starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2022-3278 (published 2022-09-23T22:15Z)

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0552.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Bram Moolenaar
author_date: 2022-09-22 21:35:19+01:00
msg: patch 9.0.0552: crash when using NUL in buffer that uses :source

Problem:    Crash when using NUL in buffer that uses :source.
Solution:   Don't get a next line when skipping over NL.
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: eval.c
change_type: ModificationType.MODIFY
diff: @@ -253,7 +253,7 @@ eval_expr_typval(typval_T *expr, typval_T *argv, int argc, typval_T *rettv)
 	    if (fc == NULL)
 		return FAIL;
 
-	    // Shortcut to call a compiled function without overhead.
+	    // Shortcut to call a compiled function with minimal overhead.
 	    r = call_def_function(partial->pt_func, argc, argv,
 					  DEF_USE_PT_ARGV, partial, fc, rettv);
 	    remove_funccal();
@@ -2291,7 +2291,7 @@ eval_next_non_blank(char_u *arg, evalarg_T *evalarg, int *getnext)
 
 	if (next != NULL)
 	{
-	    *getnext = TRUE;
+	    *getnext = *p != NL;
 	    return skipwhite(next);
 	}
     }

programming_language: C
filename: test_source.vim
change_type: ModificationType.MODIFY
diff: @@ -665,5 +665,22 @@ func Test_source_buffer_long_line()
   call delete('Xtest.vim')
 endfunc
 
+func Test_source_buffer_with_NUL_char()
+  " This was trying to use a line below the buffer.
+  let lines =<< trim END
+      if !exists('g:loaded')
+        let g:loaded = 1
+        source
+      endif
+  END
+  " Can't have a NL in heredoc
+  let lines += ["silent! vim9 echo [0 \<NL> ? 'a' : 'b']"]
+  call writefile(lines, 'XsourceNul', '')
+  edit XsourceNul
+  source
+
+  bwipe!
+endfunc
+
 
 " vim: shiftwidth=2 sts=2 expandtab

programming_language: Lua
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -699,6 +699,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    552,
 /**/
     551,
 /**/

programming_language: Ruby
CVE-2023-3069 (published 2023-06-02T17:15Z)

Unverified Password Change in GitHub repository tsolucio/corebos prior to 8.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/tsolucio/corebos
commit_details: repo_url: https://github.com/tsolucio/corebos
author: joebordes
author_date: 2023-06-02 17:06:43+02:00
msg: sec(Users) repeat password checks in backend before update
repository: repo_url: https://github.com/tsolucio/corebos
repo_name: tsolucio/corebos
description: core Business Operating System. An OPEN SOURCE business application that helps small and medium business handle all the day to day tasks.
repo_language: PHP
owner: tsolucio
file_changes: filename: ExecuteFunctions.php
change_type: ModificationType.MODIFY
diff: @@ -621,20 +621,14 @@ switch ($functiontocall) {
 		Vtiger_Request::validateRequest();
 		require_once 'modules/Users/Users.php';
 		require_once 'include/utils/UserInfoUtil.php';
+		require_once 'include/Webservices/ChangePassword.php';
 		$userid = vtlib_purify($_REQUEST['record']);
-		if (is_admin($current_user) || $current_user->id==$userid) {
-			$focus = new Users();
-			$focus->mode='edit';
-			$focus->id = $userid;
-			$focus->retrieve_entity_info($userid, 'Users');
-			$ret = $focus->change_password('old_password', vtlib_purify(substr($_REQUEST['new_password'], 0, 1024)));
-			if ($ret) {
-				$ret = array('password'=>$ret);
-			} else {
-				$ret = array('password'=>false, 'msg' => $focus->error_string);
-			}
-		} else {
-			$ret = array('password'=>false, 'msg' => $focus->error_string);
+		try {
+			$npass = vtlib_purify($_REQUEST['new_password']);
+			vtws_changePassword(vtlib_purify($_REQUEST['record']), 'nocheck_old_password', $npass, $npass, $current_user);
+			$ret = array('password'=>true);
+		} catch (\Throwable $th) {
+			$ret = array('password'=>false, 'msg' => $th->getMessage());
 		}
 		break;
 	case 'ismoduleactive':

programming_language: PHP
CVE-2023-5344 (published 2023-10-02T20:15Z)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1969.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-122
cwe_name: Heap-based Buffer Overflow
description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Christian Brabandt
author_date: 2023-10-02 20:59:08+02:00
msg: patch 9.0.1969: [security] buffer-overflow in trunc_string()

