starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2024-2952 (published 2024-04-10T17:15Z)

BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the `/completions` endpoint. The vulnerability arises from the `hf_chat_template` method processing the `chat_template` parameter from the `tokenizer_config.json` file through the Jinja template engine without proper sanitization. Attackers can exploit this by crafting malicious `tokenizer_config.json` files that execute arbitrary code on the server.


Weakness information:
cwe_id: CWE-76
cwe_name: Improper Neutralization of Equivalent Special Elements
description: The product correctly neutralizes certain special elements, but it improperly neutralizes equivalent special elements.
extended_description: The product may have a fixed list of special characters it believes is complete. However, there may be alternate encodings, or representations that also have the same meaning. For example, the product may filter out a leading slash (/) to prevent absolute path names, but does not account for a tilde (~) followed by a user name, which on some *nix systems could be expanded to an absolute pathname. Alternately, the product might filter a dangerous "-e" command-line switch when calling an external program, but it might not account for "--exec" or other switches that have the same semantics.
         

Fix information:
repo_url: https://github.com/berriai/litellm
commit_details: repo_url: https://github.com/berriai/litellm
author: Ishaan Jaff
author_date: 2024-04-10 21:28:49-07:00
msg: Merge pull request #2941 from BerriAI/litellm_fix_sec_report

[FIX] -  Security issue Server-Side Template Injection in /completions endpoint in
repository: repo_url: https://github.com/berriai/litellm
repo_name: BerriAI/litellm
description: Call all LLM APIs using the OpenAI format. Use Bedrock, Azure, OpenAI, Cohere, Anthropic, Ollama, Sagemaker, HuggingFace, Replicate, Groq (100+ LLMs)
repo_language: Python
owner: berriai
CVE-2017-2630 (published 2018-07-27T18:29Z)

A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network Block Device (NBD) client support. The flaw could occur while processing server's response to a 'NBD_OPT_LIST' request. A malicious NBD server could use this issue to crash a remote NBD client resulting in DoS or potentially execute arbitrary code on client host with privileges of the QEMU process.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-121
cwe_name: Stack-based Buffer Overflow
description: A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/qemu/qemu
commit_details: repo_url: https://github.com/qemu/qemu
author: Vladimir Sementsov-Ogievskiy
author_date: 2017-03-07 09:16:27-06:00
msg: nbd/client: fix drop_sync [CVE-2017-2630]

Comparison symbol is misused. It may lead to memory corruption.
Introduced in commit 7d3123e.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20170203154757.36140-6-vsementsov@virtuozzo.com>
[eblake: add CVE details, update conditional]
Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Marc-AndrÃ© Lureau <marcandre.lureau@redhat.com>
Message-Id: <20170307151627.27212-1-eblake@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
repository: repo_url: https://github.com/qemu/qemu
repo_name: qemu/qemu
description: Official QEMU mirror. Please see https://www.qemu.org/contribute/ for how to submit changes to QEMU. Pull Requests are ignored. Please only use release tarballs from the QEMU website.
repo_language: C
owner: qemu
file_changes: filename: client.c
change_type: ModificationType.MODIFY
diff: @@ -94,7 +94,7 @@ static ssize_t drop_sync(QIOChannel *ioc, size_t size)
     char small[1024];
     char *buffer;
 
-    buffer = sizeof(small) < size ? small : g_malloc(MIN(65536, size));
+    buffer = sizeof(small) >= size ? small : g_malloc(MIN(65536, size));
     while (size > 0) {
         ssize_t count = read_sync(ioc, buffer, MIN(65536, size));
 

programming_language: C
CVE-2015-8877 (published 2016-05-22T01:59Z)

The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in PHP before 5.6.12, uses inconsistent allocate and free approaches, which allows remote attackers to cause a denial of service (memory consumption) via a crafted call, as demonstrated by a call to the PHP imagescale function.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-399
cwe_name: Resource Management Errors
description: Weaknesses in this category are related to improper management of system resources.

