starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2018-8905 (published 2018-03-22T04:29Z)

In LibTIFF 4.0.9, a heap-based buffer overflow occurs in the function LZWDecodeCompat in tif_lzw.c via a crafted TIFF file, as demonstrated by tiff2ps.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://gitlab.com/libtiff/libtiff
commit_details: repo_url: https://gitlab.com/libtiff/libtiff
author: Even Rouault
author_date: 2018-05-12 15:32:31+02:00
msg: LZWDecodeCompat(): fix potential index-out-of-bounds write. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2780 / CVE-2018-8905

The fix consists in using the similar code LZWDecode() to validate we
don't write outside of the output buffer.
repository: repo_url: https://gitlab.com/libtiff/libtiff
repo_name: visit repo url
description: visit repo url
repo_language: visit repo url
owner: libtiff
file_changes: filename: tif_lzw.c
change_type: ModificationType.MODIFY
diff: @@ -602,6 +602,7 @@ LZWDecodeCompat(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s)
 	char *tp;
 	unsigned char *bp;
 	int code, nbits;
+	int len;
 	long nextbits, nextdata, nbitsmask;
 	code_t *codep, *free_entp, *maxcodep, *oldcodep;
 
@@ -753,13 +754,18 @@ LZWDecodeCompat(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s)
 				}  while (--occ);
 				break;
 			}
-			assert(occ >= codep->length);
-			op += codep->length;
-			occ -= codep->length;
-			tp = op;
+			len = codep->length;
+			tp = op + len;
 			do {
-				*--tp = codep->value;
-			} while( (codep = codep->next) != NULL );
+				int t;
+				--tp;
+				t = codep->value;
+				codep = codep->next;
+				*tp = (char)t;
+			} while (codep && tp > op);
+			assert(occ >= len);
+			op += len;
+			occ -= len;
 		} else {
 			*op++ = (char)code;
 			occ--;

programming_language: C
CVE-2022-0524 (published 2022-02-08T22:15Z)

Business Logic Errors in GitHub repository publify/publify prior to 9.2.7.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-840
cwe_name: Business Logic Errors
description: Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses.

Fix information:
repo_url: https://github.com/publify/publify
commit_details: repo_url: https://github.com/publify/publify
author: Matijs van Zuijlen
author_date: 2022-02-07 23:13:44+01:00
msg: Fix setting the article password from the Admin

The password field was present in the form, but not accepted by the
controller. This change adds password to the list of accepted fields.
repository: repo_url: https://github.com/publify/publify
repo_name: publify/publify
description: A self hosted Web publishing platform on Rails.
repo_language: Less
owner: publify
file_changes: filename: content_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -180,6 +180,7 @@ class Admin::ContentController < Admin::BaseController
              :body_and_extended,
              :draft,
              :extended,
+             :password,
              :permalink,
              :published_at,
              :text_filter_name,

programming_language: Ruby
filename: content_controller_spec.rb
change_type: ModificationType.MODIFY
diff: @@ -160,6 +160,12 @@ describe Admin::ContentController, type: :controller do
         assert_equal 2, new_article.tags.size
       end
 
+      it "creates an article with a password" do
+        post :create, params: { "article" => base_article(password: "foobar") }
+        new_article = Article.last
+        expect(new_article.password).to eq("foobar")
+      end
+
       it "creates an article with a unique Tag instance named lang:FR" do
         post :create, params: { "article" => base_article(keywords: "lang:FR") }
         new_article = Article.last
@@ -392,6 +398,15 @@ describe Admin::ContentController, type: :controller do
         expect(article.extended).to eq("bar<!--more-->baz")
       end
 
+      it "allows updating password" do
+        put :update, params: { "id" => article.id, "article" => {
+          "password" => "foobar",
+        } }
+        assert_response :redirect
+        article.reload
+        expect(article.password).to eq("foobar")
+      end
+
       context "when a published article has drafts" do
         let(:original_published_at) { 2.days.ago.to_date }
         let!(:original) { create(:article, published_at: original_published_at) }

programming_language: Ruby
CVE-2023-27253 (published 2023-03-17T22:15Z)

A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via manipulating the contents of an XML file supplied to the component config.xml.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-91
cwe_name: XML Injection (aka Blind XPath Injection)
description: The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
extended_description: Within XML, special elements could include reserved words or characters such as "<", ">", """, and "&", which could then be used to add new data or modify XML syntax.
         

