starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2010-4650 (published 2012-06-21T23:55Z)

Buffer overflow in the fuse_do_ioctl function in fs/fuse/file.c in the Linux kernel before 2.6.37 allows local users to cause a denial of service or possibly have unspecified other impact by leveraging the ability to operate a CUSE server.

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Miklos Szeredi
author_date: 2010-11-30 16:39:27+01:00
msg: fuse: verify ioctl retries

Verify that the total length of the iovec returned in FUSE_IOCTL_RETRY
doesn't overflow iov_length().

Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
CC: Tejun Heo <tj@kernel.org>
CC: <stable@kernel.org>         [2.6.31+]
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: file.c
change_type: ModificationType.MODIFY
diff: @@ -1666,6 +1666,20 @@ static int fuse_copy_ioctl_iovec(struct iovec *dst, void *src,
 	return 0;
 }
 
+/* Make sure iov_length() won't overflow */
+static int fuse_verify_ioctl_iov(struct iovec *iov, size_t count)
+{
+	size_t n;
+	u32 max = FUSE_MAX_PAGES_PER_REQ << PAGE_SHIFT;
+
+	for (n = 0; n < count; n++) {
+		if (iov->iov_len > (size_t) max)
+			return -ENOMEM;
+		max -= iov->iov_len;
+	}
+	return 0;
+}
+
 /*
  * For ioctls, there is no generic way to determine how much memory
  * needs to be read and/or written.  Furthermore, ioctls are allowed
@@ -1858,6 +1872,14 @@ long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg,
 		in_iov = page_address(iov_page);
 		out_iov = in_iov + in_iovs;
 
+		err = fuse_verify_ioctl_iov(in_iov, in_iovs);
+		if (err)
+			goto out;
+
+		err = fuse_verify_ioctl_iov(out_iov, out_iovs);
+		if (err)
+			goto out;
+
 		goto retry;
 	}
 

programming_language: C
CVE-2022-4732 (published 2022-12-27T15:15Z)

Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.3.2.

CVSS v3 base score: 7.2, HIGH (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/microweber/microweber
commit_details: repo_url: https://github.com/microweber/microweber
author: Peter Ivanov
author_date: 2022-12-05 10:46:54+02:00
msg: update
repository: repo_url: https://github.com/microweber/microweber
repo_name: microweber/microweber
description: Drag and Drop Website Builder and CMS with E-commerce
repo_language: HTML
owner: microweber
file_changes: filename: other.php
change_type: ModificationType.MODIFY
diff: @@ -1211,3 +1211,17 @@ if (!function_exists('mergeScreenshotParts')) {
         imagepng($targetImage, $outputFilename, 8);
     }
 }
+if (!function_exists('sanitize_path')) {
+
+    function sanitize_path($path)
+    {
+        $path = str_replace('..', '', $path);
+        $path = str_replace('./', '', $path);
+        $path = str_replace('.\\', '', $path);
+        $path = str_replace(';', '', $path);
+        $path = str_replace('&&', '', $path);
+        $path = str_replace('|', '', $path);
+        $path = str_replace('>', '', $path);
+        return $path;
+    }
+}

programming_language: PHP
filename: plupload.php
change_type: ModificationType.MODIFY
diff: @@ -285,8 +285,7 @@ if (isset($_REQUEST['path']) and trim($_REQUEST['path']) != '' and trim($_REQUES
     //$path = str_replace('%25252F','/',$path);
 
     $path = normalize_path($path, 0);
-
-    $path = str_replace('..', '', $path);
+    $path = sanitize_path($path);
     $path = str_replace($path_restirct, '', $path);
 
     // $target_path = userfiles_path() . DS . $path;

programming_language: PHP
CVE-2023-23929 (published 2023-03-04T00:15Z)

vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Currently, the refresh token is valid indefinitely. The refresh token should get a validity of 24-48 hours. A fix was released in version 3.8.0.\n

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-613
cwe_name: Insufficient Session Expiration
description: According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/vantage6/vantage6
commit_details: repo_url: https://github.com/vantage6/vantage6
author: Frank Martin
author_date: 2023-02-28 12:04:24+01:00
msg: Merge pull request from GHSA-4w59-c3gc-rrhp

Introduce maximum length of refresh tokens
repository: repo_url: https://github.com/vantage6/vantage6
repo_name: vantage6/vantage6
description: The main vantage6 repository: code for the central server, nodes, CLI and Python Client
repo_language: Python
owner: vantage6
CVE-2016-7405 (published 2016-10-03T18:59Z)

The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to incorrect quoting.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/ADOdb/ADOdb
commit_details: repo_url: https://github.com/ADOdb/ADOdb
author: Damien Regad
author_date: 2016-05-26 13:33:55+02:00
msg: PDO: fix incorrect quoting allowing SQL injection

The PDO driver was relying on ADOConnection::qstr() for quoting strings.
An application relying on qstr() to manually prepare SQL statements
rather than using parameterized queries may be vulnerable to SQL
injection attacks, as demonstrated by @jdavidlists.

