starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2013-0311 (published 2013-02-22T00:55Z)

The translate_desc function in drivers/vhost/vhost.c in the Linux kernel before 3.7 does not properly handle cross-region descriptors, which allows guest OS users to obtain host OS privileges by leveraging KVM guest OS privileges.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:A/AC:H/Au:S/C:C/I:C/A:C)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Michael S. Tsirkin
author_date: 2012-11-26 05:57:27+00:00
msg: vhost: fix length for cross region descriptor

If a single descriptor crosses a region, the
second chunk length should be decremented
by size translated so far, instead it includes
the full descriptor length.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: vhost.c
change_type: ModificationType.MODIFY
diff: @@ -1076,7 +1076,7 @@ static int translate_desc(struct vhost_dev *dev, u64 addr, u32 len,
 		}
 		_iov = iov + ret;
 		size = reg->memory_size - addr + reg->guest_phys_addr;
-		_iov->iov_len = min((u64)len, size);
+		_iov->iov_len = min((u64)len - s, size);
 		_iov->iov_base = (void __user *)(unsigned long)
 			(reg->userspace_addr + addr - reg->guest_phys_addr);
 		s += size;

programming_language: C
CVE-2023-43664 (published 2023-09-28T19:15Z)

PrestaShop is an Open Source e-commerce web application. In the Prestashop Back office interface, an employee can list all modules without any access rights: method `ajaxProcessGetPossibleHookingListForModule` doesn't check access rights. This issue has been addressed in commit `15bd281c` which is included in version 8.1.2. Users are advised to upgrade. There are no known workaround for this issue.

CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-269
cwe_name: Improper Privilege Management
description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/PrestaShop/PrestaShop
commit_details: repo_url: https://github.com/PrestaShop/PrestaShop
author: Jonathan Lelievre
author_date: 2023-09-28 10:34:56+02:00
msg: Merge pull request from GHSA-gvrg-62jp-rf7j

Check user has view access before fetching module hooks
repository: repo_url: https://github.com/PrestaShop/PrestaShop
repo_name: PrestaShop/PrestaShop
description: PrestaShop is the universal open-source software platform to build your e-commerce solution.
repo_language: PHP
owner: PrestaShop
CVE-2020-26250 (published 2020-12-01T21:15Z)

OAuthenticator is an OAuth login mechanism for JupyterHub. In oauthenticator from version 0.12.0 and before 0.12.2, the deprecated (in jupyterhub 1.2) configuration `Authenticator.whitelist`, which should be transparently mapped to `Authenticator.allowed_users` with a warning, is instead ignored by OAuthenticator classes, resulting in the same behavior as if this configuration has not been set. If this is the only mechanism of authorization restriction (i.e. no group or team restrictions in configuration) then all authenticated users will be allowed. Provider-based restrictions, including deprecated values such as `GitHubOAuthenticator.org_whitelist` are **not** affected. All users of OAuthenticator 0.12.0 and 0.12.1 with JupyterHub 1.2 (JupyterHub Helm chart 0.10.0-0.10.5) who use the `admin.whitelist.users` configuration in the jupyterhub helm chart or the `c.Authenticator.whitelist` configuration directly. Users of other deprecated configuration, e.g. `c.GitHubOAuthenticator.team_whitelist` are **not** affected. If you see a log line like this and expect a specific list of allowed usernames: "[I 2020-11-27 16:51:54.528 JupyterHub app:1717] Not using allowed_users. Any authenticated user will be allowed." you are likely affected. Updating oauthenticator to 0.12.2 is recommended. A workaround is to replace the deprecated `c.Authenticator.whitelist = ...` with `c.Authenticator.allowed_users = ...`. If any users have been authorized during this time who should not have been, they must be deleted via the API or admin interface, per the referenced documentation.

