starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2020-28896 (published 2020-11-23T19:15Z)

Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $ssl_force_tls was processed if an IMAP server's initial server response was invalid. The connection was not properly closed, and the code could continue attempting to authenticate. This could result in authentication credentials being exposed on an unencrypted connection, or to a machine-in-the-middle.

Severity: LOW
CVSS v2 base score: 2.6 (AV:N/AC:H/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         
cwe_id: CWE-755
cwe_name: Improper Handling of Exceptional Conditions
description: The product does not handle or incorrectly handles an exceptional condition.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/neomutt/neomutt
commit_details: repo_url: https://github.com/neomutt/neomutt
author: Richard Russon
author_date: 2020-11-17 12:29:12+00:00
msg: imap: close connection on all failures

Thanks to Gabriel Salles-Loustau for spotting the problem.

Co-authored-by: Kevin McCarthy <kevin@8t8.us>
repository: repo_url: https://github.com/neomutt/neomutt
repo_name: neomutt/neomutt
description: ✉️ Teaching an Old Dog New Tricks -- IRC: #neomutt on irc.libera.chat
repo_language: C
owner: neomutt
file_changes: filename: imap.c
change_type: ModificationType.MODIFY
diff: @@ -761,7 +761,7 @@ int imap_open_connection(struct ImapAccountData *adata)
       else if ((ans = query_quadoption(C_SslStarttls,
                                        _("Secure connection with TLS?"))) == MUTT_ABORT)
       {
-        goto err_close_conn;
+        goto bail;
       }
       if (ans == MUTT_YES)
       {
@@ -776,7 +776,7 @@ int imap_open_connection(struct ImapAccountData *adata)
           if (mutt_ssl_starttls(adata->conn))
           {
             mutt_error(_("Could not negotiate TLS connection"));
-            goto err_close_conn;
+            goto bail;
           }
           else
           {
@@ -791,7 +791,7 @@ int imap_open_connection(struct ImapAccountData *adata)
     if (C_SslForceTls && (adata->conn->ssf == 0))
     {
       mutt_error(_("Encrypted connection unavailable"));
-      goto err_close_conn;
+      goto bail;
     }
 #endif
   }
@@ -807,7 +807,7 @@ int imap_open_connection(struct ImapAccountData *adata)
     if ((adata->conn->ssf == 0) && C_SslForceTls)
     {
       mutt_error(_("Encrypted connection unavailable"));
-      goto err_close_conn;
+      goto bail;
     }
 #endif
 
@@ -824,11 +824,8 @@ int imap_open_connection(struct ImapAccountData *adata)
 
   return 0;
 
-#ifdef USE_SSL
-err_close_conn:
-  imap_close_connection(adata);
-#endif
 bail:
+  imap_close_connection(adata);
   FREE(&adata->capstr);
   return -1;
 }

programming_language: C
CVE-2021-40540 (published 2021-09-07T02:15Z)

ulfius_uri_logger in Ulfius HTTP Framework before 2.7.4 omits con_info initialization and a con_info->request NULL check for certain malformed HTTP requests.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/babelouest/ulfius
commit_details: repo_url: https://github.com/babelouest/ulfius
author: Nicolas Mora
author_date: 2021-09-06 16:30:07-04:00
msg: Fix bug when malformed HTTP requests are sent, thanks Jeremy Brown!
repository: repo_url: https://github.com/babelouest/ulfius
repo_name: babelouest/ulfius
description: Web Framework to build REST APIs, Webservices or any HTTP endpoint in C language. Can stream large amount of data, integrate JSON data with Jansson, and create websocket services
repo_language: C
owner: babelouest
file_changes: filename: ulfius.c
change_type: ModificationType.MODIFY
diff: @@ -207,6 +207,7 @@ void * ulfius_uri_logger (void * cls, const char * uri) {
   UNUSED(cls);
 
   if (con_info != NULL) {
+    memset(con_info, 0, sizeof(struct connection_info_struct));
     con_info->callback_first_iteration = 1;
     con_info->u_instance = NULL;
     u_map_init(&con_info->map_url_initial);
@@ -217,7 +218,8 @@ void * ulfius_uri_logger (void * cls, const char * uri) {
       return NULL;
     }
 