This commit delegates string quoting to PDO::quote() when a connection
is available. If not, it simply replaces single quotes by the value of
$replaceQuote property.

Fixes #226
repository: repo_url: https://github.com/ADOdb/ADOdb
repo_name: ADOdb/ADOdb
description: ADOdb is a PHP database class library that provides powerful abstractions for performing queries and managing databases. ADOdb also hides the differences between DB engines so you can easily switch them without changing your code.
repo_language: PHP
owner: ADOdb
file_changes: filename: adodb-pdo.inc.php
change_type: ModificationType.MODIFY
diff: @@ -518,6 +518,30 @@ class ADODB_pdo extends ADOConnection {
 	{
 		return ($this->_connectionID) ? $this->_connectionID->lastInsertId() : 0;
 	}
+
+	/**
+	 * Quotes a string to be sent to the database.
+	 * If we have an active connection, delegates quoting to the underlying
+	 * PDO object. Otherwise, replace "'" by the value of $replaceQuote (same
+	 * behavior as mysqli driver)
+	 * @param string  $s            The string to quote
+	 * @param boolean $magic_quotes If false, use PDO::quote().
+	 * @return string Quoted string
+	 */
+	function qstr($s, $magic_quotes = false)
+	{
+		if (!$magic_quotes) {
+			if ($this->_connectionID) {
+				return $this->_connectionID->quote($s);
+			}
+			return "'" . str_replace("'", $this->replaceQuote, $s) . "'";
+		}
+
+		// undo magic quotes for "
+		$s = str_replace('\\"', '"', $s);
+		return "'$s'";
+	}
+
 }
 
 class ADODB_pdo_base extends ADODB_pdo {

programming_language: PHP
CVE-2024-27516 (published 2024-02-29T01:44Z)

Server-Side Template Injection (SSTI) vulnerability in livehelperchat before 4.34v, allows remote attackers to execute arbitrary code and obtain sensitive information via the search parameter in lhc_web/modules/lhfaq/faqweight.php.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/LiveHelperChat/livehelperchat
commit_details: repo_url: https://github.com/LiveHelperChat/livehelperchat
author: Remigijus Kiminas
author_date: 2024-02-20 05:55:58-05:00
msg: fix #2054

In next two weeks svelte version will be released. So all these never ending angular issues will be over for the most of the part.
repository: repo_url: https://github.com/LiveHelperChat/livehelperchat
repo_name: LiveHelperChat/livehelperchat
description: Live Helper Chat - live support for your website. Featuring web and mobile apps, Voice & Video & ScreenShare. Supports Telegram, Twilio (whatsapp), Facebook messenger including building a bot.
repo_language: PHP
owner: LiveHelperChat
file_changes: filename: section_online_users.tpl.php
change_type: ModificationType.MODIFY
diff: @@ -20,7 +20,7 @@
 
 	</div>
 	<div class="col-2 pe-0">
-		<input class="form-control form-control-sm" <?php if (isset($_GET['search'])) :?>ng-init='query=<?php echo json_encode(strip_tags($_GET['search']),JSON_HEX_APOS);?>'<?php endif?> ng-model="query" type="text" value="" placeholder="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/lists/search_panel','Type to search')?>">
+		<input class="form-control form-control-sm" <?php if (isset($_GET['search'])) :?>ng-init='query=<?php echo json_encode(str_replace(array('}}','{{'),'',strip_tags($_GET['search'])),JSON_HEX_APOS);?>'<?php endif?> ng-model="query" type="text" value="" placeholder="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/lists/search_panel','Type to search')?>">
 	</div>
 	<div class="col-1 pe-0">
 		<select class="form-control form-control-sm" ng-model="groupByField" title="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/onlineusers','Group list by');?>">

programming_language: PHP
filename: faqwidget.php
change_type: ModificationType.MODIFY
diff: @@ -137,7 +137,7 @@ if (isset($_GET['doSearch'])) {
     $dynamic_url_append .= '/(search)/'.rawurlencode($searchString);
 }
 
