starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2014-7145 (published 2014-09-28T10:55Z)

The SMB2_tcon function in fs/cifs/smb2pdu.c in the Linux kernel before 3.16.3 allows remote CIFS servers to cause a denial of service (NULL pointer dereference and client system crash) or possibly have unspecified other impact by deleting the IPC$ share during resolution of DFS referrals.

Severity: HIGH
CVSS v2 base score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)

Weakness information:
cwe_id: CWE-399
cwe_name: Resource Management Errors
description: Weaknesses in this category are related to improper management of system resources.

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Steve French
author_date: 2014-08-17 00:22:24-05:00
msg: [CIFS] Possible null ptr deref in SMB2_tcon

As Raphael Geissert pointed out, tcon_error_exit can dereference tcon
and there is one path in which tcon can be null.

Signed-off-by: Steve French <smfrench@gmail.com>
CC: Stable <stable@vger.kernel.org> # v3.7+
Reported-by: Raphael Geissert <geissert@debian.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: smb2pdu.c
change_type: ModificationType.MODIFY
diff: @@ -907,7 +907,8 @@ SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree,
 tcon_error_exit:
 	if (rsp->hdr.Status == STATUS_BAD_NETWORK_NAME) {
 		cifs_dbg(VFS, "BAD_NETWORK_NAME: %s\n", tree);
-		tcon->bad_network_name = true;
+		if (tcon)
+			tcon->bad_network_name = true;
 	}
 	goto tcon_exit;
 }

programming_language: C
CVE-2022-23547 (published 2022-12-23T15:15Z)

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. This issue is similar to GHSA-9pfh-r8x4-w26w. Possible buffer overread when parsing a certain STUN message. The vulnerability affects applications that uses STUN including PJNATH and PJSUA-LIB. The patch is available as commit in the master branch.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-122
cwe_name: Heap-based Buffer Overflow
description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/pjsip/pjproject
commit_details: repo_url: https://github.com/pjsip/pjproject
author: sauwming
author_date: 2022-12-23 15:05:28+08:00
msg: Merge pull request from GHSA-cxwq-5g9x-x7fr

* Fixed heap buffer overflow when parsing STUN errcode attribute

* Also fixed uint parsing
repository: repo_url: https://github.com/pjsip/pjproject
repo_name: pjsip/pjproject
description: PJSIP project
repo_language: C
owner: pjsip
file_changes: filename: stun_msg.c
change_type: ModificationType.MODIFY
diff: @@ -1438,12 +1438,12 @@ static pj_status_t decode_uint_attr(pj_pool_t *pool,
     attr = PJ_POOL_ZALLOC_T(pool, pj_stun_uint_attr);
     GETATTRHDR(buf, &attr->hdr);
 
-    attr->value = GETVAL32H(buf, 4);
-
     /* Check that the attribute length is valid */
     if (attr->hdr.length != 4)
         return PJNATH_ESTUNINATTRLEN;
 
+    attr->value = GETVAL32H(buf, 4);
+
     /* Done */
     *p_attr = attr;
 
@@ -1757,14 +1757,15 @@ static pj_status_t decode_errcode_attr(pj_pool_t *pool,
     attr = PJ_POOL_ZALLOC_T(pool, pj_stun_errcode_attr);
     GETATTRHDR(buf, &attr->hdr);
 
+    /* Check that the attribute length is valid */
+    if (attr->hdr.length < 4)
+        return PJNATH_ESTUNINATTRLEN;
+
     attr->err_code = buf[6] * 100 + buf[7];
 
     /* Get pointer to the string in the message */
     value.ptr = ((char*)buf + ATTR_HDR_LEN + 4);
     value.slen = attr->hdr.length - 4;
-    /* Make sure the length is never negative */
-    if (value.slen < 0)
-        value.slen = 0;
 
     /* Copy the string to the attribute */
     pj_strdup(pool, &attr->reason, &value);

programming_language: C
CVE-2018-7648 (published 2018-03-02T16:29Z)

An issue was discovered in mj2/opj_mj2_extract.c in OpenJPEG 2.3.0. The output prefix was not checked for length, which could overflow a buffer, when providing a prefix with 50 or more characters on the command line.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/uclouvain/openjpeg
commit_details: repo_url: https://github.com/uclouvain/openjpeg
author: Karol Babioch
author_date: 2018-03-02 14:40:58+01:00
msg: opj_mj2_extract: Check provided output prefix for length

This uses snprintf() with correct buffer length instead of sprintf(), which
prevents a buffer overflow when providing a long output prefix. Furthermore
the program exits with an error when the provided output prefix is too long.

