starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2013-4300 (published 2013-09-25T10:31Z)

The scm_check_creds function in net/core/scm.c in the Linux kernel before 3.11 performs a capability check in an incorrect namespace, which allows local users to gain privileges via PID spoofing.

Severity: HIGH
CVSS v2 base score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)

Weakness information:
cwe_id: CWE-264
cwe_name: Permissions, Privileges, and Access Controls
description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Andy Lutomirski
author_date: 2013-08-22 11:39:15-07:00
msg: net: Check the correct namespace when spoofing pid over SCM_RIGHTS

This is a security bug.

The follow-up will fix nsproxy to discourage this type of issue from
happening again.

Cc: stable@vger.kernel.org
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Reviewed-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: scm.c
change_type: ModificationType.MODIFY
diff: @@ -54,7 +54,7 @@ static __inline__ int scm_check_creds(struct ucred *creds)
 		return -EINVAL;
 
 	if ((creds->pid == task_tgid_vnr(current) ||
-	     ns_capable(current->nsproxy->pid_ns->user_ns, CAP_SYS_ADMIN)) &&
+	     ns_capable(task_active_pid_ns(current)->user_ns, CAP_SYS_ADMIN)) &&
 	    ((uid_eq(uid, cred->uid)   || uid_eq(uid, cred->euid) ||
 	      uid_eq(uid, cred->suid)) || nsown_capable(CAP_SETUID)) &&
 	    ((gid_eq(gid, cred->gid)   || gid_eq(gid, cred->egid) ||

programming_language: C
CVE-2022-32323 (published 2022-07-14T21:15Z)

AutoTrace v0.40.0 was discovered to contain a heap overflow via the ReadImage function at input-bmp.c:660.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.3, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/autotrace/autotrace
commit_details: repo_url: https://github.com/autotrace/autotrace
author: Peter Lemenkov
author_date: 2022-05-31 20:40:06+02:00
msg: Merge pull request #72 from lemenkov/misleading_indentation

Misleading indentation
repository: repo_url: https://github.com/autotrace/autotrace
repo_name: autotrace/autotrace
description: bitmap to vector graphics converter
repo_language: C
owner: autotrace
CVE-2019-15946 (published 2019-09-05T17:15Z)

OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in libopensc/asn1.c.

Severity: MEDIUM
CVSS v2 base score: 4.4 (AV:L/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 6.4, MEDIUM (CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/OpenSC/OpenSC
commit_details: repo_url: https://github.com/OpenSC/OpenSC
author: Frank Morgner
author_date: 2019-08-27 15:21:46+02:00
msg: Fixed out of bounds access in ASN.1 Octet string

Credit to OSS-Fuzz
repository: repo_url: https://github.com/OpenSC/OpenSC
repo_name: OpenSC/OpenSC
description: Open source smart card tools and middleware. PKCS#11/MiniDriver/Tokend
repo_language: C
owner: OpenSC
file_changes: filename: asn1.c
change_type: ModificationType.MODIFY
diff: @@ -1469,7 +1469,7 @@ static int asn1_decode_entry(sc_context_t *ctx,struct sc_asn1_entry *entry,
 
 			/* Strip off padding zero */
 			if ((entry->flags & SC_ASN1_UNSIGNED)
-			 && obj[0] == 0x00 && objlen > 1) {
+					&& objlen > 1 && obj[0] == 0x00) {
 				objlen--;
 				obj++;
 			}

programming_language: C
CVE-2024-32879 (published 2024-04-24T20:15Z)

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.4.1, due to default case-insensitive collation in MySQL or MariaDB databases, third-party authentication user IDs are not case-sensitive and could cause different IDs to match. This issue has been addressed by a fix released in version 5.4.1. An immediate workaround would be to change collation of the affected field.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/python-social-auth/social-app-django
commit_details: repo_url: https://github.com/python-social-auth/social-app-django
author: Michal Čihař
author_date: 2024-04-24 10:26:58+02:00
msg: models: make sure uid is compared case-sensitive