Fix information:
repo_url: https://github.com/pfsense/pfsense
commit_details: repo_url: https://github.com/pfsense/pfsense
author: jim-p
author_date: 2023-02-06 12:14:59-05:00
msg: Correct RRD backup/restore cmd file handling. Fixes #13935
repository: repo_url: https://github.com/pfsense/pfsense
repo_name: pfsense/pfsense
description: Main repository for pfSense
repo_language: PHP
owner: pfsense
file_changes: filename: config.lib.inc
change_type: ModificationType.MODIFY
diff: @@ -280,7 +280,7 @@ function restore_rrddata($conf = false) {
 
 	foreach ($conf['rrddata']['rrddatafile'] as $rrd) {
 		if ($rrd['xmldata']) {
-			$rrd_file = "{$g['vardb_path']}/rrd/{$rrd['filename']}";
+			$rrd_file = "{$g['vardb_path']}/rrd/" . basename($rrd['filename']);
 			$xml_file = preg_replace('/\.rrd$/', ".xml", $rrd_file);
 			if (file_put_contents($xml_file, gzinflate(base64_decode($rrd['xmldata']))) === false) {
 				log_error(sprintf(gettext("Cannot write %s"), $xml_file));
@@ -288,14 +288,14 @@ function restore_rrddata($conf = false) {
 			}
 			$output = array();
 			$status = null;
-			exec("$rrdtool restore -f '{$xml_file}' '{$rrd_file}'", $output, $status);
+			exec("{$rrdtool} restore -f " . escapeshellarg($xml_file) . ' ' . escapeshellarg($rrd_file), $output, $status);
 			if ($status) {
 				log_error("rrdtool restore -f '{$xml_file}' '{$rrd_file}' failed returning {$status}.");
 				continue;
 			}
 			unlink($xml_file);
 		} else if ($rrd['data']) {
-			$rrd_file = "{$g['vardb_path']}/rrd/{$rrd['filename']}";
+			$rrd_file = "{$g['vardb_path']}/rrd/" . basename($rrd['filename']);
 			$rrd_fd = fopen($rrd_file, "w");
 			if (!$rrd_fd) {
 				log_error(sprintf(gettext("Cannot write %s"), $rrd_file));

programming_language: PHP
filename: backup.inc
change_type: ModificationType.MODIFY
diff: @@ -51,7 +51,7 @@ function rrd_data_xml() {
 	foreach ($rrd_files as $rrd_file) {
 		$basename = basename($rrd_file);
 		$xml_file = preg_replace('/\.rrd$/', ".xml", $rrd_file);
-		exec("$rrdtool dump '{$rrd_file}' '{$xml_file}'");
+		exec("{$rrdtool} dump " . escapeshellarg($rrd_file) . ' ' . escapeshellarg($xml_file));
 		$xml_data = file_get_contents($xml_file);
 		unlink($xml_file);
 		if ($xml_data !== false) {

programming_language: PHP
CVE-2023-32069 (published 2023-05-09T16:15Z)

XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-2 and prior to versions 14.10.4 and 15.0-rc-1, it's possible for a user to execute anything with the right of the author of the XWiki.ClassSheet document. This has been patched in XWiki 15.0-rc-1 and 14.10.4. There are no known workarounds.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-863
cwe_name: Incorrect Authorization
description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are incorrectly applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/xwiki/xwiki-platform
commit_details: repo_url: https://github.com/xwiki/xwiki-platform
author: Thomas Mortagne
author_date: 2023-01-19 10:33:11+01:00
msg: XWIKI-20566: Improve Class Sheet display
repository: repo_url: https://github.com/xwiki/xwiki-platform
repo_name: xwiki/xwiki-platform
description: The XWiki platform
repo_language: Java
owner: xwiki
file_changes: filename: ClassSheet.xml
change_type: ModificationType.MODIFY
diff: @@ -83,7 +83,7 @@
 ## sheet output. Class authors can put the description of the class in the class document content.
 #set($classSheetReference = $services.model.createDocumentReference($doc.wiki, 'XWiki', 'ClassSheet'))
 #if($services.sheet.getDocumentSheets($doc).contains($classSheetReference))
-  {{include reference="" /}}
+  {{include reference="" author="target"/}}
 #end
 {{/velocity}}
 

programming_language: CoffeeScript
CVE-2023-26302 (published 2023-02-22T23:15Z)

Denial of service could be caused to the command line interface of markdown-it-py, before v2.2.0, if an attacker was allowed to use invalid UTF-8 characters as input.\n

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/executablebooks/markdown-it-py
commit_details: repo_url: https://github.com/executablebooks/markdown-it-py
author: Chris Sewell
author_date: 2023-02-22 06:39:56+01:00
msg: 🐛 FIX: CLI crash on non-utf8 character (#247)