Fixes #1088.
repository: repo_url: https://github.com/uclouvain/openjpeg
repo_name: uclouvain/openjpeg
description: Official repository of the OpenJPEG project
repo_language: C
owner: uclouvain
file_changes: filename: opj_mj2_extract.c
change_type: ModificationType.MODIFY
diff: @@ -140,10 +140,21 @@ int main(int argc, char *argv[])
         fread(frame_codestream, sample->sample_size - 8, 1,
               file); /* Assuming that jp and ftyp markers size do*/
 
-        sprintf(outfilename, "%s_%05d.j2k", argv[2], snum);
+        {
+            int num = snprintf(outfilename, sizeof(outfilename),
+                               "%s_%05d.j2k", argv[2],
+                               snum);
+            if (num >= sizeof(outfilename)) {
+                fprintf(stderr, "maximum length of output prefix exceeded\n");
+                free(frame_codestream);
+                return 1;
+            }
+        }
+
         outfile = fopen(outfilename, "wb");
         if (!outfile) {
             fprintf(stderr, "failed to open %s for writing\n", outfilename);
+            free(frame_codestream);
             return 1;
         }
         fwrite(frame_codestream, sample->sample_size - 8, 1, outfile);

programming_language: C
CVE-2017-14061 (published 2017-08-31T16:29Z)

Integer overflow in the _isBidi function in bidi.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://gitlab.com/libidn/libidn2
commit_details: repo_url: https://gitlab.com/libidn/libidn2
author: Tim Rühsen
author_date: 2017-08-01 11:15:10+02:00
msg: lib/bidi: Fix integer overflow (found by fuzzing)
repository: repo_url: https://gitlab.com/libidn/libidn2
repo_name: visit repo url
description: visit repo url
repo_language: visit repo url
owner: libidn
file_changes: filename: bidi.c
change_type: ModificationType.MODIFY
diff: @@ -30,6 +30,7 @@
 
 #include "idn2.h"
 
+#include <sys/types.h>
 #include <stdbool.h>
 
 #include "bidi.h"
@@ -39,7 +40,7 @@
 static bool
 _isBidi (const uint32_t *label, size_t llen)
 {
-  while (llen-- > 0) {
+  for (; (ssize_t) llen > 0; llen--) {
     int bc = uc_bidi_category (*label++);
 
     if (bc == UC_BIDI_R || bc == UC_BIDI_AL || bc == UC_BIDI_AN)

programming_language: C
CVE-2015-3886 (published 2017-07-21T14:29Z)

libinfinity before 0.6.6-1 does not validate expired SSL certificates, which allows remote attackers to have unspecified impact via unknown vectors.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-295
cwe_name: Improper Certificate Validation
description: The product does not validate, or incorrectly validates, a certificate.
extended_description: When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting spoofed data that appears to originate from a trusted host.
         

Fix information:
repo_url: https://github.com/gobby/libinfinity
commit_details: repo_url: https://github.com/gobby/libinfinity
author: Armin Burgmeier
author_date: 2015-05-11 22:59:34-04:00
msg: Fix expired certificate validation (gobby #61)
repository: repo_url: https://github.com/gobby/libinfinity
repo_name: gobby/libinfinity
description: libinfinity collaborative editing library
repo_language: C
owner: gobby
file_changes: filename: inf-gtk-certificate-manager.c
change_type: ModificationType.MODIFY
diff: @@ -709,9 +709,11 @@ inf_gtk_certificate_manager_certificate_func(InfXmppConnection* connection,
 
       if(ret != GNUTLS_E_SUCCESS)
         inf_gnutls_set_error(&error, ret);
-      else if(verify & GNUTLS_CERT_INVALID)
-        inf_gnutls_certificate_verification_set_error(&error, verify);
     }
+
+    if(error == NULL)
+      if(verify & GNUTLS_CERT_INVALID)
+        inf_gnutls_certificate_verification_set_error(&error, verify);
   }
 
   /* Look up the host in our database of pinned certificates if we could not

programming_language: C
CVE-2023-5632 (published 2023-10-18T09:15Z)

In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT event to be added, which results excessive CPU consumption. This could be used by a malicious actor to perform denial of service type attack. This issue is fixed in 2.0.6\n\n\n

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-834
cwe_name: Excessive Iteration
description: The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
extended_description: If the iteration can be influenced by an attacker, this weakness could allow attackers to consume excessive resources such as CPU or memory. In many cases, a loop does not need to be infinite in order to cause enough resource consumption to adversely affect the product or its host system; it depends on the amount of resources consumed per iteration.
         

Fix information:
repo_url: https://github.com/eclipse/mosquitto
commit_details: repo_url: https://github.com/eclipse/mosquitto
author: Przemek Zygmunt
author_date: 2021-01-27 18:29:50+01:00
msg: Unconditionally adding an event to the epoll causes 100% CPU usage. This happens when the connection to the server is established and the client has not sent any data yet.