The database collation might vary, so use safer comparing in Python.
repository: repo_url: https://github.com/python-social-auth/social-app-django
repo_name: python-social-auth/social-app-django
description: Python Social Auth - Application - Django
repo_language: Python
owner: python-social-auth
file_changes: filename: models.py
change_type: ModificationType.MODIFY
diff: @@ -54,11 +54,15 @@ class AbstractUserSocialAuth(models.Model, DjangoUserMixin):
         abstract = True
 
     @classmethod
-    def get_social_auth(cls, provider, uid):
-        try:
-            return cls.objects.select_related("user").get(provider=provider, uid=uid)
-        except cls.DoesNotExist:
-            return None
+    def get_social_auth(cls, provider: str, uid: str):
+        for social in cls.objects.select_related("user").filter(
+            provider=provider, uid=uid
+        ):
+            # We need to compare to filter out case-insensitive lookups in
+            # some databases (MySQL/MariaDB)
+            if social.uid == uid:
+                return social
+        return None
 
     @classmethod
     def username_max_length(cls):

programming_language: Python
CVE-2021-29554 (published 2021-05-14T19:15Z)

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service via a FPE runtime error in `tf.raw_ops.DenseCountSparseOutput`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/efff014f3b2d8ef6141da30c806faf141297eca1/tensorflow/core/kernels/count_ops.cc#L123-L127) computes a divisor value from user data but does not check that the result is 0 before doing the division. Since `data` is given by the `values` argument, `num_batch_elements` is 0. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, and TensorFlow 2.3.3, as these are also affected.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-369
cwe_name: Divide By Zero
description: The product divides a value by zero.
extended_description: This weakness typically occurs when an unexpected value is provided to the product, or if an error occurs that is not properly detected. It frequently occurs in calculations involving physical dimensions such as size, length, width, and height.
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Amit Patankar
author_date: 2021-04-28 11:24:45-07:00
msg: Fix FPE issue with `tf.raw_ops.DenseCountSparseOutput`.

PiperOrigin-RevId: 370946862
Change-Id: I3752584ad04aaecb327ff6793a9640ac56acfe7a
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: count_ops.cc
change_type: ModificationType.MODIFY
diff: @@ -122,6 +122,9 @@ class DenseCount : public OpKernel {
 
     int num_batch_elements = 1;
     for (int i = 0; i < num_batch_dimensions; ++i) {
+      OP_REQUIRES(context, data.shape().dim_size(i) != 0,
+                  errors::InvalidArgument(
+                      "Invalid input: Shapes dimension cannot be 0."));
       num_batch_elements *= data.shape().dim_size(i);
     }
     int num_value_elements = data.shape().num_elements() / num_batch_elements;

programming_language: C++
CVE-2018-10717 (published 2018-05-03T17:29Z)

The DecodeGifImg function in ngiflib.c in MiniUPnP ngiflib 0.4 does not consider the bounds of the pixels data structure, which allows remote attackers to cause a denial of service (WritePixels heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted GIF file, a different vulnerability than CVE-2018-10677.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/miniupnp/ngiflib
commit_details: repo_url: https://github.com/miniupnp/ngiflib
author: Thomas Bernard
author_date: 2018-05-03 17:35:47+02:00
msg: fix "pixel overrun"