Addresses CVE-2023-26302
repository: repo_url: https://github.com/executablebooks/markdown-it-py
repo_name: executablebooks/markdown-it-py
description: Markdown parser, done right. 100% CommonMark support, extensions, syntax plugins & high speed. Now in Python!
repo_language: Python
owner: executablebooks
file_changes: filename: parse.py
change_type: ModificationType.MODIFY
diff: @@ -35,7 +35,7 @@ def convert_file(filename: str) -> None:
     Parse a Markdown file and dump the output to stdout.
     """
     try:
-        with open(filename, "r") as fin:
+        with open(filename, "r", encoding="utf8", errors="ignore") as fin:
             rendered = MarkdownIt().render(fin.read())
             print(rendered, end="")
     except OSError:

programming_language: Python
filename: test_cli.py
change_type: ModificationType.MODIFY
diff: @@ -20,6 +20,13 @@ def test_parse_fail():
     assert exc_info.value.code == 1
 
 
+def test_non_utf8():
+    with tempfile.TemporaryDirectory() as tempdir:
+        path = pathlib.Path(tempdir).joinpath("test.md")
+        path.write_bytes(b"\x80abc")
+        assert parse.main([str(path)]) == 0
+
+
 def test_print_heading():
     with patch("builtins.print") as patched:
         parse.print_heading()

programming_language: Python
CVE-2016-4484 (published 2017-01-23T21:59Z)

The Debian initrd script for the cryptsetup package 2:1.7.3-2 and earlier allows physically proximate attackers to gain shell access via many log in attempts with an invalid password.

Severity: HIGH
CVSS v2 base score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 6.8, MEDIUM (CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://gitlab.com/cryptsetup/cryptsetup
commit_details: repo_url: https://gitlab.com/cryptsetup/cryptsetup
author: Milan Broz
author_date: 2016-11-16 16:10:15+01:00
msg: Update Readme.md.
repository: repo_url: https://gitlab.com/cryptsetup/cryptsetup
repo_name: visit repo url
description: visit repo url
repo_language: visit repo url
owner: cryptsetup
file_changes: filename: README.md
change_type: ModificationType.MODIFY
diff: @@ -32,6 +32,12 @@ Why LUKS?
 [Project home page](https://gitlab.com/cryptsetup/cryptsetup/).
 -----------------
 
+**CVE-2016-4484 (Initrd root shell)**
+
+This is problem in **intramfs** **scripts** only (these are **not** part of cryptsetup project), it is neiter bug in cryptsetup nor in LUKS.  
+Some distributions could add these scripts to distributed package, please check your distro updates for more info.
+
+
 [Frequently asked questions (FAQ)](https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions)
 --------------------------------
 

programming_language: Markdown
CVE-2017-14057 (published 2017-08-31T15:29Z)

In FFmpeg 3.3.3, a DoS in asf_read_marker() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted ASF file, which claims a large "name_len" or "count" field in the header but does not contain sufficient backing data, is provided, the loops over the name and markers would consume huge CPU and memory resources, since there is no EOF check inside these loops.

Severity: HIGH
CVSS v2 base score: 7.1 (AV:N/AC:M/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-834
cwe_name: Excessive Iteration
description: The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
extended_description: If the iteration can be influenced by an attacker, this weakness could allow attackers to consume excessive resources such as CPU or memory. In many cases, a loop does not need to be infinite in order to cause enough resource consumption to adversely affect the product or its host system; it depends on the amount of resources consumed per iteration.
         

Fix information:
repo_url: https://github.com/FFmpeg/FFmpeg
commit_details: repo_url: https://github.com/FFmpeg/FFmpeg
author: 孙浩 and 张洪亮(望初)
author_date: 2017-08-25 12:37:25+02:00
msg: avformat/asfdec: Fix DoS due to lack of eof check

Fixes: loop.asf

Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
repository: repo_url: https://github.com/FFmpeg/FFmpeg
repo_name: FFmpeg/FFmpeg
description: Mirror of https://git.ffmpeg.org/ffmpeg.git
repo_language: C
owner: FFmpeg
file_changes: filename: asfdec_f.c
change_type: ModificationType.MODIFY
diff: @@ -749,13 +749,15 @@ static int asf_read_marker(AVFormatContext *s, int64_t size)
     count = avio_rl32(pb);    // markers count
     avio_rl16(pb);            // reserved 2 bytes
     name_len = avio_rl16(pb); // name length
-    for (i = 0; i < name_len; i++)
-        avio_r8(pb); // skip the name
+    avio_skip(pb, name_len);
 
     for (i = 0; i < count; i++) {
         int64_t pres_time;
         int name_len;
 
+        if (avio_feof(pb))
+            return AVERROR_INVALIDDATA;
+
         avio_rl64(pb);             // offset, 8 bytes
         pres_time = avio_rl64(pb); // presentation time
         pres_time -= asf->hdr.preroll * 10000;

programming_language: C
CVE-2023-2105 (published 2023-04-15T14:15Z)

Session Fixation in GitHub repository alextselegidis/easyappointments prior to 1.5.0.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-384
cwe_name: Session Fixation
description: Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
extended_description: 
            Such a scenario is commonly observed when:
            
               A web application authenticates a user without first invalidating the existing session, thereby continuing to use the session already associated with the user.
               An attacker is able to force a known session identifier on a user so that, once the user authenticates, the attacker has access to the authenticated session.
               The application or container uses predictable session identifiers.
	    