Problem:  buffer-overflow in trunc_string()
Solution: Add NULL at end of buffer

Currently trunc_string() assumes that when the string is too long,
buf[e-1] will always be writeable. But that assumption may not always be
true. The condition currently looks like this

    else if (e + 3 < buflen)
    [...]
    else
    {
	// can't fit in the "...", just truncate it
	buf[e - 1] = NUL;
    }

but this means, we may run into the last else clause with e still being
larger than buflen. So a buffer overflow occurs.

So instead of using `buf[e - 1]`, let's just always
truncate at `buf[buflen - 1]` which should always be writable.

Signed-off-by: Christian Brabandt <cb@256bit.org>
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: message.c
change_type: ModificationType.MODIFY
diff: @@ -353,7 +353,7 @@ trunc_string(
     else
     {
 	// can't fit in the "...", just truncate it
-	buf[e - 1] = NUL;
+	buf[buflen - 1] = NUL;
     }
 }
 

programming_language: C
filename: test_crash.vim
change_type: ModificationType.MODIFY
diff: @@ -66,6 +66,12 @@ func Test_crash1()
     \ '  && echo "crash 7: [OK]" >> X_crash1_result.txt' .. "\<cr>")
   call TermWait(buf, 3000)
 
+  let file = 'crash/vim_msg_trunc_poc'
+  let args = printf(cmn_args, vim, file)
+  call term_sendkeys(buf, args ..
+    \ '  || echo "crash 8: [OK]" >> X_crash1_result.txt' .. "\<cr>")
+  call TermWait(buf, 3000)
+
   " clean up
   exe buf .. "bw!"
 
@@ -79,6 +85,7 @@ func Test_crash1()
       \ 'crash 5: [OK]',
       \ 'crash 6: [OK]',
       \ 'crash 7: [OK]',
+      \ 'crash 8: [OK]',
       \ ]
 
   call assert_equal(expected, getline(1, '$'))

programming_language: Shell
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -704,6 +704,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1969,
 /**/
     1968,
 /**/

programming_language: Ruby
CVE-2016-7126 (published 2016-09-12T01:59Z)

The imagetruecolortopalette function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate the number of colors, which allows remote attackers to cause a denial of service (select_colors allocation error and out-of-bounds write) or possibly have unspecified other impact via a large value in the third argument.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/php/php-src
commit_details: repo_url: https://github.com/php/php-src
author: Anatol Belski
author_date: 2016-08-16 14:37:39+02:00
msg: Fix bug#72697 - select_colors write out-of-bounds

(cherry picked from commit b6f13a5ef9d6280cf984826a5de012a32c396cd4)

Conflicts:
	ext/gd/gd.c
repository: repo_url: https://github.com/php/php-src
repo_name: php/php-src
description: The PHP Interpreter
repo_language: C
owner: php
file_changes: filename: gd.c
change_type: ModificationType.MODIFY
diff: @@ -1537,11 +1537,11 @@ PHP_FUNCTION(imagetruecolortopalette)
 		RETURN_FALSE;
 	}
 
-	if (ncolors <= 0) {
-		php_error_docref(NULL, E_WARNING, "Number of colors has to be greater than zero");
+	if (ncolors <= 0 || ZEND_LONG_INT_OVFL(ncolors)) {
+		php_error_docref(NULL, E_WARNING, "Number of colors has to be greater than zero and no more than %d", INT_MAX);
 		RETURN_FALSE;
 	}
-	gdImageTrueColorToPalette(im, dither, ncolors);
+	gdImageTrueColorToPalette(im, dither, (int)ncolors);
 
