starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2019-11930 (published 2019-12-04T17:16Z)

An invalid free in mb_detect_order can cause the application to crash or potentially result in remote code execution. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-763
cwe_name: Release of Invalid Pointer or Reference
description: The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.
extended_description: 
            This weakness can take several forms, such as:
               
                  The memory was allocated, explicitly or implicitly, via one memory management method and deallocated using a different, non-compatible function (CWE-762).
                  The function calls or memory management routines chosen are appropriate, however they are used incorrectly, such as in CWE-761.
               
         
         

Fix information:
repo_url: https://github.com/facebook/hhvm
commit_details: repo_url: https://github.com/facebook/hhvm
author: Dhaval Kapil
author_date: 2019-10-28 23:06:25-07:00
msg: ext_mbstring: Fix invalid free() in php_mb_parse_encoding

Summary:
A chunk of memory allocated by 'req::calloc_noptrs' was being freed by 'free'. The former internally calls 'calloc' and returns a pointer at an index sizeof(MallocNode) inside the allocated buffer. This led to freeing invalid memory.

CVE-2019-11930

Reviewed By: jjergus

Differential Revision: D18179908

fbshipit-source-id: 0e3fe77628e0b9dee8361e712b8abac59ae5ed22
repository: repo_url: https://github.com/facebook/hhvm
repo_name: facebook/hhvm
description: A virtual machine for executing programs written in Hack.
repo_language: Hack
owner: facebook
file_changes: filename: ext_mbstring.cpp
change_type: ModificationType.MODIFY
diff: @@ -908,7 +908,7 @@ static bool php_mb_parse_encoding(const Variant& encoding,
   }
   if (!ret) {
     if (return_list && *return_list) {
-      free(*return_list);
+      req::free(*return_list);
       *return_list = nullptr;
     }
     return_size = 0;

programming_language: C++
filename: mb_detect_order_t54638796.php
change_type: ModificationType.ADD
diff: @@ -0,0 +1,7 @@
+<?hh
+// Copyright 2004-present Facebook. All Rights Reserved.
+
+<<__EntryPoint>>
+function main() {
+  var_dump(mb_detect_order("UTF-8,\x2c"));
+}

programming_language: None
filename: mb_detect_order_t54638796.php.expect
change_type: ModificationType.ADD
diff: @@ -0,0 +1 @@
+bool(false)

programming_language: SQL
CVE-2022-47520 (published 2022-12-18T06:15Z)

An issue was discovered in the Linux kernel before 6.0.11. Missing offset validation in drivers/net/wireless/microchip/wilc1000/hif.c in the WILC1000 wireless driver can trigger an out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet.

CVSS v3 base score: 7.1, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Phil Turnbull
author_date: 2022-11-23 10:35:40-05:00
msg: wifi: wilc1000: validate pairwise and authentication suite offsets

There is no validation of 'offset' which can trigger an out-of-bounds
read when extracting RSN capabilities.

Signed-off-by: Phil Turnbull <philipturnbull@github.com>
Tested-by: Ajay Kathat <ajay.kathat@microchip.com>
Acked-by: Ajay Kathat <ajay.kathat@microchip.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20221123153543.8568-2-philipturnbull@github.com
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: hif.c
change_type: ModificationType.MODIFY
diff: @@ -482,14 +482,25 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss,
 
 	rsn_ie = cfg80211_find_ie(WLAN_EID_RSN, ies->data, ies->len);
 	if (rsn_ie) {
+		int rsn_ie_len = sizeof(struct element) + rsn_ie[1];
 		int offset = 8;
 
-		param->mode_802_11i = 2;
-		param->rsn_found = true;
 		/* extract RSN capabilities */
-		offset += (rsn_ie[offset] * 4) + 2;
-		offset += (rsn_ie[offset] * 4) + 2;
-		memcpy(param->rsn_cap, &rsn_ie[offset], 2);
+		if (offset < rsn_ie_len) {
+			/* skip over pairwise suites */
+			offset += (rsn_ie[offset] * 4) + 2;
+
+			if (offset < rsn_ie_len) {
+				/* skip over authentication suites */
+				offset += (rsn_ie[offset] * 4) + 2;
+
+				if (offset + 1 < rsn_ie_len) {
+					param->mode_802_11i = 2;
+					param->rsn_found = true;
+					memcpy(param->rsn_cap, &rsn_ie[offset], 2);
+				}
+			}
+		}
 	}
 
