starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2014-4943 (published 2014-07-19T19:55Z)

The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket.

Severity: MEDIUM
CVSS v2 base score: 6.9 (AV:L/AC:M/Au:N/C:C/I:C/A:C)

Weakness information:
cwe_id: CWE-269
cwe_name: Improper Privilege Management
description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Sasha Levin
author_date: 2014-07-14 17:02:31-07:00
msg: net/l2tp: don't fall back on UDP [get|set]sockopt

The l2tp [get|set]sockopt() code has fallen back to the UDP functions
for socket option levels != SOL_PPPOL2TP since day one, but that has
never actually worked, since the l2tp socket isn't an inet socket.

As David Miller points out:

  "If we wanted this to work, it'd have to look up the tunnel and then
   use tunnel->sk, but I wonder how useful that would be"

Since this can never have worked so nobody could possibly have depended
on that functionality, just remove the broken code and return -EINVAL.

Reported-by: Sasha Levin <sasha.levin@oracle.com>
Acked-by: James Chapman <jchapman@katalix.com>
Acked-by: David Miller <davem@davemloft.net>
Cc: Phil Turnbull <phil.turnbull@oracle.com>
Cc: Vegard Nossum <vegard.nossum@oracle.com>
Cc: Willy Tarreau <w@1wt.eu>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: l2tp_ppp.c
change_type: ModificationType.MODIFY
diff: @@ -1365,7 +1365,7 @@ static int pppol2tp_setsockopt(struct socket *sock, int level, int optname,
 	int err;
 
 	if (level != SOL_PPPOL2TP)
-		return udp_prot.setsockopt(sk, level, optname, optval, optlen);
+		return -EINVAL;
 
 	if (optlen < sizeof(int))
 		return -EINVAL;
@@ -1491,7 +1491,7 @@ static int pppol2tp_getsockopt(struct socket *sock, int level, int optname,
 	struct pppol2tp_session *ps;
 
 	if (level != SOL_PPPOL2TP)
-		return udp_prot.getsockopt(sk, level, optname, optval, optlen);
+		return -EINVAL;
 
 	if (get_user(len, optlen))
 		return -EFAULT;

programming_language: C
CVE-2023-5591 (published 2023-10-16T01:15Z)

 SQL Injection in GitHub repository librenms/librenms prior to 23.10.0.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/librenms/librenms
commit_details: repo_url: https://github.com/librenms/librenms
author: Tony Murray
author_date: 2023-10-05 23:04:04-05:00
msg: Fix MAC search sql injection (#15402)

unparameterized variable
repository: repo_url: https://github.com/librenms/librenms
repo_name: librenms/librenms
description: Community-based GPL-licensed network monitoring system
repo_language: PHP
owner: librenms
file_changes: filename: address-search.inc.php
change_type: ModificationType.MODIFY
diff: @@ -37,7 +37,8 @@ if ($vars['search_type'] == 'ipv4') {
     }
 } elseif ($vars['search_type'] == 'mac') {
     $sql = ' FROM `ports` AS I, `devices` AS D';
-    $sql .= " WHERE I.device_id = D.device_id AND `ifPhysAddress` LIKE '%" . trim(str_replace([':', ' ', '-', '.', '0x'], '', $vars['address'])) . "%' $where ";
+    $sql .= " WHERE I.device_id = D.device_id AND `ifPhysAddress` LIKE ? $where ";
+    $param[] = '%' . trim(str_replace([':', ' ', '-', '.', '0x'], '', $vars['address'])) . '%';
 }//end if
 if (is_numeric($vars['device_id'])) {
     $sql .= ' AND I.device_id = ?';

programming_language: PHP
CVE-2022-21669 (published 2022-01-11T15:15Z)

PuddingBot is a group management bot. In version 0.0.6-b933652 and prior, the bot token is publicly exposed in main.py, making it accessible to malicious actors. The bot token has been revoked and new version is already running on the server. As of time of publication, the maintainers are planning to update code to reflect this change at a later date.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-798
cwe_name: Use of Hard-coded Credentials
description: The product contains hard-coded credentials, such as a password or cryptographic key.
extended_description: 
		   There are two main variations:
		   
			 Inbound: the product contains an authentication mechanism that checks the input credentials against a hard-coded set of credentials. In this variant, a default administration account is created, and a simple password is hard-coded into the product and associated with that account. This hard-coded password is the same for each installation of the product, and it usually cannot be changed or disabled by system administrators without manually modifying the program, or otherwise patching the product. It can also be difficult for the administrator to detect.
			 Outbound: the product connects to another system or component, and it contains hard-coded credentials for connecting to that component. This variant applies to front-end systems that authenticate with a back-end service. The back-end service may require a fixed password that can be easily discovered. The programmer may simply hard-code those back-end credentials into the front-end product.
		   