 	RETURN_TRUE;
 }

programming_language: Shell
filename: bug72697.phpt
change_type: ModificationType.ADD
diff: @@ -0,0 +1,17 @@
+--TEST--
+Bug #72697: select_colors write out-of-bounds
+--SKIPIF--
+<?php 
+if (!function_exists("imagecreatetruecolor")) die("skip");
+if (PHP_INT_MAX !== 9223372036854775807) die("skip for 64-bit long systems only");
+?>
+--FILE--
+<?php
+
+$img=imagecreatetruecolor(10, 10);
+imagetruecolortopalette($img, false, PHP_INT_MAX / 8);
+?>
+DONE
+--EXPECTF--
+Warning: imagetruecolortopalette(): Number of colors has to be greater than zero and no more than 2147483647 in %sbug72697.php on line %d
+DONE
\ No newline at end of file

programming_language: PHP
CVE-2021-30199 (published 2021-04-19T20:15Z)

In filters/reframe_latm.c in GPAC 1.0.1 there is a Null Pointer Dereference, when gf_filter_pck_get_data is called. The first arg pck may be null with a crafted mp4 file,which results in a crash.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2021-04-08 09:29:42+02:00
msg: fixed #1728
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: reframe_latm.c
change_type: ModificationType.MODIFY
diff: @@ -448,8 +448,8 @@ GF_Err latm_dmx_process(GF_Filter *filter)
 	GF_LATMDmxCtx *ctx = gf_filter_get_udta(filter);
 	GF_FilterPacket *pck, *dst_pck;
 	u32 pos;
-	u8 *data, *output;
-	u32 pck_size, prev_pck_size;
+	u8 *data=NULL, *output;
+	u32 pck_size=0, prev_pck_size;
 	u64 cts = GF_FILTER_NO_TS;
 
 	if (ctx->in_error)
@@ -475,10 +475,10 @@ GF_Err latm_dmx_process(GF_Filter *filter)
 		} else {
 			return GF_OK;
 		}
+	} else {
+		data = (char *) gf_filter_pck_get_data(pck, &pck_size);
 	}
 
-	data = (char *) gf_filter_pck_get_data(pck, &pck_size);
-
 	//input pid sets some timescale - we flushed pending data , update cts
 	if (ctx->timescale && pck) {
 		cts = gf_filter_pck_get_cts(pck);

programming_language: C
CVE-2021-29555 (published 2021-05-14T20:15Z)

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service via a FPE runtime error in `tf.raw_ops.FusedBatchNorm`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/828f346274841fa7505f7020e88ca36c22e557ab/tensorflow/core/kernels/fused_batch_norm_op.cc#L295-L297) performs a division based on the last dimension of the `x` tensor. Since this is controlled by the user, an attacker can trigger a denial of service. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-369
cwe_name: Divide By Zero
description: The product divides a value by zero.
extended_description: This weakness typically occurs when an unexpected value is provided to the product, or if an error occurs that is not properly detected. It frequently occurs in calculations involving physical dimensions such as size, length, width, and height.
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Amit Patankar
author_date: 2021-04-28 11:30:28-07:00
msg: Fix FPE issue with `tf.raw_ops.FusedBatchNorm`.