-    if (NULL == con_info->request || ulfius_init_request(con_info->request) != U_OK) {
+    if (ulfius_init_request(con_info->request) != U_OK) {
+      y_log_message(Y_LOG_LEVEL_ERROR, "Ulfius - Error initializing con_info->request");
       ulfius_clean_request_full(con_info->request);
       o_free(con_info);
       return NULL;
@@ -433,7 +435,6 @@ static int ulfius_webservice_dispatcher (void * cls,
                                          size_t * upload_data_size,
                                          void ** con_cls) {
 #endif
-
   struct _u_endpoint * endpoint_list = ((struct _u_instance *)cls)->endpoint_list, ** current_endpoint_list = NULL, * current_endpoint = NULL;
   struct connection_info_struct * con_info = * con_cls;
   int mhd_ret = MHD_NO, callback_ret = U_OK, i, close_loop = 0, inner_error = U_OK, mhd_response_flag;

programming_language: C
CVE-2014-8351 (published 2014-11-06T15:55Z)

SQL injection vulnerability in info.php in French National Commission on Informatics and Liberty (aka CNIL) CookieViz before 1.0.1 allows remote web servers to execute arbitrary SQL commands via the domain parameter.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/LaboCNIL/CookieViz
commit_details: repo_url: https://github.com/LaboCNIL/CookieViz
author: LaboCnil
author_date: 2014-11-04 11:30:34+01:00
msg: Patch vulnerabilities

Patch vulnerabilities :
CVE-2014-8352
CVE-2014-8351
repository: repo_url: https://github.com/LaboCNIL/CookieViz
repo_name: LINCnil/CookieViz
description: CookieViz est un outil de visualisation qui permet de mesurer l'impact des cookies lors de votre propre navigation.
repo_language: CSS
owner: LaboCNIL
file_changes: filename: info.php
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,4 @@
-<?php
+﻿<?php
 /*Copyright (c) 2013, Stéphane Petitcolas
 This file is part of CookieViz
 
@@ -20,8 +20,14 @@ require "connect.php";
 
 if(isset($_GET["domain"]))
 {
-	$domain = $_GET["domain"];
+	$domain = mysql_real_escape_string($_GET["domain"]);
+	
 }
+else
+{
+	exit;
+}
+
 echo '<table id="infos">';
  echo "<thead>";
  echo "<tr>";

programming_language: PHP
filename: json.php
change_type: ModificationType.MODIFY
diff: @@ -23,12 +23,16 @@ $init_max_date=0;
 
 if(isset($_GET["max_date"]))
 {
-	$init_max_date = $_GET["max_date"];
+	$init_max_date = 	mysql_real_escape_string($_GET["max_date"]);
+	if (!is_numeric($init_max_date))
+	{
+		$init_max_date="";
+	}
 }
 
 if(isset($_GET["domain"]))
 {
-	$domain = $_GET["domain"];
+	$domain = mysql_real_escape_string($_GET["domain"]);
 }
 
 $max_date = $init_max_date;

programming_language: PHP
CVE-2022-23573 (published 2022-02-04T23:15Z)

Tensorflow is an Open Source Machine Learning Framework. The implementation of `AssignOp` can result in copying uninitialized data to a new tensor. This later results in undefined behavior. The implementation has a check that the left hand side of the assignment is initialized (to minimize number of allocations), but does not check that the right hand side is also initialized. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-908
cwe_name: Use of Uninitialized Resource
description: The product uses or accesses a resource that has not been initialized.
extended_description: When a resource has not been properly initialized, the product may behave unexpectedly. This may lead to a crash or invalid memory access, but the consequences vary depending on the type of resource and how it is used within the product.
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Mihai Maruseac
author_date: 2021-11-09 11:04:04-08:00
msg: Prevent copying uninitialized data in `AssignOp`.

This prevents harder to debug undefined behaviors that cannot be traced back to the original tensor after assignments occur earlier in the graph execution. Several of these undefined behaviors are just reference bindings to null pointers, which are caught when running under ubsan/asan.

PiperOrigin-RevId: 408654780
Change-Id: Iad2ec40d43f5fd7ea016c20283356c12d5ddeab1
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: assign_op.h
change_type: ModificationType.MODIFY
diff: @@ -50,6 +50,12 @@ class AssignOp : public OpKernel {
     // We always return the input ref.
     context->forward_ref_input_to_ref_output(0, 0);
 
+    // Prevent copying uninitialized data, to solve harder to debug undefined
+    // behaviors that cannot be traced back to the original tensor.
+    OP_REQUIRES(
+        context, rhs.IsInitialized(),
+        errors::Internal("Right hand side of AssignOp is not initialized"));
+
     // We can't always know how this value will be used downstream, so make
     // conservative assumptions in specifying constraints on the memory
     // allocation attributes, unless the Grappler graph analysis determined that

programming_language: Rust
CVE-2023-43661 (published 2023-10-11T20:15Z)