         
         

Fix information:
repo_url: https://github.com/PuddingBot/pudding-bot
commit_details: repo_url: https://github.com/PuddingBot/pudding-bot
author: Happy-Ferret
author_date: 2022-01-21 11:10:34+01:00
msg: Merge pull request #15 from PuddingBot/CVE-2022-21669

CVE-2022-21669

Remove exposed bot token and integrate with gitleaks as a pre-commit hook
to prevent future security leaks.
repository: repo_url: https://github.com/PuddingBot/pudding-bot
repo_name: PuddingBot/pudding-bot
description: Version 1 of my Rose Bot replacement (AGPL3)
repo_language: Python
owner: PuddingBot
CVE-2023-1762 (published 2023-03-31T02:15Z)

Improper Privilege Management in GitHub repository thorsten/phpmyfaq prior to 3.1.12.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-269
cwe_name: Improper Privilege Management
description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/thorsten/phpmyfaq
commit_details: repo_url: https://github.com/thorsten/phpmyfaq
author: Thorsten Rinne
author_date: 2023-02-14 20:47:37+01:00
msg: fix: privilege escalation for users with insufficient permissions
repository: repo_url: https://github.com/thorsten/phpmyfaq
repo_name: thorsten/phpMyFAQ
description: phpMyFAQ - Open Source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases
repo_language: PHP
owner: thorsten
file_changes: filename: user.php
change_type: ModificationType.MODIFY
diff: @@ -121,6 +121,10 @@ if (
             $isSuperAdmin = Filter::filterInput(INPUT_POST, 'is_superadmin', FILTER_UNSAFE_RAW);
             $isSuperAdmin = $isSuperAdmin === 'on';
 
+            if (!$user->isSuperAdmin()) {
+                $isSuperAdmin = false;
+            }
+
             // Sanity check
             if (is_null($userData['email'])) {
                 $message .= sprintf('<p class="alert alert-danger">%s</p>', $PMF_LANG['err_noMailAdress']);
@@ -705,6 +709,7 @@ if (
               </div>
             </div>
 
+            <?php if ($user->isSuperAdmin()) { ?>
             <div class="form-group row">
               <div class="col-lg-4"></div>
               <div class="col-lg-8">
@@ -716,6 +721,7 @@ if (
                 </div>
               </div>
             </div>
+            <?php } ?>
 
           </form>
         </div>

programming_language: PHP
CVE-2014-9627 (published 2020-01-24T22:15Z)

The MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 performs an incorrect cast operation from a 64-bit integer to a 32-bit integer, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large box size.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-704
cwe_name: Incorrect Type Conversion or Cast
description: The product does not correctly convert an object, resource, or structure from one type to a different type.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/videolan/vlc
commit_details: repo_url: https://github.com/videolan/vlc
author: Fabian Yamaguchi
author_date: 2014-12-05 13:52:42+01:00
msg: demux: mp4: fix buffer overflow in parsing of string boxes.

We ensure that pbox->i_size is never smaller than 8 to avoid an
integer underflow in the third argument of the subsequent call to
memcpy. We also make sure no truncation occurs when passing values
derived from the 64 bit integer p_box->i_size to arguments of malloc
and memcpy that may be 32 bit integers on 32 bit platforms.

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>
repository: repo_url: https://github.com/videolan/vlc
repo_name: videolan/vlc
description: VLC media player - All pull requests are ignored, please use MRs on https://code.videolan.org/videolan/vlc
repo_language: C
owner: videolan
file_changes: filename: libmp4.c
change_type: ModificationType.MODIFY
diff: @@ -2858,6 +2858,9 @@ static int MP4_ReadBox_String( stream_t *p_stream, MP4_Box_t *p_box )
 {
     MP4_READBOX_ENTER( MP4_Box_data_string_t );
 