PiperOrigin-RevId: 370948185
Change-Id: If0c8e0320062ed6363e94ff5fe38e6a301f69ac2
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: fused_batch_norm_op.cc
change_type: ModificationType.MODIFY
diff: @@ -293,6 +293,9 @@ struct FusedBatchNorm<CPUDevice, T, U, /* is_training= */ false> {
     const CPUDevice& d = context->eigen_device<CPUDevice>();
 
     const int depth = x.dimension(3);
+    OP_REQUIRES(
+        context, depth != 0,
+        errors::Internal("The 4th element in the input shape cannot be 0."));
     const int size = x.size();
     const int rest_size = size / depth;
     Eigen::DSizes<Eigen::Index, 2> rest_by_depth(rest_size, depth);

programming_language: C++
CVE-2014-9096 (published 2014-11-26T15:59Z)

Multiple SQL injection vulnerabilities in recover.php in Pligg CMS 2.0.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id or (2) n parameter.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/Pligg/pligg-cms
commit_details: repo_url: https://github.com/Pligg/pligg-cms
author: yankidank
author_date: 2014-07-30 09:15:22-07:00
msg: - Security fix applied to address a vulnerability
repository: repo_url: https://github.com/Pligg/pligg-cms
repo_name: Kliqqi-CMS/Kliqqi-CMS
description: Kliqqi formerly known as Pligg CMS -  New version available at Kliqqi.com
repo_language: PHP
owner: Pligg
file_changes: filename: recover.php
change_type: ModificationType.MODIFY
diff: @@ -26,8 +26,8 @@ if($my_pligg_base){
 	if (strpos($_POST['return'],$my_pligg_base)!==0) $_POST['return']=$my_pligg_base . '/';
 }
 
-$id=$_REQUEST['id'];
-$n=$_REQUEST['n'];
+$id=sanitize($_REQUEST['id'], 3);
+$n=sanitize($_REQUEST['n'], 3);
 $username=base64_decode($id);
 $sql="SELECT * FROM `" . table_users . "` where `user_login` = '".$username."' AND `last_reset_request` = FROM_UNIXTIME('".$n."') AND user_level!='Spammer'";
 		

programming_language: PHP
repo_url: https://github.com/Pligg/pligg-cms
commit_details: repo_url: https://github.com/Pligg/pligg-cms
author: yankidank
author_date: 2014-08-12 09:25:26-07:00
msg: - Added another layer of sanitization to the recover password page, as recommended by Dominik
repository: repo_url: https://github.com/Pligg/pligg-cms
repo_name: Kliqqi-CMS/Kliqqi-CMS
description: Kliqqi formerly known as Pligg CMS -  New version available at Kliqqi.com
repo_language: PHP
owner: Pligg
file_changes: filename: recover.php
change_type: ModificationType.MODIFY
diff: @@ -28,7 +28,9 @@ if($my_pligg_base){
 
 $id=sanitize($_REQUEST['id'], 3);
 $n=sanitize($_REQUEST['n'], 3);
-$username=base64_decode($id);
+$idTemp=base64_decode($id);
+$username=sanitize($idTemp ,3);
+
 $sql="SELECT * FROM `" . table_users . "` where `user_login` = '".$username."' AND `last_reset_request` = FROM_UNIXTIME('".$n."') AND user_level!='Spammer'";
 		
 $user = $db->get_row($sql);

programming_language: PHP
CVE-2021-40812 (published 2021-09-08T21:15Z)

The GD Graphics Library (aka LibGD) through 2.3.2 has an out-of-bounds read because of the lack of certain gdGetBuf and gdPutBuf return value checks.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/libgd/libgd
commit_details: repo_url: https://github.com/libgd/libgd
author: Pierre Joye
author_date: 2021-09-08 10:08:12+07:00
msg: Merge pull request #755 from libgd/bug/750

Partial fix for #750, BMP and WebP. Gif's usage of PutBuf needs too much refactoring for the actual gain here."
repository: repo_url: https://github.com/libgd/libgd
repo_name: libgd/libgd
description: GD Graphics Library
repo_language: C
owner: libgd
CVE-2015-10016 (published 2023-01-06T10:15Z)

