starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2023-2609 (published 2023-05-09T18:15Z)

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Bram Moolenaar
author_date: 2023-05-09 17:09:30+01:00
msg: patch 9.0.1531: crash when register contents ends up being invalid

Problem:    Crash when register contents ends up being invalid.
Solution:   Check "y_array" is not NULL.
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: register.c
change_type: ModificationType.MODIFY
diff: @@ -301,7 +301,7 @@ get_register(
     if (copy)
     {
 	// If we run out of memory some or all of the lines are empty.
-	if (reg->y_size == 0)
+	if (reg->y_size == 0 || y_current->y_array == NULL)
 	    reg->y_array = NULL;
 	else
 	    reg->y_array = ALLOC_MULT(char_u *, reg->y_size);

programming_language: C
filename: test_registers.vim
change_type: ModificationType.MODIFY
diff: @@ -835,6 +835,23 @@ func Test_end_reg_executing()
   bwipe!
 endfunc
 
+" This was causing a crash because y_append was ending up being NULL
+func Test_zero_y_append()
+  " Run in a separate Vim instance because changing 'encoding' may cause
+  " trouble for later tests.
+  let lines =<< trim END
+      d
+      silent ?n
+      next <sfile>
+      so
+      sil! norm 0VPSP
+      set enc=latin1
+       
+  END
+  call writefile(lines, 'XTest_zero_y_append', 'D')
+  call RunVim([], [], '-u NONE -i NONE -e -s -S XTest_zero_y_append -c qa\!')
+endfunc
+
 " Make sure that y_append is correctly reset
 " and the previous register is working as expected
 func Test_register_y_append_reset()

programming_language: Lua
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -695,6 +695,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1531,
 /**/
     1530,
 /**/

programming_language: Ruby
CVE-2020-8941 (published 2020-12-15T15:15Z)

An arbitrary memory read vulnerability in Asylo versions up to 0.6.0 allows an untrusted attacker to make a call to enc_untrusted_inet_pton using an attacker controlled klinux_addr_buffer parameter. The parameter size is unchecked allowing the attacker to read memory locations outside of the intended buffer size including memory addresses within the secure enclave. We recommend upgrading past commit 8fed5e334131abaf9c5e17307642fbf6ce4a57ec

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/google/asylo
commit_details: repo_url: https://github.com/google/asylo
author: Chong Cai
author_date: 2020-09-25 15:34:34-07:00
msg: Check sockaddr size in inet_pton

PiperOrigin-RevId: 333821843
Change-Id: Ie0b694f1edd3f7a4a3de6df964d68566961accf6
repository: repo_url: https://github.com/google/asylo
repo_name: google/asylo
description: An open and flexible framework for developing enclave applications
repo_language: C++
owner: google
file_changes: filename: host_calls.cc
change_type: ModificationType.MODIFY
diff: @@ -1283,8 +1283,16 @@ int enc_untrusted_inet_pton(int af, const char *src, void *dst) {
   auto klinux_addr_buffer = output.next();
   size_t max_size = 0;
   if (af == AF_INET) {
+    if (klinux_addr_buffer.size() != sizeof(klinux_in_addr)) {
+      ::asylo::primitives::TrustedPrimitives::BestEffortAbort(
+          "enc_untrusted_inet_pton: unexpected output size");
+    }
     max_size = sizeof(struct in_addr);
   } else if (af == AF_INET6) {
+    if (klinux_addr_buffer.size() != sizeof(klinux_in6_addr)) {
+      ::asylo::primitives::TrustedPrimitives::BestEffortAbort(
+          "enc_untrusted_inet_pton: unexpected output size");
+    }
     max_size = sizeof(struct in6_addr);
   }
   memcpy(dst, klinux_addr_buffer.data(),

programming_language: C++
CVE-2019-19246 (published 2019-11-25T17:15Z)

Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in str_lower_case_match in regexec.c.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/kkos/oniguruma
commit_details: repo_url: https://github.com/kkos/oniguruma
author: K.Kosako
author_date: 2019-08-13 13:37:30+09:00
msg: fix heap-buffer-overflow
repository: repo_url: https://github.com/kkos/oniguruma
repo_name: kkos/oniguruma
description: regular expression library
repo_language: C
owner: kkos
file_changes: filename: regexec.c
change_type: ModificationType.MODIFY
diff: @@ -4196,6 +4196,7 @@ str_lower_case_match(OnigEncoding enc, int case_fold_flag,
     lowlen = ONIGENC_MBC_CASE_FOLD(enc, case_fold_flag, &p, end, lowbuf);
     q = lowbuf;
     while (lowlen > 0) {
+      if (t >= tend)    return 0;
       if (*t++ != *q++) return 0;
       lowlen--;
     }

programming_language: C
CVE-2023-24826 (published 2023-05-30T17:15Z)

RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send crafted frames to the device to trigger the usage of an uninitialized object leading to denial of service. This issue is fixed in version 2023.04. As a workaround, disable fragment forwarding or SFR.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-824
cwe_name: Access of Uninitialized Pointer
description: The product accesses or uses a pointer that has not been initialized.
extended_description: 
            If the pointer contains an uninitialized value, then the value might not point to a valid memory location. This could cause the product to read from or write to unexpected memory locations, leading to a denial of service. If the uninitialized pointer is used as a function call, then arbitrary functions could be invoked. If an attacker can influence the portion of uninitialized memory that is contained in the pointer, this weakness could be leveraged to execute code or perform other attacks.
            Depending on memory layout, associated memory management behaviors, and product operation, the attacker might be able to influence the contents of the uninitialized pointer, thus gaining more fine-grained control of the memory location to be accessed.
         
         

Fix information:
repo_url: https://github.com/RIOT-OS/RIOT
commit_details: repo_url: https://github.com/RIOT-OS/RIOT
author: Kaspar Schleiser
author_date: 2023-04-21 11:54:57+02:00
msg: Merge pull request from GHSA-xfj4-9g7w-f4gh

fixes for CVE-2023-24826
repository: repo_url: https://github.com/RIOT-OS/RIOT
repo_name: RIOT-OS/RIOT
description: RIOT -  The friendly OS for IoT
repo_language: C
owner: RIOT-OS
CVE-2021-29588 (published 2021-05-14T20:15Z)

TensorFlow is an end-to-end open source platform for machine learning. The optimized implementation of the `TransposeConv` TFLite operator is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/0d45ea1ca641b21b73bcf9c00e0179cda284e7e7/tensorflow/lite/kernels/internal/optimized/optimized_ops.h#L5221-L5222). An attacker can craft a model such that `stride_{h,w}` values are 0. Code calling this function must validate these arguments. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-369
cwe_name: Divide By Zero
description: The product divides a value by zero.
extended_description: This weakness typically occurs when an unexpected value is provided to the product, or if an error occurs that is not properly detected. It frequently occurs in calculations involving physical dimensions such as size, length, width, and height.
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Mihai Maruseac
author_date: 2021-04-27 17:46:25-07:00
msg: Fix another division by 0 in TFLite

PiperOrigin-RevId: 370800181
Change-Id: I924809166a6131f5075e6d45c455106538d755f9
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: transpose_conv.cc
change_type: ModificationType.MODIFY
diff: @@ -591,6 +591,10 @@ TfLiteStatus Eval(TfLiteContext* context, TfLiteNode* node) {
   const auto* params =
       reinterpret_cast<TfLiteTransposeConvParams*>(node->builtin_data);
 
+  // Prevent divisions by 0
+  TF_LITE_ENSURE(context, params->stride_height > 0);
+  TF_LITE_ENSURE(context, params->stride_width > 0);
+
   // Resize any deferred dynamic tensors
   if (IsDynamicTensor(output)) {
     TF_LITE_ENSURE_OK(context, ResizeTensor(context, output_shape, output));

programming_language: Objective-C
CVE-2010-3872 (published 2010-11-22T12:54Z)

A flaw was found in the mod_fcgid module of httpd. A malformed FastCGI response may result in a stack-based buffer overflow in the modules/fcgid/fcgid_bucket.c file in the fcgid_header_bucket_read() function, resulting in an application crash.