+    if( p_box->i_size < 8 || p_box->i_size > SIZE_MAX )
+        MP4_READBOX_EXIT( 0 );
+
     p_box->data.p_string->psz_text = malloc( p_box->i_size + 1 - 8 ); /* +\0, -name, -size */
     if( p_box->data.p_string->psz_text == NULL )
         MP4_READBOX_EXIT( 0 );

programming_language: C
CVE-2023-40184 (published 2023-08-30T18:15Z)

 xrdp is an open source remote desktop protocol (RDP) server. In versions prior to 0.9.23 improper handling of session establishment errors allows bypassing OS-level session restrictions. The `auth_start_session` function can return non-zero (1) value on, e.g., PAM error which may result in in session restrictions such as max concurrent sessions per user by PAM (ex ./etc/security/limits.conf) to be bypassed. Users (administrators) don't use restrictions by PAM are not affected. This issue has been addressed in release version 0.9.23. Users are advised to upgrade. There are no known workarounds for this issue.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-755
cwe_name: Improper Handling of Exceptional Conditions
description: The product does not handle or incorrectly handles an exceptional condition.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/neutrinolabs/xrdp
commit_details: repo_url: https://github.com/neutrinolabs/xrdp
author: metalefty
author_date: 2023-08-24 10:14:48+09:00
msg: Merge pull request from GHSA-f489-557v-47jq

Check auth_start_session() result
repository: repo_url: https://github.com/neutrinolabs/xrdp
repo_name: neutrinolabs/xrdp
description: xrdp: an open source RDP server
repo_language: C
owner: neutrinolabs
CVE-2021-4279 (published 2022-12-25T20:15Z)

A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.1 is able to address this issue. The name of the patch is 7ad6af41eabb2d799f698740a91284d762c955c9. It is recommended to upgrade the affected component. VDB-216778 is the identifier assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-1321
cwe_name: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
extended_description: 
				By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the product depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf).
				This weakness is usually exploited by using a special attribute of objects called proto,  constructor or prototype. Such attributes give access to the object prototype. This weakness is often found in code that assigns object attributes based on user input, or merges or clones objects recursively.
			
			

Fix information:
repo_url: https://github.com/Starcounter-Jack/JSON-Patch
commit_details: repo_url: https://github.com/Starcounter-Jack/JSON-Patch
author: Joachim Wester
author_date: 2021-08-13 12:10:25+02:00
msg: Merge pull request #262 from 418sec/1-npm-fast-json-patch

Security Fix for Prototype Pollution - huntr.dev
repository: repo_url: https://github.com/Starcounter-Jack/JSON-Patch
repo_name: Starcounter-Jack/JSON-Patch
description: Lean and mean Javascript implementation of the JSON-Patch standard (RFC 6902). Update JSON documents using delta patches.
repo_language: JavaScript
owner: Starcounter-Jack
CVE-2021-3846 (published 2021-10-19T13:15Z)

firefly-iii is vulnerable to Unrestricted Upload of File with Dangerous Type

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/firefly-iii/firefly-iii
commit_details: repo_url: https://github.com/firefly-iii/firefly-iii
author: James Cole
author_date: 2021-10-01 11:33:45+02:00
msg: Make sure temp file is closed (and thus deleted)
repository: repo_url: https://github.com/firefly-iii/firefly-iii
repo_name: firefly-iii/firefly-iii
description: Firefly III: a personal finances manager
repo_language: PHP
owner: firefly-iii
file_changes: filename: AttachmentHelper.php
change_type: ModificationType.MODIFY
diff: @@ -171,6 +171,7 @@ public function saveAttachmentFromApi(Attachment $attachment, string $content):
         $allowedMime = config('firefly.allowedMimes');
         if (!in_array($mime, $allowedMime, true)) {
             Log::error(sprintf('Mime type %s is not allowed for API file upload.', $mime));
+            fclose($resource);
 
             return false;
         }

programming_language: PHP
CVE-2022-2652 (published 2022-08-04T10:15Z)

Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with many %s modifiers in a row).

CVSS v3 base score: 6.0, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-134
cwe_name: Use of Externally-Controlled Format String
description: The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
extended_description: 
            When an attacker can modify an externally-controlled format string, this can lead to buffer overflows, denial of service, or data representation problems.
            It should be noted that in some circumstances, such as internationalization, the set of format strings is externally controlled by design. If the source of these format strings is trusted (e.g. only contained in library files that are only modifiable by the system administrator), then the external control might not itself pose a vulnerability.
         