fixes #3
repository: repo_url: https://github.com/miniupnp/ngiflib
repo_name: miniupnp/ngiflib
description: GIF picture format decoding library written in C
repo_language: C
owner: miniupnp
file_changes: filename: ngiflib.c
change_type: ModificationType.MODIFY
diff: @@ -528,7 +528,8 @@ static int DecodeGifImg(struct ngiflib_img * i) {
 			act_code = GetGifWord(i, &context);
 			casspecial = (u8)act_code;
 			old_code = act_code;
-			WritePixel(i, &context, casspecial); npix--;
+			if(npix > 0) WritePixel(i, &context, casspecial);
+			npix--;
 		} else {
 			read_byt = act_code;
 			if(act_code >= free) {	/* code pas encore dans alphabet */
@@ -545,7 +546,11 @@ static int DecodeGifImg(struct ngiflib_img * i) {
 			/* act_code est concret */
 			casspecial = (u8)act_code;	/* dernier debut de chaine ! */
 			*(--stackp) = casspecial;	/* push on stack */
-			WritePixels(i, &context, stackp, stack_top - stackp);	/* unstack all pixels at once */
+			if(npix >= (stack_top - stackp)) {
+				WritePixels(i, &context, stackp, stack_top - stackp);	/* unstack all pixels at once */
+			} else if(npix > 0) {	/* "pixel overflow" */
+				WritePixels(i, &context, stackp, npix);
+			}
 			npix -= (stack_top - stackp);
 			stackp = stack_top;
 /*			putchar('\n'); */

programming_language: C
CVE-2020-26213 (published 2020-11-06T17:15Z)

In teler before version 0.0.1, if you run teler inside a Docker container and encounter `errors.Exit` function, it will cause denial-of-service (`SIGSEGV`) because it doesn't get process ID and process group ID of teler properly to kills. The issue is patched in teler 0.0.1 and 0.0.1-dev5.1.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/kitabisa/teler
commit_details: repo_url: https://github.com/kitabisa/teler
author: Dwi Siswanto
author_date: 2020-11-02 21:09:38+07:00
msg: :hammer: Fix segmentation fault of syscall

If teler is run via the docker image, the syscall function cannot allocate and return a nil pointer to address.
repository: repo_url: https://github.com/kitabisa/teler
repo_name: teler-sh/teler
description: Real-time HTTP Intrusion Detection
repo_language: Go
owner: kitabisa
file_changes: filename: abort.go
change_type: ModificationType.MODIFY
diff: @@ -2,10 +2,17 @@
 
 package errors
 
-import "syscall"
+import (
+	"os"
+	"syscall"
+)
 
 // Abort will terminate & sends SIGTERM to process
 func Abort(i ...int) {
+	if _, err := os.Stat("/.dockerenv"); err == nil {
+		os.Exit(i[0])
+	}
+
 	pgid, err := syscall.Getpgid(syscall.Getpid())
 	if err != nil {
 		Exit(err.Error())

programming_language: Go
CVE-2022-23470 (published 2022-12-06T18:15Z)

Galaxy is an open-source platform for data analysis. An arbitrary file read exists in Galaxy 22.01 and Galaxy 22.05 due to the switch to Gunicorn, which can be used to read any file accessible to the operating system user under which Galaxy is running. This vulnerability affects Galaxy 22.01 and higher, after the switch to gunicorn, which serve static contents directly.  Additionally, the vulnerability is mitigated when using Nginx or Apache to serve /static/* contents, instead of Galaxy's internal middleware. This issue has been patched in commit `e5e6bda4f` and will be included in future releases. Users are advised to manually patch their installations. There are no known workarounds for this vulnerability.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/galaxyproject/galaxy
commit_details: repo_url: https://github.com/galaxyproject/galaxy
author: Dannon Baker
author_date: 2022-12-05 14:35:56-05:00
msg: Contain directory traversal for static files to host static root.
repository: repo_url: https://github.com/galaxyproject/galaxy
repo_name: galaxyproject/galaxy
description: Data intensive science for everyone.
repo_language: Python
owner: galaxyproject
file_changes: filename: static.py
change_type: ModificationType.MODIFY
diff: @@ -38,7 +38,11 @@ class CacheableStaticURLParser(StaticURLParser):
                     directory = host_val
                     break
 