Signed-off-by: Przemek Zygmunt <p.zygmunt@acsoftware.pl>
repository: repo_url: https://github.com/eclipse/mosquitto
repo_name: eclipse/mosquitto
description: Eclipse Mosquitto - An open source MQTT broker
repo_language: C
owner: eclipse
file_changes: filename: packet_mosq.c
change_type: ModificationType.MODIFY
diff: @@ -216,7 +216,9 @@ int packet__write(struct mosquitto *mosq)
 	if(mosq->sock == INVALID_SOCKET) return MOSQ_ERR_NO_CONN;
 
 #ifdef WITH_BROKER
-	mux__add_out(mosq);
+	if (mosq->current_out_packet) {
+	   mux__add_out(mosq);
+	}
 #endif
 
 	pthread_mutex_lock(&mosq->current_out_packet_mutex);

programming_language: C
CVE-2022-46158 (published 2022-12-08T22:15Z)

PrestaShop is an open-source e-commerce solution. Versions prior to 1.7.8.8 did not properly restrict host filesystem access for users. Users may have been able to view the contents of the upload directory without appropriate permissions. This issue has been addressed and users are advised to upgrade to version 1.7.8.8. There are no known workarounds for this issue.

CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-862
cwe_name: Missing Authorization
description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are not applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/PrestaShop/PrestaShop
commit_details: repo_url: https://github.com/PrestaShop/PrestaShop
author: atomiix
author_date: 2022-12-06 15:40:19+01:00
msg: Merge pull request from GHSA-9qgp-9wwc-v29r

User needs to have rights to see /uploads/* content
repository: repo_url: https://github.com/PrestaShop/PrestaShop
repo_name: PrestaShop/PrestaShop
description: PrestaShop is the universal open-source software platform to build your e-commerce solution.
repo_language: PHP
owner: PrestaShop
CVE-2022-4644 (published 2022-12-22T01:15Z)

Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.4.

CVSS v3 base score: 6.1, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-601
cwe_name: URL Redirection to Untrusted Site ('Open Redirect')
description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
extended_description: An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance. Whether this issue poses a vulnerability will be subject to the intended behavior of the application. For example, a search engine might intentionally provide redirects to arbitrary URLs.
         

Fix information:
repo_url: https://github.com/ikus060/rdiffweb
commit_details: repo_url: https://github.com/ikus060/rdiffweb
author: Patrik Dufresne
author_date: 2022-12-06 16:24:08-05:00
msg: Discard `X-Forwarded-Host` headers
repository: repo_url: https://github.com/ikus060/rdiffweb
repo_name: ikus060/rdiffweb
description: A simplified backup management software for quick access to your archives through an efficient web interface.
repo_language: Python
owner: ikus060
file_changes: filename: README.md
change_type: ModificationType.MODIFY
diff: @@ -108,6 +108,10 @@ Professional support for Rdiffweb is available by contacting [IKUS Soft](https:/
 
 # Changelog
 
+## Next Release - 2.5.4
+
+* Discard `X-Forwarded-Host` headers
+
 ## 2.5.3 (2022-12-05)
 
 * Add support for WTForms v3 to support Debian Bookworm

programming_language: Markdown
filename: rdw_app.py
change_type: ModificationType.MODIFY
diff: @@ -85,7 +85,7 @@ cherrypy.config.environments['development'] = {
 @cherrypy.tools.currentuser(userobj=lambda username: UserObject.get_user(username))
 @cherrypy.tools.db()
 @cherrypy.tools.enrich_session()
-@cherrypy.tools.proxy(remote='X-Real-IP')
+@cherrypy.tools.proxy(local=None, remote='X-Real-IP')
 @cherrypy.tools.secure_headers()
 class Root(LocationsPage):
     def __init__(self):

programming_language: Python
CVE-2021-40576 (published 2022-01-13T19:15Z)

The binary MP4Box in Gpac 1.0.1 has a null pointer dereference vulnerability in the gf_isom_get_payt_count function in hint_track.c, which allows attackers to cause a denial of service.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2021-09-01 13:45:04+02:00
msg: fixed #1904
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: hint_track.c
change_type: ModificationType.MODIFY
diff: @@ -43,7 +43,7 @@ Bool IsHintTrack(GF_TrackBox *trak)
 u32 GetHintFormat(GF_TrackBox *trak)
 {
 	GF_HintMediaHeaderBox *hmhd = (GF_HintMediaHeaderBox *)trak->Media->information->InfoHeader;
-	if (hmhd->type != GF_ISOM_BOX_TYPE_HMHD)
+	if (!hmhd || (hmhd->type != GF_ISOM_BOX_TYPE_HMHD))
 		return 0;
 		
 	if (!hmhd || !hmhd->subType) {

programming_language: C
CVE-2023-27560 (published 2023-03-03T06:15Z)

Math/PrimeField.php in phpseclib 3.x before 3.0.19 has an infinite loop with composite primefields.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-835
cwe_name: Loop with Unreachable Exit Condition ('Infinite Loop')
description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
extended_description: If the loop can be influenced by an attacker, this weakness could allow attackers to consume excessive resources such as CPU or memory.
         