Severity: HIGH
CVSS v2 base score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)

Weakness information:
cwe_id: CWE-189
cwe_name: Numeric Errors
description: Weaknesses in this category are related to improper calculation or conversion of numbers.

Fix information:
repo_url: https://github.com/apache/httpd-mod_fcgid
commit_details: repo_url: https://github.com/apache/httpd-mod_fcgid
author: Jeff Trawick
author_date: 2010-11-04 12:10:10+00:00
msg: SECURITY: CVE-2010-3872 (cve.mitre.org)

Fix possible stack buffer overwrite.

PR:  49406
Reported and diagnosed by: Edgar Frank <ef-lists email.de>


git-svn-id: https://svn.apache.org/repos/asf/httpd/mod_fcgid/trunk@1030894 13f79535-47bb-0310-9956-ffa450edef68
repository: repo_url: https://github.com/apache/httpd-mod_fcgid
repo_name: apache/httpd-mod_fcgid
description: Mirror of SVN Apache HTTPD mod_fcgid
repo_language: C
owner: apache
file_changes: filename: CHANGES-FCGID
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,10 @@
                                                          -*- coding: utf-8 -*-
 Changes with mod_fcgid 2.3.6
 
+  *) SECURITY: CVE-2010-3872 (cve.mitre.org)
+     Fix possible stack buffer overwrite.  Diagnosed by the reporter.
+     PR 49406.  [Edgar Frank <ef-lists email.de>]
+
   *) Change the default for FcgidMaxRequestLen from 1GB to 128K.
      Administrators should change this to an appropriate value based on
      site requirements.  [Jeff Trawick]

programming_language: Markdown
filename: fcgid_bucket.c
change_type: ModificationType.MODIFY
diff: @@ -96,7 +96,7 @@ static apr_status_t fcgid_header_bucket_read(apr_bucket * b,
 
         /* Initialize header */
         putsize = fcgid_min(bufferlen, sizeof(header) - hasread);
-        memcpy(&header + hasread, buffer, putsize);
+        memcpy((apr_byte_t *)&header + hasread, buffer, putsize);
         hasread += putsize;
 
         /* Ignore the bytes that have read */

programming_language: C
CVE-2017-14056 (published 2017-08-31T15:29Z)

In libavformat/rl2.c in FFmpeg 3.3.3, a DoS in rl2_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted RL2 file, which claims a large "frame_count" field in the header but does not contain sufficient backing data, is provided, the loops (for offset and size tables) would consume huge CPU and memory resources, since there is no EOF check inside these loops.

Severity: HIGH
CVSS v2 base score: 7.1 (AV:N/AC:M/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-834
cwe_name: Excessive Iteration
description: The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
extended_description: If the iteration can be influenced by an attacker, this weakness could allow attackers to consume excessive resources such as CPU or memory. In many cases, a loop does not need to be infinite in order to cause enough resource consumption to adversely affect the product or its host system; it depends on the amount of resources consumed per iteration.
         

Fix information:
repo_url: https://github.com/FFmpeg/FFmpeg
commit_details: repo_url: https://github.com/FFmpeg/FFmpeg
author: 孙浩 and 张洪亮(望初)
author_date: 2017-08-25 01:15:29+02:00
msg: avformat/rl2: Fix DoS due to lack of eof check

Fixes: loop.rl2

Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
repository: repo_url: https://github.com/FFmpeg/FFmpeg
repo_name: FFmpeg/FFmpeg
description: Mirror of https://git.ffmpeg.org/ffmpeg.git
repo_language: C
owner: FFmpeg
file_changes: filename: rl2.c
change_type: ModificationType.MODIFY
diff: @@ -170,12 +170,21 @@ static av_cold int rl2_read_header(AVFormatContext *s)
     }
 