-        full = os.path.join(directory, filename)
+        full = self.normpath(os.path.join(directory, filename))
+        if not full.startswith(directory):
+            # Out of bounds
+            return self.not_found(environ, start_response)
+
         if not os.path.exists(full):
             return self.not_found(environ, start_response)
         if os.path.isdir(full):

programming_language: Python
CVE-2019-1010246 (published 2019-07-18T19:15Z)

MailCleaner before c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9 is affected by: Unauthenticated MySQL database password information disclosure. The impact is: MySQL database content disclosure (e.g. username, password). The component is: The API call in the function allowAction() in NewslettersController.php. The attack vector is: HTTP Get request. The fixed version is: c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-862
cwe_name: Missing Authorization
description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are not applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/MailCleaner/MailCleaner
commit_details: repo_url: https://github.com/MailCleaner/MailCleaner
author: orgeat
author_date: 2019-01-21 17:32:45+01:00
msg: Update NewslettersController.php

Test if an Exim ID was passed.
repository: repo_url: https://github.com/MailCleaner/MailCleaner
repo_name: MailCleaner/MailCleaner
description: MailCleaner Community Edition
repo_language: PHP
owner: MailCleaner
file_changes: filename: NewslettersController.php
change_type: ModificationType.MODIFY
diff: @@ -22,6 +22,8 @@ class NewslettersController extends Zend_Controller_Action
         $status = 0;
         
         $eximId = $this->getRequest()->getParam('id');
+	
+	if (strlen($eximId) == 0) { die(); }
 
         $spam = new Default_Model_DbTable_Spam();
 

programming_language: PHP
CVE-2022-31139 (published 2022-07-11T19:15Z)

UnsafeAccessor (UA) is a bridge to access jdk.internal.misc.Unsafe & sun.misc.Unsafe. Normally, if UA is loaded as a named module, the internal data of UA is protected by JVM and others can only access UA via UA's standard API. The main application can set up `SecurityCheck.AccessLimiter` for UA to limit access to UA. Starting with version 1.4.0 and prior to version 1.7.0, when `SecurityCheck.AccessLimiter` is set up, untrusted code can access UA without limitation, even when UA is loaded as a named module. This issue does not affect those for whom `SecurityCheck.AccessLimiter` is not set up. Version 1.7.0 contains a patch.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-863
cwe_name: Incorrect Authorization
description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are incorrectly applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/Karlatemp/UnsafeAccessor
commit_details: repo_url: https://github.com/Karlatemp/UnsafeAccessor
author: Karlatemp
author_date: 2022-07-09 17:11:31+08:00
msg: Fix UnsafeAccess perm checking
repository: repo_url: https://github.com/Karlatemp/UnsafeAccessor
repo_name: Karlatemp/UnsafeAccessor
description: A bridge to access sun.misc.Unsafe & jdk.internal.misc.Unsafe
repo_language: Java
owner: Karlatemp
file_changes: filename: Root.java
change_type: ModificationType.MODIFY
diff: @@ -157,8 +157,8 @@ public class Root {
     @Contract(pure = false)
     public static <T> T throw0(Throwable throwable) {
         if (throwable == null) throw new NullPointerException();
-        getUnsafe().throwException(throwable);
-        throw new RuntimeException();
+        Unsafe.getUnsafe0().throwException(throwable);
+        throw new RuntimeException(throwable);
     }
 
     /**

programming_language: Java
filename: UnsafeAccess.java
change_type: ModificationType.MODIFY
diff: @@ -17,7 +17,8 @@ public final class UnsafeAccess extends ProtectedObject {
     static final UnsafeAccess INSTANCE = new UnsafeAccess();
 
     public static UnsafeAccess getInstance() {
-        SecurityCheck.getInstance();
+        SecurityCheck.AccessLimiter accessLimiter = SecurityCheck.getInstance().getLimiter();
+        if (accessLimiter != null) accessLimiter.preGetUnsafeAccess();
         return INSTANCE;
     }
 

programming_language: Java