-$tpl->set('keyword',$keywordSearch);
+$tpl->set('keyword', str_replace(array('}}','{{'),'',$keywordSearch));
 
 $q->where($whereConditions);
 

programming_language: PHP
CVE-2023-47625 (published 2023-11-13T21:15Z)

PX4 autopilot is a flight control solution for drones. In affected versions a global buffer overflow vulnerability exists in the CrsfParser_TryParseCrsfPacket function in /src/drivers/rc/crsf_rc/CrsfParser.cpp:298 due to the invalid size check. A malicious user may create an RC packet remotely and that packet goes into the device where the _rcs_buf reads. The global buffer overflow vulnerability will be triggered and the drone can behave unexpectedly. This issue has been addressed in version 1.14.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)

Weakness information:
cwe_id: CWE-120
cwe_name: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
extended_description: A buffer overflow condition exists when a product attempts to put more data in a buffer than it can hold, or when it attempts to put data in a memory area outside of the boundaries of a buffer. The simplest type of error, and the most common cause of buffer overflows, is the "classic" case in which the product copies the buffer without restricting how much is copied. Other variants exist, but the existence of a classic overflow strongly suggests that the programmer is not considering even the most basic of security protections.
         

Fix information:
repo_url: https://github.com/PX4/PX4-Autopilot
commit_details: repo_url: https://github.com/PX4/PX4-Autopilot
author: Beat Küng
author_date: 2023-09-28 07:44:11+02:00
msg: fix crsf_rc: prevent potential buffer overflow for unknown packets

The length check for unknown packets did not include PACKET_SIZE_TYPE_SIZE
and CRC_SIZE, and hence working_index could overflow CRSF_MAX_PACKET_LEN,
triggering invalid memory access further down in QueueBuffer_PeekBuffer.

Also the working_segment_size was wrong for unknown packets.

Credits for finding this go to @Pwn9uin.
repository: repo_url: https://github.com/PX4/PX4-Autopilot
repo_name: PX4/PX4-Autopilot
description: PX4 Autopilot Software
repo_language: C++
owner: PX4
file_changes: filename: CrsfParser.cpp
change_type: ModificationType.MODIFY
diff: @@ -293,9 +293,9 @@ bool CrsfParser_TryParseCrsfPacket(CrsfPacket_t *const new_packet, CrsfParserSta
 			} else {
 				// We don't know what this packet is, so we'll let the parser continue
 				// just so that we can dequeue it in one shot
-				working_segment_size = packet_size + PACKET_SIZE_TYPE_SIZE;
+				working_segment_size = packet_size - PACKET_SIZE_TYPE_SIZE;
 
-				if (working_segment_size > CRSF_MAX_PACKET_LEN) {
+				if (working_index + working_segment_size + CRC_SIZE > CRSF_MAX_PACKET_LEN) {
 					parser_statistics->invalid_unknown_packet_sizes++;
 					parser_state = PARSER_STATE_HEADER;
 					working_segment_size = HEADER_SIZE;

programming_language: C
CVE-2013-4563 (published 2013-11-20T13:19Z)

The udp6_ufo_fragment function in net/ipv6/udp_offload.c in the Linux kernel through 3.12, when UDP Fragmentation Offload (UFO) is enabled, does not properly perform a certain size comparison before inserting a fragment header, which allows remote attackers to cause a denial of service (panic) via a large IPv6 UDP packet, as demonstrated by use of the Token Bucket Filter (TBF) queueing discipline.

Severity: HIGH
CVSS v2 base score: 7.1 (AV:N/AC:M/Au:N/C:N/I:N/A:C)

Weakness information:
cwe_id: CWE-189
cwe_name: Numeric Errors
description: Weaknesses in this category are related to improper calculation or conversion of numbers.

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Hannes Frederic Sowa
author_date: 2013-11-05 02:41:27+01:00
msg: ipv6: fix headroom calculation in udp6_ufo_fragment

Commit 1e2bd517c108816220f262d7954b697af03b5f9c ("udp6: Fix udp
fragmentation for tunnel traffic.") changed the calculation if
there is enough space to include a fragment header in the skb from a
skb->mac_header dervived one to skb_headroom. Because we already peeled
off the skb to transport_header this is wrong. Change this back to check
if we have enough room before the mac_header.