Severity: LOW
CVSS v2 base score: 3.5 (AV:N/AC:M/Au:S/C:P/I:N/A:N)
CVSS v3 base score: 6.3, MEDIUM (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-863
cwe_name: Incorrect Authorization
description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are incorrectly applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/jupyterhub/oauthenticator
commit_details: repo_url: https://github.com/jupyterhub/oauthenticator
author: Min RK
author_date: 2020-11-30 12:35:25+01:00
msg: Merge pull request from GHSA-384w-5v3f-q499

fix conflict with deprecations in jupyterhub 1.2
repository: repo_url: https://github.com/jupyterhub/oauthenticator
repo_name: jupyterhub/oauthenticator
description: OAuth + JupyterHub Authenticator = OAuthenticator
repo_language: Python
owner: jupyterhub
CVE-2018-14682 (published 2018-07-28T23:29Z)

An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the TOLOWER() macro for CHM decompression.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-193
cwe_name: Off-by-one Error
description: A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/kyz/libmspack
commit_details: repo_url: https://github.com/kyz/libmspack
author: Stuart Caie
author_date: 2018-02-06 23:17:30+00:00
msg: Fix off-by-one error in chmd TOLOWER() fallback
repository: repo_url: https://github.com/kyz/libmspack
repo_name: kyz/libmspack
description: A library for some loosely related Microsoft compression formats, CAB, CHM, HLP, LIT, KWAJ and SZDD.
repo_language: C
owner: kyz
file_changes: filename: ChangeLog
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,8 @@
+2018-02-06  Stuart Caie <kyzer@cabextract.org.uk>
+
+	* chmd.c: fixed an off-by-one error in the TOLOWER() macro, reported
+	by Dmitry Glavatskikh. Thanks Dmitry!
+
 2017-11-26  Stuart Caie <kyzer@cabextract.org.uk>
 
 	* kwajd_read_headers(): fix up the logic of reading the filename and

programming_language: Markdown
filename: chmd.c
change_type: ModificationType.MODIFY
diff: @@ -831,7 +831,7 @@ static int search_chunk(struct mschmd_header *chm,
 # endif
 # define TOLOWER(x) tolower(x)
 #else
-# define TOLOWER(x) (((x)<0||(x)>256)?(x):mspack_tolower_map[(x)])
+# define TOLOWER(x) (((x)<0||(x)>255)?(x):mspack_tolower_map[(x)])
 /* Map of char -> lowercase char for the first 256 chars. Generated with:
  * LC_CTYPE=en_GB.utf-8 perl -Mlocale -le 'print map{ord(lc chr).","} 0..255'
  */

programming_language: C
CVE-2021-3632 (published 2022-08-26T16:15Z)

A flaw was found in Keycloak. This vulnerability allows anyone to register a new security device or key when there is not a device already registered for any user by using the WebAuthn password-less login flow.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/keycloak/keycloak
commit_details: repo_url: https://github.com/keycloak/keycloak
author: Florian Ritterhoff
author_date: 2021-06-12 18:30:27+02:00
msg: Prevent security flaw using passwordless authentication

If you register without an password or delete your last token your account can be hijacked. This is can be done by simply trying to login in that moment where the account is without a token. You get the "normal" registration dialog and can capture the complete account.
repository: repo_url: https://github.com/keycloak/keycloak
repo_name: keycloak/keycloak
description: Open Source Identity and Access Management For Modern Applications and Services
repo_language: Java
owner: keycloak
file_changes: filename: WebAuthnPasswordlessAuthenticatorFactory.java
change_type: ModificationType.MODIFY
diff: @@ -53,4 +53,10 @@ public class WebAuthnPasswordlessAuthenticatorFactory extends WebAuthnAuthentica
     public String getId() {
         return PROVIDER_ID;
     }
+
+    @Override
+    public boolean isUserSetupAllowed() {
+        return false;
+    }
+
 }

programming_language: Java
CVE-2023-2315 (published 2023-09-27T15:18Z)

Path Traversal in OpenCart versions 4.0.0.0 to 4.0.2.2 allows an authenticated user with access/modify privilege on the Log component to empty out arbitrary files on the server

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/opencart/opencart
commit_details: repo_url: https://github.com/opencart/opencart
author: Daniel Kerr
author_date: 2023-09-16 03:49:45+08:00
msg: Update log.php
repository: repo_url: https://github.com/opencart/opencart
repo_name: opencart/opencart
description: A free shopping cart system. OpenCart is an open source PHP-based online e-commerce solution.
repo_language: PHP
owner: opencart
file_changes: filename: log.php
change_type: ModificationType.MODIFY
diff: @@ -104,7 +104,7 @@ class Log extends \Opencart\System\Engine\Controller {
 		$this->load->language('tool/log');
 
 		if (isset($this->request->get['filename'])) {
-			$filename = (string)basename($this->request->get['filename']);
+			$filename = (string)basename(html_entity_decode($this->request->get['filename'], ENT_QUOTES, 'UTF-8'));
 		} else {
 			$filename = '';
 		}
@@ -140,7 +140,7 @@ class Log extends \Opencart\System\Engine\Controller {
 		$this->load->language('tool/log');
 
 		if (isset($this->request->get['filename'])) {
-			$filename = (string)$this->request->get['filename'];
+			$filename = (string)basename(html_entity_decode($this->request->get['filename'], ENT_QUOTES, 'UTF-8'));
 		} else {
 			$filename = '';
 		}

programming_language: PHP
CVE-2023-38497 (published 2023-08-04T16:15Z)

Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local user, another local user could exploit this to change the source code compiled and executed by the current user. To prevent existing cached extractions from being exploitable, the Cargo binary version 0.72.2 included in Rust 1.71.1 or later will purge caches generated by older Cargo versions automatically. As a workaround, configure one's system to prevent other local users from accessing the Cargo directory, usually located in `~/.cargo`.

CVSS v3 base score: 7.3, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-278
cwe_name: Insecure Preserved Inherited Permissions
description: A product inherits a set of insecure permissions for an object, e.g. when copying from an archive file, without user awareness or involvement.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/rust-lang/cargo
commit_details: repo_url: https://github.com/rust-lang/cargo
author: bors
author_date: 2023-08-03 12:58:25+00:00
msg: Auto merge of #12443 - pietroalbini:pa-cve-2023-38497-nightly, r=weihanglo

Fix CVE-2023-38497 for master

Changes have been made by `@weihanglo` and reviewed by `@ehuss` in a private repository.
repository: repo_url: https://github.com/rust-lang/cargo
repo_name: rust-lang/cargo
description: The Rust package manager
repo_language: Rust
owner: rust-lang
CVE-2024-34082 (published 2024-05-15T17:15Z)

Grav is a file-based Web platform. Prior to version 1.7.46, a low privilege user account with page edit privilege can read any server files using Twig Syntax. This includes Grav user account files - `/grav/user/accounts/*.yaml`. This file stores hashed user password, 2FA secret, and the password reset token. This can allow an adversary to compromise any registered account and read any file in the web server by resetting a password for a user to get access to the password reset token from the file or by cracking the hashed password. A low privileged user may also perform a full account takeover of other registered users including Administrators. Version 1.7.46 contains a patch.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/getgrav/grav
commit_details: repo_url: https://github.com/getgrav/grav
author: Andy Miller
author_date: 2024-05-06 12:48:45+01:00
msg: fixes #GHSA-f8v5-jmfh-pr69
repository: repo_url: https://github.com/getgrav/grav
repo_name: getgrav/grav
description: Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS powered by PHP, Markdown, Twig, and Symfony
repo_language: PHP
owner: getgrav
file_changes: filename: Security.php
change_type: ModificationType.MODIFY
diff: @@ -225,7 +225,7 @@ class Security
         // Set the patterns we'll test against
         $patterns = [
             // Match any attribute starting with "on" or xmlns
-            'on_events' => '#(<[^>]+[[a-z\x00-\x20\"\'\/])([\s\/]on|\sxmlns)[a-z].*=>?#iUu',
+            'on_events' => '#(<[^>]+[a-z\x00-\x20\"\'\/])(on[a-z]+|xmlns)\s*=[\s|\'\"].*[\s|\'\"]>#iUu',
 
             // Match javascript:, livescript:, vbscript:, mocha:, feed: and data: protocols
             'invalid_protocols' => '#(' . implode('|', array_map('preg_quote', $invalid_protocols, ['#'])) . ')(:|\&\#58)\S.*?#iUu',
@@ -279,6 +279,7 @@ class Security
             'twig.getFunction',
             'core.setEscaper',
             'twig.safe_functions',
+            'read_file',
         ];
         $string = preg_replace('/(({{\s*|{%\s*)[^}]*?(' . implode('|', $bad_twig) . ')[^}]*?(\s*}}|\s*%}))/i', '{# $1 #}', $string);
         return $string;

programming_language: PHP
CVE-2023-31137 (published 2023-05-09T14:15Z)

