatic-systems/Bento4
repo_name: axiomatic-systems/Bento4
description: Full-featured MP4 format, MPEG DASH, HLS, CMAF SDK and tools
repo_language: C++
owner: axiomatic-systems
file_changes: filename: Ap4HdlrAtom.cpp
change_type: ModificationType.MODIFY
diff: @@ -80,9 +80,10 @@ AP4_HdlrAtom::AP4_HdlrAtom(AP4_UI32        size,
     stream.ReadUI32(m_Reserved[2]);
     
     // read the name unless it is empty
-    int name_size = size-(AP4_FULL_ATOM_HEADER_SIZE+20);
-    if (name_size == 0) return;
+    if (size < AP4_FULL_ATOM_HEADER_SIZE+20) return;
+    AP4_UI32 name_size = size-(AP4_FULL_ATOM_HEADER_SIZE+20);
     char* name = new char[name_size+1];
+    if (name == NULL) return;
     stream.Read(name, name_size);
     name[name_size] = '\0'; // force a null termination
     // handle a special case: the Quicktime files have a pascal

programming_language: C++
CVE-2023-28626 (published 2023-03-28T21:15Z)

comrak is a CommonMark + GFM compatible Markdown parser and renderer written in rust. A range of quadratic parsing issues are present in Comrak. These can be used to craft denial-of-service attacks on services that use Comrak to parse Markdown. This issue has been addressed in version 0.17.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as `GHSL-2023-047`

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-400
cwe_name: Uncontrolled Resource Consumption
description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
extended_description: 
            Limited resources include memory, file system storage, database connection pool entries, and CPU. If an attacker can trigger the allocation of these limited resources, but the number or size of the resources is not controlled, then the attacker could cause a denial of service that consumes all available resources. This would prevent valid users from accessing the product, and it could potentially have an impact on the surrounding environment. For example, a memory exhaustion attack against an application could slow down the application as well as its host operating system.
            There are at least three distinct scenarios which can commonly lead to resource exhaustion:
               
                  Lack of throttling for the number of allocated resources
                  Losing all references to a resource before reaching the shutdown stage
                  Not closing/returning a resource after processing
               
            Resource exhaustion problems are often result due to an incorrect implementation of the following situations:
               
                  Error conditions and other exceptional circumstances.
                  Confusion over which part of the program is responsible for releasing the resource.
               
         
         

Fix information:
repo_url: https://github.com/kivikakk/comrak
commit_details: repo_url: https://github.com/kivikakk/comrak
author: Asherah Connor
author_date: 2023-03-28 10:26:21+11:00
msg: Merge pull request from GHSA-8hqf-xjwp-p67v

Address quadratic complexity issues from upstream, pest
repository: repo_url: https://github.com/kivikakk/comrak
repo_name: kivikakk/comrak
description: CommonMark + GFM compatible Markdown parser and renderer
repo_language: Rust
owner: kivikakk
CVE-2023-47016 (published 2023-11-22T07:15Z)

radare2 5.8.9 has an out-of-bounds read in r_bin_object_set_items in libr/bin/bobj.c, causing a crash in r_read_le32 in libr/include/r_endian.h.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/radareorg/radare2
commit_details: repo_url: https://github.com/radareorg/radare2
author: pancake
author_date: 2023-10-28 19:02:07+02:00
msg: Fix #22349 - oobread in xnu kernelcache ##crash

* Reproducer rabin_hbo_194
* Reported by @gandalf4a
repository: repo_url: https://github.com/radareorg/radare2
repo_name: radareorg/radare2
description: UNIX-like reverse engineering framework and command-line toolset
repo_language: C
owner: radareorg
file_changes: filename: bin_xnu_kernelcache.c
change_type: ModificationType.MODIFY
diff: @@ -988,7 +988,7 @@ static void process_constructors(RKernelCacheObj *obj, struct MACH0_(obj_t) *mac
 		}
 		int j;
 		int count = 0;
-		for (j = 0; j < section->size; j += 8) {
+		for (j = 0; j + 7 < section->size; j += 8) {
 			ut64 addr64 = K_RPTR (buf + j);
 			ut64 paddr64 = section->paddr + paddr + j;
 			if (mode == R_K_CONSTRUCTOR_TO_ENTRY) {

programming_language: C
CVE-2024-1454 (published 2024-02-12T23:15Z)

The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or smart card to present the system with specially crafted responses to the APDUs, which are considered high complexity and low severity. This manipulation can allow for compromised card management operations during enrolment.


Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/OpenSC/OpenSC
commit_details: repo_url: https://github.com/OpenSC/OpenSC
author: Jakub Jelen
author_date: 2023-12-18 11:09:50+01:00
msg: authentic: Avoid use after free

Thanks oss-fuzz

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64898
repository: repo_url: https://github.com/OpenSC/OpenSC
repo_name: OpenSC/OpenSC
description: Open source smart card tools and middleware. PKCS#11/MiniDriver/Tokend
repo_language: C
owner: OpenSC
file_changes: filename: pkcs15-authentic.c
change_type: ModificationType.MODIFY
diff: @@ -868,7 +868,7 @@ authentic_emu_update_tokeninfo(struct sc_profile *profile, struct sc_pkcs15_card
 	rv = sc_select_file(p15card->card, &path, &file);
 	if (!rv) {
 		rv = sc_get_challenge(p15card->card, buffer, sizeof(buffer));
-		if (!rv) {
+		if (rv < 0) {
 			sc_file_free(file);
 			LOG_TEST_RET(ctx, rv, "Get challenge error");
 		}

programming_language: C
CVE-2024-34081 (published 2024-05-14T15:38Z)

MantisBT (Mantis Bug Tracker) is an open source issue tracker.  Improper escaping of a custom field's name allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript when resolving or closing issues (`bug_change_status_page.php`) belonging to a project linking said custom field, viewing issues (`view_all_bug_page.php`) when the custom field is displayed as a column, or printing issues (`print_all_bug_page.php`) when the custom field is displayed as a column. Version 2.26.2 contains a patch for the issue. As a workaround, ensure Custom Field Names do not contain HTML tags.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/mantisbt/mantisbt
commit_details: repo_url: https://github.com/mantisbt/mantisbt
author: Damien Regad
author_date: 2024-05-06 19:04:08+02:00
msg: Proper escaping of Custom Field name for display

Fixes XSS vulnerability on
- bug_change_status_page.php (resolving and closing issues)
- view_all_bug_page.php & print_all_bug_page.php (when the custom field
  is selected as a column for display/print)

Fixes #34432, CVE-2024-34081
repository: repo_url: https://github.com/mantisbt/mantisbt
repo_name: mantisbt/mantisbt
description: Mantis Bug Tracker (MantisBT)
repo_language: PHP
owner: mantisbt
file_changes: filename: bug_change_status_page.php
change_type: ModificationType.MODIFY
diff: @@ -303,7 +303,7 @@ layout_page_begin();
 	<tr>
 		<th class="category">
 			<?php if( $t_require && $t_has_write_access ) {?><span class="required">*</span><?php } ?>
-			<?php echo lang_get_defaulted( $t_def['name'] ) ?>
+			<?php echo string_attribute( lang_get_defaulted( $t_def['name'] ) ) ?>
 		</th>
 		<td>
 <?php

programming_language: PHP
filename: print_api.php
change_type: ModificationType.MODIFY
diff: @@ -1344,7 +1344,12 @@ function print_view_bug_sort_link( $p_string, $p_sort_field, $p_sort, $p_dir, $p
 			$t_sort_field = rawurlencode( $p_sort_field );
 			$t_print_parameter = ( $p_columns_target == COLUMNS_TARGET_PRINT_PAGE ) ? '&print=1' : '';
 			$t_filter_parameter = filter_is_temporary( $g_filter ) ? filter_get_temporary_key_param( $g_filter ) . '&' : '';
-			print_link( 'view_all_set.php?' . $t_filter_parameter . 'sort_add=' . $t_sort_field . '&dir_add=' . $p_dir . '&type=' . FILTER_ACTION_PARSE_ADD . $t_print_parameter, $p_string );
+			$t_url = 'view_all_set.php?' . $t_filter_parameter
+				. 'sort_add=' . $t_sort_field
+				. '&dir_add=' . $p_dir
+				. '&type=' . FILTER_ACTION_PARSE_ADD
+				. $t_print_parameter;
+			print_link( $t_url, string_attribute( $p_string ) );
 			break;
 		default:
 			echo $p_string;

programming_language: PHP