     /** read offset and size tables */
-    for(i=0; i < frame_count;i++)
+    for(i=0; i < frame_count;i++) {
+        if (avio_feof(pb))
+            return AVERROR_INVALIDDATA;
         chunk_size[i] = avio_rl32(pb);
-    for(i=0; i < frame_count;i++)
+    }
+    for(i=0; i < frame_count;i++) {
+        if (avio_feof(pb))
+            return AVERROR_INVALIDDATA;
         chunk_offset[i] = avio_rl32(pb);
-    for(i=0; i < frame_count;i++)
+    }
+    for(i=0; i < frame_count;i++) {
+        if (avio_feof(pb))
+            return AVERROR_INVALIDDATA;
         audio_size[i] = avio_rl32(pb) & 0xFFFF;
+    }
 
     /** build the sample index */
     for(i=0;i<frame_count;i++){

programming_language: C
CVE-2021-35206 (published 2021-06-22T14:15Z)

Gitpod before 0.6.0 allows unvalidated redirects.

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v3 base score: 6.1, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-601
cwe_name: URL Redirection to Untrusted Site ('Open Redirect')
description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
extended_description: An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance. Whether this issue poses a vulnerability will be subject to the intended behavior of the application. For example, a search engine might intentionally provide redirects to arbitrary URLs.
         

Fix information:
repo_url: https://github.com/gitpod-io/gitpod
commit_details: repo_url: https://github.com/gitpod-io/gitpod
author: Alex Tugarev
author_date: 2021-01-13 08:36:53+00:00
msg: [server/auth] ensure safe returnTo param
repository: repo_url: https://github.com/gitpod-io/gitpod
repo_name: gitpod-io/gitpod
description: The developer platform for on-demand cloud development environments to create software faster and more securely.
repo_language: Go
owner: gitpod-io
file_changes: filename: user-controller.ts
change_type: ModificationType.MODIFY
diff: @@ -81,6 +81,7 @@ export class UserController {
             }
 
             // Proceed with login
+            this.ensureSafeReturnToParam(req);
             await this.authenticator.authenticate(req, res, next);
         });
         router.get("/authorize", (req: express.Request, res: express.Response, next: express.NextFunction) => {
@@ -88,6 +89,7 @@ export class UserController {
                 res.sendStatus(401);
                 return;
             }
+            this.ensureSafeReturnToParam(req);
             this.authenticator.authorize(req, res, next);
         });
         const branding = this.env.brandingConfig;
@@ -483,6 +485,10 @@ export class UserController {
         }
     }
 
+    protected ensureSafeReturnToParam(req: express.Request) {
+        req.query.returnTo = this.getSafeReturnToParam(req);
+    }
+
     protected getSafeReturnToParam(req: express.Request) {
         const returnToURL: string | undefined = req.query.redirect || req.query.returnTo;
         if (returnToURL) {

programming_language: TypeScript
CVE-2018-13818 (published 2018-07-10T14:29Z)

Twig before 2.4.4 allows Server-Side Template Injection (SSTI) via the search search_key parameter. NOTE: the vendor points out that Twig itself is not a web application and states that it is the responsibility of web applications using Twig to properly wrap input to it

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-94
cwe_name: Improper Control of Generation of Code ('Code Injection')
description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
extended_description: 
            When a product allows a user's input to contain code syntax, it might be possible for an attacker to craft the code in such a way that it will alter the intended control flow of the product. Such an alteration could lead to arbitrary code execution.
            Injection problems encompass a wide variety of issues -- all mitigated in very different ways. For this reason, the most effective way to discuss these weaknesses is to note the distinct features which classify them as injection weaknesses. The most important issue to note is that all injection problems share one thing in common -- i.e., they allow for the injection of control plane data into the user-controlled data plane. This means that the execution of the process may be altered by sending code in through legitimate data channels, using no other mechanism. While buffer overflows, and many other flaws, involve the use of some further issue to gain execution, injection problems need only for the data to be parsed. The most classic instantiations of this category of weakness are SQL injection and format string vulnerabilities.
         