 	if (param->rsn_found) {

programming_language: C
CVE-2022-21667 (published 2022-01-10T14:12Z)

soketi is an open-source WebSockets server. There is an unhandled case when reading POST requests which results in the server crashing if it could not read the body of a request. In the event that a POST request is sent to any endpoint of the server with an empty body, even unauthenticated with the Pusher Protocol, it will crash the server. All users that run the server are affected by this vulnerability and it's highly recommended to upgrade to the latest patch. There are no workarounds for this issue.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-755
cwe_name: Improper Handling of Exceptional Conditions
description: The product does not handle or incorrectly handles an exceptional condition.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/soketi/soketi
commit_details: repo_url: https://github.com/soketi/soketi
author: rennokki
author_date: 2022-01-07 13:26:17+02:00
msg: Merge pull request #246 from soketi/fix/crash-on-empty-post

[fix] Do not close the connection on empty POST payload
repository: repo_url: https://github.com/soketi/soketi
repo_name: soketi/soketi
description: Next-gen, Pusher-compatible, open-source WebSockets server. Simple, fast, and resilient. 📣
repo_language: TypeScript
owner: soketi
CVE-2024-0455 (published 2024-02-26T16:27Z)

The inclusion of the web scraper for AnythingLLM means that any user with the proper authorization level (manager, admin, and when in single user) could put in the URL\n```\nhttp://169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance\n```\nwhich is a special IP and URL that resolves only when the request comes from within an EC2 instance. This would allow the user to see the connection/secret credentials for their specific instance and be able to manage it regardless of who deployed it.\n\nThe user would have to have pre-existing knowledge of the hosting infra which the target instance is deployed on, but if sent - would resolve if on EC2 and the proper `iptable` or firewall rule is not configured for their setup.


Weakness information:
cwe_id: CWE-918
cwe_name: Server-Side Request Forgery (SSRF)
description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
extended_description: By providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly bypassing access controls such as firewalls that prevent the attackers from accessing the URLs directly. The server can be used as a proxy to conduct port scanning of hosts in internal networks, use other URLs such as that can access documents on the system (using file://), or use other protocols such as gopher:// or tftp://, which may provide greater control over the contents of requests.
         

Fix information:
repo_url: https://github.com/mintplex-labs/anything-llm
commit_details: repo_url: https://github.com/mintplex-labs/anything-llm
author: Timothy Carambat
author_date: 2024-01-11 18:37:00-08:00
msg: protect AWS CF deployments by automatically blocking metadata URL (#578)
repository: repo_url: https://github.com/mintplex-labs/anything-llm
repo_name: Mintplex-Labs/anything-llm
description: The all-in-one Desktop & Docker AI application with full RAG and AI Agent capabilities.
repo_language: JavaScript
owner: mintplex-labs
file_changes: filename: cloudformation_create_anythingllm.json
change_type: ModificationType.MODIFY
diff: @@ -82,7 +82,8 @@
                 "\n",
                 "#!/bin/bash\n",
                 "# check output of userdata script with sudo tail -f /var/log/cloud-init-output.log\n",
-                "sudo yum install docker -y\n",
+                "sudo yum install docker iptables -y\n",
+                "sudo iptables -A OUTPUT -m owner ! --uid-owner root -d 169.254.169.254 -j DROP\n",
                 "sudo systemctl enable docker\n",
                 "sudo systemctl start docker\n",
                 "mkdir -p /home/ec2-user/anythingllm\n",

programming_language: Jupyter Notebook
CVE-2024-27101 (published 2024-03-01T21:15Z)

SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Integer overflow in chunking helper causes dispatching to miss elements or panic.  Any SpiceDB cluster with any schema where a resource being checked has more than 65535 relationships for the same resource and subject type is affected by this problem.  The CheckPermission, BulkCheckPermission, and LookupSubjects API methods are affected. This vulnerability is fixed in 1.29.2.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/authzed/spicedb
commit_details: repo_url: https://github.com/authzed/spicedb
author: Jimmy Zelinskie
author_date: 2024-03-01 15:50:06-05:00
msg: Merge pull request from GHSA-h3m7-rqc4-7h9p

fix chunking integer overflow
repository: repo_url: https://github.com/authzed/spicedb
repo_name: authzed/spicedb
description: Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications
repo_language: Go
owner: authzed
CVE-2021-41198 (published 2021-11-05T20:15Z)