         

Fix information:
repo_url: https://github.com/umlaeute/v4l2loopback
commit_details: repo_url: https://github.com/umlaeute/v4l2loopback
author: IOhannes m zmölnig
author_date: 2022-08-03 15:09:17+02:00
msg: add explicit format specifier to printf() invocations

CWE-134
repository: repo_url: https://github.com/umlaeute/v4l2loopback
repo_name: umlaeute/v4l2loopback
description: v4l2-loopback device 
repo_language: C
owner: umlaeute
file_changes: filename: v4l2loopback.c
change_type: ModificationType.MODIFY
diff: @@ -756,7 +756,7 @@ static int vidioc_querycap(struct file *file, void *priv,
 	__u32 capabilities = V4L2_CAP_STREAMING | V4L2_CAP_READWRITE;
 
 	strlcpy(cap->driver, "v4l2 loopback", sizeof(cap->driver));
-	snprintf(cap->card, labellen, dev->card_label);
+	snprintf(cap->card, labellen, "%s", dev->card_label);
 	snprintf(cap->bus_info, sizeof(cap->bus_info),
 		 "platform:v4l2loopback-%03d", device_nr);
 
@@ -2494,7 +2494,7 @@ static int v4l2_loopback_add(struct v4l2_loopback_config *conf, int *ret_nr)
 	}
 
 	MARK();
-	snprintf(dev->vdev->name, sizeof(dev->vdev->name), dev->card_label);
+	snprintf(dev->vdev->name, sizeof(dev->vdev->name), "%s", dev->card_label);
 
 	vdev_priv->device_nr = nr;
 

programming_language: C
CVE-2021-4216 (published 2022-08-26T16:15Z)

A Floating point exception (division-by-zero) flaw was found in Mupdf for zero width pages in muraster.c. It is fixed in Mupdf-1.20.0-rc1 upstream.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-369
cwe_name: Divide By Zero
description: The product divides a value by zero.
extended_description: This weakness typically occurs when an unexpected value is provided to the product, or if an error occurs that is not properly detected. It frequently occurs in calculations involving physical dimensions such as size, length, width, and height.
         

Fix information:
repo_url: https://github.com/ArtifexSoftware/mupdf
commit_details: repo_url: https://github.com/ArtifexSoftware/mupdf
author: Sebastian Rasmussen
author_date: 2022-01-18 20:33:10+01:00
msg: Bug 704834: Fix division by zero for zero width pages in muraster.
repository: repo_url: https://github.com/ArtifexSoftware/mupdf
repo_name: ArtifexSoftware/mupdf
description: mupdf mirror
repo_language: C
owner: ArtifexSoftware
file_changes: filename: muraster.c
change_type: ModificationType.MODIFY
diff: @@ -1003,8 +1003,9 @@ initialise_banding(fz_context *ctx, render_details *render, int color)
 
 	w = render->ibounds.x1 - render->ibounds.x0;
 	min_band_mem = (size_t)bpp * w * min_band_height;
-	reps = (int)(max_band_memory / min_band_mem);
-	if (reps < 1)
+	if (min_band_mem > 0)
+		reps = (int)(max_band_memory / min_band_mem);
+	if (min_band_mem == 0 || reps < 1)
 		reps = 1;
 
 	/* Adjust reps to even out the work between threads */

programming_language: C
CVE-2019-20422 (published 2020-01-27T05:15Z)

In the Linux kernel before 5.3.4, fib6_rule_lookup in net/ipv6/ip6_fib.c mishandles the RT6_LOOKUP_F_DST_NOREF flag in a reference-count decision, leading to (for example) a crash that was identified by syzkaller, aka CID-7b09c2d052db.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-755
cwe_name: Improper Handling of Exceptional Conditions
description: The product does not handle or incorrectly handles an exceptional condition.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Eric Dumazet
author_date: 2019-09-19 10:12:36-07:00
msg: ipv6: fix a typo in fib6_rule_lookup()

Yi Ren reported an issue discovered by syzkaller, and bisected
to the cited commit.

Many thanks to Yi, this trivial patch does not reflect the patient
work that has been done.

Fixes: d64a1f574a29 ("ipv6: honor RT6_LOOKUP_F_DST_NOREF in rule lookup logic")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Wei Wang <weiwan@google.com>
Bisected-and-reported-by: Yi Ren <c4tren@gmail.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: ip6_fib.c
change_type: ModificationType.MODIFY
diff: @@ -318,7 +318,7 @@ struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi6 *fl6,
 	if (rt->dst.error == -EAGAIN) {
 		ip6_rt_put_flags(rt, flags);
 		rt = net->ipv6.ip6_null_entry;
-		if (!(flags | RT6_LOOKUP_F_DST_NOREF))
+		if (!(flags & RT6_LOOKUP_F_DST_NOREF))
 			dst_hold(&rt->dst);
 	}
 

programming_language: C