         

Fix information:
repo_url: https://github.com/twigphp/Twig
commit_details: repo_url: https://github.com/twigphp/Twig
author: Fabien Potencier
author_date: 2017-09-27 11:10:31-07:00
msg: prepared the 2.4.4 release
repository: repo_url: https://github.com/twigphp/Twig
repo_name: twigphp/Twig
description: Twig, the flexible, fast, and secure template language for PHP
repo_language: PHP
owner: twigphp
file_changes: filename: CHANGELOG
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,4 @@
-* 2.4.4 (2017-XX-XX)
+* 2.4.4 (2017-09-27)
 
  * added Twig_Profiler_Profile::reset()
  * fixed use TokenParser to return an empty Node

programming_language: Markdown
filename: Environment.php
change_type: ModificationType.MODIFY
diff: @@ -16,12 +16,12 @@
  */
 class Twig_Environment
 {
-    const VERSION = '2.4.4-DEV';
+    const VERSION = '2.4.4';
     const VERSION_ID = 20404;
     const MAJOR_VERSION = 2;
     const MINOR_VERSION = 4;
     const RELEASE_VERSION = 4;
-    const EXTRA_VERSION = 'DEV';
+    const EXTRA_VERSION = '';
 
     private $charset;
     private $loader;

programming_language: PHP
CVE-2018-11383 (published 2018-05-22T19:29Z)

The r_strbuf_fini() function in radare2 2.5.0 allows remote attackers to cause a denial of service (invalid free and application crash) via a crafted ELF file because of an uninitialized variable in the CPSE handler in libr/anal/p/anal_avr.c.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-908
cwe_name: Use of Uninitialized Resource
description: The product uses or accesses a resource that has not been initialized.
extended_description: When a resource has not been properly initialized, the product may behave unexpectedly. This may lead to a crash or invalid memory access, but the consequences vary depending on the type of resource and how it is used within the product.
         

Fix information:
repo_url: https://github.com/radare/radare2
commit_details: repo_url: https://github.com/radare/radare2
author: pancake
author_date: 2018-04-24 09:55:19+02:00
msg: Fix #9943 - Invalid free on RAnal.avr
repository: repo_url: https://github.com/radare/radare2
repo_name: radareorg/radare2
description: UNIX-like reverse engineering framework and command-line toolset
repo_language: C
owner: radare
file_changes: filename: anal_avr.c
change_type: ModificationType.MODIFY
diff: @@ -619,7 +619,7 @@ INST_HANDLER (cpi) { // CPI Rd, K
 INST_HANDLER (cpse) {	// CPSE Rd, Rr
 	int r = (buf[0] & 0xf) | ((buf[1] & 0x2) << 3);
 	int d = ((buf[0] >> 4) & 0xf) | ((buf[1] & 0x1) << 4);
-	RAnalOp next_op;
+	RAnalOp next_op = {0};
 
 	// calculate next instruction size (call recursively avr_op_analyze)
 	// and free next_op's esil string (we dont need it now)

programming_language: C
filename: cmd_anal.c
change_type: ModificationType.MODIFY
diff: @@ -4350,8 +4350,9 @@ static void cmd_anal_esil(RCore *core, const char *input) {
 		{
 			// anal ESIL to REIL.
 			RAnalEsil *esil = r_anal_esil_new (stacksize, iotrap, addrsize);
-			if (!esil)
+			if (!esil) {
 				return;
+			}
 			r_anal_esil_to_reil_setup (esil, core->anal, romem, stats);
 			r_anal_esil_set_pc (esil, core->offset);
 			r_anal_esil_parse (esil, input + 2);

programming_language: Go