TensorFlow is an open source platform for machine learning. In affected versions if `tf.tile` is called with a large input argument then the TensorFlow process will crash due to a `CHECK`-failure caused by an overflow. The number of elements in the output tensor is too much for the `int64_t` type and the overflow is detected via a `CHECK` statement. This aborts the process. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: TensorFlower Gardener
author_date: 2021-09-20 18:50:30-07:00
msg: Merge pull request #51138 from yongtang:46911-tile

PiperOrigin-RevId: 397891537
Change-Id: I9b12304000e80dd87e6d4a42614ab10383a967b0
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
CVE-2014-2063 (published 2014-10-17T15:55Z)

Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/jenkinsci/jenkins
commit_details: repo_url: https://github.com/jenkinsci/jenkins
author: Vojtech Juranek
author_date: 2013-06-14 00:34:17+02:00
msg: [FIXED SECURITY-80] Add X-Frame-Options head to prevent clickjacking attacks
repository: repo_url: https://github.com/jenkinsci/jenkins
repo_name: jenkinsci/jenkins
description: Jenkins automation server
repo_language: Java
owner: jenkinsci
file_changes: filename: layout.jelly
change_type: ModificationType.MODIFY
diff: @@ -56,6 +56,7 @@ THE SOFTWARE.
 <st:header name="Expires" value="0" />
 <st:header name="Cache-Control" value="no-cache,must-revalidate" />
 <st:header name="X-Hudson-Theme" value="default" />
+<st:header name="X-Frame-Options" value="sameorigin" />
 <st:contentType value="text/html;charset=UTF-8" />
 
   <j:new var="h" className="hudson.Functions" /><!-- instead of JSP functions -->

programming_language: HTML
CVE-2023-33176 (published 2023-06-26T20:15Z)

BigBlueButton is an open source virtual classroom designed to help teachers teach and learners learn. In affected versions are affected by a Server-Side Request Forgery (SSRF) vulnerability. In an `insertDocument` API request the user is able to supply a URL from which the presentation should be downloaded. This URL was being used without having been successfully validated first. An update to the `followRedirect` method in the `PresentationUrlDownloadService` has been made to validate all URLs to be used for presentation download. Two new properties `presentationDownloadSupportedProtocols` and `presentationDownloadBlockedHosts` have also been added to `bigbluebutton.properties` to allow administrators to define what protocols a URL must use and to explicitly define hosts that a presentation cannot be downloaded from. All URLs passed to `insertDocument` must conform to the requirements of the two previously mentioned properties. Additionally, these URLs must resolve to valid addresses, and these addresses must not be local or loopback addresses. There are no workarounds. Users are advised to upgrade to a patched version of BigBlueButton.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-918
cwe_name: Server-Side Request Forgery (SSRF)
description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
extended_description: By providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly bypassing access controls such as firewalls that prevent the attackers from accessing the URLs directly. The server can be used as a proxy to conduct port scanning of hosts in internal networks, use other URLs such as that can access documents on the system (using file://), or use other protocols such as gopher:// or tftp://, which may provide greater control over the contents of requests.
         

Fix information:
repo_url: https://github.com/bigbluebutton/bigbluebutton
commit_details: repo_url: https://github.com/bigbluebutton/bigbluebutton
author: Anton Georgiev
author_date: 2023-05-31 18:19:40-04:00
msg: Merge pull request #18045 from paultrudel/ssrf-fix

fix(sec): SSRF fix
repository: repo_url: https://github.com/bigbluebutton/bigbluebutton
repo_name: bigbluebutton/bigbluebutton
description: Complete open source web conferencing system.
repo_language: JavaScript
owner: bigbluebutton
CVE-2023-4434 (published 2023-08-20T01:15Z)

Missing Authorization in GitHub repository hamza417/inure prior to build88.