	    In the generic exploit of session fixation vulnerabilities, an attacker creates a new session on a web application and records the associated session identifier. The attacker then causes the victim to associate, and possibly authenticate, against the server using that session identifier, giving the attacker access to the user's account through the active session.
         
         

Fix information:
repo_url: https://github.com/alextselegidis/easyappointments
commit_details: repo_url: https://github.com/alextselegidis/easyappointments
author: Alex Tselegidis
author_date: 2023-04-15 14:46:30+02:00
msg: Regenerate the session ID after logging in to avoid Session Fixation attacks
repository: repo_url: https://github.com/alextselegidis/easyappointments
repo_name: alextselegidis/easyappointments
description: :date: Easy!Appointments - Self Hosted Appointment Scheduler
repo_language: PHP
owner: alextselegidis
file_changes: filename: Login.php
change_type: ModificationType.MODIFY
diff: @@ -76,6 +76,8 @@ class Login extends EA_Controller {
             {
                 throw new InvalidArgumentException('Invalid credentials provided, please try again.');
             }
+            
+            $this->session->sess_regenerate();
 
             session($user_data); // Save data in the session.
 

programming_language: PHP
CVE-2017-1000414 (published 2018-01-25T16:29Z)

ImpulseAdventure JPEGsnoop version 1.7.5 is vulnerable to a division by zero in the JFIF decode handling resulting denial of service.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-369
cwe_name: Divide By Zero
description: The product divides a value by zero.
extended_description: This weakness typically occurs when an unexpected value is provided to the product, or if an error occurs that is not properly detected. It frequently occurs in calculations involving physical dimensions such as size, length, width, and height.
         

Fix information:
repo_url: https://github.com/ImpulseAdventure/JPEGsnoop
commit_details: repo_url: https://github.com/ImpulseAdventure/JPEGsnoop
author: Calvin Hass
author_date: 2017-06-05 23:32:45-07:00
msg: Fixed div0 vulnerability in SampFact
repository: repo_url: https://github.com/ImpulseAdventure/JPEGsnoop
repo_name: ImpulseAdventure/JPEGsnoop
description: JPEGsnoop: JPEG decoder and detailed analysis
repo_language: C++
owner: ImpulseAdventure
file_changes: filename: JfifDecode.cpp
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,5 @@
 // JPEGsnoop - JPEG Image Decoder & Analysis Utility
-// Copyright (C) 2015 - Calvin Hass
+// Copyright (C) 2017 - Calvin Hass
 // http://www.impulseadventure.com/photo/jpeg-snoop.html
 //
 //    This program is free software: you can redistribute it and/or modify
@@ -4903,8 +4903,8 @@ unsigned CjfifDecode::DecodeMarker()
 			// possibility of div by 0).
 			m_anSofHorzSampFact_Hi[nCompIdent] = (anSofSampFact[nCompIdent] & 0xF0) >> 4;	// Hi, range 1..4
 			m_anSofVertSampFact_Vi[nCompIdent] = (anSofSampFact[nCompIdent] & 0x0F);		// Vi, range 1..4
-			//if (!ValidateValue(m_anSofHorzSampFact_Hi[nCompIdent],1,4,_T("Horizontal Sampling Factor <Hi>"),true,1)) return DECMARK_ERR;
-			//if (!ValidateValue(m_anSofVertSampFact_Vi[nCompIdent],1,4,_T("Vertical Sampling Factor <Vi>"),true,1)) return DECMARK_ERR;
+			if (!ValidateValue(m_anSofHorzSampFact_Hi[nCompIdent],1,4,_T("Horizontal Sampling Factor <Hi>"),true,1)) return DECMARK_ERR;
+			if (!ValidateValue(m_anSofVertSampFact_Vi[nCompIdent],1,4,_T("Vertical Sampling Factor <Vi>"),true,1)) return DECMARK_ERR;
 
 		}
 

programming_language: C++
CVE-2018-17569 (published 2018-09-26T22:29Z)

network/nw_buf.c in ViaBTC Exchange Server before 2018-08-21 has an integer overflow leading to memory corruption.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/viabtc/viabtc_exchange_server
commit_details: repo_url: https://github.com/viabtc/viabtc_exchange_server
author: haipo yang
author_date: 2018-08-21 14:50:19+08:00
msg: Merge pull request #131 from benjaminchodroff/master

fix memory corruption and other 32bit overflows
repository: repo_url: https://github.com/viabtc/viabtc_exchange_server
repo_name: viabtc/viabtc_exchange_server
description: A trading engine with high-speed performance and real-time notification
repo_language: C
owner: viabtc