Fix information:
repo_url: https://github.com/phpseclib/phpseclib
commit_details: repo_url: https://github.com/phpseclib/phpseclib
author: terrafrost
author_date: 2023-03-02 03:25:08-06:00
msg: PrimeField: prevent infinite loop with composite primefields
repository: repo_url: https://github.com/phpseclib/phpseclib
repo_name: phpseclib/phpseclib
description: PHP Secure Communications Library
repo_language: PHP
owner: phpseclib
file_changes: filename: PrimeField.php
change_type: ModificationType.MODIFY
diff: @@ -44,9 +44,9 @@ class PrimeField extends FiniteField
      */
     public function __construct(BigInteger $modulo)
     {
-        //if (!$modulo->isPrime()) {
-        //    throw new \UnexpectedValueException('PrimeField requires a prime number be passed to the constructor');
-        //}
+        if (!$modulo->isPrime()) {
+            throw new \UnexpectedValueException('PrimeField requires a prime number be passed to the constructor');
+        }
 
         $this->instanceID = self::$instanceCounter++;
         Integer::setModulo($this->instanceID, $modulo);

programming_language: PHP
filename: Integer.php
change_type: ModificationType.MODIFY
diff: @@ -263,13 +263,13 @@ class Integer extends Base
         $r = $this->value->powMod($temp, static::$modulo[$this->instanceID]);
 
         while (!$t->equals($one)) {
-            $i = clone $one;
-
-            while (!$t->powMod($two->pow($i), static::$modulo[$this->instanceID])->equals($one)) {
-                $i = $i->add($one);
+            for ($i == clone $one; $i->compare($m) < 0; $i = $i->add($one)) {
+                if ($t->powMod($two->pow($i), static::$modulo[$this->instanceID])->equals($one)) {
+                    break;
+                }
             }
 
-            if ($i->compare($m) >= 0) {
+            if ($i->compare($m) == 0) {
                 return false;
             }
             $b = $c->powMod($two->pow($m->subtract($i)->subtract($one)), static::$modulo[$this->instanceID]);

programming_language: PHP
CVE-2020-35530 (published 2022-09-01T18:15Z)

In LibRaw, there is an out-of-bounds write vulnerability within the "new_node()" function (libraw\\src\\x3f\\x3f_utils_patched.cpp) that can be triggered via a crafted X3F file.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/LibRaw/LibRaw
commit_details: repo_url: https://github.com/LibRaw/LibRaw
author: Alex Tutubalin
author_date: 2020-04-04 18:21:33+03:00
msg: X3F: check huffman tree size
repository: repo_url: https://github.com/LibRaw/LibRaw
repo_name: LibRaw/LibRaw
description: LibRaw is a library for reading RAW files from digital cameras
repo_language: C++
owner: LibRaw
file_changes: filename: x3f_tools.h
change_type: ModificationType.MODIFY
diff: @@ -213,6 +213,7 @@ typedef struct x3f_huffnode_s
 typedef struct x3f_hufftree_s
 {
   uint32_t free_node_index; /* Free node index in huffman tree array */
+  uint32_t total_node_index;
   x3f_huffnode_t *nodes;    /* Coding tree */
 } x3f_hufftree_t;
 

programming_language: C
filename: x3f_utils_patched.cpp
change_type: ModificationType.MODIFY
diff: @@ -179,6 +179,7 @@ static void new_huffman_tree(x3f_hufftree_t *HTP, int bits)
   int leaves = 1 << bits;
 
   HTP->free_node_index = 0;
+  HTP->total_node_index = HUF_TREE_MAX_NODES(leaves);
   HTP->nodes = (x3f_huffnode_t *)calloc(1, HUF_TREE_MAX_NODES(leaves) *
                                                sizeof(x3f_huffnode_t));
 }
@@ -708,6 +709,8 @@ static char *display_code(int length, uint32_t code, char *buffer)
 
 static x3f_huffnode_t *new_node(x3f_hufftree_t *tree)
 {
+	if (tree->free_node_index >= tree->total_node_index)
+		throw LIBRAW_EXCEPTION_IO_CORRUPT;
   x3f_huffnode_t *t = &tree->nodes[tree->free_node_index];
 
   t->branch[0] = NULL;

programming_language: C