Fix information:
repo_url: https://github.com/libgd/libgd
commit_details: repo_url: https://github.com/libgd/libgd
author: Vladimir Mitrovic
author_date: 2015-08-05 03:01:06+02:00
msg: gdImageScaleTwoPass memory leak fix

Fixing memory leak in gdImageScaleTwoPass, as reported by @cmb69 and
confirmed by @vapier.  This bug actually bit me in production and I'm
very thankful that it was reported with an easy fix.

Fixes #173.
repository: repo_url: https://github.com/libgd/libgd
repo_name: libgd/libgd
description: GD Graphics Library
repo_language: C
owner: libgd
file_changes: filename: gd_interpolation.c
change_type: ModificationType.MODIFY
diff: @@ -1087,7 +1087,7 @@ gdImageScaleTwoPass(const gdImagePtr src, const unsigned int new_width,
     }/* if */
 
     if (src != tmp_im) {
-        gdFree(tmp_im);
+        gdImageDestroy(tmp_im);
     }/* if */
 
 	return dst;

programming_language: C
CVE-2021-23180 (published 2022-03-02T23:15Z)

A flaw was found in htmldoc in v1.9.12 and before. Null pointer dereference in file_extension(),in file.c may lead to execute arbitrary code and denial of service.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/michaelrsweet/htmldoc
commit_details: repo_url: https://github.com/michaelrsweet/htmldoc
author: Michael R Sweet
author_date: 2021-01-26 08:02:32-05:00
msg: Fix a crash bug with malformed URIs (Issue #418)
repository: repo_url: https://github.com/michaelrsweet/htmldoc
repo_name: michaelrsweet/htmldoc
description: HTML Conversion Software
repo_language: C++
owner: michaelrsweet
file_changes: filename: CHANGES.md
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,7 @@
 # Changes in HTMLDOC v1.9.12
 
 - Fixed a crash bug with "data:" URIs and EPUB output (Issue #410)
+- Fixed a crash bug with malformed URIs (Issue #418)
 - Fixed some issues reported by Coverity.
 
 

programming_language: Markdown
filename: file.c
change_type: ModificationType.MODIFY
diff: @@ -304,6 +304,7 @@ const char *			/* O - File extension */
 file_extension(const char *s)	/* I - Filename or URL */
 {
   const char	*extension;	/* Pointer to directory separator */
+  char		*bufptr;	/* Pointer into buffer */
   static char	buf[1024];	/* Buffer for files with targets */
 
 
@@ -334,7 +335,8 @@ file_extension(const char *s)	/* I - Filename or URL */
 
   strlcpy(buf, extension, sizeof(buf));
 
-  *(char *)strchr(buf, '#') = '\0';
+  if ((bufptr = strchr(buf, '#')) != NULL)
+    *bufptr = '\0';
 
   return (buf);
 }

programming_language: C
CVE-2015-5725 (published 2018-02-21T16:29Z)

SQL injection vulnerability in the offset method in the Active Record class in CodeIgniter before 2.2.4 allows remote attackers to execute arbitrary SQL commands via vectors involving the offset variable.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/bcit-ci/CodeIgniter
commit_details: repo_url: https://github.com/bcit-ci/CodeIgniter
author: kenjis
author_date: 2011-09-02 08:41:17+09:00
msg: fixes potential SQL injection vector in Active Record offset()
repository: repo_url: https://github.com/bcit-ci/CodeIgniter
repo_name: bcit-ci/CodeIgniter
description: Open Source PHP Framework (originally from EllisLab)
repo_language: PHP
owner: bcit-ci
file_changes: filename: DB_active_rec.php
change_type: ModificationType.MODIFY
diff: @@ -895,7 +895,7 @@ class CI_DB_active_record extends CI_DB_driver {
 	 */
 	public function offset($offset)
 	{
-		$this->ar_offset = $offset;
+		$this->ar_offset = (int) $offset;
 		return $this;
 	}
 

programming_language: PHP
CVE-2021-41202 (published 2021-11-05T22:15Z)