A vulnerability, which was classified as critical, has been found in jeff-kelley opensim-utils. Affected by this issue is the function DatabaseForRegion of the file regionscrits.php. The manipulation of the argument region leads to sql injection. The patch is identified as c29e5c729a833a29dbf5b1e505a0553fe154575e. It is recommended to apply a patch to fix this issue. VDB-217550 is the identifier assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/jeff-kelley/opensim-utils
commit_details: repo_url: https://github.com/jeff-kelley/opensim-utils
author: jeff-kelley
author_date: 2015-12-14 18:37:02+01:00
msg: sql injection prevention
repository: repo_url: https://github.com/jeff-kelley/opensim-utils
repo_name: jeff-kelley/opensim-utils
repo_language: PHP
owner: jeff-kelley
file_changes: filename: regionscrits.php
change_type: ModificationType.MODIFY
diff: @@ -70,6 +70,7 @@
 	// Get region name from query string
 	$region = urldecode ($_SERVER['QUERY_STRING']);
 	if ($region=='') die ("You must specify a region");
+	$region = mysql_real_escape_string($region);
 
 	// Get region data
 	$query  = "SELECT * FROM $robustDB.regions WHERE regionName='$region';";

programming_language: PHP
CVE-2021-33364 (published 2021-09-13T19:15Z)

Memory leak in the def_parent_box_new function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-401
cwe_name: Missing Release of Memory after Effective Lifetime
description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
extended_description: This is often triggered by improper handling of malformed data or unexpectedly interrupted sessions.  In some languages, developers are responsible for tracking memory allocation and releasing the memory.  If there are no more pointers or references to the memory, then it can no longer be tracked and identified for release.
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2021-05-10 11:18:59+02:00
msg: fixed #1783 (fuzz)
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: isom_intern.c
change_type: ModificationType.MODIFY
diff: @@ -497,6 +497,7 @@ static GF_Err gf_isom_parse_movie_boxes_internal(GF_ISOFile *mov, u32 *boxType,
 					if (pos<0) pos=0;
 					gf_list_insert(mov->TopBoxes, brand, pos);
 				}
+				gf_isom_box_del(a);
 			}
 			break;
 

programming_language: C
CVE-2024-30564 (published 2024-04-18T15:15Z)

An issue inandrei-tatar nora-firebase-common between v.1.0.41 and v.1.12.2 allows a remote attacker to execute arbitrary code via a crafted script to the updateState parameter of the updateStateInternal method.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/andrei-tatar/nora-firebase-common
commit_details: repo_url: https://github.com/andrei-tatar/nora-firebase-common
author: Andrei Tatar
author_date: 2024-03-19 06:57:29+02:00
msg: simple fix for prototype pollution
repository: repo_url: https://github.com/andrei-tatar/nora-firebase-common
repo_name: andrei-tatar/nora-firebase-common
repo_language: TypeScript
owner: andrei-tatar
file_changes: filename: update-state.test.ts
change_type: ModificationType.MODIFY
diff: @@ -222,5 +222,14 @@ describe('updateState', () => {
             }],
         });
     });
+
+    it('should not update via prototype props', () => {
+        var BAD_JSON = JSON.parse('{"__proto__":{"polluted":true}}')
+
+        const { hasChanges } = updateState(BAD_JSON, {})
+
+        expect(hasChanges).to.be.false;
+        expect((Object.prototype as any).polluted).to.be.undefined;
+    });
 });
 

programming_language: TypeScript
filename: update-state.ts
change_type: ModificationType.MODIFY
diff: @@ -16,6 +16,9 @@ const arrayItemKeyMap = new Map<string, string>([
     ['currentSensorStateData', 'name'],
 ]);
 
+// https://github.com/andrei-tatar/nora-firebase-common/issues/9
+const ignoreKeys: any[] = ['__proto__', 'constructor', 'prototype'];
+
 function updateArrayState(update: any[], state: any[], path = ''): boolean {
     let hasChanges = false;
 
@@ -51,6 +54,8 @@ function updateStateInternal(update: any, state: any, path = ''): boolean {
 
     let hasChanges = false;
     for (const [key, newValue] of entries(update)) {
+        if (ignoreKeys.includes(key)) { continue; }
+
         const oldValue = state[key];
         const newType = typeof newValue;
         const oldType = typeof oldValue;

programming_language: TypeScript