Cachet, the open-source status page system. Prior to the 2.4 branch, a template functionality which allows users to create templates allows them to execute any code on the server during the bad filtration and old twig version. Commit 6fb043e109d2a262ce3974e863c54e9e5f5e0587 of the 2.4 branch contains a patch for this issue.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-74
cwe_name: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
extended_description: Software or other automated logic has certain assumptions about what constitutes data and control respectively. It is the lack of verification of these assumptions for user-controlled input that leads to injection problems. Injection problems encompass a wide variety of issues -- all mitigated in very different ways and usually attempted in order to alter the control flow of the process. For this reason, the most effective way to discuss these weaknesses is to note the distinct features that classify them as injection weaknesses. The most important issue to note is that all injection problems share one thing in common -- i.e., they allow for the injection of control plane data into the user-controlled data plane. This means that the execution of the process may be altered by sending code in through legitimate data channels, using no other mechanism. While buffer overflows, and many other flaws, involve the use of some further issue to gain execution, injection problems need only for the data to be parsed.
         

Fix information:
repo_url: https://github.com/cachethq/cachet
commit_details: repo_url: https://github.com/cachethq/cachet
author: James Brooks
author_date: 2023-10-11 11:14:10+01:00
msg: Merge pull request from GHSA-hv79-p62r-wg3p

fix: Auth Remote Code execution
repository: repo_url: https://github.com/cachethq/cachet
repo_name: cachethq/cachet
description: 🚦 The open-source status page system.
repo_language: PHP
owner: cachethq
CVE-2021-31572 (published 2021-04-22T18:15Z)

The kernel in Amazon Web Services FreeRTOS before 10.4.3 has an integer overflow in stream_buffer.c for a stream buffer.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/FreeRTOS/FreeRTOS-Kernel
commit_details: repo_url: https://github.com/FreeRTOS/FreeRTOS-Kernel
author: Cobus van Eeden
author_date: 2020-12-07 11:07:31-08:00
msg: Add addition overflow check for stream buffer (#226)
repository: repo_url: https://github.com/FreeRTOS/FreeRTOS-Kernel
repo_name: FreeRTOS/FreeRTOS-Kernel
description: FreeRTOS kernel files only, submoduled into https://github.com/FreeRTOS/FreeRTOS and various other repos.
repo_language: C
owner: FreeRTOS
file_changes: filename: stream_buffer.c
change_type: ModificationType.MODIFY
diff: @@ -258,8 +258,16 @@ static void prvInitialiseNewStreamBuffer( StreamBuffer_t * const pxStreamBuffer,
          * this is a quirk of the implementation that means otherwise the free
          * space would be reported as one byte smaller than would be logically
          * expected. */
-        xBufferSizeBytes++;
-        pucAllocatedMemory = ( uint8_t * ) pvPortMalloc( xBufferSizeBytes + sizeof( StreamBuffer_t ) ); /*lint !e9079 malloc() only returns void*. */
+        if( xBufferSizeBytes < ( xBufferSizeBytes + 1 + sizeof( StreamBuffer_t ) ) )
+        {
+            xBufferSizeBytes++;
+            pucAllocatedMemory = ( uint8_t * ) pvPortMalloc( xBufferSizeBytes + sizeof( StreamBuffer_t ) ); /*lint !e9079 malloc() only returns void*. */
+        }
+        else
+        {
+            pucAllocatedMemory = NULL;
+        }
+        
 
         if( pucAllocatedMemory != NULL )
         {

programming_language: C
CVE-2016-4796 (published 2017-02-03T16:59Z)

Heap-based buffer overflow in the color_cmyk_to_rgb in common/color.c in OpenJPEG before 2.1.1 allows remote attackers to cause a denial of service (crash) via a crafted .j2k file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/uclouvain/openjpeg
commit_details: repo_url: https://github.com/uclouvain/openjpeg
author: mayeut
author_date: 2016-05-08 19:18:05+02:00
msg: Fix Heap Buffer Overflow in function color_cmyk_to_rgb

Fix uclouvain/openjpeg#774
repository: repo_url: https://github.com/uclouvain/openjpeg
repo_name: uclouvain/openjpeg
description: Official repository of the OpenJPEG project
repo_language: C
owner: uclouvain
file_changes: filename: color.c
change_type: ModificationType.MODIFY
diff: @@ -855,7 +855,14 @@ void color_cmyk_to_rgb(opj_image_t *image)
 	w = image->comps[0].w;
 	h = image->comps[0].h;
 