TensorFlow is an open source platform for machine learning. In affected versions while calculating the size of the output within the `tf.range` kernel, there is a conditional statement of type `int64 = condition ? int64 : double`. Due to C++ implicit conversion rules, both branches of the condition will be cast to `double` and the result would be truncated before the assignment. This result in overflows. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-681
cwe_name: Incorrect Conversion between Numeric Types
description: When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: TensorFlower Gardener
author_date: 2021-08-30 13:44:36-07:00
msg: Merge pull request #51711 from yongtang:46899-tf.range

PiperOrigin-RevId: 393844345
Change-Id: I2a72193d4416b8b009bc0b21489a42061f164203
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: TensorFlower Gardener
author_date: 2021-08-18 08:14:11-07:00
msg: Merge pull request #51359 from yongtang:46913-range-overflow

PiperOrigin-RevId: 391529518
Change-Id: Ie3db4ae6d3c0f3dc88404e1dbdc22f7d03cbeb3b
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
CVE-2019-17539 (published 2019-10-14T02:15Z)

In FFmpeg before 4.2, avcodec_open2 in libavcodec/utils.c allows a NULL pointer dereference and possibly unspecified other impact when there is no valid close function pointer.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/FFmpeg/FFmpeg
commit_details: repo_url: https://github.com/FFmpeg/FFmpeg
author: Michael Niedermayer
author_date: 2019-07-21 00:08:55+02:00
msg: avcodec/utils: Check close before calling it

Fixes: NULL pointer dereference
Fixes: 15733/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IDF_fuzzer-5658616977162240

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
repository: repo_url: https://github.com/FFmpeg/FFmpeg
repo_name: FFmpeg/FFmpeg
description: Mirror of https://git.ffmpeg.org/ffmpeg.git
repo_language: C
owner: FFmpeg
file_changes: filename: utils.c
change_type: ModificationType.MODIFY
diff: @@ -1024,7 +1024,7 @@ end:
 
     return ret;
 free_and_end:
-    if (avctx->codec &&
+    if (avctx->codec && avctx->codec->close &&
         (codec_init_ok ||
          (avctx->codec->caps_internal & FF_CODEC_CAP_INIT_CLEANUP)))
         avctx->codec->close(avctx);

programming_language: C
CVE-2018-13785 (published 2018-07-09T13:29Z)

In libpng 1.6.34, a wrong calculation of row_factor in the png_check_chunk_length function (pngrutil.c) may trigger an integer overflow and resultant divide-by-zero while processing a crafted PNG file, leading to a denial of service.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-369
cwe_name: Divide By Zero
description: The product divides a value by zero.
extended_description: This weakness typically occurs when an unexpected value is provided to the product, or if an error occurs that is not properly detected. It frequently occurs in calculations involving physical dimensions such as size, length, width, and height.
         
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/glennrp/libpng
commit_details: repo_url: https://github.com/glennrp/libpng
author: Cosmin Truta
author_date: 2018-06-17 22:56:29-04:00
msg: [libpng16] Fix the calculation of row_factor in png_check_chunk_length

(Bug report by Thuan Pham, SourceForge issue #278)
repository: repo_url: https://github.com/glennrp/libpng
repo_name: pnggroup/libpng
description: LIBPNG: Portable Network Graphics support, official libpng repository
repo_language: C
owner: glennrp
file_changes: filename: pngrutil.c
change_type: ModificationType.MODIFY
diff: @@ -3167,10 +3167,13 @@ png_check_chunk_length(png_const_structrp png_ptr, const png_uint_32 length)
    {
       png_alloc_size_t idat_limit = PNG_UINT_31_MAX;
       size_t row_factor =
-         (png_ptr->width * png_ptr->channels * (png_ptr->bit_depth > 8? 2: 1)
-          + 1 + (png_ptr->interlaced? 6: 0));
+         (size_t)png_ptr->width
+         * (size_t)png_ptr->channels
+         * (png_ptr->bit_depth > 8? 2: 1)
+         + 1
+         + (png_ptr->interlaced? 6: 0);
       if (png_ptr->height > PNG_UINT_32_MAX/row_factor)
-         idat_limit=PNG_UINT_31_MAX;
+         idat_limit = PNG_UINT_31_MAX;
       else
          idat_limit = png_ptr->height * row_factor;
       row_factor = row_factor > 32566? 32566 : row_factor;

programming_language: C
CVE-2010-10009 (published 2023-01-18T21:15Z)