CVSS v3 base score: 6.1, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N)

Weakness information:
cwe_id: CWE-862
cwe_name: Missing Authorization
description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are not applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/hamza417/inure
commit_details: repo_url: https://github.com/hamza417/inure
author: Hamza417
author_date: 2023-08-15 20:43:28+05:30
msg: Build88

  - Fixed Missing Authorization vulnerability
repository: repo_url: https://github.com/hamza417/inure
repo_name: Hamza417/Inure
description: An elegant and beautiful premium Android app manager for rooted and non-rooted devices with a built-in terminal, analytics, debloat, stats and various other panels with an independent custom theme engine, developed with purely custom APIs created for this app.
repo_language: Kotlin
owner: hamza417
file_changes: filename: TextViewerActivity.kt
change_type: ModificationType.MODIFY
diff: @@ -1,9 +1,11 @@
 package app.simple.inure.activities.association
 
 import android.os.Bundle
+import android.util.Log
 import app.simple.inure.R
 import app.simple.inure.extensions.activities.BaseActivity
 import app.simple.inure.ui.association.Text
+import app.simple.inure.util.ConditionUtils.invert
 import app.simple.inure.util.NullSafety.isNull
 
 class TextViewerActivity : BaseActivity() {
@@ -12,10 +14,20 @@ class TextViewerActivity : BaseActivity() {
         super.onCreate(savedInstanceState)
         setContentView(R.layout.activity_main)
 
+        Log.d("TextViewerActivity", "onCreate: ${intent.data?.path}")
+
         if (savedInstanceState.isNull()) {
-            supportFragmentManager.beginTransaction()
-                .replace(R.id.app_container, Text.newInstance())
-                .commit()
+            if (hasAppPath().invert()) {
+                supportFragmentManager.beginTransaction()
+                    .replace(R.id.app_container, Text.newInstance())
+                    .commit()
+            } else {
+                showWarning("ERR: illegal action detected.")
+            }
         }
     }
+
+    private fun hasAppPath(): Boolean {
+        return intent.data?.path?.contains("data/data/$packageName")!!
+    }
 }

programming_language: Scala
CVE-2015-4054 (published 2017-05-23T04:29Z)

PgBouncer before 1.5.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by sending a password packet before a startup packet.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/pgbouncer/pgbouncer
commit_details: repo_url: https://github.com/pgbouncer/pgbouncer
author: Marko Kreen
author_date: 2015-04-08 09:22:55+03:00
msg: Check if auth_user is set.

Fixes a crash if password packet appears before startup packet (#42).
repository: repo_url: https://github.com/pgbouncer/pgbouncer
repo_name: pgbouncer/pgbouncer
description: lightweight connection pooler for PostgreSQL
repo_language: C
owner: pgbouncer
file_changes: filename: client.c
change_type: ModificationType.MODIFY
diff: @@ -39,6 +39,12 @@ static bool check_client_passwd(PgSocket *client, const char *passwd)
 	const char *correct;
 	PgUser *user = client->auth_user;
 
+	/* auth_user may be missing */
+	if (!user) {
+		slog_error(client, "Password packet before auth packet?");
+		return false;
+	}
+
 	/* disallow empty passwords */
 	if (!*passwd || !*user->passwd)
 		return false;

programming_language: C
CVE-2022-2257 (published 2022-06-30T21:15Z)

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Bram Moolenaar
author_date: 2022-06-29 21:16:58+01:00
msg: patch 9.0.0009: going past the end of a menu item with only modifier

Problem:    Going past the end of a menu item with only modifier.
Solution:   Check for NUL.
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: message.c
change_type: ModificationType.MODIFY
diff: @@ -1820,8 +1820,8 @@ str2special(
 	    *sp = str + 1;
     }
     else
-	// single-byte character or illegal byte
-	*sp = str + 1;
+	// single-byte character, NUL or illegal byte
+	*sp = str + (*str == NUL ? 0 : 1);
 
     // Make special keys and C0 control characters in <> form, also <M-Space>.
     // Use <Space> only for lhs of a mapping.

programming_language: C
filename: test_menu.vim
change_type: ModificationType.MODIFY
diff: @@ -528,4 +528,17 @@ func Test_tmenu()
   tunmenu Test
 endfunc
 
+func Test_only_modifier()
+  exe "tmenu a.b \x80\xfc0"
+  let exp =<< trim [TEXT]
+  --- Menus ---
+  500 a
+    500 b
+        t  - <T-2-^@>
+  [TEXT]
+  call assert_equal(exp, split(execute('tmenu'), "\n"))
+
+  tunmenu a.b
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab

programming_language: Lua
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -735,6 +735,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    9,
 /**/
     8,
 /**/

programming_language: Ruby