-	if(image->numcomps < 4) return;
+	if (
+			(image->numcomps < 4)
+		 || (image->comps[0].dx != image->comps[1].dx) || (image->comps[0].dx != image->comps[2].dx) || (image->comps[0].dx != image->comps[3].dx)
+		 || (image->comps[0].dy != image->comps[1].dy) || (image->comps[0].dy != image->comps[2].dy) || (image->comps[0].dy != image->comps[3].dy)
+			) {
+		fprintf(stderr,"%s:%d:color_cmyk_to_rgb\n\tCAN NOT CONVERT\n", __FILE__,__LINE__);
+		return;
+	}
 
 	max = w * h;
 	

programming_language: C
filename: test_suite.ctest.in
change_type: ModificationType.MODIFY
diff: @@ -559,3 +559,5 @@ opj_decompress -i @INPUT_NR_PATH@/basn6a08.jp2 -o @TEMP_PATH@/basn6a08_tif-15.ti
 opj_decompress -i @INPUT_NR_PATH@/issue726.j2k -o @TEMP_PATH@/issue726.png
 # issue 733
 !opj_decompress -i @INPUT_NR_PATH@/issue733.jp2 -o @TEMP_PATH@/issue733.png
+# issue 774
+!opj_decompress -i @INPUT_NR_PATH@/issue774.jp2 -o @TEMP_PATH@/issue774.png

programming_language: Shell
CVE-2020-9365 (published 2020-02-24T16:15Z)

An issue was discovered in Pure-FTPd 1.0.49. An out-of-bounds (OOB) read has been detected in the pure_strcmp function in utils.c.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/jedisct1/pure-ftpd
commit_details: repo_url: https://github.com/jedisct1/pure-ftpd
author: Frank Denis
author_date: 2020-02-24 15:19:43+01:00
msg: pure_strcmp(): len(s2) can be > len(s1)

Reported by Antonio Morales from GitHub Security Labs, thanks!
repository: repo_url: https://github.com/jedisct1/pure-ftpd
repo_name: jedisct1/pure-ftpd
description: Pure FTP server
repo_language: C
owner: jedisct1
file_changes: filename: utils.c
change_type: ModificationType.MODIFY
diff: @@ -45,5 +45,9 @@ int pure_memcmp(const void * const b1_, const void * const b2_, size_t len)
 
 int pure_strcmp(const char * const s1, const char * const s2)
 {
-    return pure_memcmp(s1, s2, strlen(s1) + 1U);
+    const size_t s1_len = strlen(s1);
+    const size_t s2_len = strlen(s2);
+    const size_t len = (s1_len < s2_len) ? s1_len : s2_len;
+
+    return pure_memcmp(s1, s2, len + 1);
 }

programming_language: C
CVE-2018-20546 (published 2018-12-28T16:29Z)

There is an illegal READ memory access at caca/dither.c (function get_rgba_default) in libcaca 0.99.beta19 for the default bpp case.

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 8.1, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/cacalabs/libcaca
commit_details: repo_url: https://github.com/cacalabs/libcaca
author: Sam Hocevar
author_date: 2018-12-30 13:18:27+01:00
msg: dither: fix integer multiplication overflow that caused crashes.

Fixes: #38 (CVE-2018-20546)
Fixes: #39 (CVE-2018-20547)
repository: repo_url: https://github.com/cacalabs/libcaca
repo_name: cacalabs/libcaca
description: 💩 Colour ASCII Art Library
repo_language: C
owner: cacalabs
file_changes: filename: dither.c
change_type: ModificationType.MODIFY
diff: @@ -6,8 +6,8 @@
  *  This library is free software. It comes without any warranty, to
  *  the extent permitted by applicable law. You can redistribute it
  *  and/or modify it under the terms of the Do What the Fuck You Want
- *  to Public License, Version 2, as published by Sam Hocevar. See
- *  http://www.wtfpl.net/ for more details.
+ *  to Public License, Version 2, as published by the WTFPL Task Force.
+ *  See http://www.wtfpl.net/ for more details.
  */
 
 /*
@@ -116,7 +116,7 @@ enum color_mode
 struct caca_dither
 {
     int bpp, has_palette, has_alpha;
-    int w, h, pitch;
+    size_t w, h, pitch;
     int rmask, gmask, bmask, amask;
     int rright, gright, bright, aright;
     int rleft, gleft, bleft, aleft;

programming_language: C