A vulnerability was found in frioux ptome. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to sql injection. The patch is named 26829bba67858ca0bd4ce49ad50e7ce653914276. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218519.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/frioux/ptome
commit_details: repo_url: https://github.com/frioux/ptome
author: JohnBOren
author_date: 2010-01-11 06:15:24+00:00
msg: Security update to thwart SQL injection (previously, magic_quotes_gpc was saving us)
repository: repo_url: https://github.com/frioux/ptome
repo_name: frioux/ptome
description: Automatically exported from code.google.com/p/ptome
repo_language: PHP
owner: frioux
file_changes: filename: Field.php
change_type: ModificationType.MODIFY
diff: @@ -203,7 +203,7 @@
 		 * @return MIXED Current field value.
 		 */
 		function getValue() {
-			$ret = $this->value;
+            $ret = SecurityManager::formPrep($this->value);
             if(empty($ret)) {
 				return $this->default;
 			}
@@ -271,6 +271,7 @@
          * @return BOOLEAN False if any error were encountered.
          */
         protected function postProcess($value) {
+            $value = SecurityManager::SQLPrep($value);
             $this->setValue($value);
             return true;
         }

programming_language: PHP
filename: LoginManager.php
change_type: ModificationType.MODIFY
diff: @@ -68,6 +68,8 @@
 		 * @return INTEGER One of the error code constants defined in this class.
 		 */
 		function login($user, $pass, $remember="no", $isCookie=false) {
+            $user = htmlspecialchars(addslashes($user));
+            $pass = htmlspecialchars(addslashes($pass));
 			$sql = "select `users`.*, `libraries`.`interTOME` from `users` JOIN `libraries` ON `users`.`libraryID` = `libraries`.`ID` where `username` LIKE '$user'";
 			$result = DatabaseManager::checkError($sql);
 			if(DatabaseManager::getNumResults($result) === 0) {

programming_language: PHP
CVE-2013-7455 (published 2016-05-07T10:59Z)

Double free vulnerability in the DefaultICCintents function in cmscnvrt.c in liblcms2 in Little CMS 2.x before 2.6 allows remote attackers to execute arbitrary code via a malformed ICC profile that triggers an error in the default intent handler.

Severity: HIGH
CVSS v2 base score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/mm2/Little-CMS
commit_details: repo_url: https://github.com/mm2/Little-CMS
author: Marti Maria
author_date: 2013-07-10 10:04:36+02:00
msg: Fix a double free on error recovering
repository: repo_url: https://github.com/mm2/Little-CMS
repo_name: mm2/Little-CMS
description: A free, open source, CMM engine. It provides fast transforms between ICC profiles.
repo_language: C
owner: mm2
file_changes: filename: ChangeLog
change_type: ModificationType.MODIFY
diff: @@ -125,3 +125,6 @@ Added some checks for non-happy path, mostly failing mallocs
 -----------------------
 2.5 Maintenance release
 -----------------------
+
+Fixed a double free in recovering from a previous error in default intent handler.
+

programming_language: Markdown
filename: cmscnvrt.c
change_type: ModificationType.MODIFY
diff: @@ -571,7 +571,9 @@ cmsPipeline* DefaultICCintents(cmsContext       ContextID,
         // Concatenate to the output LUT
         if (!cmsPipelineCat(Result, Lut))
             goto Error;
+
         cmsPipelineFree(Lut);
+        Lut = NULL;
 
         // Update current space
         CurrentColorSpace = ColorSpaceOut;
@@ -581,7 +583,7 @@ cmsPipeline* DefaultICCintents(cmsContext       ContextID,
 
 Error:
 
-    cmsPipelineFree(Lut);
+    if (Lut != NULL) cmsPipelineFree(Lut);
     if (Result != NULL) cmsPipelineFree(Result);
     return NULL;
 

programming_language: C