MaraDNS is open-source software that implements the Domain Name System (DNS). In version 3.5.0024 and prior, a remotely exploitable integer underflow vulnerability in the DNS packet decompression function allows an attacker to cause a Denial of Service by triggering an abnormal program termination.\n\nThe vulnerability exists in the `decomp_get_rddata` function within the `Decompress.c` file. When handling a DNS packet with an Answer RR of qtype 16 (TXT record) and any qclass, if the `rdlength` is smaller than `rdata`, the result of the line `Decompress.c:886` is a negative number `len = rdlength - total;`. This value is then passed to the `decomp_append_bytes` function without proper validation, causing the program to attempt to allocate a massive chunk of memory that is impossible to allocate. Consequently, the program exits with an error code of 64, causing a Denial of Service.\n\nOne proposed fix for this vulnerability is to patch `Decompress.c:887` by breaking `if(len <= 0)`, which has been incorporated in version 3.5.0036 via commit bab062bde40b2ae8a91eecd522e84d8b993bab58.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-191
cwe_name: Integer Underflow (Wrap or Wraparound)
description: The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
extended_description: This can happen in signed and unsigned cases.
         

Fix information:
repo_url: https://github.com/samboy/MaraDNS
commit_details: repo_url: https://github.com/samboy/MaraDNS
author: Sam Trenholme
author_date: 2023-05-02 16:35:04-07:00
msg: Fix long standing issue in this code from 2002
repository: repo_url: https://github.com/samboy/MaraDNS
repo_name: samboy/MaraDNS
description: MaraDNS: A small open-source DNS server
repo_language: C
owner: samboy
file_changes: filename: Decompress.c
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,4 @@
-/* Copyright (c) 2002-2006 Sam Trenholme
+/* Copyright (c) 2002-2023 Sam Trenholme
  *
  * TERMS
  *
@@ -884,7 +884,7 @@ int decomp_get_rddata(js_string *compressed, js_string *out,
             /* Variable length data (length determined by rdlength) */
             else if(subtype == RRSUB_VARIABLE) {
                 len = rdlength - total;
-                if(len == 0) {
+                if(len <= 0) {
                     break;
                     }
                 if(decomp_append_bytes(compressed,out,

programming_language: C
CVE-2021-32845 (published 2023-02-17T23:15Z)

HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, the implementation of `qnotify` at `pci_vtrnd_notify` fails to check the return value of `vq_getchain`. This leads to `struct iovec iov;` being uninitialized and used to read memory in `len = (int) read(sc->vrsc_fd, iov.iov_base, iov.iov_len);` when an attacker is able to make `vq_getchain` fail. This issue may lead to a guest crashing the host causing a denial of service and, under certain circumstance, memory corruption. This issue is fixed in commit 41272a980197917df8e58ff90642d14dec8fe948.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-252
cwe_name: Unchecked Return Value
description: The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
extended_description: Two common programmer assumptions are "this function call can never fail" and "it doesn't matter if this function call fails". If an attacker can force the function to fail or otherwise return a value that is not expected, then the subsequent program logic could lead to a vulnerability, because the product is not in a state that the programmer assumes. For example, if the program calls a function to drop privileges but does not check the return code to ensure that privileges were successfully dropped, then the program will continue to operate with the higher privileges.
         

Fix information:
repo_url: https://github.com/moby/hyperkit
commit_details: repo_url: https://github.com/moby/hyperkit
author: Frederic Dalleau
author_date: 2021-06-02 12:02:47+02:00
msg: Fix vtrnd pci_vtrnd_notify uninitialized memory use (GHSL-2021-056)

Signed-off-by: Frederic Dalleau <frederic.dalleau@docker.com>
repository: repo_url: https://github.com/moby/hyperkit
repo_name: moby/hyperkit
description: A toolkit for embedding hypervisor capabilities in your application
repo_language: C
owner: moby
file_changes: filename: pci_virtio_rnd.c
change_type: ModificationType.MODIFY
diff: @@ -100,7 +100,7 @@ pci_vtrnd_notify(void *vsc, struct vqueue_info *vq)
 {
 	struct iovec iov;
 	struct pci_vtrnd_softc *sc;
-	int len;
+	int len, n;
 	uint16_t idx;
 
 	sc = vsc;
@@ -111,7 +111,11 @@ pci_vtrnd_notify(void *vsc, struct vqueue_info *vq)
 	}
 
 	while (vq_has_descs(vq)) {
-		vq_getchain(vq, &idx, &iov, 1, NULL);
+		n = vq_getchain(vq, &idx, &iov, 1, NULL);
+		if (n < 0) {
+			fprintf(stderr, "vtrnd: vtrnd_notify(): n %d\r\n", n);
+			return;
+		}
 
 		len = (int) read(sc->vrsc_fd, iov.iov_base, iov.iov_len);
 

programming_language: C