This fixes a panic Saran Neti reported. He used the tbf scheduler which
skb_gso_segments the skb. The offsets get negative and we panic in memcpy
because the skb was erroneously not expanded at the head.

Reported-by: Saran Neti <Saran.Neti@telus.com>
Cc: Pravin B Shelar <pshelar@nicira.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: udp_offload.c
change_type: ModificationType.MODIFY
diff: @@ -90,7 +90,7 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
 
 		/* Check if there is enough headroom to insert fragment header. */
 		tnl_hlen = skb_tnl_header_len(skb);
-		if (skb_headroom(skb) < (tnl_hlen + frag_hdr_sz)) {
+		if (skb->mac_header < (tnl_hlen + frag_hdr_sz)) {
 			if (gso_pskb_expand_head(skb, tnl_hlen + frag_hdr_sz))
 				goto out;
 		}

programming_language: C
CVE-2019-19960 (published 2019-12-25T00:15Z)

In wolfSSL before 4.3.0, wc_ecc_mulmod_ex does not properly resist side-channel attacks.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/wolfSSL/wolfssl
commit_details: repo_url: https://github.com/wolfSSL/wolfssl
author: toddouska
author_date: 2019-12-17 15:16:16-08:00
msg: Merge pull request #2637 from SparkiDev/ecc_cache_resist

Improve wc_ecc_mulmod_ex cache attack resistance
repository: repo_url: https://github.com/wolfSSL/wolfssl
repo_name: wolfSSL/wolfssl
description: The wolfSSL library is a small, fast, portable implementation of TLS/SSL for embedded devices to the cloud.  wolfSSL supports up to TLS 1.3 and DTLS 1.3!
repo_language: C
owner: wolfSSL
CVE-2012-1836 (published 2012-03-22T03:28Z)

Heap-based buffer overflow in dns.cpp in InspIRCd 2.0.5 might allow remote attackers to execute arbitrary code via a crafted DNS query that uses compression.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/inspircd/inspircd
commit_details: repo_url: https://github.com/inspircd/inspircd
author: Sir Pogsalot
author_date: 2012-03-21 07:01:08-07:00
msg: Merge pull request #1 from nenolod/insp20

DNS resolver hardening (insp20 branch)
repository: repo_url: https://github.com/inspircd/inspircd
repo_name: inspircd/inspircd
description: A modular C++ IRC server (ircd).
repo_language: C++
owner: inspircd
CVE-2018-11378 (published 2018-05-22T19:29Z)

The wasm_dis() function in libr/asm/arch/wasm/wasm.c in or possibly have unspecified other impact via a crafted WASM file.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/radare/radare2
commit_details: repo_url: https://github.com/radare/radare2
author: pancake
author_date: 2018-05-06 15:26:12+02:00
msg: Fix #9969 - Stack overflow in wasm disassembler
repository: repo_url: https://github.com/radare/radare2
repo_name: radareorg/radare2
description: UNIX-like reverse engineering framework and command-line toolset
repo_language: C
owner: radare
file_changes: filename: wasm.c
change_type: ModificationType.MODIFY
diff: @@ -414,14 +414,20 @@ int wasm_dis(WasmOp *op, const unsigned char *buf, int buf_len) {
 			}
 			op->len += n;
 			snprintf (op->txt, R_ASM_BUFSIZE, "%s %d ", opdef->txt, count);
-			for (i = 0; i < count && strlen (op->txt) + 10 < R_ASM_BUFSIZE; i++) {
-				int optxtlen = strlen (op->txt);
-				snprintf (op->txt + optxtlen, R_ASM_BUFSIZE - optxtlen, "%d ", table[i]);
+			char *txt = op->txt;
+			int txtLen = strlen (op->txt);
+			int txtLeft = R_ASM_BUFSIZE - txtLen;
+			txt += txtLen;
+			for (i = 0; i < count && txtLen + 10 < R_ASM_BUFSIZE; i++) {
+				snprintf (txt, txtLeft, "%d ", table[i]);
+				txtLen = strlen (txt);
+				txt += txtLen;
+				txtLeft -= txtLen;
 			}
-			snprintf (op->txt + strlen (op->txt), R_ASM_BUFSIZE, "%d", def);
+			snprintf (txt, txtLeft - 1, "%d", def);
 			free (table);
 			break;
-			beach:
+		beach:
 			free (table);
 			goto err;
 		}

programming_language: Lua